Managed Cloud Security Posture Management &Cloud Workload Protection Powered by Microsoft Defender for Cloud
1/28/2022
Raul Neagoe© 2022 NTT DATA, Inc. All rights reserved.

Multi-Cloud Cloud Requires a New Approach to Security

Infrastructure increasingly distributed across public clouds and on-premises datacenter

Rapidlychanging
resources

High complexity
added when using
Hybrid Cloud

Increasingly
sophisticatedattacks!
© 2022 NTT DATA, Inc. All rights reserved.

2

Security skills
are in short
supplySecuring the Unknown
Increases in attack surface and vectors provide challenges
VIRTUAL
INSTANCES(MANAGED)CONTAINER
CLUSTER

CODEREPOSITORIES(GIT)CONTAINER/
PACKAGEREGISTRIESDATABASESUSER,
ACCOUNTS &PERMISSIONSPROXIES &GATEWAYSSERVERLESSFUNCTIONS

15+

DATA
BREACHES

BUSINESSAPPSEXPOSEDTOOLDASHBOARDSPERIMETER
IN AND OUT
OF VPCS

WEAK
CONTROL
PLANE

CONTAINERCONTROL
PLANE

INSIDERTHREAT
INSUFFICIENTIDENTITY,ACCESS AND
KEY MGT.

ACCOUNTHIJACKINGABUSE &NEFARIOUS
USE OFCLOUDSERVICES(CI/CD)PIPELINETOOLSTYPICAL ASSETSIN THE ATTACK SURFACE* https://cloudsecurityalliance.org/artifacts/top-threats-to-cloud-computing-egregious-eleven/

LACK OFCLOUD
SECURITY
ARCITECTURESERVICEOUTAGEDATA
THEFTMISCONFIGURATIONCLOUD SUBSCRIPTIONSLIMITED
CLOUD USAGE
VISIBILITY

INSUFFICIENTIDENTITY,ACCESS AND
KEY MGT.

INSECURE
APIS

META/APLISTRUCTURE
FAILURESATTACK VECTORS BY
11 CLOUDCLOUD SECURITY ALLIANCE*RESOURCETHEFT

RESULTS IN
3 INCREASEDRISKGeneral Predictions and Challenges in the Cloud
Predictions
Through 2023, at least99%
of cloud security failures
will be the customer’s fault
Through 2024, workloads that leverage theprogrammability of cloud infrastructure to
improve security protection will suffer at least

60%
fewer security incidents than thosein traditional data centers.

Without security controls inplace, 68% of breaches takemonths or longer to discover.

Time torespond

The dynamic andever-changing nature ofcloud infrastructure.

Visibility into
security andcomplianceA consistent,

Issue of cloudvisibility due tocloud sprawl.

!

Cloud security

Increase in
number andsophisticationof attacks
The shift to DevOps

secure and compliant
challenges places an emphasis on speed
cloud infrastructure will
and rapid iterations, making
become more complex due
traditional security tools too slow,
to “multi-cloud strategy”.
cumbersome and reactive to use
for managing cloud risk.
In 2021, theaverage cost of abreach was$4.24M.1

52% oforganizations cite
secure configurationof cloud resources
as a top priority.2

Source: Gartner© 2022 NTT DATA, Inc. All rights reserved.

4

1Source: Ponemon Institute, Cost of a Breach Report
2Source: 451 ResearchWhat Is CSPM and CWP ?
Cloud Security Posture Management (CSPM)• Enhanced visibility to help you understandyour current security situation.
• Hardening guidance to help you efficiently andeffectively improve your security.
Continuously assess• Know your security
posture• Identify and track
security risks

Secure• Harden cloud
resources andservices• Check yourcompliance using
security
benchmarks

Defend• Detect and resolve
threats toresources,
workloads andservices

Through 2024, organizations implementing a CSPM & CWP offering and extending this intodevelopment will reduce cloud-related security incidents due to misconfiguration by 80%.
Source: Gartner© 2022 NTT DATA, Inc. All rights reserved.

5• Enhanced automation: Automatically fixing
threats.
Cloud Workload Protection (CWP)• Defender for Cloud offers security alerts that are
powered by Microsoft Threat Intelligence. It also
includes a range of advanced, intelligent,
protections for your workloads.
• Azure, hybrid, and multi-cloud protectionsDefend Azure, On-prem and AWS/GCP
environments.

