Merge pull request #49518 from ShawnKupfer/WB1716

AB#1023963: Top 5 security items to consider before pushing to produc…

Author: JamesJBarnett

learn-pr/advocates/top-5-security-items-to-consider/1-introduction.yml

@@ -5,8 +5,8 @@ metadata:
   title: Introduction
   description: Introduction
   author: patridge
-  ms.author: adpatrid
-  ms.date: 05/26/2023
+  ms.author: robmcm
+  ms.date: 03/14/2025
   ms.topic: unit
 durationInMinutes: 2
 content: |

learn-pr/advocates/top-5-security-items-to-consider/2-azure-security-center.yml

@@ -5,8 +5,8 @@ metadata:
   title: Microsoft Defender for Cloud
   description: Microsoft Defender for Cloud
   author: patridge
-  ms.author: adpatrid
-  ms.date: 05/26/2023
+  ms.author: robmcm
+  ms.date: 03/14/2025
   ms.topic: unit
 durationInMinutes: 15
 content: |

learn-pr/advocates/top-5-security-items-to-consider/3-inputs-and-outputs.yml

@@ -5,8 +5,8 @@ metadata:
   title: Inputs and Outputs
   description: Inputs and Outputs
   author: patridge
-  ms.author: adpatrid
-  ms.date: 05/26/2023
+  ms.author: robmcm
+  ms.date: 03/14/2025
   ms.topic: unit
 durationInMinutes: 10
 content: |
@@ -15,44 +15,44 @@ quiz:
   title: Check your knowledge
   questions:
 
-  - content: 'Which of the following data sources need to be validated?'
+  - content: "Which of the following data sources need to be validated?"
     choices:
-    - content: 'Data from a 3rd party API'
+    - content: "Data from a third-party API"
       isCorrect: false
-      explanation: 'This is just one of many sources that needs to be validated.'
-    - content: 'Data from the URL parameter'
+      explanation: "This is just one of many sources that needs to be validated."
+    - content: "Data from the URL parameter"
       isCorrect: false
-      explanation: 'This is just one of many sources that needs to be validated'
-    - content: 'Data collected from the user via an input field'
+      explanation: "This is just one of many sources that needs to be validated."
+    - content: "Data collected from the user via an input field"
       isCorrect: false
-      explanation: 'This is just one of many sources that needs to be validated.'
-    - content: 'All of the above'
+      explanation: "This is just one of many sources that needs to be validated."
+    - content: "All of the above"
       isCorrect: true
-      explanation: 'All these sources of data need to be validated. Never trust any data that could have been modified.'
+      explanation: "All these sources of data need to be validated. Never trust any data that could have been modified."
 
-  - content: 'Parameterized queries (stored procedures in SQL) are a secure way to talk to the database because:'
+  - content: "Parameterized queries (stored procedures in SQL) are a secure way to talk to the database because:"
     choices:
-    - content: 'They're more organized than inline database commands, and therefore less confusing for users.'
+    - content: "They're more organized than inline database commands, and therefore less confusing for users."
       isCorrect: false
-      explanation: 'Organization of the code is not the reason that parameterized queries are more secure than inline SQL.'
-    - content: 'There's a clear outline of the script in the stored procedure, ensuring better visibility.'
+      explanation: "Organization of the code isn't the reason that parameterized queries are more secure than inline SQL."
+    - content: "There's a clear outline of the script in the stored procedure, ensuring better visibility."
       isCorrect: false
-      explanation: 'Clear outline of the script is not the reason that parameterized queries are more secure than inline SQL.'
-    - content: 'Parameterized queries substitute variables before running queries, meaning it avoids the opportunity for code to be submitted in place of a variable.'
+      explanation: "Clear outline of the script isn't the reason that parameterized queries are more secure than inline SQL."
+    - content: "Parameterized queries substitute variables before running queries, meaning it avoids the opportunity for code to be submitted in place of a variable."
       isCorrect: true
-      explanation: 'Parameter fields used in parameterized queries are treated as data, not code, protecting against injection vulnerabilities. For more information on how to implement parameterized queries please see the [OWASP Query Parameterization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html).'
+      explanation: "Parameter fields used in parameterized queries are treated as data, not code, protecting against injection vulnerabilities. For more information on how to implement parameterized queries please see the [OWASP Query Parameterization Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html)."
 
-  - content: 'Which of the following data needs to be output encoded?'
+  - content: "Which of the following data needs to be output encoded?"
     choices:
-    - content: 'Data saved to the database'
+    - content: "Data saved to the database"
       isCorrect: false
-      explanation: 'Although data saved to the database needs to be validated to ensure the data is good, we don't need to encode it for output.'
-    - content: 'Data to be output to the screen'
+      explanation: "Although data saved to the database needs to be validated to ensure the data is good, we don't need to encode it for output."
+    - content: "Data to be output to the screen"
       isCorrect: true
-      explanation: 'Data sent to the screen needs to be output encoded to ensure it's never interpreted as code.'
-    - content: 'Data sent to a 3rd party API'
+      explanation: "Data sent to the screen needs to be output encoded to ensure it's never interpreted as code."
+    - content: "Data sent to a third-party API"
       isCorrect: false
-      explanation: 'Although data sent to a 3rd party API needs to be validated to ensure the data is good, we don't need to encode it for output.'
-    - content: 'Data in the URL parameters'
+      explanation: "Although data sent to a third-party API needs to be validated to ensure the data is good, we don't need to encode it for output."
+    - content: "Data in the URL parameters"
       isCorrect: false
-      explanation: 'Although data from URL Parameters needs to be validated before it's used in our application, we don't need to encode it for output.'
+      explanation: "Although data from URL Parameters needs to be validated before it's used in our application, we don't need to encode it for output."

learn-pr/advocates/top-5-security-items-to-consider/4-secrets-in-key-vault.yml

@@ -5,8 +5,8 @@ metadata:
   title: Secrets in Key Vault
   description: Secrets in Key Vault
   author: patridge
-  ms.author: adpatrid
-  ms.date: 05/26/2023
+  ms.author: robmcm
+  ms.date: 03/14/2025
   ms.topic: unit
 durationInMinutes: 5
 content: |

learn-pr/advocates/top-5-security-items-to-consider/5-framework-updates.yml

@@ -5,8 +5,8 @@ metadata:
   title: Framework Updates
   description: Framework Updates
   author: patridge
-  ms.author: adpatrid
-  ms.date: 05/26/2023
+  ms.author: robmcm
+  ms.date: 03/14/2025
   ms.topic: unit
 durationInMinutes: 7
 content: |

learn-pr/advocates/top-5-security-items-to-consider/6-safe-dependencies.yml

@@ -5,8 +5,8 @@ metadata:
   title: Safe Dependencies
   description: Safe Dependencies
   author: patridge
-  ms.author: adpatrid
-  ms.date: 05/26/2023
+  ms.author: robmcm
+  ms.date: 03/14/2025
   ms.topic: unit
 durationInMinutes: 5
 content: |

learn-pr/advocates/top-5-security-items-to-consider/7-conclusion.yml

@@ -5,8 +5,8 @@ metadata:
   title: Conclusion
   description: Conclusion
   author: patridge
-  ms.author: adpatrid
-  ms.date: 05/26/2023
+  ms.author: robmcm
+  ms.date: 03/14/2025
   ms.topic: unit
 durationInMinutes: 1
 content: |

learn-pr/advocates/top-5-security-items-to-consider/includes/2-azure-security-center.md

@@ -15,9 +15,9 @@ Defender for Cloud is part of the [Center for Internet Security](https://www.cis
 
 ## Activating Microsoft Defender for Cloud
 
-Microsoft Defender for Cloud provides unified security management and advanced threat protection for hybrid cloud workloads and is offered in several plans. The Foundational Cloud Security Posture Management (CSPM) plan, which is free and activated by default provides security policies, assessments, and recommendations. The Defender CSPM plan provides a robust set of features, including threat intelligence. There are also plans for Servers, App Service, and more.
+Microsoft Defender for Cloud provides unified security management and advanced threat protection for hybrid cloud workloads, and is offered in several plans. The Foundational Cloud Security Posture Management (CSPM) plan, which is free and activated by default provides security policies, assessments, and recommendations. The Defender CSPM plan provides a robust set of features, including threat intelligence. There are also plans for Servers, App Service, and more.
 
-Given the benefits of Defender for Cloud, the security team at your company has decided that it will be turned on for all subscriptions at your office. You got an email this morning to turn it on for your applications, so let's look at how to do that.
+Given the benefits of Defender for Cloud, your company's security team has decided to turn it on for all subscriptions at your office. You got an email this morning to turn it on for your applications, so let's look at how to do that.
 
