Using resource exemptions

Disabling a security policy on a subscription or management group is a good way to make sure that recommendations that entirely do not apply to your environment are removed from the Secure Score calculation. However, a frequent customer demand is to have a more granular option for exempting resources from a particular recommendation. For example, you have a test environment for which you accept the risk of being exposed, or if some of your VMs are protected by an endpoint protection solution which Microsoft Defender for Cloud does not track, whereas others are protected by Microsoft Defender for Endpoint. Leveraging policy exemptions, an Azure Policy capability you learned about in Chapter 4, Defender for Cloud comes with resource exemptions, which you can use to fine-tune the set of recommendations that apply to your particular environment more granular. You can create a resource exemption in Defender for Cloud when working with recommendations. Figure 5-6 shows the Storage Account Public Access Should Be Disallowed recommendation. When you take a closer look at the recommendation, you see there is already one exempted resource.

If you look at the Affected Resources section, you see that there are four unhealthy resources, one healthy resource, and one not applicable resource. Once you create an exemption for a resource, the resource is moved from unhealthy status to not applicable. To create a new exemption, follow these steps:

1. Open the Azure portal and sign in with a user who has Security Admin privileges.

2. In the top search bar, enter Defender, and then click Microsoft Defender For Cloud.

3. In the Defender For Cloud navigation pane, select Recommendations.

4. Open a security control and click the recommendation for which you want to create a resource exemption.

5. In the recommendation’s details view, look for the resource for which you want to create an exemption, select the resource, and click Exempt.

6. Select the scope you want to create the exemption on—single resource(s), subscription(s), or management group(s)—enter an Exemption Name, and define whether and when the exemption will expire. There are two Exemption Categories:

   • Mitigated Select Mitigated if the policy’s intent has been met by a process not tracked by Defender for Cloud.

   • Waiver Select Waiver if your organization has decided to (temporarily) accept the risk of not mitigating the recommendation’s intent.

7. Finally, enter an Exemption Description that explains the reason for creating the exemption. Then, click Create to finish creating the exemption, as shown in Figure 5-7.

   

In the last section of this chapter, we will take a look at how to build automation artifacts around the resource exemption capability.

Secure Score Continuous Export

With Continuous Export, Defender for Cloud has a built-in capability to export recommendations, alerts, and Secure Score information to either a Log Analytics workspace or an Azure Event Hub (or both), so you can build further automations on top of this data. Continuous Export is always configured on a subscription level, so you need to create a Continuous Export configuration for all subscriptions for which you want to export security data. To enable Continuous Export of Secure Score data, follow these steps:

1. Open the Azure portal and sign in with a user who has Security Admin privileges.

2. In the search bar, enter Defender, and then click Microsoft Defender For Cloud.

3. In the left navigation pane, select Environment Settings.

4. Select the subscription on which you want to enable Continuous Export, and then click Continuous Export in the left navigation pane.

5. Determine if you want to export the data to an existing Event Hub or Log Analytics Workspace by selecting the respective tab.

6. For the Exported Data Types, select Secure Score.

7. You can export the Overall Score, Control Score, or both. When you select Control Score, you can choose the Controls you want to export, as shown in Figure 5-10.

   

8. Make sure to configure Export Configuration and Export Target as explained in the screen, and then click Save.

Once the configuration has been saved, Defender for Cloud will automatically take care of exporting changes in your Secure Score. If you have configured export to a Log Analytics workspace, you can then, for example, start building an Azure Monitor Workbook based on the data stored in the workspace. In the next section, you will learn about a built-in workbook that leverages Continuous Export to show an environment’s Secure Score over time.

Manage access and permissions

In addition to making sure your identities are protected from credential theft attacks, you should also keep in mind that with great power comes great responsibility. Accounts with elevated and far-reaching access rights are valuable targets for bad actors and, therefore, should be protected in a special way. But security issues can also occur when an account has access rights to resources they should not be allowed to work with. The Manage Access And Permissions control is focused on the principle of least privilege, which says that access rights will always reflect the level of necessity. This control counts as 4 points toward your overall Secure Score, as shown in Figure 5-14.

For security purposes, it is good practice not to give elevated access rights, such as owner or write permissions on the subscription level, to external accounts. External accounts in this context are accounts that are not part of your organization’s Azure Active Directory tenant. Also, deprecated accounts should be removed from your subscription’s access control list. These are accounts that have been blocked from signing in. These accounts can be targets for attackers looking for ways to access your data without being noticed.

