Merge pull request #114711 from memildin/asc-melvyn-release-notes

New release notes pages

Author: SyntaxC4

articles/security-center/TOC.yml

@@ -12,6 +12,8 @@
       href: security-center-services.md
     - name: Feature coverage for Azure PaaS resources
       href: features-paas.md
+  - name: What's new in Security Center?
+    href: release-notes.md
   - name: Security recommendations
     href: recommendations-reference.md
   - name: Security alerts and the intent kill chain
@@ -194,7 +196,9 @@
       href: faq-vms.md      
     - name: Existing users of Azure Log Analytics
       href: faq-azure-monitor-logs.md      
-  - name: Release notes
+  - name: Archive of what's new in Security Center?
+    href: release-notes-archive.md
+  - name: Azure roadmap blog
     href: https://azure.microsoft.com/updates/?product=security-center
   - name: Features and API retirement (July 2019)
     href: security-center-features-retirement-july2019.md

articles/security-center/recommendations-reference.md

@@ -36,7 +36,7 @@ Your Secure Score is based on the number of Security Center recommendations you'
 |**Function App should only be accessible over HTTPS**|Enable "HTTPS only" access for function apps. Use of HTTPS ensures server/service authentication and protects data in transit from network layer eavesdropping attacks.<br>(Related policy: Function App should only be accessible over HTTPS)|Medium|**Y**|Function app|
 |**Internet-facing virtual machines should be protected with Network Security Groups**|Enable Network Security Groups to control network access of your virtual machines.<br>(Related policy: Internet-facing virtual machines should be protected with Network Security Groups)|High/ Medium|N|Virtual machine|
 |**IP forwarding on your virtual machine should be disabled**|Disable IP forwarding. When IP forwarding is enabled on a virtual machine's NIC, the machine can receive traffic addressed to other destinations. IP forwarding is rarely required (for example, when using the VM as a network virtual appliance), and therefore, this should be reviewed by the network security team.<br>(Related policy: [Preview]: IP Forwarding on your virtual machine should be disabled)|Medium|N|Virtual machine|
-|**Just-in-time network access control should be applied on virtual machines**|Apply just-in-time (JIT) virtual machine (VM) access control to permanently lock down access to selected ports, and enable authorized users to open them, via JIT, for a limited amount of time only.<br>(Related policy: Just-In-Time network access control should be applied on virtual machines)|High|N|Virtual machine|
+|**Management ports of virtual machines should be protected with just-in-time network access control**|Apply just-in-time (JIT) virtual machine (VM) access control to permanently lock down access to selected ports, and enable authorized users to open them, via JIT, for a limited amount of time only.<br>(Related policy: Management ports of virtual machines should be protected with just-in-time network access control)|High|N|Virtual machine|
 |**Management ports should be closed on your virtual machines**|Harden the network security group of your virtual machines to restrict access to management ports.<br>(Related policy: Management ports should be closed on your virtual machines)|High|N|Virtual machine|
 |**Secure transfer to storage accounts should be enabled**|Enable secure transfer to storage accounts. Secure transfer is an option that forces your storage account to accept requests only from secure connections (HTTPS). Use of HTTPS ensures authentication between the server and the service and protects data in transit from network layer attacks, such as man-in-the-middle, eavesdropping, and session-hijacking.<br>(Related policy: Secure transfer to storage accounts should be enabled)|High|**Y**|Storage account|
 |**Subnets should be associated with a Network Security Group**|Enable network security groups to control network access of resources deployed in your subnets.<br>(Related policy: Subnets should be associated with a Network Security Group.<br>This policy is disabled by default)|High/ Medium|N|Subnet|