 > [!IMPORTANT]
 > Microsoft Defender for Cloud is not supported in the free Azure sandbox. You can perform these steps in your own subscription, or just follow along to understand how to activate Defender for Cloud.
@@ -26,7 +26,7 @@ Given the benefits of Defender for Cloud, the security team at your company has
 
    ![Screenshot showing the All services pane with Defender for Cloud highlighted.](../media/2-ASC-Menu.png)
 
-1. If you've never opened Defender for Cloud, the pane will start on the **Getting started** entry which might ask you to upgrade your subscription. Ignore that for now; select **Skip** at the bottom of the page, then select **Overview**.
+1. If you've never opened Defender for Cloud, the pane starts on the **Getting started** entry, which might ask you to upgrade your subscription. Ignore that for now; select **Skip** at the bottom of the page, then select **Overview**.
     - This will display the "big security picture" across all the elements available in your subscription.
     - This has a ton of great information you can explore.
 
@@ -36,7 +36,7 @@ Given the benefits of Defender for Cloud, the security team at your company has
 
 ### Foundational CSPM vs. Defender CSPM pricing tier
 
-While you can use a free Azure subscription tier with Defender for Cloud, it's limited to assessments and recommendations of Azure resources only. To really leverage Defender for Cloud, you will need to upgrade to a Defender CSPM subscription as shown previously. You can upgrade your subscription through the **Upgrade** button on the **Getting Started** pane in the Defender for Cloud menu, which will walk you through changing your subscription level. The pricing and features may change based on the region, you can get a full overview on the [pricing page](https://azure.microsoft.com/pricing/details/security-center/).
+Although you can use a free Azure subscription tier with Defender for Cloud, it's limited to assessments and recommendations of Azure resources only. To really leverage Defender for Cloud, you'll need to upgrade to a Defender CSPM subscription as shown previously. You can upgrade your subscription through the **Upgrade** button on the **Getting Started** pane in the Defender for Cloud menu, which will walk you through changing your subscription level. The pricing and features might change based on the region; you can get a full overview on the [pricing page](https://azure.microsoft.com/pricing/details/defender-for-cloud/).
 
 > [!NOTE]
 > To upgrade a subscription to the Defender CSPM tier, you must be assigned the role of Subscription Owner, Subscription Contributor, or Security Admin.
@@ -46,22 +46,22 @@ While you can use a free Azure subscription tier with Defender for Cloud, it's l
 
 ## Turning off Microsoft Defender for Cloud
 
-For production systems, you definitely want to keep Microsoft Defender for Cloud turned on so it can monitor all your resources for threats. However, if you're just playing with Defender for Cloud and turned it on, you will likely want to disable it to ensure you're not charged. Let's do that now.
+For production systems, you definitely want to keep Microsoft Defender for Cloud turned on so it can monitor all your resources for threats. However, if you're just playing with Defender for Cloud and turned it on, you'll likely want to disable it to ensure you're not charged. Let's do that now.
 
 1. Open the [Azure portal](https://portal.azure.com?azure-portal=true) and select **Microsoft Defender for Cloud** from the left-hand menu. If you don't see it there, you can select **All services** and find **Microsoft Defender for Cloud** in the security section as shown in the following image:
 
     ![Screenshot showing the All services pane with Defender for Cloud highlighted.](../media/2-ASC-Menu.png)
 
-1. Select **Environment settings** from the left-hand menu.
+1. Select **Environment settings** under **Management** in the left-hand menu.
 
-1. Next, select the ellipses next to the subscription for which you want to downgrade, then select **Edit settings**.
+1. Next, select the ellipses next to the subscription you want to downgrade, then select **Edit settings**.
 
 1. A new page will appear that looks like the image below. Toggle the **Defender CSPM** plan to **Off**.
 
     ![Screenshot showing Foundational CSPM and Defender CSPM options.](../media/2-Pricing-Tier.png)
 
-1. Press the **Save** button at the top of the screen.
+1. Select the **Save** button at the top of the screen.
 
-You have now downgraded your subscription to the free tier of Microsoft Defender for Cloud.
+You've now downgraded your subscription to the free tier of Microsoft Defender for Cloud.
 
-Congratulations, you have taken your first (and most important) step to securing your application, data and network!
+Congratulations, you've taken your first (and most important) step to securing your application, data and network!