In this lesson,
we are going to talk about "Managing Sensitive Information".
Now, before we get into the lesson,
first you need to understand
that this is an odds and ends lesson.
And over the next couple of sections,
you're probably going to hear me say that several times.
Basically, there are some exam requirements
that Microsoft has listed
that don't really fit into the natural flow
as we talk about things like Synapse
or Data Factory or whatever.
And so it's kind of an odds and ends lesson.
It is something you need to be aware of.
It's not something that you need
to spend all that much time on,
because it's probably a pretty small requirement
on the exam.
At least that is a good assumption to make.
So in this lesson, we're going to be talking
about some tips to help you secure your environment.
Included in that, we're going to talk about tags,
and isolation, and monitoring, and encryption, and RBAC.
All concepts that you should have some familiarity with,
because we've been talking about them in this course.
So with that, let's get started.
First thing, tagging.
As we talk about tagging,
have you developed a tagging scheme?
In your tagging scheme, you need to be thinking about
how you want to design tagging for your environment.
Some good options for you could be workload name,
or criticality, or business unit, or owner.
So we could have it built based upon:
these are super-critical, these are non-essential.
Or we could have it built on:
these are resources used by Accounting,
and this is resources used by Marketing.
Whatever you choose, you need to have a consistent scheme
that is well thought-out and that is scalable.
Scalable is very important,
because you may have 5 resources now,
but as your business grows,
you may have hundreds or even thousands
of different resources within Azure subscriptions.
So keep that in mind.
Next, isolation.
Separate subscriptions and management groups.
I'll say this again a couple of times in the course.
Subscriptions and management groups
should be set in isolation,
and this is part of that defense in depth.
Basically, you don't want to give someone access
to everything that you have
if there's a breach of security in some facet or form.
If you've separated subscriptions out,
the worst that someone could do is
break into your dev subscription,
or your production subscription even,
but still, it's at least a little bit separated,
and even more so if you've broken it out by,
this is my Accounting subscription, right?
So make sure that you have isolation
built into your environment.
Next, monitoring.
You do have an Azure Monitor plan, right?
You should be thinking about that.
You should be using Azure Monitor, and most likely,
you should be using something like Log Analytics.
Don't forget about monitoring.
Third-party solutions.
You should be looking at third-party solutions, looking at
something like Site24x7, or DataDog, or Dynatrace.
There are tons of different solutions,
but it may provide you an additional level of monitoring,
especially if you're talking about hybrid environments
or environments that are multi-cloud.
Some of these third-party solutions
can be pretty fantastic for that.
Encryption.
You need to be encrypting data at rest and in transit.
Don't forget about multi-cloud
and hybrid scenarios here as well.
It's quite possible that your Azure resources are secure,
but your hybrid resources, or your multi-cloud resources,
something in another cloud, may not be as secure
and may create vulnerabilities within your system.
Make sure that you have a holistic approach
as you look at encryption.
That includes RBAC.
This is preferred across all Azure resources.
Make sure you are using your identity access management.
Make sure that you are defining roles
not just for your employees,
but also for guests or contractors
that may be interacting with your environment.
This provides a really easy way for you
to shut down access or manage who has access
based upon their role.
Some key points to remember as we round out this lesson.
When you're viewing data management,
take a holistic approach. Think about, holistically,
what are you trying to accomplish?
That folds into security.
That folds into data management
as far as in movement and transformation.
That folds into cost and optimization.
Take a holistic approach.
Don't just jump into development.
This is something that's actually really helpful
from a contractor perspective.
Make sure that you have a plan for your data management,
again, as a whole.
And don't forget about the business.
It's really easy, from an IT perspective,
to jump in to the weeds and start thinking
about the technical solutions
while forgetting about the actual business need,
which is what you're there to solve.
So make sure that you're thinking
about the business need first, and then creating
a holistic plan before you just jump into development,
and start thinking about what schema you need.
So just a couple of key points to remember.
From the DP-203 perspective, there's not a whole lot here.
I'm just going to be honest with you.
These are more general concepts of data management.
These are listed as requirements on the DP-203, however,
so there you go.
Beyond the DP-203, however, there is a ton
of good information here that you need to know
as you step into your data management role.
So with that, let's end this lesson,
and I'll see you in the next.