13.1 Microsoft Defender for Cloud & Secure Score

8.1 Microsoft Defender for Cloud & Secure Score

Microsoft Defender for Cloud is Microsoft's cloud-native application protection platform (CNAPP). It combines Cloud Security Posture Management (CSPM), Cloud Workload Protection (CWP), and DevOps security management into a unified security management system across Azure, Amazon Web Services (AWS), Google Cloud Platform (GCP), and hybrid on-premises environments.

---

Architecture & Core Platform Capabilities

Defender for Cloud functions as a centralized security management layer integrated directly into the Azure Resource Manager (ARM) control plane. It continuously assesses the configuration state of deployed resources, analyzes log telemetry, and generates actionable security recommendations and real-time security alerts.

Architectural Components

1. Security Engine & Policy Framework: Built on Azure Policy infrastructure, Defender for Cloud continuously evaluates resource configurations against security initiatives (such as the Microsoft Cloud Security Benchmark).
2. Telemetry & Data Collection: Integrates both agentless and agent-based telemetry ingestion mechanisms:
   • Agentless Scanning: Uses cloud service provider APIs and snapshot-based disk inspection to discover inventory, software vulnerabilities, and secrets without performance overhead or host agent deployment.
   • Agent-Based Ingestion: Leverages the Azure Monitor Agent (AMA) and dedicated security extensions (e.g., Microsoft Defender for Endpoint) for deep OS-level log collection, real-time process monitoring, and memory inspection.
3. Multi-Cloud Connectors: Native API integration with AWS accounts and GCP projects allowing security posture management, compliance auditing, and threat detection across non-Azure environments within a single dashboard.

---

Foundational CSPM vs. Defender CSPM Plan

Defender for Cloud separates Cloud Security Posture Management (CSPM) into two distinct service tiers:

Foundational CSPM (Free / Default Tier)

• Cost: Enabled by default at no extra cost across all Azure subscriptions.
• Capabilities: Continuous agentless configuration assessment, real-time Secure Score calculation, security recommendations aligned with the Microsoft Cloud Security Benchmark (MCSB v2), and standard regulatory compliance tracking.
• Scope: Primarily focused on basic hygiene rules and configuration misstatements across native Azure infrastructure.

Defender CSPM (Paid Plan Tier)

• Cost: Per-resource billable tier (priced per server, database, or cloud instance per month).
• Advanced Posture Features:
  • Attack Path Analysis: Graph-based analysis that models attacker techniques and maps multi-step vulnerability vectors across network paths, identity permissions, and resource misconfigurations.
  • Agentless Vulnerability Scanning: Automated scanning of virtual machine disks and container images in registries for software vulnerabilities (CVEs) and plain-text exposed secrets without installing guest agents.
  • Cloud Security Graph: High-performance graph database enabling custom KQL-like security graph queries to discover complex risk combinations (e.g., internet-facing VMs with high-severity vulnerabilities and key vault access permissions).
  • Contextual Risk Prioritization: Prioritizes recommendations based on exploitability, data sensitivity, and network exposure rather than raw vulnerability severity alone.
  • Multi-Cloud Governance Rules: Centralized assignment of custom security rules and compliance policies across AWS, GCP, and Azure workloads.

---

Secure Score Calculation & Structure

Secure Score is a numerical metric expressing an organization's security posture. It is expressed as both a total point tally and a normalized overall percentage score.

Security Controls & Max Points

Recommendations in Defender for Cloud are grouped into logical Security Controls (such as Enable MFA, Restrict unauthorized network access, Remediate vulnerabilities, or Apply adaptive application controls). Each control is assigned a maximum point value reflecting its relative security impact.

Secure Score Calculation Algorithm

Points within a control are earned based on the proportion of compliant (healthy) resources to total applicable resources evaluated under that control:

$\text{Control Earned Points} = \text{Max Points} \times \left( \frac{\text{Number of Healthy Resources}}{\text{Total Applicable Resources}} \right)$

$\text{Overall Secure Score \%} = \left( \frac{\sum \text{Earned Points Across All Applicable Controls}}{\sum \text{Maximum Possible Points Across All Applicable Controls}} \right) \times 100\%$

Critical Exam Rule: If even a single resource is evaluated as unhealthy under a security control, the control score decreases proportionally. If a control contains 10 resources and 2 are unhealthy, the subscription receives 80% of that control's maximum point allocation.

Exemption Impact on Secure Score

When a resource is explicitly exempted from a security recommendation (with a documented business justification or mitigated control status):

1. The exempted resource is completely removed from the evaluation denominator for that recommendation.
2. The resource no longer counts as unhealthy, preventing it from penalizing the subscription's Secure Score percentage.
3. The exemption status is recorded in audit logs and highlighted on compliance dashboards for transparency during security reviews.

---

Security Recommendation Remediation Workflows

Defender for Cloud recommendations transition through a defined remediation lifecycle. Security teams utilize four primary remediation mechanisms:

1. Fix (Manual Remediation): Step-by-step documentation detailing manual Azure Portal operations, Azure CLI commands, or PowerShell scripts required to remediate non-compliant settings.
2. Quick Fix (Automated One-Click Remediation): Allows administrators to select multiple unhealthy resources in the portal and execute pre-configured ARM templates or remediation tasks directly from Defender for Cloud to resolve misconfigurations instantly.
3. Exempt (Governance Exception): Excludes specific resources or resource scopes from evaluation. Exemptions require specifying:
   • Exemption Category: Mitigated Control (risk handled by alternative security control, such as a third-party firewall) or Waiver (accepted business risk).
   • Justification & Expiration Date: Mandatory documentation for compliance tracking and periodic review.
4. Enforce / Deny (Proactive Azure Policy Control): Prevents the deployment of non-compliant resources at provisioning time. Configured by assigning Azure Policy definitions with an Enforce (Deny) or DeployIfNotExists effect.

---

Regulatory Compliance Dashboard & Policy Assignment

The Regulatory Compliance Dashboard tracks organizational posture against formal industry standards, regulatory mandates, and cloud benchmarks.

Supported Regulatory Frameworks

• Microsoft Cloud Security Benchmark (MCSB v2): The default baseline security policy for Azure, defining control domains for network, identity, data, and compute protection.
• NIST SP 800-53 R5 & Cybersecurity Framework (CSF)
• PCI-DSS v4.0 (Payment Card Industry Data Security Standard)
• ISO/IEC 27001:2022 & SOC 2 Type II
• HIPAA / HITRUST

Security Policy & Initiative Assignment

Security assessments in Defender for Cloud are driven by Azure Policy Initiatives (collections of related policy definitions). Security policies can be assigned at various administrative scopes:

• Management Group Scope: Applies governance recursively down to all nested subscriptions and resource groups.
• Subscription Scope: Enforces policy parameters across all resources within a single billing subscription.
• Resource Group Scope: Targets localized workloads with specialized compliance rules.