cloud-app-security-posture

Name: cloud-app-security-posture
Author: vinayaklatthe

53installs34forks

How to install cloud-app-security-posture?

vinayaklatthe/microsoft-security-skills/cloud-app-security-posture

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill cloud-app-security-posture

Installs into the current project.

Summary

Guidance for cloud and SaaS security posture management - combining Defender for Cloud CSPM (IaaS/PaaS) and Defender for Cloud Apps SSPM (SaaS) to assess and harden posture across cloud and SaaS apps. Covers Secure Score, MCSB, attack-path analysis, SSPM recommendations, and gove

Files · 1

View on GitHub

SKILL.md

1	# Cloud & App Security Posture
2
3	Security posture management spans two complementary layers: CSPM for cloud infrastructure
4	(IaaS/PaaS) via Microsoft Defender for Cloud, and SSPM for SaaS applications via Microsoft
5	Defender for Cloud Apps. Together they continuously reduce misconfiguration risk across the
6	cloud and SaaS estate.
7
8	## When to use
9	Assessing and continuously hardening configuration posture across both cloud infrastructure and
10	SaaS applications - especially when remediation has stalled or when you cannot answer "what
11	should we fix next?".
12
13	Do not use this skill for:
14	- IaaS/PaaS workload threat protection plans (use `defender-for-cloud-hardening`)
15	- SaaS threat detection or shadow-IT discovery only (use `defender-for-cloud-apps`)
16	- DSPM for AI (use `purview-dspm-ai`)
17
18	## Pick the right posture lens
19
20	\| You need to harden... \| Use this \| Surface \|
21	\|---\|---\|---\|
22	\| Azure subscriptions, AWS accounts, GCP projects \| Defender for Cloud CSPM \| Defender for Cloud → Recommendations \|
23	\| Internet-exposed VMs / data with toxic combinations \| Defender CSPM (paid) + attack-path \| Defender for Cloud → Attack path analysis \|
24	\| Microsoft 365, Salesforce, ServiceNow, GitHub config \| Defender for Cloud Apps SSPM \| Defender XDR → Cloud apps → Posture \|
25	\| Container / Kubernetes posture \| Defender CSPM container plan \| Defender for Cloud → Cloud security graph \|
26	\| Code / IaC misconfiguration \| DevOps security in Defender for Cloud \| Defender for Cloud → DevOps \|
27	\| Identity hygiene gaps in the cloud \| Identity recommendations (CIEM) \| Defender for Cloud + Entra Permissions Mgmt \|
28
29	> Rule of thumb: Foundation CSPM is free with the Defender for Cloud plan and gives you
30	> Secure Score + MCSB recommendations. The paid Defender CSPM plan adds attack-path
31	> analysis, the cloud security graph, agentless scanning, and DevOps - enable it for any
32	> environment where you need to prioritise by exploitability, not by count.
33
34	## Approach
35
36	1. Enable foundation CSPM everywhere - Turn on Defender for Cloud across all Azure
37	subscriptions, connect AWS accounts and GCP projects, and confirm **Microsoft Cloud Security
38	Benchmark (MCSB) recommendations and Secure Score** are populating.
39	*Verify: Defender for Cloud → Inventory shows all subscriptions/accounts; Secure Score is
40	non-zero per scope.*
41	2. Turn on Defender CSPM (paid) for high-value scopes - Enable the paid plan on
42	subscriptions/accounts holding internet-exposed workloads or sensitive data to unlock
43	attack-path analysis and the cloud security graph. Foundation CSPM alone tells you
44	what is misconfigured; Defender CSPM tells you which misconfigurations form an exploitable
45	chain.
46	*Verify: Attack path analysis page lists at least one path; you can trace a path from
47	internet to sensitive data.*
48	3. Enable SSPM in Defender for Cloud Apps - Connect each SaaS app (Microsoft 365,
49	Salesforce, ServiceNow, GitHub, Okta, etc.) via API connector. SSPM recommendations cover
50	admin controls, MFA settings, sharing exposure, and inactive privileged users per app.
51	*Verify: Defender XDR → Cloud apps → Posture shows recommendations per connected app, not
52	just discovery.*
53	4. Prioritise by exposure and impact - Rank remediations by: internet exposure, sensitive
54	data, privileged identity, and attack-path criticality. Use the cloud security graph to
55	group recommendations that break the same path.
56	*Verify: top 10 remediation list is not the top 10 by recommendation count but the top 10
57	by risk-weighted impact.*
58	5. Assign owners and SLAs - Recommendations without an owner do not get fixed. Route by
59	workload (subscription tag, resource group, SaaS app owner) into your ticketing system with
60	a remediation SLA based on severity.
61	*Verify: ticket count per workload owner is visible; aging report shows median time to
62	close per severity.*
63	6. Enforce and automate where safe - Use Azure Policy to prevent regression of fixed
64	configurations (deny new resources without encryption, block public IP creation in tagg

