Merge pull request #47775 from TerryLanfear/dec-sec

Dec sec

Author: Ja-Dunn

articles/security-center/media/tutorial-security-policy/tutorial-security-policy-fig1.png

@@ -3,7 +3,7 @@ title: Azure Security Center Tutorial - Define and assess security policies | Mi
 description: Azure Security Center Tutorial - Define and assess security policies
 services: security-center
 documentationcenter: na
-author: terrylan
+author: TerryLanfear
 manager: mbaldwin
 editor: ''
 
@@ -14,12 +14,12 @@ ms.topic: tutorial
 ms.custom: mvc
 ms.tgt_pltfrm: na
 ms.workload: na
-ms.date: 02/22/2018
-ms.author: yurid
+ms.date: 07/30/2018
+ms.author: terrylan
 ---
 
 # Tutorial: Define and assess security policies
-Security Center helps ensure compliance with company or regulatory security requirements by using security policies to define the desired configuration of your workloads. Once you define policies for your Azure subscriptions, and adapt them to the type of workload or the sensitivity of your data, Security Center can provide security recommendations to your compute, networking, SQL & storage, and application resources. In this tutorial, you will learn how to:
+Security Center helps ensure compliance with company or regulatory security requirements by using security policies to define the desired configuration of your workloads. Once you define policies for your Azure subscriptions, and adapt them to the type of workload or the sensitivity of your data, Security Center can provide security recommendations for your compute, application, networking, data & storage, and identity & access resources. In this tutorial, you will learn how to:
 
 > [!div class="checklist"]
 > * Configure security policy
@@ -33,16 +33,20 @@ To step through the features covered in this tutorial, you must be on Security C
 ## Configure security policy
 Security Center automatically creates a default security policy for each of your Azure subscriptions. Security policies are comprised of recommendations that you can turn on or turn off according to the security requirements of that subscription. To make changes to the default security policy, you need to be an owner, contributor, or security administrator of the subscription.
 
-1. At the Security Center main menu, select **Security policy**. Select the subscription that you want to use. Under **POLICY COMPONENTS**, select **Security policy**:
+1. At the Security Center main menu, select **Security policy**.
+2. Select the subscription that you want to use.
 
   ![Security Policy](./media/tutorial-security-policy/tutorial-security-policy-fig1.png)  
 
-2. For each security configuration you want to monitor, select **On**. Security Center will continuously assess the configuration of your environment and when vulnerability exists, Security Center will generate a security recommendation. Select **Off** if the security configuration is not recommended or not relevant. For example, in a dev/test environment you might not require the same level of security as a production environment. After selecting the policies that are applicable to your environment, click **Save**.
+3. Under **POLICY COMPONENTS**, select **Security policy**
+4. For each security configuration you want to monitor, select **On**. Security Center will continuously assess the configuration of your environment and when vulnerability exists, Security Center will generate a security recommendation. Select **Off** if the security configuration is not recommended or not relevant. For example, in a dev/test environment you might not require the same level of security as a production environment. After selecting the policies that are applicable to your environment, click **Save**.
+
+  ![Security configuration](./media/tutorial-security-policy/tutorial-security-policy-fig6.png)  
 
 Wait until Security Center processes these policies and generates recommendations. Some configurations, such as system updates and OS configurations can take up to 12 hours, while network security groups and encryption configurations can be assessed almost instantly. Once you see recommendations in the Security Center dashboard, you can proceed to the next step.
 
 ## Assess security of resources
-1. According to the security policies that were enabled, Security Center will provide a set of security recommendations as needed. You should start by reviewing the virtual machine and computers recommendations. On the Security Center dashboard, click **Overview**, and click **Compute**.
+1. According to the security policies that were enabled, Security Center will provide a set of security recommendations as needed. You should start by reviewing the virtual machine and computers recommendations. On the Security Center dashboard, select **Overview**, and select **Compute & apps**.
 
   ![Compute](./media/tutorial-security-policy/tutorial-security-policy-fig2.png)
 
@@ -52,19 +56,23 @@ Wait until Security Center processes these policies and generates recommendation
 
   ![Networking](./media/tutorial-security-policy/tutorial-security-policy-fig3.png)
 
-  The networking recommendations page has a list of security issues for network configuration, internet facing endpoints, and network topology. Just like **Compute**, some networking recommendations will provide integrated remediation, and some others will not.
+  The networking recommendations page has a list of security issues for network configuration, internet facing endpoints, and network topology. Just like **Compute & apps**, some networking recommendations will provide integrated remediation, and some others will not.
 
-3. Once you address all relevant networking recommendations, you should move on to the next workload: storage & data. On the Security Center dashboard, click **Overview**, and click **Storage & data**.
+3. Once you address all relevant networking recommendations, you should move on to the next workload: storage & data. On the Security Center dashboard, click **Overview**, and click **Data & storage**.
 
   ![Data resources](./media/tutorial-security-policy/tutorial-security-policy-fig4.png)
 
-  The **Data resources** page contains recommendations around enabling auditing for Azure SQL servers and databases, enabling encryption for SQL databases, and enabling encryption of your Azure storage account. If you don’t have these workloads, you will not see any recommendation. Just like **Compute**, some SQL & storage recommendations will provide integrated remediation, and some others will not.
+  The **Data Resources** page contains recommendations around enabling auditing for Azure SQL servers and databases, enabling encryption for SQL databases, and enabling encryption of your Azure storage account. If you don’t have these workloads, you will not see any recommendation. Just like **Compute & apps**, some data & storage recommendations will provide integrated remediation, and some others will not.
+
+4. Once you address all relevant data & storage recommendations, you should move on to the next workload: Identity & access. On the Security Center dashboard, click **Overview**, and click **Identity & access**.
 
-4. Once you address all relevant SQL & storage recommendations, you should move on to the next workload: Applications. On the Security Center dashboard, click **Overview**, and click **Applications**.
+  ![Identity & access](./media/tutorial-security-policy/tutorial-security-policy-fig5.png)
 
-  ![Applications](./media/tutorial-security-policy/tutorial-security-policy-fig5.png)
+  The **Identity & Access** page contains recommendations such as:
 
-  The **Applications** page contains recommendations for web application firewall deployment, and general guidelines for application hardening. If you don’t have virtual machine or computers with web applications running on Internet Information Service (IIS), you will not see these recommendations.
+   - Enable MFA for privileged accounts on your subscription
+   - Remove external accounts with write permissions from your subscription
+   - Remove privileged external accounts from your subscription
 
 ## Clean up resources
 Other quickstarts and tutorials in this collection build upon this quickstart. If you plan to continue on to work with subsequent quickstarts and tutorials, continue running the Standard tier and keep automatic provisioning enabled. If you do not plan to continue or wish to return to the Free tier: