Merge pull request #53753 from ceperezb/CEPEREZB-sc100-secure-organizational-data

Carolyn135 · web-flow · commit 560a0058c720 · 2026-03-10T10:40:48.000Z
new unit and other updates
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/0-introduction.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/0-introduction.yml
@@ -4,7 +4,7 @@ title: Introduction
 metadata:
   title: Introduction
   description: "Introduction to the module on designing solutions for securing an organization's data."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/1-introduction-data-security.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/1-introduction-data-security.yml
@@ -4,7 +4,7 @@ title: Data security design principles and frameworks
 metadata:
   title: Data security design principles and frameworks
   description: "SC-100 preparatory unit on the topic: data security design principles and frameworks."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/2-design-solution-data-discovery-classification-microsoft-purview.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/2-design-solution-data-discovery-classification-microsoft-purview.yml
@@ -4,7 +4,7 @@ title: Evaluate solutions for data discovery and classification
 metadata:
   title: Evaluate solutions for data discovery and classification
   description: "SC-100 preparatory unit on the topic: Evaluate solutions for data discovery and classification."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/2a-specify-priorities-mitigating-threats-data.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/2a-specify-priorities-mitigating-threats-data.yml
@@ -0,0 +1,14 @@
+### YamlMime:ModuleUnit
+uid: learn.wwl.design-solutions-secure-organization-data.specify-priorities-mitigating-threats-data
+title: Specify priorities for mitigating threats to data
+metadata:
+  title: Specify priorities for mitigating threats to data
+  description: "SC-100 preparatory unit on the topic: Specify priorities for mitigating threats to data."
+  ms.date: 03/10/2026
+  author: ceperezb
+  ms.author: ceperezb
+  ms.topic: unit
+  ai-usage: ai-generated
+durationInMinutes: 11
+content: |
+  [!include[](includes/2a-specify-priorities-mitigating-threats-data.md)]
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/3-design-solution-data-protection.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/3-design-solution-data-protection.yml
@@ -4,7 +4,7 @@ title: Evaluate solutions for encryption of data at rest and in transit, includi
 metadata:
   title: Evaluate solutions for encryption of data at rest and in transit, including Azure KeyVault and infrastructure encryption
   description: "SC-100 preparatory unit on the topic: Evaluate solutions for encryption of data at rest and in transit, including Azure KeyVault and infrastructure encryption."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/4-design-data-security-azure-workloads.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/4-design-data-security-azure-workloads.yml
@@ -4,7 +4,7 @@ title: Design data security for Azure workloads
 metadata:
   title: Design data security for Azure workloads
   description: "SC-100 preparatory unit on the topic: design data security for Azure workloads."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/4a-design-security-data-ai-workloads.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/4a-design-security-data-ai-workloads.yml
@@ -4,7 +4,7 @@ title: Design security for data used in AI workloads
 metadata:
   title: Design security for data used in AI workloads
   description: "SC-100 preparatory unit on the topic: Design security for data used in AI workloads."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/5-design-security-azure-storage.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/5-design-security-azure-storage.yml
@@ -4,7 +4,7 @@ title: Design security for Azure Storage
 metadata:
   title: Design security for Azure Storage
   description: "SC-100 preparatory unit on the topic: design security for Azure Storage."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/6-design-security-defender-sql-storage.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/6-design-security-defender-sql-storage.yml
@@ -4,7 +4,7 @@ title: Design a security solution with Microsoft Defender for SQL and Microsoft
 metadata:
   title: Design a security solution with Microsoft Defender for SQL and Microsoft Defender for Storage
   description: "SC-100 preparatory unit on the topic: Design a security solution with Microsoft Defender for SQL and Microsoft Defender for Storage."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/7-knowledge-check.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/7-knowledge-check.yml
@@ -4,12 +4,10 @@ title: Module assessment
 metadata:
   title: Module assessment
   description: "Knowledge check for module on the topic: design solutions for securing an organization's data."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
-  content_well_notification: 
-    - AI-contribution
   ai-usage: ai-generated
   module_assessment: true
 durationInMinutes: 3
@@ -43,7 +41,7 @@ quiz:
           explanation: Data encryption does not reduce the cost of storing data, but it is essential to secure data against unauthorized access.
