Defender CSPM and Attack Paths

Defender for Cloud's Cloud Security Posture Management (CSPM) is a set of capabilities that continuously assess your cloud resources against industry-standard security benchmarks (e.g., CIS, NIST, Azure Security Benchmark) and Microsoft's own best practices. It provides a unified view of your security posture across Azure, AWS, and GCP. The core mechanism is the cloud security graph, which models all your cloud resources, their configurations, and the relationships between them (e.g., which VMs are connected to which subnets, which subnets have network security groups, which managed identities have permissions to which storage accounts).

The cloud security graph is built by Defender for Cloud agents and scanners that run in your cloud environments. For Azure resources, the scanner uses the Azure Resource Manager API and Azure Policy to collect configuration data. For AWS and GCP, it uses connectors that pull data via their respective APIs (e.g., AWS Config, GCP Cloud Asset Inventory). The graph is updated every 24-48 hours for most resources, but some critical changes trigger near-real-time updates (e.g., a new VM deployment).

The graph stores entities (resources) and edges (relationships). For example:

Each entity and edge is evaluated against security rules (recommendations) defined by Microsoft. A recommendation like 'Storage accounts should restrict network access' checks if the firewall rule allows 'All networks'. If it does, the recommendation is flagged as unhealthy.

Attack path analysis takes the cloud security graph and applies a graph-based algorithm to find chains of misconfigurations that an attacker could exploit to reach a high-value asset (e.g., a database with sensitive data). The algorithm uses the concept of blast radius and exposure. It starts from an assumed initial compromise (e.g., a public-facing VM with a known vulnerability) and then traverses the graph edges, looking for sequences where each step increases privilege or access.

For example, an attack path might look like: 1. Public-facing VM has a critical vulnerability (CVE-2023-XXXX) — initial compromise. 2. VM has a managed identity with 'Contributor' on a subscription — privilege escalation. 3. That subscription contains a Key Vault that allows 'All networks' and has a soft-delete enabled but not purged — data access.

Each step is a specific recommendation that is unhealthy. The attack path algorithm scores each path based on the number of steps, the severity of each vulnerability, and the value of the target asset. The result is a prioritized list of attack paths that security teams should remediate first.

To enable CSPM, you need to enable Defender for Cloud on your subscription with the 'Cloud Security Posture Management' plan (free tier includes basic CSPM; enhanced CSPM with attack paths requires the 'Defender for Cloud' paid plan). Verification commands:

# Check if CSPM is enabled on a subscription
Get-AzSecurityPricing -Name 'CloudPosture' | Select-Object Name, PricingTier

To view attack paths in the portal: Navigate to Defender for Cloud -> Attack Paths (under 'Cloud Security'). Each attack path shows a visual graph of the steps and the affected resources.

Defender CSPM integrates with: - Microsoft Sentinel: You can stream CSPM alerts and recommendations to Sentinel for advanced correlation and incident response. - Azure Policy: Many CSPM recommendations are backed by Azure Policy definitions. Remediating a recommendation often creates a policy assignment that enforces the desired state. - Microsoft Defender for Cloud Apps: For SaaS applications, CSPM can assess the posture of connected apps (e.g., Office 365, AWS). - Microsoft Secure Score: The secure score from Defender for Cloud is aggregated into the Microsoft Secure Score in the Microsoft 365 Defender portal.

The algorithm uses a topological sort of the graph to identify all possible paths from an initial compromise point to a target (e.g., a resource containing sensitive data). It then applies a weighted scoring based on: - Exploitability: How easy is it to exploit each vulnerability? CVSS scores are used for CVEs. - Impact: What is the blast radius? Access to a subscription vs. a single VM. - Number of steps: More steps generally mean lower likelihood, but the algorithm considers that attackers often chain multiple low-severity issues.

The result is a list of paths sorted by risk score (0-100). Paths with score > 70 are considered critical and should be remediated immediately.

To query attack paths via Azure REST API:

GET https://management.azure.com/subscriptions/{subscriptionId}/providers/Microsoft.Security/attackPaths?api-version=2023-01-01-preview

To list recommendations:

Get-AzSecurityAssessment | Where-Object {$_.Status.Code -eq 'Unhealthy'}

To get secure score:

Get-AzSecuritySecureScore | Select-Object Name, Percentage

You can create analytics rules in Sentinel that trigger when an attack path is detected. This allows for automated incident creation and response. For example, a Sentinel playbook can automatically block the public IP of a VM that is part of a critical attack path.

Defender CSPM and attack path analysis are powerful tools for understanding and improving your cloud security posture. The cloud security graph provides a holistic view of your environment, and attack paths help you prioritize remediation by showing you the most critical chains of vulnerabilities. For the SC-200 exam, focus on understanding how the graph works, how attack paths are scored, and how to interpret the secure score. Practice with the Azure portal and PowerShell to reinforce these concepts.

In a large enterprise with thousands of Azure resources, a common scenario is a multi-tier web application deployed across multiple subscriptions. The frontend VMs are exposed to the internet with an NSG that allows HTTP/HTTPS from 0.0.0.0/0. These VMs have a managed identity that, due to a misconfiguration, has 'Contributor' rights on the entire resource group containing the backend database. An attacker who compromises the frontend (e.g., through a web vulnerability) can use the managed identity to access the database. Defender CSPM's attack path analysis would detect this chain: (1) frontend VM has a public IP and open HTTP (recommendation: 'Management ports should be closed'—but actually, this is about non-management ports? Wait, the exam expects that public exposure is a recommendation). The attack path would show the sequence and score it as critical. The security team would see this and either remove the public IP (use Azure Front Door) or restrict the managed identity's permissions to only the necessary scope (e.g., specific database).

Another scenario involves a company using both Azure and AWS. They have an Azure VM that accesses an AWS S3 bucket using cross-account roles. If the Azure VM's managed identity is overprivileged, an attacker could pivot from Azure to AWS. Defender CSPM with multi-cloud connectors would model this cross-cloud relationship and detect an attack path spanning both clouds. This is a powerful feature that many organizations overlook.

A common misconfiguration that goes wrong is when an organization enables 'Allow trusted Microsoft services to bypass firewall' on a storage account. While this is intended for Azure services, it can be abused if a VM with a managed identity is compromised. Attack path analysis would flag this if the VM has a vulnerability. The recommended fix is to use service endpoints or private endpoints instead of relying on the trusted services bypass.

Performance considerations: The cloud security graph can become large in complex environments. Microsoft recommends using management groups to structure subscriptions and applying policies at the management group level to reduce the number of individual resource configurations. The graph scan runs every 24 hours, which means there is a delay between a misconfiguration and detection. For critical environments, consider using Azure Policy in 'deny' mode to prevent misconfigurations in real time.

When misconfigured, the most common issue is that the CSPM scanner fails to collect data from some resources due to permissions. The scanner needs 'Reader' permission on the subscription. If a resource group is locked or has a custom role that denies read access, the scanner may miss those resources. This leads to incomplete attack paths and a false sense of security. Always verify that the scanner can access all resources by checking the 'Coverage' tab in Defender for Cloud.