Foreword |
|
ix | |
Introduction |
|
xi | |
|
Chapter 1 The threat landscape |
|
|
1 | (16) |
|
|
1 | (1) |
|
Understanding the cyber kill chain |
|
|
2 | (2) |
|
|
4 | (1) |
|
Building a security posture |
|
|
5 | (1) |
|
Adopting an assume-breach mentality |
|
|
6 | (1) |
|
Cloud threats and security |
|
|
7 | (4) |
|
|
8 | (1) |
|
|
9 | (1) |
|
Identity and access management |
|
|
9 | (1) |
|
|
9 | (1) |
|
|
10 | (1) |
|
|
10 | (1) |
|
|
11 | (6) |
|
|
12 | (1) |
|
|
12 | (2) |
|
|
14 | (3) |
|
Chapter 2 Introduction to Azure Security Center |
|
|
17 | (16) |
|
Understanding Security Center |
|
|
17 | (5) |
|
Security Center architecture |
|
|
18 | (3) |
|
Security Center dashboard |
|
|
21 | (1) |
|
Considerations before adoption |
|
|
22 | (2) |
|
Role-based access control |
|
|
22 | (1) |
|
|
23 | (1) |
|
|
23 | (1) |
|
|
23 | (1) |
|
Incorporating Security Center into your security operations |
|
|
24 | (1) |
|
|
25 | (5) |
|
|
30 | (3) |
|
Chapter 3 Policy management |
|
|
33 | (18) |
|
Legacy Azure Security Center security policy |
|
|
33 | (5) |
|
Next-generation Azure Security Center security policy |
|
|
38 | (5) |
|
The Data Collection blade |
|
|
38 | (2) |
|
The Policy Management blade |
|
|
40 | (1) |
|
The Email Notifications blade |
|
|
41 | (1) |
|
|
42 | (1) |
|
|
43 | (6) |
|
Policy definitions and assignments |
|
|
44 | (1) |
|
Initiative definitions and assignments |
|
|
44 | (1) |
|
|
45 | (4) |
|
Customizing your Security Center security policies |
|
|
49 | (1) |
|
Azure Security Center RBAC and permissions |
|
|
49 | (2) |
|
Chapter 4 Mitigating security issues |
|
|
51 | (22) |
|
|
51 | (7) |
|
Setting up endpoint protection |
|
|
52 | (4) |
|
Remediate Security Configurations |
|
|
56 | (2) |
|
Networking recommendations |
|
|
58 | (5) |
|
NSGs on subnets not enabled |
|
|
59 | (2) |
|
Restrict access through internet-facing endpoint |
|
|
61 | (2) |
|
|
63 | (5) |
|
Server auditing and threat detection not enabled |
|
|
64 | (2) |
|
Storage encryption not enabled |
|
|
66 | (2) |
|
|
68 | (5) |
|
Web application firewall not installed |
|
|
68 | (5) |
|
Chapter 5 Using Security Center for incident response |
|
|
73 | (26) |
|
Understanding security alerts |
|
|
73 | (2) |
|
|
75 | (2) |
|
|
75 | (1) |
|
|
76 | (1) |
|
Accessing security alerts |
|
|
77 | (7) |
|
|
79 | (2) |
|
|
81 | (3) |
|
Investigating a security issue |
|
|
84 | (5) |
|
Responding to a security alert |
|
|
89 | (10) |
|
|
89 | (2) |
|
|
91 | (3) |
|
|
94 | (1) |
|
Auditing playbook execution |
|
|
95 | (4) |
|
Chapter 6 Advanced cloud defense |
|
|
99 | (22) |
|
Threat prevention versus threat detection |
|
|
99 | (1) |
|
Methods of threat detection |
|
|
100 | (8) |
|
|
101 | (1) |
|
Threat-intelligence feeds and integrated security solutions |
|
|
102 | (2) |
|
|
104 | (2) |
|
|
106 | (2) |
|
The cyber kill chain and fusion alerts |
|
|
108 | (3) |
|
Application whitelisting: adaptive application controls |
|
|
111 | (3) |
|
|
114 | (7) |
|
Chapter 7 Security incident and event management (SIEM) integration with Splunk |
|
|
121 | (20) |
|
Integrating SIEM solutions |
|
|
122 | (1) |
|
Splunk integration with Azure Security Center |
|
|
123 | (18) |
|
Confirming accessible logs in Azure Monitor |
|
|
124 | (1) |
|
Configuring the subscription for the Splunk SIEM pipe |
|
|
124 | (1) |
|
Creating and configuring a resource group for the Splunk SIEM pipe |
|
|
124 | (1) |
|
Setting up an Azure AD application to provide an access control identity |
|
|
125 | (2) |
|
Creating an Azure key vault |
|
|
127 | (3) |
|
Copying the app password into Key Vault |
|
|
130 | (1) |
|
|
131 | (2) |
|
Creating a shared access key for event hub access control |
|
|
133 | (1) |
|
Placing the event hub shared access key in Azure Key Vault |
|
|
134 | (2) |
|
Hooking up the event hub to Azure Monitor |
|
|
136 | (2) |
|
Spinning up the virtual machine that hosts the Splunk enterprise VM |
|
|
138 | (1) |
|
Installing and configuring the Azure Monitor add-on for Splunk |
|
|
139 | (2) |
|
Chapter 8 Monitoring identity and access |
|
|
141 | (12) |
|
Monitoring identity-related activities |
|
|
141 | (7) |
|
|
143 | (1) |
|
|
144 | (3) |
|
|
147 | (1) |
|
Integrating Security Center with Azure Active Directory Identity Protection |
|
|
148 | (1) |
|
|
149 | (4) |
|
Chapter 9 Using threat intelligence to identify security issues |
|
|
153 | (11) |
|
What is threat intelligence and why use it? |
|
|
153 | (2) |
|
Using threat intelligence reports in Security Center |
|
|
155 | (2) |
|
Using the Threat Intelligence dashboard in Security Center |
|
|
157 | (2) |
|
Hunting security issues in Security Center |
|
|
159 | (4) |
|
|
163 | (1) |
|
Appendix A Using multiple workspaces in Security Center |
|
|
164 | (4) |
|
|
164 | (1) |
|
Moving computers and VMs to a new workspace |
|
|
165 | (3) |
|
Appendix B Customizing your operating system security baseline assessment |
|
|
168 | (6) |
|
|
168 | (1) |
|
Customizing operating system configuration |
|
|
169 | (5) |
|
Downloading the JSON file |
|
|
169 | (1) |
|
|
170 | (3) |
|
|
173 | (1) |
Index |
|
174 | |