Multi-Cloud & Hybrid Protection With Microsoft Defender for CloudOn-premAzure Arc
Native CSPSecurity posture& compliance

Secure score

Asset management

Regulatory complianceProtection(Defender for Servers,
Containers)

Threat detection

Vulnerability Assessment

Hardening Recommendations

Automation &management at scale

Automation

SIEM integration

Export© 2022 NTT DATA, Inc. All rights reserved.

6

Microsoft Defender for Cloud
Secure your critical cloud workloads running in Azure, AWS and Google Cloud• Easy onboarding of AWS and GCP accounts andnative support for Azure
Server VMs

Containers

Azure Key Vault• Get a bird’s-eye view of your security posture andvulnerabilities across clouds with secure score• Assess and implement best practices forcompliance and security in the cloud• Protect Amazon EKS clusters and AWS EC2
workloads
Network

SQL/Storage

Azure App
Services• Detect and block advanced malware and threatsfor Linux and Windows servers running in thecloud or on-premises

Multi-cloud and Hybrid coverage© 2022 NTT DATA, Inc. All rights reserved.

7

A Complete Security View From a Single Pane of Glass
Continuous detection,
improvement & protection

Speed up compliance• Detect threats across
IaaS and PaaS services
using advanced
analytics• Manage security
policies at anorganizational level• Easily set security
policies forsubscriptions or
management groups• Continuously monitor
and protect all yourcross-cloud resources• Reduce exposure andprotect data services
against malicious
attacks• Follow best practicerecommendations• Instantly understandyour current policy
compliance andreview complianceovertime• Reduce attack surface
by applying proactive
hygiene measures© 2022 NTT DATA, Inc. All rights reserved.

8

Improved Automation

Apply quick fixes
to recommendations

Automate responses
with Logic Apps

Continuously export
to Event Hub and
Log Analytics

Autogeneratereports

With deep knowledge in Azure
Automation our Cloud Security
experts can help you gain:• Operational efficiencies• Reduce attack surface• Automate incident response
triggers• Support compliance efforts© 2022 NTT DATA, Inc. All rights reserved.

9

NTT DATA CSPM & CWP Advisory Engagement Overview
Zero Trust Assessment• Conduct a Zero Trust
assessment – review high-level
environment architecture andsecurity solutions currently inplace• Discuss business concerns andrequirements• Output - a Zero Trust evaluation
report and top line objectives,
concerns and requirements

Security Posture
Discovery & Policies

Secure Score &Compliance

Remediating
Configuration Errors• Review MS Defender for Cloudfunctionality and assess how
these solutions can be used toprotect your cloud environment• Interactive activity to discuss andrun Secure Score for yourenvironment, review findings anddiscuss opportunities toremediate issues and drive
systemic improvements• Determine what actions should
be taken for common
configuration and what can be
set up for automatic remediation• Discuss specific ASC &Defender capabilities• Output - Develop and deliver a
prioritized list of objectives as
they apply to ASC. Build anactionable roadmap

Amplifying CSPM

• Implement discovery and policies
to identify shadow IT,
unsanctioned activities, andsubscriptions not leveraging
recommended security policies• Identify workflow automation
opportunities and priorities• Determine actions to take (orautomate) to prevent unapproved
activities• Output - Develop integration
strategy, outline workbook(s)configuration and workflow
automation priorities• Output - Develop critical CSPM
policy and controls list

© 2022 NTT DATA, Inc. All rights reserved.

Intro to Microsoft
Defender for Cloud• Evaluate reporting requirements
to determine dashboard andreporting needs

10• Discuss compliancerequirements and assess Secure
Score compliance findings• Output - Develop a prioritized listof security improvement
opportunities• Determine the process foraddressing uncommon security
vulnerabilities• Output - Create a mitigation planand determine actions toremediate vulnerabilities

Threat Detection &Prevention

Design Decisions &Enabling Controls• Discuss the test plan process forenabling controls across theenvironment to determine thepreferred approach ensuring
productivity is not disrupted• Summarize all gathered intel &established parameters,
configuration details and data