articles/security-center/release-notes-archive.md

@@ -0,0 +1,207 @@
+---
+title: Archive of what's new in Azure Security Center
+description: A description of what's new and changed in Azure Security Center from six months ago and earlier.
+services: security-center
+documentationcenter: na
+author: memildin
+manager: rkarlin
+ms.service: security-center
+ms.devlang: na
+ms.topic: conceptual
+ms.tgt_pltfrm: na
+ms.workload: na
+ms.date: 05/11/2020
+ms.author: memildin
+
+---
+
+# Archive for what's new in Azure Security Center?
+
+The primary [What's new in Azure Active Directory?](release-notes.md) release notes page contains updates for the last six months, while this page contains older items.
+
+This page provides you with information about:
+
+- New features
+- Bug fixes
+- Deprecated functionality
+
+## November 2019
+
+### Threat Protection for Azure Key Vault in Public Preview in North America Regions
+
+Azure Key Vault is an essential service for protecting data and improving performance of cloud applications by offering the ability to centrally manage keys, secrets, cryptographic keys and policies in the cloud. Since Azure Key Vault stores sensitive and business critical data, it requires maximum security for the key vaults and the data stored in them.
+
+Azure Security Center’s support for Threat Protection for Azure Key Vault provides an additional layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit key vaults. This new layer of protection allows customers to address threats against their key vaults without being a security expert or manage security monitoring systems. The feature is in public preview in North America Regions.
+
+
+### Threat Protection for Azure Storage includes Malware Reputation Screening
+
+Threat protection for Azure Storage offers new detections powered by Microsoft Threat Intelligence for detecting malware uploads to Azure Storage using hash reputation analysis and suspicious access from an active Tor exit node (an anonymizing proxy). You can now view detected malware across storage accounts using Azure Security Center.
+
+
+### Workflow automation with Logic Apps (preview)
+
+Organizations with centrally managed security and IT/operations implement internal workflow processes to drive required action within the organization when discrepancies are discovered in their environments. In many cases, these workflows are repeatable processes and automation can greatly streamline processes within the organization.
+
+Today we are introducing a new capability in Security Center that allows customers to create automation configurations leveraging Azure Logic Apps and to create policies that will automatically trigger them based on specific ASC findings such as Recommendations or Alerts. Azure Logic App can be configured to do any custom action supported by the vast community of Logic App connectors, or use one of the templates provided by Security Center such as sending an email or opening a ServiceNow™ ticket.
+
+For more information about the automatic and manual Security Center capabilities for running your workflows, see [workflow automation](workflow-automation.md).
+
+To learn about creating Logic Apps, see [Azure Logic Apps](https://docs.microsoft.com/azure/logic-apps/logic-apps-overview).
+
+
+### Quick Fix for bulk resources generally available
+
+With the many tasks that a user is given as part of Secure Score, the ability to effectively remediate issues across a large fleet can become challenging.
+
+To simplify remediation of security misconfigurations and to be able to quickly remediate recommendations on a bulk of resources and improve your secure score, use Quick Fix remediation.
+
+This operation will allow you to select the resources you want to apply the remediation to and launch a remediation action that will configure the setting on your behalf.
+
+Quick fix is generally available today customers as part of the Security Center recommendations page.
+
+See which recommendations have quick fix enabled in the [reference guide to security recommendations](recommendations-reference.md).
+
+
+### Scan container images for vulnerabilities (preview)
+
+Azure Security Center can now scan container images in Azure Container Registry for vulnerabilities.
+
+The image scanning works by parsing the container image file, then checking to see whether there are any known vulnerabilities (powered by Qualys).
+
+The scan itself is automatically triggered when pushing new container images to Azure Container Registry. Found vulnerabilities will surface as Security Center recommendations and included in the Azure Secure Score together with information on how to patch them to reduce the attack surface they allowed.
+
+
+### Additional regulatory compliance standards (preview)
+
+The Regulatory Compliance dashboard provides insights into your compliance posture based on Security Center assessments. The dashboard shows how your environment complies with controls and requirements designated by specific regulatory standards and industry benchmarks and provides prescriptive recommendations for how to address these requirements.
+
