Cloud

Azure Sentinel and Microsoft Defender Platform Delivers Better Cloud Security

Security in the cloud is becoming more complex. But Microsoft’s Defender XDR and Sentinel’s Security Operations Service are helping businesses identify potential risks sooner.

Doug Bonderud

Doug Bonderud is an award-winning writer capable of bridging the gap between complex and conversational across technology, innovation and the human condition.

According to recent survey data from Flexera, 89% of companies now use multicloud, with 73% taking a hybrid cloud approach. While Azure and Amazon Web Services (AWS) continue to lead the market, Google Cloud Platform (GCP), IBM and Oracle are also making inroads.

Having more players in the marketplace improves distribution of resources and enhances computing power, but it also results in more potential security risks.

Azure Sentinel and Microsoft Defender have created a unified security operations cloud-based platform. The partnership bolsters cloud security across any cloud environment.

Azure Sentinel and Microsoft Defender Deliver Cloud Protection

Azure Sentinel is a cloud-native SIEM capable of intelligently detecting threats and taking automatic action. “Sentinel is the brain. It handles all the data,” says CDW’s Paul Carrico, principal strategist for Microsoft Cloud. And it’s capable of ingesting data from multiple sources and multiple clouds to create evolving threat profiles.

Defender, meanwhile, provides comprehensive endpoint protection. “It protects your cloud workloads, endpoints, and ID management, and it all gets pulled into Sentinel,” adds Rufus Harvey, cloud strategic alliance architect at CDW.

It’s also worth noting that Defender is agentless, cloud-powered and offers infinite room to scale, with the capacity to handle more than 1 million endpoints on a single tenant.

By combining Azure Sentinel with Azure Defender and Microsoft 365 Defender, businesses can create a unified security operations (SecOps) experience that uses the best of extended detection and response (XDR) and security information and event management (SIEM).

DIG DEEPER: How Microsoft Azure is transforming cloud operations.

The Benefits of a Unified Security Operations Platform

Microsoft Sentinel and Defender XDR create a SecOps platform that allows IT leaders to “uncover sophisticated cyberthreats and respond decisively with an easy and powerful SIEM solution, built on the cloud and enriched by AI,” according to Microsoft.

The platform brings together the capabilities of XDR and SIEM. Here are some additional benefits:

Integration with existing security tools: While Sentinel and Defender are a powerful pair, Sentinel also integrates with existing security tools so businesses don’t need to shift their entire ecosystems or modify business practices. Instead, Sentinel can pull data from existing tools and then use it to both detect emerging threats and inform Defender responses.

Connection with multiple clouds. Sentinel and Defender aren’t limited to Azure. Whether it’s Azure and GCP, Azure and AWS, or any other cloud combination, all relevant security data is collected. “This data is then combined and analyzed to produce a holistic picture of security,” Harvey explains.

Microsoft Secure Score is like a credit score for organizational security. It helps companies test, tweak and tune operations to improve their security posture.”

Paul Carrico Principal Strategist for Microsoft Cloud, CDW

Ongoing, fast updates: “Since Defender and Sentinel are cloud-enabled, they are constantly updated for zero-day attacks,” Carrico notes. This helps reduce the delay between detection and action to limit the scope and scale of attacks.

Automation of key tasks: Businesses can use Defender and Sentinel to create auto-remediation strategies that trigger a SIEM response to threats. For example, if unusual access behavior is detected, Defender can automatically investigate alerts to determine if a threat is real and take actions to terminate access, quarantine affected areas and remediate compromised machines.

“The average incident is very expensive,” Harvey says. “You want to shut off that network path or disable access to a data source to limit the impact. As new common vulnerabilities and exposures are detected and released, this information is folded into the security suite, allowing companies to auto-remediate issues.”

A visual analysis of current security posture: Data from Sentinel and Defender is used to create a company’s Microsoft Secure Score. “Microsoft Secure Score is like a credit score for organizational security,” Carrico says. “It helps companies test, tweak and tune operations to improve their security posture.”

A Future Where All Your Data Is Safe in the Cloud

To help companies see firsthand how these tools work together, CDW has developed a push-button deployment of Azure Sentinel and Microsoft Defender used to show threat detection in a “war games”-style demonstration.

UP NEXT: An expert shares three tips to ensure a smooth cloud migration.

Teams need a single-pane-of-glass security solution that covers all aspects of business IT, say Carrico and Harvey. It’s about considering onsite infrastructure and edge computing as much as multiple clouds and artificial intelligence capabilities.

Once a business invests in this SecOps platform, IT leaders receive a hands-on demonstration, followed by an assessment to identify the tools that improve security posture and meet compliance obligations. Once deployed, and with the help of CDW’s experts, Microsoft Sentinel gives teams the transparency and control they need to protect multicloud environments.

Brought to you by: