Addressed PR review feedback

Author: msmbaldwin

articles/key-vault/general/developers-guide.md

@@ -28,7 +28,7 @@ Periodically, we release a public preview of a new Key Vault feature. Try out th
 
 Azure Key Vault provides a way to securely store credentials and other keys and secrets, but your code needs to authenticate to Key Vault to retrieve them. Managed identities for Azure resources makes solving this problem simpler by giving Azure services an automatically managed identity in Azure Active Directory (Azure AD). You can use this identity to authenticate to any service that supports Azure AD authentication, including Key Vault, without having any credentials in your code. 
 
-For more information on managed identities for Azure resources, see [the managed identities overview](../../active-directory/managed-identities-azure-resources/overview.md). For more information on working with AAD, see [Integrating applications with Azure Active Directory](../../active-directory/develop/active-directory-integrating-applications.md).
+For more information on managed identities for Azure resources, see [the managed identities overview](../../active-directory/managed-identities-azure-resources/overview.md). For more information on working with Azure AD, see [Integrating applications with Azure Active Directory](../../active-directory/develop/active-directory-integrating-applications.md).
 
 Before working with keys, secrets or certificates in your key vault, you'll create and manage your key vault through CLI, PowerShell, Resource Manager Templates or REST, as described in the following articles:
 

articles/key-vault/general/overview-throttling.md

@@ -31,7 +31,7 @@ Key Vault was originally created with the limits specified in [Azure Key Vault s
 1. Cache the secrets you retrieve from Azure Key Vault in memory, and reuse from memory whenever possible.  Re-read from Azure Key Vault only when the cached copy stops working (e.g. because it got rotated at the source). 
 1. Key Vault is designed for your own services secrets.   If you are storing your customers' secrets (especially for high-throughput key storage scenarios), consider putting the keys in a database or storage account with encryption, and storing just the master key in Azure Key Vault.
 1. Encrypt, wrap, and verify  public-key operations can be performed with no access to Key Vault, which not only reduces risk of throttling, but also improves reliability (as long as you properly cache the public key material).
-1. If you use Key Vault to store credentials for a service, check if that service supports AAD Authentication to authenticate directly. This reduces the load on Key Vault, improves reliability and simplifies your code since Key Vault can now use the AAD token.  Many services have moved to using AAD Auth.  See the current list at [Services that support managed identities for Azure resources](../../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-managed-identities-for-azure-resources).
+1. If you use Key Vault to store credentials for a service, check if that service supports Azure AD Authentication to authenticate directly. This reduces the load on Key Vault, improves reliability and simplifies your code since Key Vault can now use the Azure AD token.  Many services have moved to using Azure AD Auth.  See the current list at [Services that support managed identities for Azure resources](../../active-directory/managed-identities-azure-resources/services-support-managed-identities.md#azure-services-that-support-managed-identities-for-azure-resources).
 1. Consider staggering your load/deployment over a longer period of time to stay under the current RPS limits.
 1. If your app comprises multiple nodes that need to read the same secret(s), then consider using a fan out pattern, where one entity reads the secret from Key Vault, and fans out to all nodes.   Cache the retrieved secrets only in memory.
 If you find that the above still does not meet your needs, please fill out the below table and contact us to determine what additional capacity can be added (example put below for illustrative purposes only).

articles/key-vault/keys/about-keys.md

@@ -44,7 +44,7 @@ Refer to the JOSE specifications for relevant data types for keys, encryption, a
 -   **signature-value** - output of a signature algorithm, encoded using Base64URL  
 -   **base64URL** - a Base64URL [RFC4648] encoded binary value  
 -   **boolean** - either true or false  
--   **Identity** - an identity from Azure Active Directory (AAD).  
+-   **Identity** - an identity from Azure Active Directory (Azure AD).  
 -   **IntDate** - a JSON decimal value representing the number of seconds from 1970-01-01T0:0:0Z UTC until the specified UTC date/time. See RFC3339 for details regarding date/times, in general and UTC in particular.  
 
 ### Objects, identifiers, and versioning

articles/security/benchmarks/security-control-data-protection.md

@@ -1,17 +1,21 @@
 ---
 title: Azure Security Control - Data Protection
-description: Azure Security Control Data Protection
+description: Security Control Data Protection
 author: msmbaldwin
+manager: rkarlin
+
 ms.service: security
 ms.topic: conceptual
-ms.date: 04/03/2020
+ms.date: 12/30/2019
 ms.author: mbaldwin
-ms.custom: security-benchmark
+ms.custom: security-recommendations
 
