Fundamental Cloud Security with Microsoft SC-900

2021-12-20 // By Troy Stoneking
Category: Cloud

I write frequently about our NIST cybersecurity framework training courses. In one of those courses, NIST Cybersecurity Framework (NCSF) Foundation, we provide an overview of the NIST Cybersecurity Framework along with some introductory real-world application of the framework.

This post is not about the NCSF, but it is about introductory real-world application.

You know that organizations around the globe are moving more and more resources to the cloud. Offering cloud-based services to your staff, customers, and other stakeholders is no longer a “nice to have” option, it’s becoming the expectation. As a security person, when I think of cloud services, my most pressing question is, “How do we keep them secure?”

Let me offer you a place to begin to answer that question. It’s likely you have some resources deployed in Microsoft Azure. In fact, growth of the Azure cloud platform was 50% year over year as of FY-2021-Q3. Perhaps your organization helped fuel that growth. For our purposes, this being a security post, I’d like to talk about a great place to start learning how to secure your Azure cloud deployment.

If you are looking to get an overview of Microsoft and Azure security before a deep dive, the place to begin is MS-SC-900T00 - Microsoft Security, Compliance, and Identity Fundamentals. SC-900 is one of a suite of security courses related to Microsoft security. Let’s talk about some of the great features of this class.

  • First, it’s just one day. You don’t need to dedicate an entire week to getting critical information on Microsoft’s security, compliance, and identity (SCI) fundamentals.
  • Second, the class starts with reviewing the basics of SCI, just in case it’s been a while for you, or you’ve been so focused on putting our fires that you haven’t had time to brush up.
  • Third, it’s been newly updated. The course was literally revised less than a month ago (as of this writing).
  • Fourth, it’s divided into specific focus areas of:
    • Identity and Access Management (including Azure AD)
    • Microsoft Security Solutions including:
      • Azure security capabilities and management
      • Azure Sentinel (SIEM – Security Information and Event Management/ SOAR – Security Orchestration, Automation, and Response)
      • Microsoft 365 threat protection and security management
      • Microsoft Intune endpoint security
    • Microsoft Compliance Solutions
      • Compliance management capabilities
      • Microsoft 365 information protection and governance
      • Microsoft 365 insider risk management
      • Microsoft 365 eDiscovery
      • Microsoft 365 auditing
      • Azure resource governance

All that information, getting you up to speed on the most current aspects of the Security, Compliance, and Identity (SCI) in Azure and Microsoft 365, in one day. It’s a lot of content, with a broad array of topics, but you’ll come away with practical ideas on ways to answer that critical question, “How do we secure our resources in the cloud?”

-Troy Stoneking, Certified NIST Cybersecurity Framework Trainer and Cybersecurity Assessor

More Posts