azure-security-benchmark

Name: azure-security-benchmark
Author: vinayaklatthe

55installs34forks

How to install azure-security-benchmark?

vinayaklatthe/microsoft-security-skills/azure-security-benchmark

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-security-benchmark

Installs into the current project.

Summary

Guidance for the Microsoft Cloud Security Benchmark (MCSB) — Microsoft's canonical set of cloud security best-practice controls mapped to industry frameworks and monitored in Microsoft Defender for Cloud. Covers control domains, applying the benchmark, and compliance tracking. WH

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Cloud Security Benchmark (MCSB)
2
3	The Microsoft Cloud Security Benchmark (MCSB, successor to the Azure Security Benchmark) is
4	Microsoft's canonical, prescriptive set of cloud security best practices, with controls mapped
5	to CIS, NIST SP 800-53, PCI DSS, and ISO 27001, and monitored natively in Microsoft Defender
6	for Cloud. MCSB is the default initiative in Defender for Cloud - you are already being
7	scored against it.
8
9	## When to use
10	Use this skill when the user wants a recognised, framework-mapped cloud security baseline,
11	needs to translate compliance obligations into concrete Azure controls, or is trying to
12	prioritise where to start with Defender for Cloud recommendations.
13
14	Do not use this skill for:
15	- Tactical Defender for Cloud remediation work (use `defender-for-cloud-hardening`)
16	- Azure Policy authoring details (use `azure-policy`)
17	- Workload-specific threat modelling (use `threat-modelling`)
18
19	## Pick the right MCSB control domain first
20
21	MCSB has 12 control domains. Do not try to fix them in parallel - pick by risk + dependency:
22
23	\| Priority \| Domain \| Why this order \| Typical first action \|
24	\|---\|---\|---\|---\|
25	\| P0 \| Identity Management + Privileged Access \| Identity is the new perimeter; admin compromise = game over \| Enforce MFA, remove standing Global Admin via PIM \|
26	\| P0 \| Logging & Threat Detection \| Cannot respond without visibility \| Enable diagnostic settings on subscriptions + Sentinel/Defender \|
27	\| P1 \| Network Security \| Reduces blast radius of compromised identities \| Default-deny NSGs, private endpoints for PaaS \|
28	\| P1 \| Data Protection \| Encryption, key management, classification \| Customer-managed keys for crown-jewel data, sensitivity labels \|
29	\| P1 \| Asset Management \| Cannot protect what you cannot see \| Tag policy + resource inventory \|
30	\| P2 \| Posture & Vulnerability Management \| Continuous improvement loop \| Onboard Defender for Servers, weekly Secure Score review \|
31	\| P2 \| Endpoint Security + Backup & Recovery \| Resilience baseline \| Defender for Endpoint + Azure Backup with immutable vault \|
32	\| P2 \| Incident Response \| Process maturity \| Runbook + tabletop with Defender XDR / Sentinel \|
33	\| P3 \| DevOps Security \| Shift-left controls \| GitHub Advanced Security or Azure DevOps with Defender for DevOps \|
34	\| P3 \| Governance & Strategy \| Sustains the others \| Azure Policy + management group structure \|
35
36	> Rule of thumb: an MCSB Secure Score of 65-75% is a realistic working target for a
37	> mature tenant; >85% typically means you are auditing recommendations that do not apply
38	> to your workloads. Validate before chasing 100%.
39
40	## Approach
41
42	1. Confirm MCSB is the active baseline — In Defender for Cloud → Regulatory compliance,
43	MCSB is enabled by default but a tenant may have disabled it. Re-enable if missing.
44	*Verify: Regulatory compliance dashboard shows "Microsoft cloud security benchmark" as an
45	active standard with current pass/fail percentages.*
46	2. Baseline your Secure Score — Note current score per subscription and per control domain.
47	This is the number you will move; without a baseline you cannot prove progress to leadership.
48	Verify: screenshot or export of Secure Score per subscription before remediation starts.
49	3. Map MCSB to the frameworks you are obligated to — Do not treat CIS, NIST, ISO, PCI as
50	separate workstreams. Use MCSB as the canonical implementation and the per-framework
51	mappings to evidence compliance. Reduces 4 audits worth of work to 1.
52	*Verify: Regulatory compliance dashboard shows your obligated frameworks alongside MCSB
53	with overlap visible.*
54	4. Triage by the priority table above — Work P0 domains across all subscriptions first.
55	Within each domain, sort recommendations by Secure Score impact (descending) and
56	affected resources (descending). Top 5 per domain = quarter's work for most teams.
57	5. Use service baselines for the implementation detail — MCSB controls are abstract
58	("Enable encryption in transit"). The per-service security baselines translate to
59	concrete Azure config (e.g. App Service: TLS 1.2 minimum, HTTPS-only on). Always read the
60	service baseline before designing the fix.
61	Verify: a deployed resource passes its service baseline check in Defender for Cloud.
62	6. Enforce with Azure Policy — Recommendat

