全面指南：Azure治理与安全，政策、蓝图、安全中心及哨兵实践

需积分: 10 116 浏览量更新于2024-07-17 收藏 19.53MB PDF 举报

"Pro Azure Governance and Security" 是一本由 Peter De Tender、David Rendon 和 Samuel Erskine 联合撰写的专著，针对Microsoft Azure的全面指南，重点讲解了Azure平台中的关键治理和安全实践。这本书深入探讨了Azure Policy（策略）、Blueprints（蓝图）、Security Center（安全中心）以及新兴的Azure Sentinel（安全哨兵）等工具和服务。作者们以其丰富的行业经验，从两个主要视角——客户视角和Microsoft操作视角，指导读者如何有效地管理和控制在Azure环境中部署的应用程序工作负载。从顶级订阅层开始，本书介绍了Azure中的核心安全服务和功能，如如何使用Azure策略来定义和实施统一的安全策略，以及如何制定和应用蓝图来确保资源的一致性和合规性。 Azure Security Center是书中重要的部分，它作为一个集中的安全监控平台，帮助用户监控和响应潜在威胁，同时教授读者如何配置基于角色的访问控制(RBAC)来管理权限和访问权限。此外，通过实际操作演练，读者可以学习如何部署Azure Governance，理解其在资源管理和审计方面的价值。 Azure Sentinel作为Siem（安全信息和事件管理）解决方案，本书会详细介绍如何将其集成到混合环境，以便进行实时的安全事件管理和主动搜索，提升整体安全防护能力。版权信息表明，此书适用于个人和组织，所有内容受版权保护，不得未经许可进行翻译、复制或传播。 "Pro Azure Governance and Security" 是一本实用的指南，适合IT专业人员，特别是那些希望提升在Azure中实施安全和治理策略效率的开发者、管理员和决策者，通过学习本书，他们能够更有效地保护云端资源，确保业务连续性和数据安全。

xix

As the Global Director for the Microsoft Cybersecurity

Solutions Group, Jonathan leads Microsoft’s team of

worldwide security advisors and cloud security architects

who provide strategic direction on the development of

Microsoft security products and services and deliver deep

customer and partner engagements around the globe. He

serves as a member of Microsoft’s Internal Risk Management

Committee and is a principal author of the Microsoft

Security Intelligence Report.

Jonathan joined Microsoft in 2016 as an experienced

information security executive, bringing more than 17 years

of public and private sector experience. He was Vice President and CISO with Optiv,

where he was responsible for developing and executing the company’s information

security strategy and program. Prior to his role at Optiv, he was the Chief Information

Security Officer (CISO) for Qualys where he was responsible for securing infrastructure

and products, bringing security best practices to customers, providing strategic direction

on the development of the QualysGuard Security Platform, achieving FedRAMP

certification of the Qualys cloud platform, researching real-world threats, and providing

guidance on how to address them.

Jonathan has established himself as an innovative security leader and was recently

named by the SANS Institute as one of the “People Who Made a Difference in

Cybersecurity.” He serves as an advisor to several security startups and venture capital

firms, participates in the Cloud Security Alliance Top Threats Working Group, and has

spoken at major security events such as RSA, Black Hat, Gartner, CSO50, and SANS.He is

also the principal author of the Center for Internet Security Azure Security Foundations

Benchmark and several open source security tools. He is a Certified Cloud Security

Professional (CCSP), Certified Information Systems Security Professional (CISSP),

Certified Information Systems Auditor (CISA), and an Offensive Security Certified

Professional (OSCP). He completed the Carnegie Mellon University CISO Executive

Program and earned a master’s degree from the University of North Texas and a

bachelor’s degree from Metropolitan State University of Denver.

foreword

xxi

Introduction

The idea for writing an Azure security-oriented book was on my mind for two years, but

because of other projects, traveling a lot, and continuous changes in the Azure platform,

I decided to put it on the shelf for a while. Until about a year ago, when it became clear

that Microsoft was taking cloud security seriously. Seeing how impressive services like

Azure Security Center and Azure Policy have become, it would be a shame to not expose

that enthusiasm in another book project. But where was I to find time in my already

crazy-busy business life, traveling the world, providing Azure workshops, flying on to the

next location…?

