Securing Infrastructure on the Public Cloud with Defender for Cloud Apps

Infra Security Challenges in Public Cloud

Cloud computing use is fast expanding, and enterprises are exploring for cloud platform solutions that will offer them with security while also saving them money to operate their workloads. As we move forward to 2023, cybersecurity for public cloud workloads (e.g., VMs, containers, and services) will continue to grow, with enterprises attempting to reconcile the requirement for aggressive cloud adoption and compliance with corporate security demands. CIOs and CISOs will push their teams to lay the groundwork for a security platform capable of consolidating point products, supporting various clouds (AWS, Azure, and GCP), and providing automation to expand security operations.

The most common underlying cause of cyberattacks is incorrect setups brought on by human mistake. These attacks often use methods like code injection and buffer overflow assaults to get access to the vulnerable setups. Configuring security rules at individual firewalls at each VPC (or a trust zone), where cloud-enabling workloads are constantly spun up and down, leaves room for human mistake. Customers will search for architectures that can centralise the definition, enforcement, and correction of their cloud security policies.

How Defender for Cloud Apps can help ?

Moving to cloud increases flexibility for employees and IT Teams along with that it also introduces new challenged and complexities for keeping organization data, apps & infrastructure secure. This is where Cloud Access Security Broker (CASB) steps in and safeguards the organizations use of cloud services by enforcing the enterprise security policies.

Microsoft Defender for Cloud Apps provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyberthreats across all your Microsoft and third-party cloud services. CASB acts as a real time gatekeeper between your enterprise users and the cloud resources they are entitled to use, irrespective for where they are located and what device they are using.

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that supports various deployment modes like

Log collection
API connectors
Reverse proxy.

Microsoft Defender for Cloud Apps provides a seamless integration with Public Cloud platforms such as Azure, AWS & GCP. Once integrated, Defender for cloud apps helps organization to improve threat detection capability. By Connecting each of these cloud platforms to Defender for Cloud Apps helps you improve your threat detections capabilities. By monitoring administrative and sign-in activities for these services, you can detect and be notified about possible brute force attack, malicious use of a privileged user account, and other threats in your environment.

Integrating Public Clouds with Microsoft Defender for Cloud provides with a security configuration assessment of the environment. The assessment provides recommendations for missing configuration and security control. Reviewing these recommendations helps you identify anomalies and potential vulnerabilities in your environment, and navigate directly in the relevant location in the Azure Security portal to resolve them.

Out of the Box Policies & Templates

Defender for Cloud Apps provides few out of the box security policies and templates organization can leverage to control & detect anomalies

Type	Name
Activity policy template	Admin console sign-in failures CloudTrail configuration changes EC2 instance configuration changes IAM policy changes Logon from a risky IP address Network access control list (ACL) changes Network gateway changes S3 configuration changes Security group configuration changes Virtual private network changes
Built-in anomaly detection policy	Activity from anonymous IP addresses Activity from infrequent country Activity from suspicious IP addresses Impossible travel Activity performed by terminated user Multiple failed login attempts Unusual administrative activities Unusual multiple storage deletion activities (preview) Multiple delete VM activities Unusual multiple VM creation activities (preview) Unusual region for cloud resource (preview)

Type

Name

Activity policy template