Skip to content

Commit f060948

Browse files
Merge pull request #110185 from msmbaldwin/benchmark
Refreshed Security Benchmark
2 parents 9d2b9dd + d259c48 commit f060948

11 files changed

+327
-562
lines changed
Lines changed: 32 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,12 @@
11
---
22
title: Azure Security Control - Data Protection
3-
description: Security Control Data Protection
3+
description: Azure Security Control Data Protection
44
author: msmbaldwin
5-
manager: rkarlin
6-
75
ms.service: security
86
ms.topic: conceptual
9-
ms.date: 12/30/2019
7+
ms.date: 04/14/2020
108
ms.author: mbaldwin
11-
ms.custom: security-recommendations
9+
ms.custom: security-benchmark
1210

1311
---
1412

@@ -24,53 +22,33 @@ Data protection recommendations focus on addressing issues related to encryption
2422

2523
Use Tags to assist in tracking Azure resources that store or process sensitive information.
2624

27-
How to create and use Tags:
28-
29-
https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags
25+
- [How to create and use Tags](https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags)
3026

3127
## 4.2: Isolate systems storing or processing sensitive information
3228

3329
| Azure ID | CIS IDs | Responsibility |
3430
|--|--|--|
35-
| 4.2 | 13.2 | Customer |
36-
37-
Implement separate subscriptions and/or management groups for development, test, and production. Resources should be separated by VNet/Subnet, tagged appropriately, and secured by an NSG or Azure Firewall. Resources storing or processing sensitive data should be sufficiently isolated. For Virtual Machines storing or processing sensitive data, implement policy and procedure(s) to turn them off when not in use.
38-
39-
How to create additional Azure subscriptions:
40-
41-
https://docs.microsoft.com/azure/billing/billing-create-subscription
42-
43-
How to create Management Groups:
44-
45-
https://docs.microsoft.com/azure/governance/management-groups/create
46-
47-
How to create and use Tags:
48-
49-
https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags
50-
51-
How to create a Virtual Network:
52-
53-
https://docs.microsoft.com/azure/virtual-network/quick-create-portal
54-
55-
How to create an NSG with a Security Config:
31+
| 4.2 | 13.2, 2.10 | Customer |
5632

57-
https://docs.microsoft.com/azure/virtual-network/tutorial-filter-network-traffic
33+
Implement isolation using separate subscriptions and management groups for individual security domains such as environment type and data sensitivity level. You can restrict the level of access to your Azure resources that your applications and enterprise environments demand. You can control access to Azure resources via Azure Active Directory role-based access control.
5834

59-
How to deploy Azure Firewall:
35+
- [How to create additional Azure subscriptions](https://docs.microsoft.com/azure/billing/billing-create-subscription)
6036

61-
https://docs.microsoft.com/azure/firewall/tutorial-firewall-deploy-portal
37+
- [How to create Management Groups](https://docs.microsoft.com/azure/governance/management-groups/create)
6238

63-
How to configure alert or alert and deny with Azure Firewall:
64-
65-
https://docs.microsoft.com/azure/firewall/threat-intel
39+
- [How to create and use tags](https://docs.microsoft.com/azure/azure-resource-manager/resource-group-using-tags)
6640

6741
## 4.3: Monitor and block unauthorized transfer of sensitive information
6842

6943
| Azure ID | CIS IDs | Responsibility |
7044
|--|--|--|
71-
| 4.3 | 13.3 | Customer |
45+
| 4.3 | 13.3 | Shared |
46+
47+
Leverage a third-party solution from Azure Marketplace on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.
48+
49+
For the underlying platform which is managed by Microsoft, Microsoft treats all customer content as sensitive and guard against customer data loss and exposure. To ensure customer data within Azure remains secure, Microsoft has implemented and maintains a suite of robust data protection controls and capabilities.
7250

73-
Deploy an automated tool on network perimeters that monitors for unauthorized transfer of sensitive information and blocks such transfers while alerting information security professionals.
51+
- [Understand customer data protection in Azure](https://docs.microsoft.com/azure/security/fundamentals/protection-customer-data)
7452

7553
## 4.4: Encrypt all sensitive information in transit
7654

@@ -82,53 +60,47 @@ Encrypt all sensitive information in transit. Ensure that any clients connecting
8260

8361
Follow Azure Security Center recommendations for encryption at rest and encryption in transit, where applicable.
8462

85-
Understand encryption in transit with Azure:
86-
87-
https://docs.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit
63+
- [Understand encryption in transit with Azure](https://docs.microsoft.com/azure/security/fundamentals/encryption-overview#encryption-of-data-in-transit)
8864