         - content: To improve the performance of applications that use data.
           isCorrect: false
-          explanation: Data encryption does not improve the performance of applications that use data, but it can have a small impact on performance due to the additional overhead of encryption and decryption.
+          explanation: Data encryption does not improve the performance of applications that use data, but it can have a small impact on performance due to the extra overhead of encryption and decryption.
     - content: What are the benefits of using Azure Key Vault for data encryption in Azure?
       choices:
         - content: It provides a centralized key management solution.
@@ -79,10 +77,10 @@ quiz:
           explanation: Microsoft Defender for Azure SQL can detect and block SQL injection attacks, which are a common type of attack that exploits vulnerabilities in SQL code to gain unauthorized access to databases.
         - content: Network bandwidth throttling attacks
           isCorrect: false
-          explanation: Network bandwidth throttling attacks are not specifically related to SQL Server security and are not within the scope of Microsoft Defender for Azure SQL.
+          explanation: Network bandwidth throttling attacks are not related to SQL Server security and are not within the scope of Microsoft Defender for Azure SQL.
         - content: Distributed denial of service (DDoS) attacks
           isCorrect: false
-          explanation: While DDoS attacks can be a threat to any cloud-based service, they are not specifically related to SQL Server security and are not within the scope of Microsoft Defender for Azure SQL.
+          explanation: While DDoS attacks can be a threat to any cloud-based service, they are not related to SQL Server security and are not within the scope of Microsoft Defender for Azure SQL.
         - content: Physical server theft
           isCorrect: false
           explanation: Microsoft Defender for Azure SQL is a cloud based technology that does offer physical security.
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/8-summary.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/8-summary.yml
@@ -4,7 +4,7 @@ title: Summary
 metadata:
   title: Summary
   description: "Summary of a module on the topic: design solutions for securing an organization's data."
-  ms.date: 01/26/2026
+  ms.date: 03/10/2026
   author: ceperezb
   ms.author: ceperezb
   ms.topic: unit
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/2a-specify-priorities-mitigating-threats-data.md b/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/2a-specify-priorities-mitigating-threats-data.md
@@ -0,0 +1,87 @@
+Organizations face dozens of potential data threats—from exfiltration and insider misuse to encryption weaknesses and key compromise—but limited resources mean not every threat can be addressed at once. A cybersecurity architect must specify which mitigations to implement first, which can be deferred, and why. This unit presents three complementary inputs for making those prioritization decisions:
+
+- **MCSB v2 criticality levels** establish a baseline priority for each data protection control.
+- **MITRE ATT&CK mappings and Defender for Cloud risk signals** adjust those priorities based on the threat landscape and environmental context.
+- **A defense-in-depth layered model** translates the resulting priorities into a sequenced implementation roadmap.
+
+## Baseline priorities: MCSB v2 data protection controls
+
+The first step in specifying priorities is to understand which controls matter most by default. The [MCSB v2 data protection domain](/security/benchmark/azure/mcsb-v2-data-protection) defines eight controls organized into three pillars, each with a criticality level that directly informs implementation order. The criticality values—"Must have" (essential for baseline security), "Should have" (important for enhanced security), and "Nice to have" (beneficial for advanced scenarios)—give architects a starting point: all seven "Must have" controls take precedence over the single "Should have" control.
+
+### Know and classify your data
+
+- **DP-1 (Discover, classify, and label sensitive data)**—*Must have*—Establish a comprehensive inventory of sensitive data across all repositories. Without foundational classification, governance controls (DLP, conditional access, encryption workflows) cannot trigger. Risk: untracked regulated data (PCI, PHI, PII) bypasses required controls and over-privileged access persists because sensitivity and business impact aren't identified.
+- **DP-2 (Monitor anomalies and threats targeting sensitive data)**—*Must have*—Detect silent exfiltration, insider misuse, and data staging that bypass coarse monitoring. DLP solutions and behavior analytics are essential to identify abnormal access patterns before data leaves the organization.
