- [Narrator] Microsoft clearly recognizes the importance
of applying proper security settings
to the resources that you have in your Azure infrastructure.
As well, they recognize the importance
of early detection of issues when they do occur.
Also, Microsoft understands that
there are a number of configuration options
that you can apply and a large number
of settings and objects that you need to manage
as part of your Azure infrastructure.
Therefore, it now provides you a tool
that allows you to detect any security issues
or poor security configurations
that you currently have in your environment,
and recommend options and remediations
in order to ensure that your environment
is as secure as possible.
There are two main portals that we can use to both
detect and resolve security issues in our infrastructure.
The first is available through the Azure portal,
and the second is available through
the Office 365 admin center.
So let's start with the security center,
which is available through the Azure portal.
So if I click on "Security Center" on the left,
I will see my security center dashboard open up.
Now the first page in the dashboard
are various tiles that provide initial detection
of issues that occur in my environment
or recommendations for changes in my environment
to improve the security settings.
Now, I have to be honest and say that
some of these recommendations are actually,
hey, upgrade to a more costly subscription,
or deploy an option that is actually
gonna cost you a little bit more.
Also, you might notice that some
of these advanced security settings
are only available in the upper-end tiers
of subscriptions of Office 365 or Azure.
So, for example, here under my overview tile,
I have two recommendations, or two
active recommendations for changes.
When I click on that button,
I notice that my subscription is highlighted,
and there is one that has a severity of "High"
and the second one is a severity of "Medium".
Now, the "medium" severity is just
about adding contact to detail
or security contact details in the event of an emergency,
which is an easy thing to do and is not costly.
However, the second is to enable
advanced security for subscription.
Now, enabling advanced security requires me
to upgrade my subscription, and additional cost.
So I'm gonna go back to my initial portal here,
and I'm just gonna show you some of the more relevant
changes or options that I have here.
First is the security policy.
Now security policy allows you to define
some automatic provisioning for some of your servers
or resources that you have in your infrastructure.
So you can ensure that your devices,
such as servers, can be provisioned with an agent,
and that agent will communicate back to Azure,
allowing it to detect any of its configuration
that are poorly made towards a security good practice.
Now, security policies are not enabled by default.
You see here that my automatic provisioning is off,
but I can turn it on and, again,
there are some costs associated to that,
which is why the type of subscription
that I have is highlighted immediately.
Now if I go under "Events", I can see things
such as an event dashboard, and here I
will be notified in the event of various events
that have triggered security issues.
If I go down the list here under "Prevention",
I have "Security solutions".
Now, security solutions allow me to
actually enhance, again, my subscription,
and one of the things that I can enhance this with
is the ability to detect non-Azure computers,
so, again, computers that are not
part of my Azure infrastructure,
and have them also detected as part
of my security recommendations.
So Microsoft will deploy an agent,
that agent will then report data back to Azure
that will then analyze that data
to provide security recommendations.
And I can do that for my virual machines,
I can do that for my computers,
I can also do that for all of my other resources in Azure,
such as my networking configurations,
my storage, such as my storage accounts, and so on.
So all of the resources that you have in Azure
that you will look at during the course of these videos,
and that are specifically focused
on security settings or that must be secured,
well we can have recommendations here
that tell us how they should be secured,
or, if they are already secured, whether or not
those security configurations have been properly applied.
One of these security settings
that is quite interesting and also relatively new
is "Just in time Virtual Machine access".
Now, "Just in time Virtual Machine access"
is not a feature that is enabled by default,
but that is available, that allows you to provide
just in time access to your virtual machine.
Now we've discussed earlier in the course
the defense in depth approach, or ensuring
that all the various layers that I have
between my access of my users and accessing the resources,
there are multiples layers in ensuring
that each one of those layers is properly secured.
Well, to enhance and to again go within that vein
of a defense in depth approach,
"Just in time VM access" will allow you
to define rules that will open up a port
or a communication protocol to a virtual machine
when a user requires it, based on a rule.
And then, as soon as the user closes the connection,
that port is then deactivated,
and therefore the network access is cut off.
And so this prevents a brute force attack
on a server where someone will just continuously
try to attack a server on a known port,
an open port, or an open protocol.
In this case, a communication will
completely be blocked, and it's just like
if somebody disconnected the wire.
So "Just in time Virtual Machine access"
is one of these enhanced security functionality
for very secured virtual machine.
This is not a solution that fits all virtual machines
or all servers hosted in Azure,
but you would consider that for
some highly secured and virtual machines.