 ---
 
 # Security Control: Data Protection
 
+Data protection recommendations focus on addressing issues related to encryption, access control lists, identity-based access control, and audit logging for data access.
+
 ## 4.1: Maintain an inventory of sensitive Information
 
 | Azure ID | CIS IDs | Responsibility |
@@ -28,31 +32,46 @@ https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tag
 
 | Azure ID | CIS IDs | Responsibility |
 |--|--|--|
-| 4.2 | 13.2, 2.10 | Customer |
+| 4.2 | 13.2 | Customer |
+
+Implement separate subscriptions and/or management groups for development, test, and production. Resources should be separated by VNet/Subnet, tagged appropriately, and secured by an NSG or Azure Firewall. Resources storing or processing sensitive data should be sufficiently isolated. For Virtual Machines storing or processing sensitive data, implement policy and procedure(s) to turn them off when not in use.
+
+How to create additional Azure subscriptions:
+
+https://docs.microsoft.com/azure/billing/billing-create-subscription
+
+How to create Management Groups:
+
+https://docs.microsoft.com/azure/governance/management-groups/create
+
+How to create and use Tags:
+
+https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags
+
+How to create a Virtual Network:
+
+https://docs.microsoft.com/azure/virtual-network/quick-create-portal
+
+How to create an NSG with a Security Config:
 
-Implement isolation using separate subscriptions and management groups for individual security domains such as environment type and data sensitivity level. You can restrict the level of access to your Azure resources that your applications and enterprise environments demand. You can control access to Azure resources via Azure Active Directory role-based access control. 
+https://docs.microsoft.com/azure/virtual-network/tutorial-filter-network-traffic
 
-How to create additional Azure subscriptions: https://docs.microsoft.com/azure/billing/billing-create-subscription 
+How to deploy Azure Firewall:
 
-How to create Management Groups: https://docs.microsoft.com/azure/governance/management-groups/create 
+https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal
 
-How to create and use tags: https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags 
+How to configure alert or alert and deny with Azure Firewall:
+
+https://docs.microsoft.com/azure/firewall/threat-intel
 
 ## 4.3: Monitor and block unauthorized transfer of sensitive information
 
 | Azure ID | CIS IDs | Responsibility |
 |--|--|--|
-| 4.3 | 13.3 | Shared |
+| 4.3 | 13.3 | Customer |
 
 Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.
 
-For the underlying platform which is managed by Microsoft, Microsoft treats all customer content as sensitive and goes to great lengths to guard against customer data loss and exposure. To ensure customer data within Azure remains secure, Microsoft has implemented and maintains a suite of robust data protection controls and
- capabilities.
-
-Understand customer data protection in Azure:
-
-https://docs.microsoft.com/azure/security/fundamentals/protection-customer-data
-
 ## 4.4: Encrypt all sensitive information in transit
 
 | Azure ID | CIS IDs | Responsibility |
@@ -71,17 +90,14 @@ https://docs.microsoft.com/azure/security/fundamentals/encryption-overview#encry
 
 | Azure ID | CIS IDs | Responsibility |
 |--|--|--|
-| 4.5 | 14.5 | Shared |
+| 4.5 | 14.5 | Customer |
 
 When no feature is available for your specific service in Azure, use a third-party active discovery tool to identify all sensitive information stored, processed, or transmitted by the organization's technology systems, including those located on-site, or at a remote service provider, and update the organization's sensitive information inventory.
 
 Use Azure Information Protection for identifying sensitive information within Office 365 documents.
 
 Use Azure SQL Information Protection to assist in the classification and labeling of information stored in Azure SQL Databases.
 
-For the underlying platform which is managed by Microsoft, Microsoft treats all customer content as sensitive and goes to great lengths to guard against customer data loss and exposure. To ensure customer data within Azure remains secure, Microsoft has implemented and maintains a suite of robust data protection controls and
- capabilities.
-
 How to implement Azure SQL Data Discovery:
 
 https://docs.microsoft.com/azure/sql-database/sql-database-data-discovery-and-classification
@@ -90,18 +106,18 @@ How to implement Azure Information Protection:
 
 https://docs.microsoft.com/azure/information-protection/deployment-roadmap
 
-Understand customer data protection in Azure:
-
-https://docs.microsoft.com/azure/security/fundamentals/protection-customer-data
-
-## 4.6: Use Role-based access control to control access to resources
+## 4.6: Use Azure RBAC to control access to resources
 
 | Azure ID | CIS IDs | Responsibility |
 |--|--|--|
 | 4.6 | 14.6 | Customer |
 
 Use Azure AD RBAC to control access to data and resources, otherwise use service specific access control methods.
 
+Understand Azure RBAC:
+
+https://docs.microsoft.com/azure/role-based-access-control/overview
+
 How to configure RBAC in Azure:
 
 https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal
@@ -110,15 +126,9 @@ https://docs.microsoft.com/azure/role-based-access-control/role-assignments-port
 
 | Azure ID | CIS IDs | Responsibility |
 |--|--|--|
-| 4.7 | 14.7 | Shared |
-
-If required for compliance on compute resources, implement a third-party tool, such as an automated host-based Data Loss Prevention solution, to enforce access controls to data even when data is copied off a system.
-
-For the underlying platform which is managed by Microsoft, Microsoft treats all customer content as sensitive and goes to great lengths to guard against customer data loss and exposure. To ensure customer data within Azure remains secure, Microsoft has implemented and maintains a suite of robust data protection controls and capabilities.
+| 4.7 | 14.7 | Customer |
 
-Understand customer data protection in Azure:
-
-https://docs.microsoft.com/azure/security/fundamentals/protection-customer-data
+Implement a third-party tool, such as an automated host-based Data Loss Prevention solution, to enforce access controls to data even when data is copied off a system.
 
