Microsoft Azure Security Infrastructure

YURI DIOGENES is a Senior Content Developer on the CSI Enterprise Mobility and Security Team, focusing on enterprise mobility solutions, Azure Security Center, and OMS Security. Previously, Yuri worked at Microsoft as a writer for the Windows Security team and as a Support Escalation Engineer for the CSS Forefront team. He has a Master of Science degree in Cybersecurity Intelligence and Forensics from Utica College and an MBA from FGF in Brazil, and he holds several industry certifications. He is co-author of Enterprise Mobility Suite–Managing BYOD and Company-Owned Devices (Microsoft Press, 2015), Microsoft Forefront Threat Management Gateway (TMG) Administrator’s Companion (Microsoft Press, 2010), and three other Forefront titles from Microsoft Press.DR. THOMAS SHINDER is a program manager in Azure Security Engineering and a 20-year veteran in IT security. Tom is best known for his work with ISA Server and TMG, publishing nine books on those topics. He was also the leading voice at ISAserver.org. After joining Microsoft in 2009, Tom spent time on the UAG DirectAccess team and then took a 3-year vacation from security to be a cloud infrastructure specialist and architect. He’s now back where he belongs in security, and spends a good deal of time hugging his Azure Security Center console and hiding his secrets in Azure Key Vault.DEBRA LITTLEJOHN SHINDER, MCSE, is a former police officer and police academy instructor who is self-employed as a technol¿ogy consultant, trainer, and writer, specializing in network and cloud security. She has authored a number of books, including Scene of the Cybercrime: Computer Forensics Handbook (Syngress Publishing, 2002) and Computer Networking Essentials (Cisco Press, 2001). She has co-authored more than 20 additional books and worked as a tech editor, developmental editor, and contributor to more than 15 books. Deb is a lead author for WindowSecurity.com and WindowsNetworking.com, and a long-time contributor to the GFI Software blog and other technology publications, with more than 1,500 published articles in print magazines and on websites. Deb focuses on Microsoft products, and has been awarded the Microsoft MVP (Most Valuable Professional) award in the field of enterprise security for 14 years in a row. She lives and works in the Dallas-Fort Worth area and has taught law enforcement, computer networking, and security courses at Eastfield College in Mesquite, Texas. She currently sits on the advisory board of the Eastfield Criminal Justice Training Center Police Academy.

• Chapter 1 Cloud security Cloud security considerationsComplianceRisk managementIdentity and access managementOperational securityEndpoint protectionData protectionShared responsibilityCloud computingDistributed responsibility in public cloud computingAssume breach and isolationAzure security architectureAzure design principlesChapter 2 Identity protection in AzureAuthentication and authorizationAzure hierarchyRole-Based Access ControlOn-premises integrationAzure AD ConnectFederationSuspicious activity identificationIdentity protectionUser risk policySign-in risk policyNotification enablingVulnerabilitiesMulti-Factor AuthenticationAzure Multi-Factor Authentication implementationAzure Multi-Factor Authentication option configurationChapter 3 Azure network securityAnatomy of Azure networkingVirtual network infrastructureNetwork access controlRouting tablesRemote access (Azure gateway/point-to-site VPN/RDP/Remote PowerShell/SSH)Cross-premises connectivityNetwork availabilityNetwork loggingPublic name resolutionNetwork security appliancesReverse proxyAzure Network Security best practicesSubnet your networks based on security zonesUse Network Security Groups carefullyUse site-to-site VPN to connect Azure Virtual NetworksConfigure host-based firewalls on IaaS virtual machinesConfigure User Defined Routes to control trafficRequire forced tunnelingDeploy virtual network security appliancesCreate perimeter networks for Internet-facing devicesUse ExpressRouteOptimize uptime and performanceDisable management protocols to virtual machinesEnable Azure Security CenterExtend your datacenter into AzureChapter 4 Data and storage securityVirtual machine encryptionAzure Disk EncryptionStorage encryptionFile share wire encryptionHybrid data encryptionAuthenticationWire securityData at restRights managementDatabase securityAzure SQL FirewallSQL Always EncryptedRow-level securityTransparent data encryptionCell-level encryptionDynamic data maskingChapter 5 Virtual machine protection with AntimalwareUnderstanding the Antimalware solutionAntimalware deploymentAntimalware deployment to an existing VMAntimalware deployment to a new VM n