Defender CSPM (Cloud Security Posture Management) is a security solution offered by Microsoft as a paid plan through Defender for Cloud, designed to help companies monitor and improve the security posture of their cloud environments. This tool provides continuous visibility, risk assessments, and recommendations to mitigate vulnerabilities, ensuring compliance with best practices and security standards. It allows you to identify and correct misconfigurations, reduce exposure risks and strengthen infrastructure security in multicloud and hybrid environments. In this article, we'll explore Defender CSPM's role in defending environments “in the clouds” and the capabilities it provides to better protect them.
As the number of organizations moving to the cloud increases, security risks, intentional or accidental, also continue to grow.
The most serious data breaches occur due to human error, while misconfigurations are among the leading causes of financial and reputational damage to businesses and government bodies.
Although they may seem simple to avoid, they represent the most significant risk to cloud environments.
65 to 70 percent of all cloud security challenges stem from misconfigurations. The cloud environment is comprised of a multitude of settings, policies, assets, and interconnected services and resources, making it complex.
With the increase in vulnerabilities, the catastrophic impact of cloud breaches has made it clear that the adoption of appropriate security practices is of paramount importance for managing today's multi-cloud environments.
The question, then, is: how do you identify misconfigured cloud resources that are exposed to malicious hackers or cyberattacks? Microsoft may have the answer to that question, and it's Microsoft Defender CSPM, an additional paid plan offered through Defender for Cloud.
Let's take a closer look at Defender CSPM's capabilities and how it can help manage cloud security challenges, improve protection efficiency, and provide visibility to reduce highlighted risks.
Cloud security presents different challenges than the risks of previous computing models. First of all, the cloud infrastructure is necessarily connected to the Internet. Because it allows the almost instantaneous transfer of any type of data, the Internet exposes everything connected to it to a vast number of threats.
In addition, connecting to the Internet increases the risk of data exposure: anyone in the world can view and potentially steal the exposed data, unlike when the data is stored in private networks.
Second, cloud infrastructure is often highly complex, combining different types of cloud services, as is the case in a multi-cloud environment. As business needs change, various computing, storage, and software services are added, expanded, or removed.
All of this happens in remote data centers, making it difficult to maintain visibility and control, meet compliance requirements, and identify and eliminate risks.
Finally, while some aspects of a cloud service may be managed by the provider, security configurations usually aren't. This forces organizations to implement security measures for an infrastructure that they do not directly manage.
Cloud configuration errors occur when the security standards or framework of a cloud infrastructure do not follow a configuration policy and security guidelines, directly jeopardizing the protection of cloud resources.
These risks take the form of security breaches, hacker attacks, ransomware, malware, or insider threats that exploit vulnerabilities to access cloud systems.
A rather terrifying scenario, but in which a CSPM (Cloud Security Posture Management) can lend us a hand.
But what exactly is it?
It is a solution that helps identify, prevent, and correct misconfigurations and security vulnerabilities in cloud environments to reduce the risk of breaches and improve compliance. CSPM provides visibility into cloud environments, allowing you to quickly detect configuration errors and correct them automatically.
A CSPM manages multiple aspects of cloud security, the most important of which are:
Protecting workloads in the cloud begins with the adoption of security policies customized for the organization, supported by a specially designed CSPM platform, which continuously monitors and discovers the resources distributed in the workloads in the cloud, evaluating them to verify if they meet security best practices and standards, such as CIS and NIST.
The CSPM identifies and corrects risks by automating visibility, monitoring, threat detection, and correction flows to search for configuration errors in various cloud environments, including:
A CSPM is generally automated. Instead of requiring security teams to manually check their clouds for security risks, it works in the background, analyzing the cloud for compliance risks and configuration vulnerabilities.
Most CSPM tools can scan multi-cloud environments, providing a combined view of the security status across all cloud services. This capability is crucial because many organizations use more than one cloud service, which increases the risk of misconfigurations and can be more difficult to manage manually.
Finally, modern CSPM solutions also integrate seamlessly with DevOps processes, ensuring that security is embedded throughout the software development lifecycle. This integration helps identify and address security issues early, reducing the likelihood of vulnerabilities being introduced into production environments.
We have created the Infrastructure & Security team, focused on the Azure cloud, to better respond to the needs of our customers who involve us in technical and strategic decisions. In addition to configuring and managing the tenant, we also take care of:
With Dev4Side, you have a reliable partner that supports you across the entire Microsoft application ecosystem.
Microsoft Defender CSPM (Cloud Security Posture Management) is an integrated solution within Defender for Cloud that helps protect cloud infrastructures by continuously monitoring resource configuration, detecting vulnerabilities, and automating error correction to ensure compliance with best security practices.
The CSPM provides detailed visibility into the security status of assets and workloads, offering guidelines for strengthening security to help you efficiently and effectively improve your security posture.
Defender for Cloud continuously evaluates its resources against the security standards defined for its Azure subscriptions, AWS accounts, and GCP projects. Defender for Cloud provides security recommendations based on these assessments.
By default, when you enable Defender for Cloud on an Azure subscription, the Microsoft Cloud Security Benchmark (MCSB) compliance standard is enabled. It provides recommendations and Defender for Cloud provides an aggregated security score based on some of the MCSB recommendations.
The higher the score, the lower the level of risk identified.
