Create security baselines 
Tags: azure, security
Published: 2019-04-15 16:11:01

---
title: Create security baselines 
published: true
description: Manage security operations 
tags: #Azure, #Security
---
**Create a platform security baseline**
- The Microsoft cybersecurity group in conjunction with CIS developed best practices to help establish security baselines
- A variety of security standards can help cloud service customers achieve workload security when using cloud services
- CIS has the following implementation levels:
    - Level 1. Recommended minimum security settings
    - Level 2. Recommended for highly secure environments

**Create an IAM baseline**
Some common recommendations for IAM protection baselines include:
- Restricting access to the Azure AD admin portal
- Enabling MFA
- Properly managing guests
- Managing password security
- Managing member and guest invitation capabilities
- Disabling application options

**Create an Azure Security Center baseline**
- The following are Security Center recommendations that, if followed, will set various security policies on an Azure subscription:
    - Enable the Standard pricing tier
    - Enable the automatic provisioning of a monitoring agent
    - Enable System updates
    - Enable Security configurations
    - Enable Endpoint protection
    - Enable Disk encryption
    - Enable Network security groups
    - Enable Web application firewall
    - Enable Vulnerability Assessment

**Create a storage accounts baseline**
Recommendations for an Azure storage account include:
    - Require security-enhanced transfers
    - Enable blob encryption
    - Periodically regenerate access keys
    - Require shared access signature (SAS) tokens to expire within an hour
    - Require SAS tokens to be shared only via HTTPS
    - Enable Azure Files encryption
    - Require only private access to blob containers

**Create an Azure SQL Database baseline**
Microsoft SQL Server policy recommendations include:
    - Enable auditing
    - Enable a threat detection service
    - Enable all threat detection types
    - Enable the option to send security alerts
    - Enable the email service and co-administrators
    - Configure audit retention for more than 90 days
    - Configure threat detection retention for more than 90 days
    - Configure Azure AD administration

**Create a logging and monitoring baseline**
Logging and monitoring recommendations include:
- Ensure that a log profile exists
- Ensure that activity log retention is set to 365 days or more
- Create an activity log alert for:
    - Creating a policy assignment
    - Updating a security policy
    - Creating, updating, or deleting a security solution
- Enable Azure Key Vault logging
Create an activity log alert for:
    - Creating, updating, or deleting an NSG
    - Creating, updating, or deleting an NSG rule
    - Creating or updating an SQL Server firewall rule
    - Creating an activity log alert for deleting an SQL Server firewall rule

**Create a networking baseline**
Networking recommendations include:
    - Restrict RDP access from the internet
    - Restrict SSH access from the internet
    - Restrict SQL Server access from the internet
    - Configure the NSG flow log retention period for more than 90 days
    - Enable Azure Network Watcher

**Create a VMs baseline**
Azure VM security baseline recommendations include:
    - Install a VM agent (required for enabling data collection for Azure Security Center)
    - Ensure that encryption protects the OS disk and its content 
    - Carefully review extensions to help ensure that they don’t compromise the security of the host or Azure subscription
    - Update VMs to help ensure their security
    - Ensure that VMs have an installed and running endpoint protection solution

**Other security considerations for a baseline**
Some additional recommendations you should consider:
    - Set an expiration date on all keys
    - Set an expiration date on all secrets
    - Set resource locks for mission-critical Azure resources