People who liked this also viewed

6 picks

Type

cloud-app-security-posture

53installs34forks

View on GitHub

How to install cloud-app-security-posture?

vinayaklatthe/microsoft-security-skills/cloud-app-security-posture

$npx -y skills add vinayaklatthe/microsoft-security-skills --skill cloud-app-security-posture

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Cloud & App Security Posture
2
3	Security posture management spans two complementary layers: CSPM for cloud infrastructure
4	(IaaS/PaaS) via Microsoft Defender for Cloud, and SSPM for SaaS applications via Microsoft
5	Defender for Cloud Apps. Together they continuously reduce misconfiguration risk across the
6	cloud and SaaS estate.
7
8	## When to use
9	Assessing and continuously hardening configuration posture across both cloud infrastructure and
10	SaaS applications - especially when remediation has stalled or when you cannot answer "what
11	should we fix next?".
12
13	Do not use this skill for:
14	- IaaS/PaaS workload threat protection plans (use `defender-for-cloud-hardening`)
15	- SaaS threat detection or shadow-IT discovery only (use `defender-for-cloud-apps`)
16	- DSPM for AI (use `purview-dspm-ai`)
17
18	## Pick the right posture lens
19
20	\| You need to harden... \| Use this \| Surface \|
21	\|---\|---\|---\|
22	\| Azure subscriptions, AWS accounts, GCP projects \| Defender for Cloud CSPM \| Defender for Cloud → Recommendations \|
23	\| Internet-exposed VMs / data with toxic combinations \| Defender CSPM (paid) + attack-path \| Defender for Cloud → Attack path analysis \|
24	\| Microsoft 365, Salesforce, ServiceNow, GitHub config \| Defender for Cloud Apps SSPM \| Defender XDR → Cloud apps → Posture \|
25	\| Container / Kubernetes posture \| Defender CSPM container plan \| Defender for Cloud → Cloud security graph \|
26	\| Code / IaC misconfiguration \| DevOps security in Defender for Cloud \| Defender for Cloud → DevOps \|
27	\| Identity hygiene gaps in the cloud \| Identity recommendations (CIEM) \| Defender for Cloud + Entra Permissions Mgmt \|
28
29	> Rule of thumb: Foundation CSPM is free with the Defender for Cloud plan and gives you
30	> Secure Score + MCSB recommendations. The paid Defender CSPM plan adds attack-path
31	> analysis, the cloud security graph, agentless scanning, and DevOps - enable it for any
32	> environment where you need to prioritise by exploitability, not by count.
33
34	## Approach
35
36	1. Enable foundation CSPM everywhere - Turn on Defender for Cloud across all Azure
37	subscriptions, connect AWS accounts and GCP projects, and confirm **Microsoft Cloud Security
38	Benchmark (MCSB) recommendations and Secure Score** are populating.
39	*Verify: Defender for Cloud → Inventory shows all subscriptions/accounts; Secure Score is
40	non-zero per scope.*
41	2. Turn on Defender CSPM (paid) for high-value scopes - Enable the paid plan on
42	subscriptions/accounts holding internet-exposed workloads or sensitive data to unlock
43	attack-path analysis and the cloud security graph. Foundation CSPM alone tells you
44	what is misconfigured; Defender CSPM tells you which misconfigurations form an exploitable
45	chain.
46	*Verify: Attack path analysis page lists at least one path; you can trace a path from
47	internet to sensitive data.*
48	3. Enable SSPM in Defender for Cloud Apps - Connect each SaaS app (Microsoft 365,
49	Salesforce, ServiceNow, GitHub, Okta, etc.) via API connector. SSPM recommendations cover
50	admin controls, MFA settings, sharing exposure, and inactive privileged users per app.
51	*Verify: Defender XDR → Cloud apps → Posture shows recommendations per connected app, not
52	just discovery.*
53	4. Prioritise by exposure and impact - Rank remediations by: internet exposure, sensitive
54	data, privileged identity, and attack-path criticality. Use the cloud security graph to
55	group recommendations that break the same path.
56	*Verify: top 10 remediation list is not the top 10 by recommendation count but the top 10
57	by risk-weighted impact.*
58	5. Assign owners and SLAs - Recommendations without an owner do not get fixed. Route by
59	workload (subscription tag, resource group, SaaS app owner) into your ticketing system with
60	a remediation SLA based on severity.
61	*Verify: ticket count per workload owner is visible; aging report shows median time to
62	close per severity.*
63	6. Enforce and automate where safe - Use Azure Policy to prevent regression of fixed
64	configurations (deny new resources without encryption, block public IP creation in tagg

People who liked this also viewed

6 picks

Type