Defender for Cloud offers two options for its CSPM functionality: the free plan (defined by Microsoft under the name Foundational CSPM), integrated into the basic offer of the service, and Microsoft Defender CSPM, an additional paid plan that we will discuss in the next section.
As for the free plan, its features are automatically enabled on any subscription or account that has onboarded to Defender for Cloud and include:
Are Defender for Cloud's free features not enough for us?
If you deem it necessary, you can expand its set of features by activating the plan Defender CSPM.
The Defender CSPM plan offers advanced security posture management features, among the main ones we find:
In this table, let's see in detail the difference between the “foundational” features and those offered by Defender CSPM:
Now that we have a clearer view of the features offered in the paid plan, it's time to take a closer look at how to enable and configure them with a small practical example.
First, the Defender CSPM plan must be enabled on the Azure subscription. To activate it, you must have at least the role of Security Admin (a predefined Azure role).
Once we have verified that the prerequisite above is met, we access the Azure portal And let's go to the section Microsoft Defender for Cloud. From the menu, we access the page Environment Settings.
We select the subscription on which we want to enable Defender CSPM and on the page Defender plans, let's select Defender CSPM and let's set the status to ON.
Let's click on Save to save changes.
Once activated, Defender CSPM is ready to evaluate our multi-cloud environment and will provide recommendations to strengthen asset security and improve security posture.
The most inexperienced in cloud security may have difficulty implementing the recommendations and solving the problems identified, but as we have seen, Defender CSPM offers governance rules to assign high priority issues to cloud security managers, with defined resolution times.
To create governance rules, we just need to access the section Microsoft Defender for Cloud from the Azure portal, as in the previous example. After that, from the menu of Defender for Cloud, let's go up Environment Settings and we select the interested subscription.
In the settings, we select Governance Rules.
Let's click on +Create governance rule and fill in the details:
Let's click on Next to proceed to the next page.
In the section Conditions, let's set:
Let's enable weekly notification for managers on the management of open or due tasks and click on Save. A weekly email will be sent to the cloud security team and their managers with all recommendations assigned based on the configured governance rules.
The security of your cloud environments must be considered of paramount importance if your digital infrastructure has been transferred “to the clouds” and with the increase in cyber threats, nothing should be left to chance, not even the possibility of a configuration error on our part.
It is therefore important to have tools that assist cybersecurity experts in their operations and provide them with the control and feedback they need in order to keep our IT environments safe and prevent the unintentional creation of flaws in our security posture.
The basic features of Defender for Cloud and the functionality of Defender CSPM (depending on our needs) can help us with exactly this, providing vision and possibility of action to the professionals who manage and maintain our defenses.
In this type of environment, it is essential not to rest too much on your laurels; so, why wait when you can already rely on these solid tools to begin to secure your organization?
Microsoft Defender CSPM is a paid extension of Defender for Cloud, developed to help organizations improve the security posture of their cloud environments. It offers advanced tools to identify and correct misconfigurations, monitor vulnerabilities, and ensure compliance with recognized security standards.
Defender for Cloud includes some basic CSPM functionality in a free plan called Foundational CSPM. Defender CSPM, on the other hand, is an advanced plan that adds additional functionality for more in-depth and proactive cloud security management.
The free plan allows you to automatically discover all your cloud resources, perform continuous assessments of security configurations, receive recommendations to improve your security posture, and monitor your overall health with an indicator called Secure Score. In addition, it ensures compliance with the Microsoft Cloud Security Benchmark and supports data visualization through Azure Workbooks.
The paid plan includes tools for security governance, advanced regulatory compliance, the ability to graphically explore risks through the Cloud Security Explorer, the analysis of attack paths, agentless scanning for virtual machines and containers, the evaluation of container logs and the management of permissions, offering even more complete control of the cloud environment.
No, Defender CSPM is designed for multicloud environments. In addition to Azure, it can also be used with AWS accounts and GCP projects. However, some more advanced features are only available on Azure.
To enable Defender CSPM, you must have at least the Security Admin role. From the Azure portal, you access the Microsoft Defender for Cloud section, enter the environment settings, select the desired subscription and activate the Defender CSPM plan by setting it to ON. Finally, you save the changes to make it operational.
The Secure Score is an indicator that measures the overall security of the cloud environment. It is calculated based on the number of security recommendations implemented compared to those available. The higher the score, the lower the level of risk associated with the infrastructure.
The Microsoft Cloud Security Benchmark is a security standard that is automatically applied to Azure subscriptions when Defender for Cloud is activated. It includes a series of best practices and controls based on recognized standards such as NIST and CIS, adapted for the Microsoft cloud environment and for other providers such as AWS and GCP.
No, one of the advanced features of the plan is the ability to perform an agentless scan of virtual machines, which allows you to detect vulnerabilities and collect information without impacting performance and without requiring additional installations.
Defender CSPM is aimed at organizations that operate in the cloud and need advanced tools to protect complex infrastructures, improve visibility of risks, and maintain compliance with regulations and security best practices.
The Infra & Security team focuses on the management and evolution of our customers' Microsoft Azure tenants. Besides configuring and managing these tenants, the team is responsible for creating application deployments through DevOps pipelines. It also monitors and manages all security aspects of the tenants and supports Security Operations Centers (SOC).
