You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-resiliency-strategy-common-cyberthreats-like-ransomware/1-common-cyberthreats-attack-patterns.yml
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -4,10 +4,10 @@ title: Common cyberthreats and attack patterns
4
4
metadata:
5
5
title: Common cyberthreats and attack patterns
6
6
description: "You'll learn about common cyberthreats like ransomware and what kinds of attack patterns an organization must be prepared for."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-resiliency-strategy-common-cyberthreats-like-ransomware/2-support-business-resiliency.yml
+2-2Lines changed: 2 additions & 2 deletions
Original file line number
Diff line number
Diff line change
@@ -4,10 +4,10 @@ title: Support business resiliency
4
4
metadata:
5
5
title: Support business resiliency
6
6
description: "Learn how to support business resiliency."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-resiliency-strategy-common-cyberthreats-like-ransomware/3-ransomware-protection.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ title: Design solutions for mitigating ransomware attacks, including prioritizat
4
4
metadata:
5
5
title: Design solutions for mitigating ransomware attacks, including prioritization of BCDR and privileged access
6
6
description: "Learn Microsoft best practices for ransomware protection."
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-resiliency-strategy-common-cyberthreats-like-ransomware/4-configurations-secure-backup-restore.yml
+1-1Lines changed: 1 addition & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -4,7 +4,7 @@ title: Design solutions for business continuity and disaster recovery (BCDR), i
4
4
metadata:
5
5
title: Design solutions for business continuity and disaster recovery (BCDR), including secure backup and restore
6
6
description: "Learn how to design solutions for business continuity and disaster recovery (BCDR), including secure backup and restore."
This module covers common cyberthreats, business resiliency, secure backup and restore configurations, and security update management.
2
+
3
+
Imagine that you work for a medium-sized company that has recently experienced a ransomware attack. The attack has caused significant damage to the company's systems and data, and the company is struggling to recover. As a cybersecurity architect, you've been tasked with designing a comprehensive resiliency strategy that protects against ransomware and other attacks. In this module, you learn how to identify and prioritize threats to business-critical assets, design solutions for business continuity and disaster recovery (BCDR) including secure backup and restore for hybrid and multicloud environments, implement ransomware mitigation strategies with emphasis on privileged access protection, and evaluate solutions for security updates. You'll also discover how AI-powered security operations can accelerate threat detection and response.
4
+
5
+
## Learning objectives
6
+
7
+
In this module, you learn how to:
8
+
9
+
* Understand common cyberthreats like ransomware and attack patterns organizations must defend against.
10
+
* Design security strategies to support business resiliency goals, including identifying and prioritizing threats to business-critical assets.
11
+
* Design solutions for mitigating ransomware attacks, including prioritization of BCDR and privileged access protection.
12
+
* Design solutions for business continuity and disaster recovery (BCDR), including secure backup and restore for hybrid and multicloud environments.
13
+
* Evaluate solutions for security updates.
14
+
15
+
The content in the module helps you prepare for the certification exam SC-100: Microsoft Cybersecurity Architect.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-resiliency-strategy-common-cyberthreats-like-ransomware/includes/1-common-cyberthreats-attack-patterns.md
+2-24Lines changed: 2 additions & 24 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,26 +1,4 @@
1
-
This module covers common cyberthreats, business resiliency, secure backup and restore configurations, and security update management.
2
1
3
-
Imagine that you work for a medium-sized company that has recently experienced a ransomware attack. The attack has caused significant damage to the company's systems and data, and the company is struggling to recover. As a cybersecurity architect, you have been tasked with designing a comprehensive backup and restore plan that will help the company recover from future attacks. In this module, you'll learn how to design secure backup and restore configurations using Azure Backup, and how to integrate with Configuration Manager for on-premises resources. You'll also learn how to manage security updates using Update Management and how to support business resiliency in the face of cyberthreats.
4
-
5
-
The module is divided into four sections: Understanding Cyberthreats, Designing Secure Backup and Restore Configurations, Managing Security Updates, and Supporting Business Resiliency.
6
-
7
-
## Learning objectives
8
-
9
-
In this module, you learn how to:
10
-
11
-
* Understand common cyberthreats like ransomware.
12
-
* Understand how to support business resiliency.
13
-
* Design configurations for secure backup and restore.
14
-
* Design solutions for managing security updates.
15
-
16
-
The content in the module helps you prepare for the certification exam SC-100: Microsoft Cybersecurity Architect.
17
-
18
-
## Prerequisites
19
-
20
-
- Conceptual knowledge of security policies, requirements, zero trust architecture, and management of hybrid environments
21
-
- Working experience with zero trust strategies, applying security policies, and developing security requirements based on business goals
22
-
23
-
## Cyberthreats
24
2
25
3
### What is the threat landscape?
26
4
@@ -43,7 +21,7 @@ An attack vector is an entry point or route for an attacker to gain access to a
43
21
44
22
Here are some examples of common attack vectors:
45
23
46
-
-**Email** is perhaps the most common attack vector. Cybercriminals send seemingly legitimate emails that result in users taking action. This might include downloading a file, or selecting a link that will compromise their device.
24
+
-**Email** is perhaps the most common attack vector. Cybercriminals send seemingly legitimate emails that result in users taking action. This might include downloading a file, or selecting a link that will compromise their device. Advanced AI technologies now enable attackers to create highly convincing phishing emails with proper grammar, context-aware content, and personalized details that make detection more difficult.
47
25
-**Removable media**. An attacker can use media such as USB drives, smart cables, storage cards, and more to compromise a device. For example, attackers might load malicious code into USB devices that are later provided to users as a free gift, or left in public spaces to be found. When they're plugged in, the damage is done.
48
26
-**Browser**. Attackers can use malicious websites or browser extensions to get users to download malicious software on their devices, or change a user's browser settings. The device can then become compromised, providing an entry point to the wider system or network.
49
27
-**Cloud services**. Organizations rely more on cloud services for day-to-day business and processes. Attackers can compromise poorly secured resources or services in the cloud. For example, an attacker could compromise an account in a cloud service, and gain control of any resources or services accessible to that account. They could also gain access to another account with even more permissions.
@@ -55,7 +33,7 @@ Any attack that results in someone gaining unauthorized access to devices, servi
55
33
56
34
Security breaches come in different forms, including the following:
57
35
58
-
- Social engineering attacks - In social engineering, impersonation attacks happen when an unauthorized user (the attacker), aims to gain the trust of an authorized user by posing as a person of authority to access a system from some nefarious activity. For example, a cybercriminal might pretend to be a support engineer to trick a user into revealing their password to access an organization’s systems.
36
+
- Social engineering attacks - In social engineering, impersonation attacks happen when an unauthorized user (the attacker), aims to gain the trust of an authorized user by posing as a person of authority to access a system from some nefarious activity. For example, a cybercriminal might pretend to be a support engineer to trick a user into revealing their password to access an organization's systems. AI-powered tools enable attackers to create convincing deep fake audio or video, making impersonation attacks more sophisticated and harder to detect.
59
37
- Browser attacks - Whether on a desktop, laptop, or phone, browsers are an important access tool for the internet. Security vulnerabilities in a browser can have a significant impact because of their pervasiveness.
60
38
- Password attacks - A password attack is when someone attempts to use authentication for a password-protected account to gain unauthorized access to a device or system. Attackers often use software to speed up the process of cracking and guessing passwords.
Copy file name to clipboardExpand all lines: learn-pr/wwl-sci/design-resiliency-strategy-common-cyberthreats-like-ransomware/includes/2-support-business-resiliency.md
+37-2Lines changed: 37 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,4 +1,4 @@
1
-
An organization can never have perfect security, but it can become resilient to security attacks. Like we are never perfectly immune to all health and safety risks in the physical world, the data and information systems we operate are also never 100 percent safe from all attacks all the time.
1
+
An organization can never have perfect security, but it can become resilient to security attacks. Like we're never perfectly immune to all health and safety risks in the physical world, the data, and information systems we operate are also never 100 percent safe from all attacks, all the time.
2
2
3
3
Focus your security efforts on increasing the resilience of business operations in the face of security incidents. These efforts can reduce risk and enable continuous improvements in security posture and your ability to respond to incidents.
4
4
@@ -19,10 +19,45 @@ Security resiliency is focused on supporting the resiliency of your business.
19
19
20
20
-**Enable your business** to rapidly innovate and adapt to the ever changing business environment. Security should always be seeking safe ways to say _yes_ to business innovation and technology adoption. Your organization can then adapt to unexpected changes in the business environment, like the sudden shift to working from home during COVID-19.
21
21
-**Limit the impact** and likelihood of disruptions before, during, and after active attacks to business operations.
22
+
## Identifying and prioritizing threats to business-critical assets
22
23
24
+
Effective business resiliency requires identifying which assets are most critical to business operations and understanding the threats that could disrupt them. This risk-based approach ensures security investments align with business priorities.
25
+
26
+
Key steps include:
27
+
28
+
1.**Identify business-critical assets**: Work with business stakeholders to determine which systems, data, and processes are essential for maintaining operations. Consider both customer-facing services and internal capabilities. In modern organizations, this increasingly includes:
29
+
- AI and machine learning systems that support business decisions
30
+
- AI-powered customer service and support systems
31
+
- Predictive analytics platforms
32
+
- Automated business process systems
33
+
34
+
2.**Assess threats and vulnerabilities**: For each critical asset, identify the most likely and impactful threats:
35
+
- Ransomware and extortion attacks
36
+
- Distributed denial-of-service (DDoS) attacks
37
+
- Data breaches and exfiltration
38
+
- Insider threats
39
+
- Supply chain compromises
40
+
- AI-specific threats (model poisoning, prompt injection, training data exfiltration)
41
+
- Natural disasters and infrastructure failures
42
+
43
+
3.**Prioritize based on business impact**: Evaluate threats based on:
44
+
- Likelihood of occurrence
45
+
- Potential business impact (financial, operational, reputational, regulatory)
46
+
- Time to recover
47
+
- Complexity of mitigation
48
+
49
+
4.**Map controls to threats**: For each prioritized threat, identify specific security controls and recovery capabilities:
50
+
- Preventive controls to reduce likelihood
51
+
- Detective controls for early warning
52
+
- Response procedures to contain damage
53
+
- Recovery capabilities to restore operations
54
+
55
+
5.**Establish recovery objectives**: Define specific Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for each critical asset based on business requirements, not technical convenience.
56
+
57
+
This threat-informed, business-aligned approach ensures security strategies directly support business resiliency goals rather than implementing generic security measures.
23
58
## Security resilience and assume breach
24
59
25
-
Good security starts with assuming breach or assuming compromise. Understand that information technology (IT) systems operate over the open internet where criminals are constantly attacking and compromising organizations. This assumption is a key principle of zero trust, which drives healthy and pragmatic security behaviors. Zero trust prepares your organization to prevent attacks, limit their damage, and quickly recover from them.
60
+
Good security starts with assuming breach or assuming compromise. Understand that information technology (IT) systems operate over the open internet where criminals are constantly attacking and compromising organizations. This assumption is a key principle of Zero Trust, which drives healthy and pragmatic security behaviors. Zero Trust prepares your organization to prevent attacks, limit their damage, and quickly recover from them.
26
61
27
62
Assuming compromise should drive changes across people, process, and technology in your organization. Education, exercises, and other incident preparation activities are good examples. For more information, see [Incident preparation](/azure/cloud-adoption-framework/organize/cloud-security-incident-preparation).
0 commit comments