Microsoft Defender for Cloud in Architecture

Microsoft Defender for Cloud is a Cloud Security Posture Management (CSPM) and Cloud Workload Protection Platform (CWPP) that provides unified security management across Azure, on-premises, and multi-cloud environments (AWS and GCP). It assesses resources for vulnerabilities, enforces security policies, and provides threat detection and response. The service is natively integrated into Azure and can be enabled at the subscription or resource level.

Defender for Cloud addresses two primary security needs: - Security posture management: Continuously assess resources against built-in or custom security policies (e.g., CIS, NIST, Azure Security Benchmark). Provides a secure score that quantifies your security posture. - Threat protection: Detect and respond to threats using advanced analytics, Microsoft Threat Intelligence, and integration with Microsoft Sentinel.

Defender for Cloud uses the following mechanisms: - Data collection: The Log Analytics agent (or Azure Monitor Agent) collects security-relevant data from VMs (event logs, syslog, performance counters). For PaaS services (e.g., SQL, Storage), telemetry is collected via Azure resource logs. - Assessment engine: The engine evaluates resources against enabled policies. For example, a policy might check that VMs have just-in-time (JIT) network access enabled. Each policy has a built-in logic that produces a compliance state: Compliant, Non-compliant, or Unknown. - Secure score: Each control (group of policies) contributes points to the secure score. The score is calculated as a percentage of achieved points out of total possible points. For example, enabling MFA on all accounts might give 10 points out of 10. - Threat detection: Uses behavioral analytics, machine learning, and signature-based detection. For example, a VM communicating with a known malicious IP triggers an alert. The detection rules are updated via Microsoft Threat Intelligence.

- Defender for Cloud plans: - Defender CSPM (Free): Basic secure score, policy assessment, and regulatory compliance. No threat protection. - Defender for Cloud (Paid): Includes CSPM plus workload protection plans. Each plan covers specific resource types: Servers, App Service, Databases (SQL, Cosmos DB), Storage, Key Vault, Kubernetes, Container Registries, etc. Pricing is per resource per hour (e.g., ~$15/node/month for servers, ~$0.015/GB/month for storage). - Secure score: Ranges from 0% to 100%. Default target is 100%, but you can set a custom target. - Policy initiatives: By default, the Azure Security Benchmark is assigned. You can add custom initiatives. - Data retention: Security alerts are retained for 90 days. Raw logs depend on Log Analytics retention (default 30 days). - Integration with Microsoft Sentinel: Alerts can be streamed to Sentinel for SIEM capabilities.

Enable Defender for Cloud at the subscription level:

# Enable Defender for Cloud on a subscription
Set-AzSecurityPricing -Name "subscriptionId" -PricingTier "Standard"

Enable specific plans:

Set-AzSecurityPricing -Name "VirtualMachines" -PricingTier "Standard"

Check current security posture:

az security secure-score list

View alerts:

az security alert list

A large financial services company runs 500 VMs in Azure and 200 on-premises servers. They need unified security posture management and threat detection. They enable Defender for Cloud on the Azure subscription and install the Log Analytics agent on all VMs (including on-prem via Azure Arc). They enable the 'Servers' plan for threat detection. They also enable 'SQL servers on machines' to protect their on-prem SQL databases. The secure score starts at 40%. They prioritize high-severity recommendations: enabling MFA, applying just-in-time VM access, and installing system updates. Within a month, the score reaches 75%. Alerts are streamed to Microsoft Sentinel for SOC analysts. One challenge: on-prem servers require Azure Arc to be enabled, which adds a small management overhead. Performance impact is minimal (agent uses ~1% CPU). Misconfiguration: initially they forgot to enable the 'SQL servers on machines' plan, leaving databases unprotected.

A tech startup uses AWS and Azure. They want a single pane of glass for security. They enable Defender for Cloud on Azure and connect their AWS account using the connector feature (requires AWS IAM roles). Defender for Cloud assesses AWS resources (EC2, S3, IAM) against Azure Security Benchmark. They get a unified secure score across both clouds. They enable the paid plan for Azure VMs but only use free CSPM for AWS. They find that AWS recommendations are limited compared to Azure (e.g., no threat detection for AWS). For full protection, they consider using third-party tools for AWS. Common mistake: assuming Defender for Cloud provides equal protection for AWS as Azure; it only provides posture assessment, not threat detection.

A healthcare organization must comply with HIPAA. They enable Defender for Cloud and assign the HIPAA HITRUST initiative. The regulatory compliance dashboard shows compliance status for each control. They enable continuous monitoring (paid plan) to get real-time compliance assessments. They use the secure score to track progress. They integrate with Azure Policy to enforce encryption at rest and in transit. A common issue: the built-in HIPAA initiative may not cover all requirements, so they must add custom policies. They also enable workload protection for their Azure SQL databases to detect SQL injection attempts. Performance: no noticeable impact on database performance.