• Integration with SIEM and
X/MDR.
(Example: Managed Sentinel)• Output - agreed upon test plan
approach and procedures• Output - A design guide,architectural diagram, andimplementation plan combining
your requirements and
NTT DATA best-practices

Overview of the NTT DATA CSPM & CWP Implementation Phases

Microsoft Defender
Initial Setup

Microsoft DefenderOnboarding andConfiguration

Workbook
and Policy
Development• Microsoft Defender will be enabled across the targeted subscription in the Management Group.
• An initial assessment of the Secure Score will be ran and assets will be reviewed to identify
priority vulnerabilities.
• Alerts will be enabled at the preferred parameters and email notifications for designatedstakeholders, in alignment with client preference or direction.
• Standard auto-responses to alerts may be configured during initial setup phase.
• The client will manage or provide direction on access levels for ASC.

• Microsoft Defender for Cloud will be deployed at the subscription level where the workloads
to be protected reside to enable full functionality of the solution.
• Once the initial Microsoft Defender for Cloud solution is deployed, NTT DATA will enable
automatic provisioning of the Log Analytics agent and applicable extensions for resources
added to the Azure environment.

• Microsoft Defender embedded security policies will be enabled to assess vulnerabilities thatcreate opportunities for threats and threat actors.
• Custom workbooks will be created to surface deeper insights on critical use cases the client
wishes to assess at a more granular level, as determined during the advisory workshop
engagement.
Note: Additional custom workbooks can be provided using our optional service

Workflow
Automation
Creation• NTT DATA will enable workflows to automatically remediate vulnerabilities the client determines
are critical to their security objectives as defined during the advisory engagement.
• NTT DATA will work with the client’s technical team to test the workflows to verify the remediation
action aligns to the trigger. Any changes required as a result of testing will be updated in the
CSPM design guide.
• The implementation engineer will need to be provided with Logic App Contributor access tocreate the automated workflows.
Note: Additional custom workflows can be provided using our optional service© 2022 NTT DATA, Inc. All rights reserved.

11

Validate thecontrols and meetthe objectives byenabling Controls
Assess usage
and performancepatterns from thecaptured alerts
established during
the preceding
phases.
Configuregovernancecontrols basedon required
modifications as
indicated during
the testingprocess.

NTT DATA CSPM & CWP Managed Services

Operational Support• Security monitoring to help ensure defense integrity ofthe onboarded Cloud subscriptions, with analysis andvalidation support as sent by the SIEM or SOC team of
impactful alerts.
• Daily vulnerability scan of protected resources, withanalysis of findings and top concerns, and present toclient stakeholders in alignment with determinations
made during the advisory engagement.
• Weekly evaluation using Secure Score, analyze andvalidate recommendations and prioritize based on
criticality.

On a monthly basis:• Monthly report outlining operational metrics, security
pattern trends and changes, improvements made, with
impact or progress assessments.
• Identify cloud resources that need to be exempt from
ASC recommendations, document accordingly.

Optimization Support
Continual improvement efforts to consistently
improve your cloud security posture
On a monthly basis:• Present top cloud security posture improvements forclient consideration• Review of policy and automation workflow effectivenessto validate the client’s requirements are being met• Validate remediation recommendations, assess impacts
and present mitigation approach to the client.

Audit Support
On a quarterly basis:• Identify 1-3 workflow automation opportunities toimprove the security.
• Assess opportunities to develop new or refine policies if
gaps exist in remediation recommendations.
• Validate the existing threat detection workbook
effectiveness, optimize based on evolved security
patterns and threat trends.

Support client-led audit preparations for complianceor security program-related efforts
Audit assistance on up to a biannual basis.
Such entitlements include:• Export CSPM data upon request• Detailed data usage reports• Off-band reporting per client-directed requirements© 2022 NTT DATA, Inc. All rights reserved.

12

Amplifying Managed CSPM & CWP: NTT DATA’s Add-On Value
Workbooks

Automation Scripts
ExamplesInvestigation Insights
Alert/Report Scripts
Help analysts gain insight into incident,
bookmark and entity data.
JIT custom role

Security Operations Efficiency

Security alerts in Azure
activity log

Security operations center managers canview overall efficiency metrics andmeasures regarding the performance of
their team.