8965
## 4.5: Use an active discovery tool to identify sensitive data
9066

9167
| Azure ID | CIS IDs | Responsibility |
9268
|--|--|--|
93-
| 4.5 | 14.5 | Customer |
69+
| 4.5 | 14.5 | Shared |
9470

9571
When no feature is available for your specific service in Azure, use a third-party active discovery tool to identify all sensitive information stored, processed, or transmitted by the organization's technology systems, including those located on-site, or at a remote service provider, and update the organization's sensitive information inventory.
9672

9773
Use Azure Information Protection for identifying sensitive information within Office 365 documents.
9874

9975
Use Azure SQL Information Protection to assist in the classification and labeling of information stored in Azure SQL Databases.
10076

101-
How to implement Azure SQL Data Discovery:
102-
103-
https://docs.microsoft.com/azure/sql-database/sql-database-data-discovery-and-classification
77+
- [How to implement Azure SQL Data Discovery](https://docs.microsoft.com/azure/sql-database/sql-database-data-discovery-and-classification)
10478

105-
How to implement Azure Information Protection:
79+
- [How to implement Azure Information Protection](https://docs.microsoft.com/azure/information-protection/deployment-roadmap)
10680

107-
https://docs.microsoft.com/azure/information-protection/deployment-roadmap
81+
- [Understand customer data protection in Azure](https://docs.microsoft.com/azure/security/fundamentals/protection-customer-data)
10882

109-
## 4.6: Use Azure RBAC to control access to resources
83+
## 4.6: Use Role-based access control to control access to resources
11084

11185
| Azure ID | CIS IDs | Responsibility |
11286
|--|--|--|
11387
| 4.6 | 14.6 | Customer |
11488

11589
Use Azure AD RBAC to control access to data and resources, otherwise use service specific access control methods.
11690

117-
Understand Azure RBAC:
118-
119-
https://docs.microsoft.com/azure/role-based-access-control/overview
120-
121-
How to configure RBAC in Azure:
122-
123-
https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal
91+
- [How to configure RBAC in Azure](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal)
12492

12593
## 4.7: Use host-based data loss prevention to enforce access control
12694

12795
| Azure ID | CIS IDs | Responsibility |
12896
|--|--|--|
129-
| 4.7 | 14.7 | Customer |
97+
| 4.7 | 14.7 | Shared |
98+
99+
If required for compliance on compute resources, implement a third-party tool, such as an automated host-based Data Loss Prevention solution, to enforce access controls to data even when data is copied off a system.
130100

131-
Implement a third-party tool, such as an automated host-based Data Loss Prevention solution, to enforce access controls to data even when data is copied off a system.
101+
For the underlying platform which is managed by Microsoft, Microsoft treats all customer content as sensitive and goes to great lengths to guard against customer data loss and exposure. To ensure customer data within Azure remains secure, Microsoft has implemented and maintains a suite of robust data protection controls and capabilities.
102+
103+
- [Understand customer data protection in Azure](https://docs.microsoft.com/azure/security/fundamentals/protection-customer-data)
132104

133105
## 4.8: Encrypt sensitive information at rest
134106

@@ -138,13 +110,9 @@ Implement a third-party tool, such as an automated host-based Data Loss Preventi
138110

139111
Use encryption at rest on all Azure resources. Microsoft recommends allowing Azure to manage your encryption keys, however there is the option for you to manage your own keys in some instances.
140112

141-
Understand encryption at rest in Azure:
142-
143-
https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest
144-
145-
How to configure customer managed encryption keys:
113+
- [Understand encryption at rest in Azure](https://docs.microsoft.com/azure/security/fundamentals/encryption-atrest)
146114

147-
https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal
115+
- [How to configure customer managed encryption keys](https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal)
148116

149117
## 4.9: Log and alert on changes to critical Azure resources
150118

@@ -154,10 +122,9 @@ https://docs.microsoft.com/azure/storage/common/storage-encryption-keys-portal
154122

155123
Use Azure Monitor with the Azure Activity Log to create alerts for when changes take place to critical Azure resources.
156124

157-
How to create alerts for Azure Activity Log events:
125+
- [How to create alerts for Azure Activity Log events](https://docs.microsoft.com/azure/azure-monitor/platform/alerts-activity-log)
158126

159-
https://docs.microsoft.com/azure/azure-monitor/platform/alerts-activity-log
160127

161128
## Next steps
162129

163-
See the next security control: [Vulnerability Management](security-control-vulnerability-management.md)
130+
- See the next Security Control: [Vulnerability Management](security-control-vulnerability-management.md)
Lines changed: 18 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,12 @@
11
---
22
title: Azure Security Control - Data Recovery
3-
description: Security Control Data Recovery
3+
description: Azure Security Control Data Recovery
44
author: msmbaldwin
5-
manager: rkarlin
6-
75
ms.service: security
86
ms.topic: conceptual
9-
ms.date: 12/30/2019
7+
ms.date: 04/14/2020
108
ms.author: mbaldwin
11-
ms.custom: security-recommendations
9+
ms.custom: security-benchmark
1210