+The regulatory compliance dashboard has thus far supported four built-in standards:  Azure CIS 1.1.0, PCI-DSS, ISO 27001, and SOC-TSP. We are now announcing the public preview release of additional supported standards: NIST SP 800-53 R4, SWIFT CSP CSCF v2020, Canada Federal PBMM and UK Official together with UK NHS. We are also releasing an updated version of Azure CIS 1.1.0, covering more controls from the standard and enhancing extensibility.
+
+[Learn more about customizing the set of standards in your regulatory compliance dashboard](update-regulatory-compliance-packages.md).
+
+
+### Threat Protection for Azure Kubernetes Service (preview)
+
+Kubernetes is quickly becoming the new standard for deploying and managing software in the cloud. Few people have extensive experience with Kubernetes and many only focuses on general engineering and administration and overlook the security aspect. Kubernetes environment needs to be configured carefully to be secure, making sure no container focused attack surface doors are not left open is exposed for attackers. Security Center is expanding its support in the container space to one of the fastest growing services in Azure - Azure Kubernetes Service (AKS).
+
+The new capabilities in this public preview release include:
+
+- **Discovery & Visibility** - Continuous discovery of managed AKS instances within Security Center’s registered subscriptions.
+- **Secure Score recommendations** - Actionable items to help customers comply to security best practices in AKS as part of the customer’s Secure Score, such as "Role-Based Access Control should be used to restrict access to a Kubernetes Service Cluster".
+- **Threat Detection** - Host and cluster-based analytics, such as “A privileged container detected”.
+
+
+### Virtual machine vulnerability assessment (preview)
+
+Applications that are installed in virtual machines could often have vulnerabilities that could lead to a breach of the virtual machine. We are announcing that the Security Center Standard tier includes built-in vulnerability assessment for virtual machines for no additional fee. The vulnerability assessment, powered by Qualys in the public preview, will allow you to continuously scan all the installed applications on a virtual machine to find vulnerable applications and present the findings in the Security Center portal’s experience. Security Center takes care of all deployment operations so that no extra work is required from the user. Going forward we are planning to provide vulnerability assessment options to support our customers’ unique business needs.
+
+[Learn more about vulnerability assessments for your Azure Virtual Machines](security-center-vulnerability-assessment-recommendations.md).
+
+
+### Advanced data security for SQL servers on Azure Virtual Machines (preview)
+
+Azure Security Center’s support for threat protection and vulnerability assessment for SQL DBs running on IaaS VMs is now in preview.
+
+[Vulnerability assessment](https://docs.microsoft.com/azure/sql-database/sql-vulnerability-assessment) is an easy to configure service that can discover, track, and help you remediate potential database vulnerabilities. It provides visibility into your security posture as part of Azure secure score and includes the steps to resolve security issues and enhance your database fortifications.
+
+[Advanced threat protection](https://docs.microsoft.com/azure/sql-database/sql-database-threat-detection-overview) detects anomalous activities indicating unusual and potentially harmful attempts to access or exploit your SQL server. It continuously monitors your database for suspicious activities and provides action-oriented security alerts on anomalous database access patterns. These alerts provide the suspicious activity details and recommended actions to investigate and mitigate the threat.
+
+
+### Support for custom policies (preview)
+
+Azure Security Center now supports custom policies (in preview).
+
+Our customers have been wanting to extend their current security assessments coverage in Security Center with their own security assessments based on policies that they create in Azure Policy. With support for custom policies, this is now possible.
+
+These new policies will be part of the Security Center recommendations experience, Secure Score, and the regulatory compliance standards dashboard. With the support for custom policies, you’re now able to create a custom initiative in Azure Policy, then add it as a policy in Security Center and visualize it as a recommendation.
+
+
+### Extending Azure Security Center coverage with platform for community and partners
+
+Use Security Center to receive recommendations not only from Microsoft but also from existing solutions from partners such as Check Point, Tenable, and CyberArk with many more integrations coming.  Security Center’s simple onboarding flow can connect your existing solutions to Security Center, enabling you to view your security posture recommendations in a single place, run unified reports and leverage all of Security Center's capabilities against both built-in and partner recommendations. You can also export Security Center recommendations to partner products.
+
+[Learn more about Microsoft Intelligent Security Association](https://www.microsoft.com/security/partnerships/intelligent-security-association).
+
+
+
+### Advanced integrations with export of recommendations and alerts (preview)
+
