Security & Governance – Cloud Marathoner's Journey

Check out the Building Privacy-Enhancing Cloud Workflows with Confidential Computing session with Ridwan Badmus

Greeting to all #Cloudmarathoners!

In this first week of October, we had an interesting session to explore privacy and confidential computing from an engineering perspective.

FOCUS OF THE SESSION

Our speaker focused on some hidden details of Implementing Confidential Computing, namely learn how to leverage Trusted Execution Environments (TEEs) to build secure and privacy-conscious cloud workflows. Ridwan also emphasized aligning Governance with Privacy Regulations, as well as discovering strategies to ensure your cloud governance practices comply with evolving data privacy regulations.

In addition, he expanded topic with optimizing Cloud Investments by exploring how enhanced data security and minimized compliance risks can optimize outputs from your cloud investments.

Thank you, Ridwan!

Ridwan Badmus is a lawyer and privacy engineer who is interested to help customers. He has legal and as well as engineering experience to help in these matters. Thus, feel free to connect with him on LinkedIn if you have any inquiries.

what is next?

If you would like further to explore this topic then you are encouraged to check the following resources:

Recorded Session

If you are intrigued to watch the entire session, then please visit the following YouTube link below on our Cloud Lunch and Learn channel.

Join the session on How to secure small business in an hour with Cloud Marathoner and Tomasz

Hello Cloud Marathoner friends,

This week, we had an exciting session about what steps you could take in securing your environments for small businesses.

What was the focus of the session?

In this session, we had a conversation with Tomasz, who spoke and demonstrated tips and tricks for making significant and essential changes to secure your environments since the early days of inception.

Several Microsoft and Azure services have been used effectively in this session, which covered; Microsoft Entra ID, Intune, and Defender for Endpoint as your best friends when securing a small business company.

the Question that every SMB asks

A common question is: What is the critical setup to get the best result as soon as possible?

“In the beginning, we don’t need to build sophisticated solutions; there are some standard settings and recommendations to put in place to make significant steps forward for a good, secure posture.”

Thank you, Tomasz!

Tomasz Szulczewski is an ORS Microsoft 365 Cybersecurity Architect with extensive experience with Microsoft products and services. He has been in love with information technology for over 25 years, but still has an IT passion and feels like a geek.

He is a Microsoft 365 architect/cyber security guy and a curious problem solver who thinks that not all people must be IT experts.

Recorded Session

If you are intrigued to watch the entire session, then please visit the following YouTube link below on our Cloud Lunch and Learn channel.

[Book Review] What you need to know about Cloud Native Software Security Handbook

Hello, Cloud Marathoners!

A couple of days ago, I received a book from Packt – “Cloud Native Software Security Handbook”, authored by Mihir Shah and in this post, I will review and share my observations and impressions with the #cloud #community.

This book starts covering the Foundations of Cloud Native by exploring the tools and platforms offered by CNCF while providing a high-level stage for the rest of the book. Subsequently, the author dives into explaining AppSec culture and how to approach security implementation in cloud-native environments primarily using toolings like K8S, Calico, K9s, Falco, OPA Gateway, and others which I will be mentioning below.

I liked the Cloud Security Operation chapter where open-source tooling sets like Elasticsearch, Fluentd, Kibana, Prometheus, Helm, and K8S have been used to streamline security operations with automation playbooks to minimize human interventions and errors.

In addition, this book covers legal, compliance, and vendor management aspects of cloud-native software security by emphasizing its hidden cost and importance as important as mastering technical skills.

This book also provides code samples, available for online access which is a big plus.

My suggestion would be the addition of more advanced use cases and code samples in the second edition of this book.

Did you read any related book recently that made an impact on you
Please, share your feedback in the comments

Please, check my LinkedIn post to share your feedback. Thanks!

What services you could use to apply Zero Trust principles in your cloud environment

Hello Cloud Marathoners!

We live in a rapidly evolving security landscape with new challenges every day. Even after the pandemic, our work continues to be blended with remote work where many organizations enabled the BYOD policies to increase productivity of the people.

