Cloud Security Planning Scott Morley – Principal Application Architect

Agenda Understanding the Cloud perimeter Default insecurity Defense in depth RBAC importance Encryption Azure Security Center vCISO

OneNeck® IT Solutions at a Glance Providing hybrid IT Solutions to mid-market & enterprise-sized companies Backed by the Fortune 1000® strength of Telephone and Data Systems [NYSE: TDS] Formed in 2010 through strategic acquisitions; each doing business over 15 years Headquartered in Madison, Wisconsin Nearly 550 employees 8 data centers in 6 states Coast-to-coast presence  OneNeck IT Solutions at a Glance A little about us … We provide hybrid IT Solutions to mid-market and enterprise-sized companies We are backed by Telephone and Data Systems, #504 on the most recent Fortune 1000 list Though OneNeck IT Solutions (as it’s known today) was just formed in 2014, the companies which make up OneNeck have been doing business for more than 20 years, dating back to 1993. We have a presence in 15 states and 9 data centers strategically located across the country We employ more than 600 people and have over 400 technical resources

Setting the Baseline VS

The Perimeter Internet/ExpressRoute VPN/RDP/HTTPs VPN

Open by Default RDP or HTTPS open to the world Can be adjusted by templates ACLs are generally IP based VPN/Express Route/Direct Connect

Defense in Depth Maintained security policies and standards Employee training and awareness Network perimeter defenses (ACL) Malware defenses Risk assessments Vulnerability management Penetration Testing Data encryption (in motion and at rest) MFA Backups

Role Based Authentication RBAC is more for subscription level access Different for OS/Application level Easy to get out of control Main roles: Owner/Admin Contributor Billing Read Only

Encryption File system Drives Databases Communication Implement a key management practice

Azure Security Center Cross location security monitoring https://azure.microsoft.com/en-us/services/security-center/ Cross location security monitoring Includes traditional security systems Uses advanced ML/AI capabilities Tracks usage patterns

Virtual Chief Information Security Officer vCISO Security as a Service Can’t justify full time position Prevent head in the sand syndrome Benefit of group knowledge Understanding of your business