1311
---
1412

@@ -24,9 +22,7 @@ Ensure that all system data, configurations, and secrets are automatically backe
2422

2523
Enable Azure Backup and configure the backup source (Azure VMs, SQL Server, or File Shares), as well as the desired frequency and retention period.
2624

27-
How to enable Azure Backup:
28-
29-
https://docs.microsoft.com/azure/backup/
25+
- [How to enable Azure Backup](https://docs.microsoft.com/azure/backup/)
3026

3127
## 9.2: Perform complete system backups and backup any customer managed keys
3228

@@ -36,42 +32,39 @@ https://docs.microsoft.com/azure/backup/
3632

3733
Enable Azure Backup and target VM(s), as well as the desired frequency and retention periods. Backup customer managed keys within Azure Key Vault.
3834

39-
How to enable Azure Backup:
40-
41-
https://docs.microsoft.com/azure/backup/
35+
- [How to enable Azure Backup](https://docs.microsoft.com/azure/backup/)
4236

43-
How to backup key vault keys in Azure:
44-
45-
https://docs.microsoft.com/powershell/module/azurerm.keyvault/backup-azurekeyvaultkey?view=azurermps-6.13.0
37+
- [How to backup key vault keys in Azure](https://docs.microsoft.com/powershell/module/azurerm.keyvault/backup-azurekeyvaultkey?view=azurermps-6.13.0)
4638

4739
## 9.3: Validate all backups including customer managed keys
4840

4941
| Azure ID | CIS IDs | Responsibility |
5042
|--|--|--|
5143
| 9.3 | 10.3 | Customer |
5244

53-
Ensure ability to periodically perform data restoration of content within Azure Backup. If necessary, test restore to an isolated VLAN. Test restoration of backed up customer managed keys.
54-
55-
How to recover files from Azure Virtual Machine backup:
45+
Ensure ability to periodically perform data restoration of content within Azure Backup. Test restoration of backed up customer managed keys.
5646

57-
https://docs.microsoft.com/azure/backup/backup-azure-restore-files-from-vm
47+
- [How to recover files from Azure Virtual Machine backup](https://docs.microsoft.com/azure/backup/backup-azure-restore-files-from-vm)
5848

59-
How to restore key vault keys in Azure:
60-
61-
https://docs.microsoft.com/powershell/module/azurerm.keyvault/restore-azurekeyvaultkey?view=azurermps-6.13.0
49+
- [How to restore key vault keys in Azure](https://docs.microsoft.com/powershell/module/azurerm.keyvault/restore-azurekeyvaultkey?view=azurermps-6.13.0)
6250

6351
## 9.4: Ensure protection of backups and customer managed keys
6452

6553
| Azure ID | CIS IDs | Responsibility |
6654
|--|--|--|
6755
| 9.4 | 10.4 | Customer |
6856

69-
For on-premises backup, encryption-at-rest is provided using the passphrase you provide when backing up to Azure. For Azure VMs, data is encrypted-at-rest using Storage Service Encryption (SSE). You may enable Soft-Delete in Key Vault to protect keys against accidental or malicious deletion.
57+
For on-premises backup, encryption-at-rest is provided using the passphrase you provide when backing up to Azure. For Azure VMs, data is encrypted-at-rest using Storage Service Encryption (SSE). Use role-based access control to protect backups and customer managed keys.
58+
59+
Enable Soft-Delete and purge protection in Key Vault to protect keys against accidental or malicious deletion. If Azure Storage is used to store backups, enable soft delete to save and recover your data when blobs or blob snapshots are deleted.
60+
61+
- [Understand Azure RBAC](https://docs.microsoft.com/azure/role-based-access-control/overview)
62+
63+
- [How to enable Soft-Delete and Purge protection in Key Vault](https://docs.microsoft.com/azure/storage/blobs/storage-blob-soft-delete?tabs=azure-portal)
7064

71-
How to enable Soft-Delete in Key Vault:
65+
- [Soft delete for Azure Storage blobs](https://docs.microsoft.com/azure/storage/blobs/storage-blob-soft-delete?tabs=azure-portal)
7266

73-
https://docs.microsoft.com/azure/storage/blobs/storage-blob-soft-delete?tabs=azure-portal
7467

7568
## Next steps
7669

77-
See the next security control: [Incident Response](security-control-incident-response.md)
70+
- See the next Security Control: [Incident Response](security-control-incident-response.md)

0 commit comments

Comments
 (0)