Growing landscape of cybersecurity attacks

Relaxed controls on IT assets, welcomed potential vulnerabilities, and attack surfaces are also expanded adding layers of complexity to corporate IT to perform their task to defend and enable organizational services.

Zero Trust model aligned services

Zero Trust model offered by leading industry players like Microsoft offers comprehensive solutions to our security challenges. Let’s consider those services and their benefits that are listed below:

Security Posture Management
It is enhanced with Azure Policy and Azure Blueprints by defining and enforcing compliance and control guardrails on Azure resources

Identities
Are strengthened using Entra ID (aka, Azure AD) providing robust authentication and authorization.

Endpoint Management
Services like Microsoft Intune and Entra ID Join manage the corporate and BYOD devices with strict compliance

Web App protection
Azure Defender for Cloud & Azure Web Application Firewall (WAF) protects app services by using bleeding-edge security features

Data security
Remains top priority in transit and rest with advanced security features of Azure Storage services by providing encrypted, reliable, and scalable solutions

Infrastructure security
Secrets and certificates are protected with Azure Key Vault services and Microsoft Defender for Cloud offers comprehensive threat protection from day zero

Network Security
Azure network services like Azure Firewall and Virtual Networks are ensuring traffic is secure and segmented

Conditional Access & Controls
App and data access is guarded by Microsoft Defender for Cloud Apps and Conditional Access services by enforcing specific access controls and providing visibility of your SaaS app landscape to help protect your apps.

Modern SIEM and SOAR solution
The Azure Sentinel stands as a cloud-native solution that combines capabilities by centralizing threat detection and response.

In Summary

In summary, Microsoft Azure provides tools and services that are specifically designed to address growing concerns of vulnerabilities that your IT and Security team are tasked to deal with by following Zero Trust principles.

[ Credit] Microsoft Zero Trust & Conditional Access docs

Subscribe to the #cloudmarathoner LinkedIn #tag
Stay tuned for more Cloud, Automation & Security-related posts.

Fᴏʟʟᴏᴡ ᴍᴇ ᴀɴᴅ become ᴀ #cloudmarathoner – 𝐋𝐄𝐓’𝐒 𝐂𝐎𝐍𝐍𝐄𝐂𝐓

Check out the LinkedIn post https://www.linkedin.com/posts/elkhanyusubov_cloudmarathoner-tag-cloudmarathoner-activity-7106249128782749696-4k0j #sharingiscaring

How could you easily create new pre-configured Azure subscriptions that meet your organization’s specific needs

Hello, dear #CloudMarathoner community!

If you have been implementing your customers with the management of enterprise subscriptions and policies, then it is a pretty common need to automate the provisioning of those subscriptions in a controlled and secure manner.

The good news is that you don’t have to reinvent the wheel and do everything from scratch. The Microsoft team that is behind the Azure Landing Zones implementation has a good reference that could tremendously help you.

Microsoft Global Customer Success team

Have you ever checked the subscription vending IaC Modules from the Microsoft Global Customer Success team (the same team behind Azure Landing Zones)?

Subscription Vending IaC Modules

Well, if not then Subscription Vending IaC Modules are available for you in two popular infrastructure-as-code (IaC) tools: Bicep and Terraform.
AND designed to help you implement the best practices for subscription provisioning.

Why use these modules?

Using these modules, you can quickly and easily provision new Azure subscriptions that are pre-configured to meet your organization’s specific needs. The modules include parameters/variables for Role-Based Access Control, Networking, Tags, and more.

Check out the Bicep Landing Zone vending module for Azure a GitHub repo https://lnkd.in/dJRiK5yG

Check out the Terraform landing zone vending module for Azure a GitHub repo https://lnkd.in/dtndsfXr #sharingiscaring

In Summary

So, what is your preferred way to provision Azure subscriptions
Please, share your feedback in the comments or in the following LinkedIn post.

How to automate consistent resource naming in Microsoft Azure?