Regarding subscription ownership, it is best practice to have more than one (but not more than three) accounts with owner permissions. If you only have one account with that level of access, that might become an issue if the account is compromised or if the account owner joins another team or leaves your organization. However, you shouldn’t have more than three account owners because owner rights are not needed for everyday jobs besides granting access rights.

With the integration of container security and third-party cloud environments, Defender for Cloud also provides recommendations for these environments. For example, it is best practice to avoid privilege escalation in containers, and sensitive host namespaces shouldn’t be shared across containers. Using managed identities to access resources and information is another best practice that applies to App Services environments. To reduce your attack surface, you should think about disabling credentials that have not been used for 90 days or more. Depending on your environment, there can be quite a few recommendations that need to be taken care of, and doing so can become overwhelming. This is where security governance comes into play. Security governance is a new capability in Defender for Cloud that we discuss later in this chapter.

Secure management ports

You learned about the Cyber Kill Chain in Chapter 1. Alongside identity-based attacks, exposed management ports are a valuable target for attackers because they can be used to run attacks, such as brute-force or password-spray attacks. They belong to a group of attacks known as dictionary attacks because they use lists of usernames and passwords to generate log-in credentials that are then used in an automated process. If these attack campaigns are distributed and slow enough, it can be hard to block them.

The problem with username/password lists is that they often contain valid credentials that have been stolen in a random attack. If only one user in your organization has been affected by such a credential theft, and they are using their usernames and passwords for various services, a brute-force or password-spray attack might be successful. Figure 5-15 shows that the threat is a real threat, not a theoretical one. On February 14, 2022, a machine called Contoso-Linux-VM was started with an exposed SSH management port (port 22). Without doing anything else but starting the VM, Microsoft Defender for Cloud fired the Failed SSH brute force attack alert because someone had tried (but failed) to get access to our machine!

Because of its importance, the Secure Management Ports control counts a total of 8 points toward your overall Secure Score. It contains three different recommendations, as shown in Figure 5-16 and listed below.

• Management Ports Should Be Closed On Your Virtual Machines

• Management Ports Of Virtual Machines Should Be Protected With Just-In-Time Network Access Control

• Internet-Facing Virtual Machines Should Be Protected With Network Security Groups

The third recommendation (Internet-Facing Virtual Machines Should Be Protected With Network Security Groups) is essential for the other two because network security groups (NSGs) are used on both network interface cards (NICs) and subnet configurations to restrict communications between resources that are connected to Azure Virtual Networks (VNets). Defender for Cloud will verify whether an NSG exists on either the VM’s NIC or subnet and then create a recommendation accordingly.

The two other recommendations help you focus on closing exposed management ports on your machines. If an NSG exists on either the NIC or subnet, Defender for Cloud will assess whether there’s a rule that denies external access to management ports such as 22 for SSH or 3389 for RDP. If external access to your machine is allowed, you’ll see this particular machine listed as unhealthy regarding both recommendations. Now you have two options: You can either manually create an NSG rule that completely denies external access, or you can configure just-in-time VM access for that machine, a feature that we will cover in Chapter 8, “Enhanced security capabilities.” Whichever way you choose, once you have made sure that external access to your management ports is blocked, both recommendations will show the machine as healthy.

To manually create a rule that prevents external resource access, follow these steps:

1. Open the Azure portal and sign in with a user who has Security Admin privileges.

2. In the search bar, enter Defender, and then click Microsoft Defender For Cloud.

3. In the Defender for Cloud navigation pane, select Recommendations.

4. Look for the Secure Management Ports control and select the Management Ports Should Be Closed On Your Virtual Machines recommendation.

5. Click the name of a VM to which you want to block access. You are now redirected to the VM’s network configuration.

6. You can either remove an existing allow rule for your management port (which will remove all management access), make the existing rule less permissive by restricting access to only a range of source IP addresses, or click the Add Inbound Port Rule button to create a new rule that will block external access to your machine’s management ports.

7. For the Source, select Service Tag, and for the Source Service Tag select Internet. For the Destination Port Range, make sure to enter your machine’s management port(s), either as a range (such as 1024-65000) or as a comma-separated list. Set the Action to Deny, and make sure to enter a higher Priority than you have for an existing allow rule, as shown in Figure 5-17.

   

8. Click the Add button. It will now take up to 24 hours for Defender for Cloud to reassess the machine’s network configuration and show it as healthy regarding both recommendations.