 ## 4.8: Encrypt sensitive information at rest
 
@@ -133,6 +143,7 @@ Understand encryption at rest in Azure:
 https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest
 
 How to configure customer managed encryption keys:
+
 https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal
 
 ## 4.9: Log and alert on changes to critical Azure resources
@@ -147,3 +158,6 @@ How to create alerts for Azure Activity Log events:
 
 https://docs.microsoft.com/azure/azure-monitor/platform/alerts-activity-log
 
+## Next steps
+
+See the next security control: [Vulnerability Management](security-control-vulnerability-management.md)

articles/security/benchmarks/security-control-data-recovery.md

@@ -1,17 +1,21 @@
 ---
 title: Azure Security Control - Data Recovery
-description: Azure Security Control Data Recovery
+description: Security Control Data Recovery
 author: msmbaldwin
+manager: rkarlin
+
 ms.service: security
 ms.topic: conceptual
-ms.date: 04/03/2020
+ms.date: 12/30/2019
 ms.author: mbaldwin
-ms.custom: security-benchmark
+ms.custom: security-recommendations
 
 ---
 
 # Security Control: Data Recovery
 
+Ensure that all system data, configurations, and secrets are automatically backed up on a regular basis.
+
 ## 9.1: Ensure regular automated back ups
 
 | Azure ID | CIS IDs | Responsibility |
@@ -21,6 +25,7 @@ ms.custom: security-benchmark
 Enable Azure Backup and configure the backup source (Azure VMs, SQL Server, or File Shares), as well as the desired frequency and retention period.
 
 How to enable Azure Backup:
+
 https://docs.microsoft.com/azure/backup/
 
 ## 9.2: Perform complete system backups and backup any customer managed keys
@@ -32,9 +37,11 @@ https://docs.microsoft.com/azure/backup/
 Enable Azure Backup and target VM(s), as well as the desired frequency and retention periods. Backup customer managed keys within Azure Key Vault.
 
 How to enable Azure Backup:
+
 https://docs.microsoft.com/azure/backup/
 
 How to backup key vault keys in Azure:
+
 https://docs.microsoft.com/powershell/module/azurerm.keyvault/backup-azurekeyvaultkey?view=azurermps-6.13.0
 
 ## 9.3: Validate all backups including customer managed keys
@@ -43,25 +50,28 @@ https://docs.microsoft.com/powershell/module/azurerm.keyvault/backup-azurekeyvau
 |--|--|--|
 | 9.3 | 10.3 | Customer |
 
-Ensure ability to periodically perform data restoration of content within Azure Backup. Test restoration of backed up customer managed keys.
+Ensure ability to periodically perform data restoration of content within Azure Backup. If necessary, test restore to an isolated VLAN. Test restoration of backed up customer managed keys.
+
+How to recover files from Azure Virtual Machine backup:
 
-How to recover files from Azure Virtual Machine backup: https://docs.microsoft.com/azure/backup/backup-azure-restore-files-from-vm
+https://docs.microsoft.com/azure/backup/backup-azure-restore-files-from-vm
 
-How to restore key vault keys in Azure:  https://docs.microsoft.com/powershell/module/azurerm.keyvault/restore-azurekeyvaultkey?view=azurermps-6.13.0
+How to restore key vault keys in Azure:
+
+https://docs.microsoft.com/powershell/module/azurerm.keyvault/restore-azurekeyvaultkey?view=azurermps-6.13.0
 
 ## 9.4: Ensure protection of backups and customer managed keys
 
 | Azure ID | CIS IDs | Responsibility |
 |--|--|--|
 | 9.4 | 10.4 | Customer |
 
-For on-premises backup, encryption-at-rest is provided using the passphrase you provide when backing up to Azure. For Azure VMs, data is encrypted-at-rest using Storage Service Encryption (SSE). Use role-based access control to protect backups and customer managed keys.  
-
-Enable Soft-Delete and purge protection in Key Vault to protect keys against accidental or malicious deletion.  If Azure Storage is used to store backups, enable soft delete to save and recover your data when blobs or blob snapshots are deleted. 
+For on-premises backup, encryption-at-rest is provided using the passphrase you provide when backing up to Azure. For Azure VMs, data is encrypted-at-rest using Storage Service Encryption (SSE). You may enable Soft-Delete in Key Vault to protect keys against accidental or malicious deletion.
 
-Understand Azure RBAC:  https://docs.microsoft.com/azure/role-based-access-control/overview
+How to enable Soft-Delete in Key Vault:
 
-How to enable Soft-Delete and Purge protection in Key Vault:  https://docs.microsoft.com/azure/storage/blobs/storage-blob-soft-delete?tabs=azure-portal
+https://docs.microsoft.com/azure/storage/blobs/storage-blob-soft-delete?tabs=azure-portal
 
-Soft delete for Azure Storage blobs:  https://docs.microsoft.com/azure/storage/blobs/storage-blob-soft-delete?tabs=azure-portal
+## Next steps
 
+See the next security control: [Incident Response](security-control-incident-response.md)