Hello, my dear Cloud Marathoner community!

Anyone who manages Azure resources knows that consistent naming is key to understanding what a service is, where its location and purpose, and to whom it belongs to.

Are there any tools?

In a recent couple of days, I was exploring a tool/framework that could help me with consistent naming of cloud resources issues. And I was nicely surprised to find the Azure Naming Tool v2.

“The Azure Naming Tool was created to help administrators define and manage their naming conventions while providing a simple interface for users to generate a compliant name.”

What is it for?

The tool was developed using a naming pattern based on Microsoft’s best practices. Once an administrator has defined the organizational components, users can use the tool to generate a name for the desired Azure resource.

Check out the “Azure Naming Tool v2” https://lnkd.in/etHZf64z #sharingiscaring

Demo video?

Yes, it has a nice demo video that demonstrates how to install and configure this tool as a container for your unique needs.

Video link https://youtu.be/Ztmxx_KhZdE

These recent updates come with globally optional components, multi-type name generation, some style and/or layout updates, and more.

Summary

The Azure Naming Tool was designed to be as extendable and functional as possible. In order to accommodate that flexibility, several architectural aspects were implemented.

The ANT team will continue to improve the tool and publish updates to the GitHub repository. All feedback is welcome, and feel free to submit a code change if you have a better idea for any part of the tool. Good luck!

Zero to Hero: Secure IaC with Bicep

Hello dear friends,

I would like to welcome everyone who is landed on this page to check out the Azure Spring Clean 2023 event and Learn new cloud skills!

Before kicking off the topic, I would like to start with a “THANK YOU” message for the organizers of the event; especially for Joe, Thomas, and everyone who is involved in making this event a successful experience for everyone!

Note:

Introduction

In the spirit of Azure Spring Clean, we will explore how to organize Azure Security Services using the infrastructure-as-Code (IaC) approach with Azure Bicep.

We will look into how you could declaratively define and deploy your Azure security resources including Azure Policies to tackle real-world business problems. So, get yourself ready for simple yet powerful demos that will turn you into a hero.

And don’t worry, if you are new to Azure Bicep as we will have a super express introduction to this new IaC language to get you started with fundamentals.

By the way, if you are super new to Azure Bicep then please check the following YT recording – “What is new in Azure Bicep language?”

What is Azure Bicep

Azure Bicep is a new declarative Domain Specific Language (DSL) for provisioning Azure resources. The purpose of Azure Bicep is to simplify the resource creation and management experience with a cleaner syntax and more code reuse.

Declaring resources as IaC

There are many benefits in declaring and managing cloud infrastructure resources as a code. It provides benefits, such as increased compliance, visibility, controlled deployments and versioning of changes that get deployed into your cloud environments.

The following screenshot demonstrates how Azure Bicep declares cloud resources on the left side of the panel:

Organizing cloud resources

No matter how small or big is your project, taking time to think through the approach of how to organize your digital assets is an important task. In Microsoft Azure, you would need to consider a couple of points while trying to make this decision. Namely, you would need to consider the following factors:

Resource Governance approach
Management scopes
IaC management options
Modules, ACR, Template Specs, etc.

Azure Policies for governance

The Azure Policies are assigned with a unique mission to guard the compliance aspect of your cloud resources and workloads. It evaluates resources at specific times (by default happens every 24 hours) during the resource lifecycle changes and the policy assignment lifecycle updates.

Thus, whenever you get a resource created, updated, or deleted within a scope of the monitored compliance, or if you update/create an Azure policy then the compliance evaluation cycle will determine the compliance of these changes by auditing, blocking, or allowing the action to be performed.

Securing storage account options

Note: this section of the post is in progress…
It will be presented with the screenshots and GitHub repo for you.
Stay tuned, and check in a few days

video & Demo – a sweet combo

In the video below, I briefly cover the posted information in this blog post which also includes the instructions on how to run the demo and get the scripts to deploy Azure Policies for your Tag Governance scenario.

