Azure Security Handbook: A Comprehensive Guide for Defending Your Enterprise Environment

Table of Contents
About the Author
About the Technical Reviewer
Acknowledgments
Foreword
Introduction
Chapter 1: Introduction to Cloud Security Architecture
	Cloud Security Responsibilities
		Shared Responsibility Model
		Shifting Security Left
	Cloud-Native Security
		Multi-cloud or Cloud-Native Security?
		Cloud Security Architecture
		Azure Security Building Blocks
		Landing Zone Security
			Identity and Access Management
			Detection and Monitoring
			Network Security
	Cloud Security Framework
		Cloud Control Frameworks
		Building Your Cloud Security Framework
	Summary
Chapter 2: Identity and Access Management
	Azure Active Directory
		Overview of Azure Active Directory
		Identity Sources
		Relationship Between Azure Active Directory and Azure
		Intelligent Security Graph
		Conditional Access
		Securing Your Azure AD
			Directory Splitting
			Guest Management
			Default Access Management
			Privileged Access Management
			Conditional Access Policies
	Authorization: Azure Role-Based Access Control
		Scope
		Identity
		Role
			Role Definition
			Built-In Roles
				General Built-In Roles
				Service-Specific Built-In Roles
			Custom Roles
				Account Manipulation
		Azure AD Administrative Roles
		Assignment Life cycle
		Policies
			Policy Effects
		Locks
	Managed Identities and Service Principals
	Access Control Throughout the Secure Development Life cycle
		Developer Sandbox Access
		Continuous Deployment Pipeline Access
	Summary
Chapter 3: Logging and Monitoring
	Platform Monitoring
		Activity Logs
			Administrative Activity Logs
				Activity Logs: Authorization
			Service Health
			Security
			Policy
		Deployment History
		Azure AD Monitoring
	Infrastructure Monitoring
	Application Monitoring
	Centralized Log Architecture
		Enterprise Environment Considerations
		Securing the Centralized Log Store
		Complex Environments
	Security Posture Monitoring
		Security Posture Monitoring Using Azure Security Center
			Security Policy Initiatives
			Security Policy Architecture at Scale
		Change Tracking of Security Policies
			Azure Tenant Security Scan
	Summary
Chapter 4: Network Security
	Azure Virtual Networks
		Microsoft Global Network
		IP Addresses in Azure
		Azure Virtual Network
	Network Controls for Infrastructure as a Service
		Network Security Groups
		Securing Administrative Access to Virtual Machines
		Securing Outbound Access from Virtual Machines
	Network Controls for Platform as a Service
		Application PaaS Networking
			Controlling Inbound Traffic to App Service
			Controlling Outbound Traffic from App Service
			Cross-Network Connectivity
		Network Controls for Data Platform as a Service
			Storage Account Firewall
			Azure Monitor Network Isolation
		Private Endpoints
	Azure Firewalls
		Azure Web Application Firewall
	Network Monitoring
		Logs Supporting Forensic Investigation
		Alternative Network Monitoring
	Cloud Adoption Framework
	Summary
Chapter 5: Workload Protection – Data
	Azure Key Vault
		Access Control
		Network
		Logging
		Best Practices
	Azure Blob Storage
		Access Control
			Data-Plane Role-Based Access Control
			Shared Key Access
			Delegated Access
			Anonymous Access
		Network
		Logging
		Backup and Disaster Recovery
		Best Practices
	Azure SQL Database
		Access Control
			SQL Authentication
			Azure AD Authentication
			Authorization
			Control-Plane Role-Based Access Control Roles
		Network
		Logging
		Backup and Disaster Recovery
		Best Practices
	Summary
Chapter 6: Workload Protection – Platform as a Service
	Azure App Service
		Access Control
		Built-In Authentication
		Storage Access
		API Access
		Key Vault access
		Network
			Controlling Inbound Traffic to App Service
			Controlling Outbound Traffic
			Web Application Firewall
			Encryption in Transit
		Logging
	Azure Functions
		Access Control
		Network
		Logging
	Best Practices for Azure Compute PaaS
	Summary
Chapter 7: Workload Protection – Containers
	Container Security
		Build Security
		Registry Security
		Runtime Security
	Azure Container Registry
		Access Control
			Data-Plane Role-Based Access Control
			Access Control Without Azure Active Directory
		Network
		Logging
		Best Practices
			Encryption at Rest
			Automate Base Image Updates
			Image Signing
			High Availability
	Azure Container Instance
		Access Control
		Network
		Logging
	Azure Kubernetes Service
		Access Control
			Azure RBAC
			Azure Active Directory Authentication and Kubernetes RBAC
		Network
			Kubernetes Control Plane Network Controls
			Application Network Controls
		Logging
		Best Practices
	Summary
Chapter 8: Workload Protection – IaaS
	Access Control
		Azure Role-Based Access Control
		Automation Access
		Virtual Machine Login Access
	Network Controls
		Self-Managed Virtual Machines
		Centrally Managed Virtual Machines
		Web Application Access
	Monitoring and Detection
		Vulnerability Management
		Endpoint Protection
		Azure Defender Alerts
	Backup and Disaster Recovery
	Guest Operating System Management
		Operating System Image Management
		Self-Managed Patching
		Centrally Managed Patching
	Summary
Index