Apply system updates

System updates are the next important topic to focus on. This control counts an additional 6 points toward your overall Secure Score. Defender for Cloud will use the Log Analytics agent to determine if a machine’s operating system is missing updates, or if the machine needs to be restarted in order to apply recently installed updates. Depending on the assessment result, Defender for Cloud will then come up with some recommendations, as shown in Figure 5-18.

For Defender for Cloud to be able to assess your machines’ OS states, the Log Analytics agent needs to be installed on any type of server you are monitoring, such as Azure VMs, Azure Arc-enabled machines, and VMSS. Also, the Log Analytics agent needs to properly collect security-related information and send it to the configured Log Analytics workspace. Once the Log Analytics agent is working as expected, Defender for Cloud will scan your machines for outstanding update installations or outstanding reboots and reflect the assessment results in its recommendations. If system updates need to be installed, you will see the missing updates as Findings, as shown in Figure 5-19.

You can click each missing update to see more details about the update, including remediation information.

Remediate vulnerabilities

The remediation of vulnerabilities is another major task to focus on when remediating recommendations that apply to compute resources. The Remediate Vulnerabilities security control counts as a maximum of 6 points toward your overall Secure Score. The collections of recommendations you see within the Remediate Vulnerabilities control will vary depending on the resource types you have deployed to your environment. Figure 5-20 shows the Remediate Vulnerabilities control with several recommendations, some of which already are completed and some of which are remediated on some resources.

Vulnerabilities on servers and other compute resources are assessed by an external vulnerability assessment solution. This is when Defender for Cloud’s Vulnerability Assessment integrations come into play for the Cloud Security Posture Management scenario. Microsoft Defender for Servers will allow you to either use the integrated Qualys vulnerability assessment solution on your servers, or to leverage Microsoft Defender for Endpoint’s Threat and Vulnerability Management (TVM). Also, Microsoft Defender for Containers allows you to scan your container registries for vulnerable images, and Microsoft Defender for SQL will allow you to activate vulnerability assessments on your SQL servers, both of which also are powered by Qualys. For more information about the different Defender for Cloud plans, see Chapter 6, “Threat detection.” To enable one of the Defender for Cloud plans, follow these steps:

1. Open the Azure portal and sign in with a user who has Security Admin privileges.

2. Open Microsoft Defender For Cloud.

3. In the left navigation pane, click Environment Settings.

4. Select the subscription on which you want to activate the Defender for Cloud plan.

5. Switch the Defender for Cloud Plan you want to activate to On, as shown in Figure 5-21.

   

6. Click Save.

Once you have activated Defender for Servers, you are eligible for using the integrated Qualys VA solution at no additional cost. Also, you can rely on Microsoft Defender for Endpoint’s Threat and Vulnerability Management (TVM). Alternatively, you can deploy an external Qualys VA solution in a Bring-your-own-license (BYOL) scenario if you decide not to use Defender for Servers or if you want to integrate your servers into an existing Qualys environment. The Machines Should Have A Vulnerability Assessment Solution recommendation comes with a Fix capability that enables you to remediate the recommendation with some easy steps directly from the Recommendations overview in Defender for Cloud. To enable one of the integrated solutions, follow these steps:

1. Open the Azure portal and sign in with a user who has Security Admin privileges. Also, your account needs Write Permissions for any VM on which you want to deploy the Qualys VA extension (or enable TVM).

2. Open Microsoft Defender For Cloud.

3. In the navigation pane, click Recommendations.

4. Open the Remediate Vulnerabilities control and click the Machines Should Have A Vulnerability Assessment Solution recommendation. You can look at the automated remediation logic that is triggered by the fix capability in the recommendation by opening the Remediation Steps section and then clicking Quick Fix Logic, as shown in Figure 5-22.

   

5. Select one or several machines to deploy a vulnerability assessment solution to and click Fix.

6. You can now choose to deploy Threat and Vulnerability Management By Microsoft Defender For Endpoint or Integrated Vulnerability Scanner Powered By Qualys or configure a new third-party solution, which is the BYOL scenario. Select the desired solution, as shown in Figure 5-23, and then click Proceed.

   

7. You will see a deployment summary and can start the deployment by clicking the Fix n Resource(s) (where n represents the number of resources) button.

If you have remediated all recommendations within the five security controls we have dis­­cussed so far, you have already achieved an overall Secure Score of 58.6 percent (10+4+8+6+6/58=0,5862). Congratulations!

Additional recommendations for Container Security

Microsoft Defender for Cloud comes with a bunch of recommendations that are especially focused on container images in Azure Container Registries and containers running on Kubernetes clusters, such as Azure Kubernetes Services (AKS). You have seen some of these recommendations in the preceding sections already, but there are a lot more that you can find using the new filtering option.

To see recommendations that apply to container registries and Kubernetes clusters only, select Container Registries, Kubernetes Services, and Kubernetes–Azure Arc as resource types in the recommendations filter, as shown in Figure 5-24.

Recommendations for containers are either focused on vulnerability management or environment hardening. Defender for Cloud will continuously monitor your Docker configuration and your Kubernetes clusters, and it will create recommendations for workload protection based on Kubernetes admission control. These recommendations are then added to the respective security controls, such as Remediate Vulnerabilities, Apply System Updates, or Remediate Security Configurations.

Container image scanning is one of the advanced capabilities that comes with Defender for Containers. Once you have enabled the Defender for Containers plan on your subscription, container images will be scanned once they are pushed to the Azure Container Registry, whenever they are pulled, and periodically afterward to ensure vulnerabilities that recently have been discovered are also found in existing images. You will learn more about detecting threats in container environments in Chapter 6.

Enable endpoint protection

After making sure you have protected your organization’s identities and closed the management ports on your machines, you have already made a huge step toward securing your environment from unauthorized access. The problem with malware is that it can be installed by both unauthorized actors and inadvertently—or on purpose—by legitimate users within your organization.

Once a machine is compromised, it might start downloading further malware, opening new attack vectors and helping bad actors in other ways to get a foot into your environment. This is when the Enable Endpoint Protection control comes into play. This control will add two more points toward your overall Secure Score once it is taken care of. As you can see in Figure 5-25, this control also includes the same recommendations for the Log Analytics agent that you already know from the apply system updates control.

The reason for this recommendation being shown multiple times is that Defender for Cloud will also need the Log Analytics agent for assessing whether an endpoint protection solution has been installed on a machine, and if so, if the endpoint protection solution is working properly. Defender for Cloud will discover the following endpoint protection solutions:

• Microsoft Defender Antivirus for Windows Server 2016 or later

• Microsoft Defender for Endpoint for Linux on Linux Server Family

• System Center Endpoint Protection (Microsoft Antimalware) on Windows Server 2012 R2

• Trend Micro – Deep Security on the Windows Server Family

• Symantec v12.1.1100+ on the Windows Server Family

• McAfee v10+ on the Windows and Linux Server Families

• Sophos v9+ on the Linux Server Family

Microsoft Defender Antivirus is included in the operating system as of Windows Server 2016 and, therefore, does not require further installation. But if there is a Windows Server 2012 R2 machine without an endpoint protection solution installed, you can use Defender for Cloud to install the Microsoft Antimalware directly from the portal. To install the extension to your machines, follow these steps:

1. Open the Azure portal and sign in with a user who has Security Admin privileges. Also, your account needs Write Permissions for any VM on which you want to deploy the Microsoft Antimalware extension.

2. Click Microsoft Defender For Cloud.

3. In the navigation pane, click Recommendations.

4. Open the Enable Endpoint Protection control and click the Endpoint Protection Should Be Installed On Your Machines recommendation.

5. Select the VM(s) on which you want to install the extension and click Install. You will realize that you can only see Windows Server VMs that support installation of the Microsoft Antimalware extension.

6. Select Install On n VMs (where n represents the number of resources), and then select Microsoft Antimalware and click Create.

7. If you wish, you can now exclude files, folders, file extensions, or processes and also define a scheduled scan (see in Figure 5-26). Then click OK to start the extension deployment.

   

Network map

The Network Map appears when you click the respective tile on this page. This option allows you to view the topology of your Azure network and the traffic pattern, as shown in Figure 5-28.

This map is organized from inside-out, with the subscription shown in the middle, then working outward, you see the Azure VNet, the subnet, and the Virtual Machine (VM) connected to that subnet. The default visualization includes some filters that can be adjusted:

• Security Health This is based on severity level (high, medium, low, or healthy) of your Azure resources.

• Recommendations These are based on the active recommendations for those resources.

• Network Zones These are based on internal or Internet-facing resources (or both).

If you hover the mouse over each icon, you will see more information about that object, and if you click one of those VMs, you will see more details about the VM itself, as shown in Figure 5-29.