Without any overdue, here is the video that should be available to you:

The following image is a screenshot from the slide that demonstrates the Bicep code that declares the policy definition and initiative, with the final view of deployment on the Azure portal.

Please, feel free to check out the GitHub repo – Learn Azure Bicep.

Summary

Thank you so much for reading this post and learning about Azure security and compliance and how IaC language Azure Bicep can help you in this journey. This is a bit different perspective to strengthen your resource/workload compliance on Azure using IaC approach.

Please, keep up the good work by securing your organizational and customer cloud environments!

#AzureSpringClean 2023 event speaker submission is accepted

Hello Cloud Marathoners!

I am really excited and happy to see my session is accepted for this year’s #AzureSpringClean2023 event

What is Azure Spring Clean?

The Azure Spring Clean 2023 is an event that promotes well-managed Azure tenants. In order to achieve this goal, organizers encourage the cloud community professionals to create articles that highlight best-practices, and lessons learned, and help with some of the more difficult topics of Azure Management.

Session details

Join me this March, to learn and explore how to organize Azure Security Services using the IaC approach with Azure Bicep.

We will look into how you could declaratively define and deploy your Azure security resources including Azure Policies to tackle real-world business problems. Thus, get yourself ready for simple yet powerful demos that will turn you into a hero.

In Summary

I would highly encourage everyone to join this event and learn best practices on Azure this spring!

Check out the post details on LinkedIn platform

End of year celebration with a pass on Microsoft SOC exam

Hello, my friends!

I am sincerely wishing you all a Happy New Year!

As I always say this motto: The #cloudjourney and learning never stops 🏃‍♂️ 🏃‍♀️

What is the Microsoft SOC exam?

I am happy to share that I was able to pass an Azure security certificate before the end of 2022!!!

As you might know, this certification belongs to an important Microsoft Security operations space. I am very glad to finish this year with this achievement.

Thank you my dear #cloudfamily, #cloudmarathoner, and my co-workers at T-Rex Solutions, LLC for a strong and relentless learning culture and continued support!

***Microsoft Certified: Security Operations Analyst Associate***

What skills did I learn?

Studying for this certification helped me gain the skills and knowledge required to reduce my organization’s risk by rapidly remediating active attacks on the environment, advising on improvements to threat protection practices, and referring violations of organizational policies to appropriate people and teams.

As an important part of the exam preparation, I did labs that investigate, respond to, and hunt for threats using Microsoft products, such as Azure Defender, Azure Sentinel, Microsoft 365 Defender, and other related security products.

Summary

Please, let me know if you are targeting this certification.
I would be more than glad to provide additional guidance for your preparations!

Thank you everyone for your greetings and wishes on social media.
I do really appreciate your continued support!!!

Interview with the DynamicsSmartz

Hello Cloud Marathoner friends,

I had a great interaction with Kerry, Head of Marketing at DynamicsSmartz few weeks ago. I was offered to share my technical insights into some of the Microsoft technologies and interesting trends in the Cloud and Security areas. As a Microsoft MVP in Azure, I was really excited to share my take on Cloud Security and Governance topics using this Platfrom.

what is Microsoft Dynamics Influencer Insights?

This program provides a look at what Industry Experts and Influencers have to say about the partner benefits of pursuing Digital Transformation. It is also important to note that Microsoft MVPs are usually providing the technical insights freely for the community benefit.

Insights on Cloud Security and Governance

There are multiple questions on Microsoft tech trends and opportunities that have been addressed in my interview. In addition, I also shared my success mantra that you could check it here.

Microsoft Dynamics Influencer insights with Elkhan Yusubov — **Cloud Manager and Author, Elkhan Yusubov’s take on Cloud Security and Governance**

Updated Publication

Today, on August 30th, I have been informed by DynamicsSmartz that my interview has been featured on “The Microsoft Partner Daily” publication. Thank you Kerry for notifying me and great job that you are doing.

Conclusion

Please, let me know your take on my shared tech insights, and what would be the question you want to ask. As usual, please connect with me on @LinkedIn or @Twitter.