Read Azure storagetransaction metrics

Mail Exchange Online

Workflow Automations

Restrict access to storage
accounts with firewall andvirtual network
configurations

Notify-security issues

Require Linux VM to use
SSH key authentication

13

Post-sec-teams message

Enable transparent dataencryption on SQL
databases

Remove-malware blob

Remove external accounts

Run-MDE-antivirus

Custom Security Recommendations

Gain insights into Microsoft Exchange
online by tracing and analyzing all
Exchange operations and user activities.
Ex: monitor permission changes, andmailbox creations to discover suspicious
trends among them.
© 2022 NTT DATA, Inc. All rights reserved.

Remediation Scripts

Sensitive information
types scanning should beenabledCustom Secure Score

Secure Score reduction
alertsRemediate and Prevent Configurations Drifts With Microsoft Defender for Cloud
Recommendations against regulatory and compliance standards

Security
Recommendations

Custom security initiatives and policies
Continuous audit of assets/configurations with logging

Automate response to
misconfigurations
and driftconfigurations

Prevent drift
configurations

Automation for remediations and violations
Automation responses and alerts to configurations

Automated versioning of configurations

Prevent misconfigurations of new resources to specificrecommendations by denying, enforcing rules, policies andblueprints
500+ workbooks/playbooks/blueprints© 2022 NTT DATA, Inc. All rights reserved.

14

The Total Economic Impact™ of Microsoft Defender for Cloud(former Azure Security Center)

Security Center cost savings and businessbenefits

Financial Summary

25%
ROI

Benefits PV

NPVPayback

219%

3.56M

$2.44M<6 months

reduction in risk of a security breach50%
reduction in time to threat mitigation
Benefits$3.6 million

Payback Period:<6 months

30%
reduction in security policy andcompliance management time

Costs
$1.1 million$216K
annual reduction in security tool spend

InitialYear 1

Year 2

Year 3

Read the full study© 2022 NTT DATA, Inc. All rights reserved.

15

What Makes Us So Different
Strength of the NTT Group
6.1+ trillion logs analyzed annually
14 SOCs and 7 R&D centers
6.2B attacks defended annually150+ million identities managed

Vertical Expertise
Deep vertical expertise
Consulting
Digital Transformation services that arecomplemented by deep security expertise

Our partnerships

14 Microsoft Gold
Competencies

Flexibility of
Our Delivery and Pricing Model
Broad range of leveraged anddedicated delivery models
Maximize clients existing toolsets andinvestments

Innovation

Our People
5,000+ security and cloud engineers
1,000+ DevOps (build & release) engineers
1,500+ cloud certifications
Over 3,000 public cloud certifications
Learning obsessed culture
Employees complete continual education$4B Annual R&D
Focus on Internal IP

courses

NTT partnerships with universities , researchlabs and incubator programs

technologies: Cloud Security ,AI,

Strategic
Alliance andCollaboration
Agreement
Between NTT
and Microsoft

Learning focus on emerging
automation.

Center of ExcellenceTechnical Slide Deck
1. Overview & Architecture
2. Cloud Security Posture Management
3. Cloud Workload Protection© 2022 NTT DATA, Inc. All rights reserved.

171. Overview and Architecture© 2022 NTT DATA, Inc. All rights reserved.

18

Integrated Threat Protection for Your Enterprise
SIEM

Microsoft Sentinel
3rd-party and partners

Multi-cloud

Microsoft 365 Defender

Microsoft Defender for Cloud

Email/docs

Endpoints

SQL

Server VMs

Containers

Identities

Apps

Network traffic

IoT

Apps

XDR

Microsoft Defender© 2022 NTT DATA, Inc. All rights reserved.

19

Cloud Security Posture Management
Secure Score

Unified Pane of Glass

AlertsSIEM

Continuous assessment

Cloud Workload Protection
Microsoft Defender for Servers

Microsoft Defender for
App Services

Microsoft Defender for
Storage

Microsoft Defender for SQL

Microsoft Defender for
Containers

Microsoft Defender for DNS

Microsoft Defender for
Key Vault

Microsoft Defender for
Resource Manager

Microsoft Defender forOpen-Source Relational DB

On Prem© 2022 NTT DATA, Inc. All rights reserved.

