Defender for Cloud and CSPM

What it is

Microsoft Defender for Cloud is a tool that improves the security of your cloud resources and protects them from threats. It works for Azure, and also for resources in AWS, Google Cloud and on premises servers. It was formed by combining the earlier Azure Security Center and Azure Defender.

It does two jobs, and the exam expects you to keep them apart: posture management, which finds weak settings before an attack, and workload protection, which detects attacks on running resources.

How it works

Cloud security posture management (CSPM)

CSPM continuously checks your resources for misconfigurations and risks, and tells you how to fix them. A virtual machine with an open management port, a storage account open to the public, or a database with no encryption are the kind of findings it reports.

• Recommendations list the problems, ranked by importance, with steps to fix them.
• Secure score turns the findings into a percentage. The more recommendations you complete, the higher it rises, so it shows your posture at a glance and over time.
• Security policies and standards define what is checked. The default is the Microsoft cloud security benchmark, and you can add standards from other frameworks.
• Regulatory compliance dashboard measures your resources against standards such as PCI DSS, ISO 27001 and CIS benchmarks, and shows where you fall short.

Free, basic posture features are included. The paid Defender CSPM plan adds more, such as attack path analysis, which shows how an attacker could chain weaknesses to reach a valuable resource, and a cloud security explorer to query your environment.

Cloud workload protection (CWP)

Workload protection detects and responds to threats on resources that are running. It is delivered through Defender plans, each aimed at one kind of resource.

When a plan finds an attack, it raises a security alert with details and suggested action.

Posture compared with protection

Defender for Cloud and other tools

Defender for Cloud assesses the security of cloud workloads. It is not a SIEM. Microsoft Sentinel collects and correlates data from many sources to detect threats across the whole organisation. The two work together, because Defender for Cloud alerts can feed Sentinel.

A worked scenario

A team runs virtual machines and storage in Azure and some servers in another cloud. Defender for Cloud scores their environment at 52 percent and lists recommendations, such as closing an exposed management port and turning on encryption. As the team completes them, the secure score rises. The regulatory compliance dashboard shows which controls from a payment card standard are still failing. The team also turns on Defender for Servers, so that when malware runs on a virtual machine, the system raises an alert.

Connecting resources

Resources in Azure are covered by turning on Defender for Cloud for the subscription. Servers outside Azure, such as on premises machines, are connected through Azure Arc. Other clouds are added with connectors for AWS and Google Cloud, so one dashboard shows the posture of all of them.

Recommendations compared with alerts

Features of server protection

Defender for Servers includes features that reduce the attack surface of virtual machines. Just in time VM access keeps management ports closed and opens them only for a short time to approved users who request it. Adaptive network hardening suggests tighter network security group rules based on the traffic that really flows. Endpoint detection and response is provided through Microsoft Defender for Endpoint.

Where the standards come from

The default standard is the Microsoft cloud security benchmark, which maps controls to well known frameworks. When you add industry standards, the regulatory compliance dashboard shows how many controls pass and which resources cause failures, so you know what to fix.