+In order to enable enterprise level scenarios on top of Security Center, it’s now possible to consume Security Center alerts and recommendations in additional places except the Azure portal or API. These can be directly exported to an Event Hub and to Log Analytics workspaces. Here are a few workflows you can create around these new capabilities:
+
+- With export to Log Analytics workspace, you can create custom dashboards with Power BI.
+- With export to Event Hub, you’ll be able to export Security Center alerts and recommendations to your third-party SIEMs, to a third-party solution in real time, or Azure Data Explorer.
+
+
+### Onboard on-prem servers to Security Center from Windows Admin Center (preview)
+
+Windows Admin Center is a management portal for Windows Servers who are not deployed in Azure offering them several Azure management capabilities such as backup and system updates. We have recently added an ability to onboard these non-Azure servers to be protected by ASC directly from the Windows Admin Center experience.
+
+With this new experience users will be to onboard a WAC server to Azure Security Center and enable viewing its security alerts and recommendations directly in the Windows Admin Center experience.
+
+
+## September 2019
+
+### Managing rules with adaptive application controls improvements
+
+The experience of managing rules for virtual machines using adaptive application controls has improved. Azure Security Center's adaptive application controls help you control which applications can run on your virtual machines. In addition to a general improvement to rule management, a new benefit enables you to control which file types will be protected when you add a new rule.
+
+[Learn more about adaptive application controls](security-center-adaptive-application.md).
+
+
+### Control container security recommendation using Azure Policy
+
+Azure Security Center’s recommendation to remediate vulnerabilities in container security can now be enabled or disabled via Azure Policy.
+
+To view your enabled security policies, from Security Center open the Security Policy page.
+
+
+## August 2019
+
+### Just-in-time (JIT) VM access for Azure Firewall 
+
+Just-in-time (JIT) VM access for Azure Firewall is now generally available. Use it to secure your Azure Firewall protected environments  in addition to your NSG protected environments.
+
+JIT VM access reduces exposure to network volumetric attacks by providing controlled access to VMs only when needed, using your NSG and Azure Firewall rules.
+
+When you enable JIT for your VMs, you create a policy that determines the ports to be protected, how long the ports are to remain open, and approved IP addresses from where these ports can be accessed. This policy helps you stay in control of what users can do when they request access.
+
+Requests are logged in the Azure Activity Log, so you can easily monitor and audit access. The just-in-time page also helps you quickly identify existing VMs that have JIT enabled and VMs where JIT is recommended.
+
+[Learn more about Azure Firewall](https://docs.microsoft.com/azure/firewall/overview).
+
+
+### Single click remediation to boost your security posture (preview)
+
+Secure score is a tool that helps you assess your workload security posture. It reviews your security recommendations and prioritizes them for you, so you know which recommendations to perform first. This helps you find the most serious security vulnerabilities to prioritize investigation.
+
+In order to simplify remediation of security misconfigurations and help you to quickly improve your secure score, we’ve added a new capability that allows you to remediate a recommendation on a bulk of resources in a single click.
+
+This operation will allow you to select the resources you want to apply the remediation to and launch a remediation action that will configure the setting on your behalf.
+
+See which recommendations have quick fix enabled in the [reference guide to security recommendations](recommendations-reference.md).
+
+
+### Cross-tenant management
+
+Security Center now supports cross-tenant management scenarios as part of Azure Lighthouse. This enables you to gain visibility and manage the security posture of multiple tenants in Security Center. 
+
+[Learn more about cross-tenant management experiences](security-center-cross-tenant-management.md).
+
+
+## July 2019
+
+### Updates to network recommendations
+
+Azure Security Center (ASC) has launched new networking recommendations and improved some existing ones. Now, using Security Center ensures even greater networking protection for your resources. 
+
+[Learn more about network recommendations](recommendations-reference.md#recs-network).
+
+
+## June 2019
+
+### Adaptive Network Hardening - generally available
+
+One of the biggest attack surfaces for workloads running in the public cloud are connections to and from the public Internet. Our customers find it hard to know which Network Security Group (NSG) rules should be in place to make sure that Azure workloads are only available to required source ranges. With this feature, Security Center learns the network traffic and connectivity patterns of Azure workloads and provides NSG rule recommendations, for Internet facing virtual machines. This helps our customer better configure their network access policies and limit their exposure to attacks. 
+
+[Learn more about adaptive network hardening](security-center-adaptive-network-hardening.md).