ETWorkshops

Challenge 1: We don’t know what we don’t know

Objective: Enable EPM and Onboard Azure

Details: Your CISO attended a summit in Redmond last month and heard about other organisations looking at their cloud permissions to prevent the risk of overprovisioning. They discussed potential risk, however because your CISO could not attend the full workshop, she’s asked your team to explore the risk area, and assess where Contoso Mortgage stands from exposure perspective.

To complete this challenge, you should understand what cloud infrastructure permission risk is and how it impacts an organisation like Contoso Mortgage, which has cloud-first mindset and plans to move many of their services to public cloud. Your CISO heard about a product called Entra Permissions Management, you should evaluate how to enable it for your organisation and get some insights on current state of cloud permissions.

Your CISO expects to know how to evaluate the risk, get some details about where the gaps are, and next steps to remediate that.

He will use this information to present a case back to senior management, while your team continues to evaluate the solution.

Success Criteria:

  1. Explain the problem space
  2. Onboard the main production subscription to EPM
  3. Identify PCI rating for Azure subscription
  4. Explain the top 3 finding categories and present split between human and non-human identities

References:


Introduction Background Challenge 1 Challenge 2 Challenge 3 Challenge 4 Challenge 5 Summmary
link link link link link link link link