People who liked this also viewed

6 picks

Type

azure-security-benchmark

55installs34forks

View on GitHub

How to install azure-security-benchmark?

vinayaklatthe/microsoft-security-skills/azure-security-benchmark

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill azure-security-benchmark

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Cloud Security Benchmark (MCSB)
2
3	The Microsoft Cloud Security Benchmark (MCSB, successor to the Azure Security Benchmark) is
4	Microsoft's canonical, prescriptive set of cloud security best practices, with controls mapped
5	to CIS, NIST SP 800-53, PCI DSS, and ISO 27001, and monitored natively in Microsoft Defender
6	for Cloud. MCSB is the default initiative in Defender for Cloud - you are already being
7	scored against it.
8
9	## When to use
10	Use this skill when the user wants a recognised, framework-mapped cloud security baseline,
11	needs to translate compliance obligations into concrete Azure controls, or is trying to
12	prioritise where to start with Defender for Cloud recommendations.
13
14	Do not use this skill for:
15	- Tactical Defender for Cloud remediation work (use `defender-for-cloud-hardening`)
16	- Azure Policy authoring details (use `azure-policy`)
17	- Workload-specific threat modelling (use `threat-modelling`)
18
19	## Pick the right MCSB control domain first
20
21	MCSB has 12 control domains. Do not try to fix them in parallel - pick by risk + dependency:
22
23	\| Priority \| Domain \| Why this order \| Typical first action \|
24	\|---\|---\|---\|---\|
25	\| P0 \| Identity Management + Privileged Access \| Identity is the new perimeter; admin compromise = game over \| Enforce MFA, remove standing Global Admin via PIM \|
26	\| P0 \| Logging & Threat Detection \| Cannot respond without visibility \| Enable diagnostic settings on subscriptions + Sentinel/Defender \|
27	\| P1 \| Network Security \| Reduces blast radius of compromised identities \| Default-deny NSGs, private endpoints for PaaS \|
28	\| P1 \| Data Protection \| Encryption, key management, classification \| Customer-managed keys for crown-jewel data, sensitivity labels \|
29	\| P1 \| Asset Management \| Cannot protect what you cannot see \| Tag policy + resource inventory \|
30	\| P2 \| Posture & Vulnerability Management \| Continuous improvement loop \| Onboard Defender for Servers, weekly Secure Score review \|
31	\| P2 \| Endpoint Security + Backup & Recovery \| Resilience baseline \| Defender for Endpoint + Azure Backup with immutable vault \|
32	\| P2 \| Incident Response \| Process maturity \| Runbook + tabletop with Defender XDR / Sentinel \|
33	\| P3 \| DevOps Security \| Shift-left controls \| GitHub Advanced Security or Azure DevOps with Defender for DevOps \|
34	\| P3 \| Governance & Strategy \| Sustains the others \| Azure Policy + management group structure \|
35
36	> Rule of thumb: an MCSB Secure Score of 65-75% is a realistic working target for a
37	> mature tenant; >85% typically means you are auditing recommendations that do not apply
38	> to your workloads. Validate before chasing 100%.
39
40	## Approach
41
42	1. Confirm MCSB is the active baseline — In Defender for Cloud → Regulatory compliance,
43	MCSB is enabled by default but a tenant may have disabled it. Re-enable if missing.
44	*Verify: Regulatory compliance dashboard shows "Microsoft cloud security benchmark" as an
45	active standard with current pass/fail percentages.*
46	2. Baseline your Secure Score — Note current score per subscription and per control domain.
47	This is the number you will move; without a baseline you cannot prove progress to leadership.
48	Verify: screenshot or export of Secure Score per subscription before remediation starts.
49	3. Map MCSB to the frameworks you are obligated to — Do not treat CIS, NIST, ISO, PCI as
50	separate workstreams. Use MCSB as the canonical implementation and the per-framework
51	mappings to evidence compliance. Reduces 4 audits worth of work to 1.
52	*Verify: Regulatory compliance dashboard shows your obligated frameworks alongside MCSB
53	with overlap visible.*
54	4. Triage by the priority table above — Work P0 domains across all subscriptions first.
55	Within each domain, sort recommendations by Secure Score impact (descending) and
56	affected resources (descending). Top 5 per domain = quarter's work for most teams.
57	5. Use service baselines for the implementation detail — MCSB controls are abstract
58	("Enable encryption in transit"). The per-service security baselines translate to
59	concrete Azure config (e.g. App Service: TLS 1.2 minimum, HTTPS-only on). Always read the
60	service baseline before designing the fix.
61	Verify: a deployed resource passes its service baseline check in Defender for Cloud.
62	6. Enforce with Azure Policy — Recommendat

People who liked this also viewed

6 picks

Type