When talking about the book idea with my close friends and fellow Azure experts,

Sam and Dave, during that initial call in June, the enthusiasm was so amazing that we

decided to go for it. Honestly, if we mapped the initial outline of topics with the result

that you have here in front of you, about 70% would be changed. This includes scrapping

chapters and writing new ones.

Azure is a moving target, especially the security services and features it offers.

Every few weeks during the writing process, new updates came out, new features were

introduced, portal layouts changed, which obviously was a challenge at times. But seeing

the beauty and technical completeness of all of these tools, which really help optimize any

Azure customer’s security posture, put a big smile on our faces. And I’m pretty sure we

are only seeing the beginning of the broader potential. In the last few weeks of writing, we

were amazed by Azure Sentinel, a first attempt by Microsoft to offer a SIEM as a Service, so

we decided to dedicate a chapter to it. And while in the early preview stage for now, it looks

rather impressive. But enough of all that. Turn the pages, learn Azure, dive into the security

features, and I’m sure this book will bring the same big smile to your face as it did to ours.

In the first chapter, we introduce you to the challenges and advantages an organization

has by using public cloud services like Azure, mainly from a governance perspective.

In Chapter 2, we emphasize the importance of building out your Azure tenant and

subscription(s) in the correct way, depending on organization structure, complexity, and

technical and non-technical requirements.

In Chapter 3, we share our experiences from the field, together with best practices

and guidance from the Microsoft Azure product group, on how to name your Azure

xxii

resources. Although a resource name might look like just a name, there are certain

guidelines to follow—especially if you want to be prepared for failure.

Chapter 4 brings you to the technical details of Azure Policy, a service that allows you

to govern what can be deployed in Azure. Think of having an Azure administrative role,

where you want to lock down the Azure region resources that can be deployed or define

which Azure virtual machines sizes cannot be deployed—or pretty much anything else

in your Azure environment that you want to streamline. The most technical instrument

in Azure today allows you to define settings and validate if /how your active Azure

environment is compliant.

In Chapter 5, we guide you through the capabilities and features of Azure Security

Center, an end-to-end dashboard and reporting service, focused on all-things security in

your Azure and hybrid platform. Starting with the overall options available in the (free)

Basic tier, we also discuss the other services that you can use by switching to the (paid)

Standard tier. We highlight the importance of Azure Security Center.

Running a security team and managing security in the Azure cloud environment

would not be complete without describing the operations and monitoring aspects of the

platform, which is exactly what we cover in Chapter 6. Starting with Azure Monitor as the

new replacement for OMS, we dive into log analytics and walk you through several other

built-in Azure monitoring tools and services.

In Chapter 7, we take it one step further by describing what it takes to enable and

implement Azure security in a larger enterprise environment. Topics like automation

and self-service are obviously present, but we also provide a helicopter view on how to

manage multiple subscriptions by using management groups.

Lastly, in Chapter 8, we introduce you to the (preview) of Azure Sentinel, which is

described as a SIEM as a Service. Relying on machine learning, taking information from

your Azure subscription, and mixing with input from Microsoft Security Graph, it allows

organizations to manage security incidents with a more proactive approach than the

typical reactive one.

We hope that you enjoy reading this book and that it helps you learn and understand

Azure security by going through the step-by-step instructions that we provide as a

walkthrough in each chapter. And finally, we hope that the book helps you optimize

your Azure security overall. Do not hesitate to reach out to us when you have questions,

doubts, find any mistakes that we made, or if you want to share your enthusiasm.

Happy Azure-ing,

Peter, Dave, and Sam

InTroduCTIon

剩余331页未读，继续阅读

iebukes

粉丝: 9
资源: 132

全面指南：Azure治理与安全，政策、蓝图、安全中心及哨兵实践

Microsoft.Azure.Security.Infrastructure

Microsoft Azure Security Center

Azure Kinect and Femto Bolt Examples for Unity 1.19.2

Azure purview

AWS Lambda、Google Cloud Functions、Microsoft Azure Functions

如何布置Azure AVD

azure blob和file

微软azure本地使用

Azure devops 面试题

最新资源