Public/Private Cloud

20

Defender for Cloud is a unified
infrastructure security management
system that strengthens the security
posture of your data and provides
advanced threat detection acrossyour workloads in the cloud.

Defender for Cloud Architecture

Netflow, SQL DB
and Storage Logs, …
Security Dashboards
Security Dashboards Deliver
Deliver Rapid Insights into
Rapid Insights into Security
Security State Across All
State Across All Workloads
Workloads

Threat Detections,
Prescriptive
Recommendations

Windows Events, Syslog,
CEF, Configurations

Actionable Security
Recommendations

IP Geotagging, …
Curated, Prioritized
Security Alerts

Azure
Arc

Investigation Tools
and Log Search

Export to Excel
and Power BI

REST APIs© 2022 NTT DATA, Inc. All rights reserved.

21

Automation

Notifications

Threat Protection for Cloud at ScaleApp
Microsoft

Multi-cloud

365

Containers

Network

Connector
Partnersolutions

Network
AccessSQL
Defender for
Cloud

Microsoft
Sentinel

SIEM

IoT

IoT

ComputeMicrosoft Defender
Cloud Workload Protection© 2022 NTT DATA, Inc. All rights reserved.

22

Data

Microsoft Sentinel
Cloud Native SIEM

2. Cloud Security Posture Management© 2022 NTT DATA, Inc. All rights reserved.

23

The Security Dashboard• Unified resource view
• All your cloud resources in one
place: Azure, AWS, on premises andother clouds• Focused views for security posture,compliance, and workload protection• Clear & simple view
• Identify all your security related stats
at a glance• Emphasis on visibility & clear KPIs

© 2022 NTT DATA, Inc. All rights reserved.

24

Security Posture Management With Secure Score
Evaluated Categories

Gain instant insight into the security state of yourcloud workloads
Address security vulnerabilities withprioritized recommendations
Improve your Secure Score and overall security
posture in minutes

AccessComputeSQL server

Network

App

+7%

+2%

+1%

+3%

+2%

Secure Score Impact

Speed up regulatory compliance

50%
SecureScore

Granular control of Secure Score© 2022 NTT DATA, Inc. All rights reserved.

25

Inventory View ─ Improved Visibility Across the Entire Estate• Single view of all monitored
resources• Easy filtering, sorting and crossreferencing experience• Continue exploration in Azure
Resource Graph & export to CSV• Management of resources© 2022 NTT DATA, Inc. All rights reserved.

26

Compliance Management and Assessment•

Demonstrate compliance status, basedon continuous assessments of Azure
resources•

Monitor AWS and GCP resources withmulti-cloud support•

Azure Security Benchmark monitoring
enabled by default, fully aligned with
Secure Score•

Support common industry standards,
as well as custom initiatives based on
Azure Policy•

Overview of compliance status and report
download© 2022 NTT DATA, Inc. All rights reserved.

27

3. Cloud Workload Protection© 2022 NTT DATA, Inc. All rights reserved.

28

Integrated Threat Protection for Your Enterprise
SIEM

Microsoft Sentinel
3rd-party and partners

Multi-cloud

Microsoft 365 Defender

Microsoft Defender for Cloud

Email/docs

Endpoints

SQL

Server VMs

Containers

Identities

Apps

Network traffic

IoT

Apps

XDR

Microsoft Defender© 2022 NTT DATA, Inc. All rights reserved.

29

Threat Protection for Cloud and Hybrid Workloads
Threat protection for common cloud resources

Any
Server

Azure
VMSS

Blob
Storage

File
Storage

App
Services

Azure
SQL

Azure
K8s

Threat protection for Azure service layer

Azure Network
Layer V1

© 2022 NTT DATA, Inc. All rights reserved.

Key
Vault

Azure
Management

30

Azure
DNS

MySQL

Postgres
SQL

Maria
DB

Microsoft Defender for Servers
On-premiseProtect Linux and Windows servers
from threats
Reduce open network ports• Use Just-in-Time VM to control access to commonly

attacked management ports

Antimalware
Microsoft Defenderfor Endpoint

Behavior
analytics

Allow list
for Apps!

!

!

• Limit open ports with adaptive network hardening

Block malware with adaptive application
controls
Malicious code
execution

Protect Windows servers and clients with
the integration of Microsoft Defender for
Endpoint and protect Linux servers© 2022 NTT DATA, Inc. All rights reserved.

