Threat Hunting in the Cloud

CHAPTER 5Microsoft Cybersecurity Reference Architecture and Capability Map

What's in This Chapter

• Understanding how the Microsoft Security architecture aligns with the NIST Cybersecurity Framework (CSF)
• Understanding the Identify, Protect, Detect, Respond, and Recover functions attributed to Microsoft Security
• Using the Microsoft Reference Architecture
  • Protecting the hybrid cloud infrastructure
  • Protecting endpoints and clients
  • Protecting identities and access
  • Protecting SaaS apps
  • Protecting data and information
  • Protecting IoT and operation technology
  • Understanding security operations
  • Understanding people security

Introduction

Most organizations have several challenges in managing their IT environment, especially when managing a hybrid cloud environment that includes IaaS, PaaS, and SaaS services. Cybercriminals are also constantly evolving their techniques and tools and CISOs and cyber defenders are continuously deploying new security controls and technologies and adding new layers of security controls. As the number of technologies and connectivity increases, managing the integration, monitoring, and data flow becomes more complicated.

Prior to defining and designing a threat-hunting program, CISOs need to assess the existing capabilities, security controls, and tools, as well as understand the data flow and organization architecture.

This chapter focuses on the Microsoft Cybersecurity Reference Architecture (MCRA) to obtain a better understanding of the Microsoft ...