On this blade, you have important information about the selected VM, and a list of relevant recommendations is shown at the bottom of the page. On the right side, you can switch to the Allowed Traffic tab. On this tab, you have two tables with the list of TCP and UDP ports open for inbound and outbound traffic. This provides better visibility of the traffic allowed for that specific machine. If you want a broader view of the current possible traffic between your resources, you can switch to the network map view to show not only the network topology, but also possible allowed traffic between resources by selecting Allowed Traffic in the Layer selection in the upper left corner. By switching to this view, you see the same map, but now it shows your configured rules, defining which resources can communicate with other resources.

Adaptive network hardening

The intent of this feature is to enable you to easily harden your network traffic by using Network Security Group (NSG) rules. Defender for Cloud will use machine learning to gather information about the network traffic from/to a machine. After learning about the traffic pattern, Defender for Cloud will suggest a list of rules for hardening the network environment.

When you click the Adaptive Network Hardening tile in Defender for Cloud’s Workload Protections blade, you will see the Adaptive Network Hardening Recommendations Should Be Applied On Internet Facing Virtual Machines recommendation, as shown in Figure 5-30.

Unhealthy Resources shows the number of VMs with network-hardening recommendations that should be applied. You can click each VM and see the current rules and alerts, as shown in Figure 5-31.

Under the Rules tab, you see the rules automatically created by the Adaptive Network Hardening capability based on the learning process. You can click the Add Rule button to create a new rule, or you can select the suggested rule and click the Enforce button. To see the alerts, you can click the Alerts tab and select the alert itself.

There will be some cases in which the Adaptive Network Hardening algorithm won’t be able to run, and the Unscanned Resources tab will appear. Following are the scenarios under which the Adaptive Network Hardening algorithm won’t be able to run:

• VMs are Classic VMs Only Azure Resource Manager VMs are supported.

• Not enough data is available To produce accurate traffic-hardening recommendations, Defender for Cloud requires at least 30 days of traffic data.

• VM is not protected by Defender for Servers This feature is only available in the Microsoft Defender for Servers P2 plan.

The following section includes examples of recommendations that can be remediated directly through the Defender for Cloud dashboard.

Secure transfer to storage accounts should be enabled

Secure transfer is an option that enforces a storage account to only accept requests that are using secure connections (HTTPS). Using HTTPS for all connections enforces authentication between the storage account and the requesting service and makes sure that data in transit is always encrypted and protected from network layer attacks, such as man-in-the-middle, or session-hijacking. You can deny the creation of unsecure storage accounts directly from this recommendation, and you can also auto-remediate existing accounts using the Quick Fix capability, as shown in Figure 5-32.

Enable auditing on SQL server

Defender for Cloud can perform a security assessment to verify whether you are leveraging Azure SQL auditing and threat detection security capabilities. Auditing and threat detection can assist you with the following tasks:

• Maintaining regulatory compliance

• Understanding database activity

• Gaining insight into discrepancies and anomalies

• Identifying security violations

Because of this integration with Azure SQL, this recommendation enables you to apply the remediation directly from Defender for Cloud. Follow these steps to address this recommendation:

1. From the Recommendations blade, open the Enable Auditing And Logging control, and choose Auditing On SQL Server Should Be Enabled.

2. On the Auditing On SQL Server Should Be Enabled blade, you will see the detailed explanation about this recommendation, Remediation Steps, and Affected Resources, as shown in Figure 5-33.

   

3. Click the Unhealthy Resources tab at the bottom of this page to see the SQL servers affected by this recommendation.

4. Click the SQL server for which you want to remediate this recommendation, and the Auditing blade will open, as shown in Figure 5-34.

   

5. Under Auditing, toggle the switch to On and select the audit log destination, and then click the Save button.

6. After the save has finished, close this blade.

Find only your own recommendations

As you have learned, the owner is assigned based on a valid email address. Microsoft Defender for Cloud will use this information to find the corresponding user account in Azure AD. If there is a matching account with at least the Security Reader role’s access rights, you can use it in Defender for Cloud to only see recommendations for which you are responsible. Follow these steps to see only your recommendations:

1. Log in to the Azure portal with an account that at least has Security Reader access rights.

2. In the top search bar, enter Defender, and then click Microsoft Defender For Cloud.

3. In the Defender For Cloud navigation pane, select Recommendations.

4. In the recommendations view, enable the Show My Items Only (Preview) switch.

5. Alternatively, if you want to see another owner’s recommendations, use the Owner filter, and select the owner you want to track, as shown in Figure 5-45.