Lateralmovement

31

Data
exfiltration

Turn on Built-in Vulnerability Assessment for VMs: Available as Part of Microsoft
Defender for Servers

Automated deployment of thevulnerability scannerContinuously scans installed
applications to find vulnerabilities
for Linux & Windows VMs
Visibility to the vulnerability findings
in Security Center portal and APIs
Powered by Qualys© 2022 NTT DATA, Inc. All rights reserved.

32

Microsoft Defender for SQL
Protect SQL Server anywhere: in Azure, on premises or in other clouds

Azure Arc Enabled SQL Server

Azure

Azure Defenderfor SQL
Azure SQL
Database

Azure SQLManaged Instance

Azure Synapse
Analytics (DHW)SQL serveron Azure VM

SQL Server
On Prem

SQL Server
On AWS EC2SQL Server
On Google Cloud

Advanced Threat Protection: detect unusual and harmful attempts to breach SQL servers across hybrid estate
Vulnerability Assessment: discover and remediate security misconfigurations in SQL servers across hybrid estate© 2022 NTT DATA, Inc. All rights reserved.

33

Microsoft Defender for Storage
Protect blobs containers, file shares and data lakes in Azure

Azure Native Security

Rich Detection Suite

Response at Scale

Centralized & Integrated

Built-in within Azure with 1-click
enablement. Protect Azure Blob,
Azure Files and Data Lakes

Covering top Storage threats poweredby Microsoft Threat Intelligence

Reduce frictions preventing andresponding to top threats

Centralize security across alldata assets managed by Azureand built-in integration with
Azure Sentinel & Azure Purview© 2022 NTT DATA, Inc. All rights reserved.

34

Microsoft Defender for Containers

Seamless deployment
and configuration

Image scan in ship
Discover ACR registries, scan all
pushed images, and get visibility tovulnerable images

Image scan in runtime
Continuous scanning ofrecently pulled images© 2022 NTT DATA, Inc. All rights reserved.

35

Microsoft Defender for Containers

AKS cluster andnodes hygiene

Runtime threat
detection

Admission control
policy management

Harden and audit AKS clusters
according to Azure security
benchmarks and follow theDocker CIS benchmark on
container nodes

Detect suspicious behavior in
Kubernetes workloads via aunique agentless approachleveraging Kubernetes audit
log, in addition to Kubernetes
workers dedicated detections

Mandate/audit security bestpractices on Kubernetes
workloads© 2022 NTT DATA, Inc. All rights reserved.

36

Kubernetes Attack Matrix
Initial access

Execution

Persistence

Privilege
escalation

DefenseevasionCredential
accessDiscovery

LateralMovement

ImpactUsing cloudcredentials

Exec into
container

Backdoor
container

Privileged
container

Clear container
logs

List K8S
secrets

Access the K8S
API server

Access cloud
resources

Data
destruction

Compromised
images inregistry

Bash / CMD
insidecontainer

Writable
hostPath mount

Cluster-admin
bidingDelete K8S
eventsMount service
principle

Access Kubelet
API

Container
service accountResource
HijackingKubeconfig file

New container

Kubernetes
CronJob

hostPath mount

Pod / containername similarity

Accesscontainer
service accountNetwork
mapping

Cluster internal
network

Denial ofservice

Application
vulnerability

Application
exploit (RCE)

Access cloud
resources

Connect from
Proxy server

Applications
credentials in
configuration
files

AccessKubernetes
dashboard

Applications
credentials in
configuration
files

Exposeddashboard

SSH server
running insidecontainer

Instance
Metadata API

Writablevolume mounts
on the hostAccessKubernetes
dashboard
Access tiller
endpoint© 2022 NTT DATA, Inc. All rights reserved.

37

https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/

Breadth Threat Protection With Microsoft DefenderProtect ANY Workload in Azure

Microsoft Defender for
Resource Manager© 2022 NTT DATA, Inc. All rights reserved.

Microsoft Defenderfor DNS

38

Microsoft Defender for
Key Vault

Automation Example© 2022 NTT DATA, Inc. All rights reserved.

40

© 2022 NTT DATA, Inc. All rights reserved.