+
+### Protect data with encryption
+
+- **DP-3 (Encrypt sensitive data in transit)**—*Must have*—Enforce TLS 1.2 or higher for all network communications. Mitigates passive interception, man-in-the-middle attacks, protocol downgrade, and session hijacking that expose credentials and regulated data in plaintext.
+- **DP-4 (Enable data at rest encryption by default)**—*Must have*—Ensure all data stores use encryption at rest with AES-256. Mitigates unauthorized data access from storage compromise, theft of physical media, and improper decommissioning.
+- **DP-5 (Use customer-managed keys when required)**—*Should have*—Implement when regulations demand demonstrated control over key custody, rotation, and revocation. Provides stronger proof of data sovereignty but introduces operational overhead.
+
+### Manage cryptographic infrastructure
+
+- **DP-6 (Use a secure key management process)**—*Must have*—Centralize key lifecycle in Azure Key Vault. Mitigates key sprawl, stale cryptography, privilege overreach, and failed revocation—risks that undermine all other encryption controls.
+- **DP-7 (Use a secure certificate management process)**—*Must have*—Automate certificate lifecycle including issuance, renewal, and revocation. Expired or misconfigured certificates cause service outages and create bypass opportunities for attackers.
+- **DP-8 (Ensure security of key and certificate repository)**—*Must have*—Harden vault access with least-privilege RBAC, network isolation, soft delete, purge protection, and comprehensive logging. Repository compromise nullifies all upstream encryption and signing assurances.
+
+The criticality levels above represent Microsoft's general guidance. However, the right priority order for a specific organization depends on which threats are most likely and most impactful in that environment.
+
+## Adjusting priorities with threat intelligence
+
+MCSB v2 criticality levels set the baseline, but architects should raise or lower the priority of specific controls based on which attack techniques their environment is most exposed to. Mapping each DP control to [MITRE ATT&CK](https://attack.mitre.org/) tactics provides the threat intelligence needed to make those adjustments:
+
+| ATT&CK tactic | Techniques | Related DP controls |
+|---------------|-----------|-------------------|
+| **Credential Access (TA0006)** | Credential stores (T1555), unsecured credentials (T1552) | DP-6, DP-8 |
+| **Collection (TA0009)** | Data from cloud storage (T1530) | DP-1, DP-4 |
+| **Exfiltration (TA0010)** | Exfiltration over web services (T1567), automated exfiltration (T1020) | DP-2, DP-3 |
+| **Defense Evasion (TA0005)** | Weaken encryption (T1600), adversary-in-the-middle (T1557) | DP-3, DP-6, DP-8 |
+| **Impact (TA0040)** | Data destruction (T1485), inhibit recovery (T1490) | DP-8 |
+
+**How to use this mapping for prioritization**: If threat intelligence or incident history shows that exfiltration (TA0010) is the dominant risk in your environment, elevate DP-2 (monitoring) and DP-3 (transit encryption) above controls that address less likely tactics. If credential theft (TA0006) is the primary concern, prioritize DP-6 and DP-8 (key management and vault hardening) above other controls at the same MCSB criticality level.
+
+## Contextual prioritization with Defender for Cloud
+
+MCSB criticality levels and ATT&CK mappings help set priorities at design time. At runtime, [Microsoft Defender for Cloud](/azure/defender-for-cloud/risk-prioritization) dynamically adjusts priorities based on environmental context—surfacing the specific data resources and vulnerabilities that need attention now. The risk-prioritization engine evaluates four key factors:
+
+- **Internet exposure**: Whether data resources are accessible from the internet
+- **Data sensitivity**: The presence of sensitive or confidential data identified through classification
+- **Lateral movement**: Potential for attackers to move from compromised resources to data stores
+- **Attack paths**: Whether the security issue is part of a potential attack chain that reaches sensitive data
+
+Recommendations are classified into five risk levels: Critical, High, Medium, Low, and Not evaluated. This contextual approach ensures that a vulnerability on an internet-exposed storage account containing personal data is prioritized over the same vulnerability on an isolated internal resource—allowing architects to continuously validate and adjust their mitigation priorities as the environment changes.
+
+### Data-aware prioritization with Defender CSPM
+
+[Defender CSPM](/azure/defender-for-cloud/concept-data-security-posture) integrates Microsoft Purview sensitivity labels into the risk-prioritization engine, enabling three data-aware capabilities:
+
+- **Attack path analysis**: Maps multistep paths from initial entry points to sensitive data stores, letting architects focus on vulnerabilities that are part of a viable attack chain rather than treating all findings equally
+- **Cloud Security Explorer**: Queries the security graph to find specific combinations of risk—for example, storage accounts that are both publicly accessible and contain data labeled as confidential—across multicloud environments
+- **Sensitivity-aware alerting**: Ranks security incidents by the classification level of affected data, so alerts involving regulated or confidential data are triaged before alerts on nonsensitive resources
+
+## Translating priorities into a layered implementation plan
+
+After establishing priorities through MCSB criticality levels, threat intelligence, and Defender for Cloud signals, an architect must translate those priorities into an implementation plan. The [CAF Secure methodology](/azure/cloud-adoption-framework/secure/) recommends organizing controls into defense-in-depth layers aligned with Zero Trust principles. No single control is sufficient—each layer compensates for potential failures in adjacent layers—so the implementation plan must address all layers while respecting the priority order.
+
+| Layer | MCSB controls | Purpose | Key Microsoft capabilities |
+|-------|--------------|---------|------------------------|
+| **Classification** | DP-1 | Discover, classify, and label data to enable all downstream protection policies | Microsoft Purview Data Map, Microsoft Purview Data Catalog, Microsoft Purview Information Protection |
+| **Encryption** | DP-3, DP-4, DP-5 | Protect data confidentiality through transit and at-rest encryption | Azure Storage Service Encryption, Azure SQL TDE, Azure Disk Encryption, Azure Front Door |
+| **Key and certificate management** | DP-6, DP-7, DP-8 | Secure cryptographic material lifecycle with least-privilege access and audit logging | Azure Key Vault, Azure Key Vault Managed HSM |
+| **Monitoring** | DP-2 | Detect anomalies, exfiltration attempts, and insider threats targeting sensitive data | Microsoft Purview DLP, Microsoft Defender for Storage, Microsoft Defender for SQL |
+
+### How layers interact
+
+Classification feeds encryption policy: sensitivity labels determine whether platform-managed or customer-managed keys are required and which DLP rules apply. Encryption depends on key management: if keys are compromised, encryption provides no protection. Monitoring validates all other layers: it detects when classification is missing, encryption is disabled, or key access is anomalous. This interdependence is why the MCSB rates seven of eight DP controls as "Must have"—gaps at any layer weaken the entire stack.
+
+### Recommended implementation sequence
+
+Combining MCSB criticality levels with layer dependencies produces the following recommended sequence for organizations building or maturing a data protection program:
+
+1. **DP-1 first**: All other controls depend on classification—encryption policies, DLP rules, and monitoring alerts cannot target data that hasn't been discovered and labeled.
+2. **DP-3 and DP-4 next**: Transit and at-rest encryption provide the broadest risk reduction per effort and protect data while more targeted controls are implemented.
+3. **DP-6 and DP-8 in parallel**: Encryption is only as strong as its key management—centralizing keys and hardening the vault must follow immediately.
+4. **DP-2 and DP-7 concurrently**: Monitoring detects gaps in the layers above, and certificate lifecycle management prevents operational failures that create bypass opportunities.
+5. **DP-5 last**: Customer-managed keys require mature key management processes (DP-6, DP-8) to be operational—deploying CMK before those processes exist increases risk rather than reducing it.
+
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/3-design-solution-data-protection.md b/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/3-design-solution-data-protection.md
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/4-design-data-security-azure-workloads.md b/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/4-design-data-security-azure-workloads.md
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/8-summary.md b/learn-pr/wwl-sci/design-solutions-secure-organization-data/includes/8-summary.md
diff --git a/learn-pr/wwl-sci/design-solutions-secure-organization-data/index.yml b/learn-pr/wwl-sci/design-solutions-secure-organization-data/index.yml
