1
00:00:00,000 --> 00:00:09,200
Welcome to the Azure Security Podcast,
2
00:00:09,200 --> 00:00:12,360
where we discuss topics relating to security, privacy,
3
00:00:12,360 --> 00:00:16,680
reliability, and compliance on the Microsoft Cloud Platform.
4
00:00:16,680 --> 00:00:20,120
Hey everybody, welcome to Episode 55.
5
00:00:20,120 --> 00:00:22,400
This week is myself, Michael and Sarah.
6
00:00:22,400 --> 00:00:24,800
Glad there's a mark of taking a vacation.
7
00:00:24,800 --> 00:00:26,280
We also have a guest this week,
8
00:00:26,280 --> 00:00:28,840
Matt Sosman, who's here to talk to us about
9
00:00:28,840 --> 00:00:31,080
some of the practicalities of Zero Trust.
10
00:00:31,080 --> 00:00:32,520
But before we get to Matt,
11
00:00:32,520 --> 00:00:34,440
let's take a quick lap around the news.
12
00:00:34,440 --> 00:00:36,120
Sarah, why don't you kick things off?
13
00:00:36,120 --> 00:00:37,800
At the time we're recording this,
14
00:00:37,800 --> 00:00:40,320
it was RSA last week.
15
00:00:40,320 --> 00:00:42,960
I didn't go to RSA this time,
16
00:00:42,960 --> 00:00:46,280
but as you would expect at RSA,
17
00:00:46,280 --> 00:00:48,600
there's quite a few announcements.
18
00:00:48,600 --> 00:00:50,400
The big one, of course,
19
00:00:50,400 --> 00:00:53,960
is we announced Microsoft Entra.
20
00:00:53,960 --> 00:00:59,920
Entra is our suite of identity-based security solutions.
21
00:00:59,920 --> 00:01:02,880
So that includes good old Azure AD,
22
00:01:02,880 --> 00:01:06,320
Microsoft Entra permissions management.
23
00:01:06,320 --> 00:01:09,720
Now that's our Cloud Infrastructure Entitlement Management,
24
00:01:09,720 --> 00:01:10,680
or CIM.
25
00:01:10,680 --> 00:01:13,160
I'm not sure how we're going to say that,
26
00:01:13,160 --> 00:01:14,400
because that's CIM,
27
00:01:14,400 --> 00:01:16,920
but then we have CIM within S as well.
28
00:01:16,920 --> 00:01:19,840
So I know some in the US,
29
00:01:19,840 --> 00:01:22,880
often people say CIM for the one that starts with an S.
30
00:01:22,880 --> 00:01:24,400
I pronounce them the same.
31
00:01:24,400 --> 00:01:26,760
So I guess we'll find out how you pronounce those.
32
00:01:26,760 --> 00:01:29,760
That was, for those of you who are aware,
33
00:01:29,760 --> 00:01:32,040
Microsoft Entra permissions management
34
00:01:32,040 --> 00:01:34,640
is what we're now calling what was Cloud Knox,
35
00:01:34,640 --> 00:01:38,400
which we acquired not too long ago.
36
00:01:38,400 --> 00:01:40,440
And then the other product in there
37
00:01:40,440 --> 00:01:43,000
is Microsoft Entra Verified ID.
38
00:01:43,000 --> 00:01:44,640
So a lot of stuff,
39
00:01:44,640 --> 00:01:48,520
a lot of cool things that we've put into one suite of products.
40
00:01:48,520 --> 00:01:51,160
So there's a lot of,
41
00:01:51,160 --> 00:01:54,240
we'll have links of course in the show notes as usual,
42
00:01:54,240 --> 00:01:56,440
but go check out Entra,
43
00:01:56,440 --> 00:01:58,200
because that is our,
44
00:01:58,200 --> 00:02:00,920
we call it our modern identity and access solutions.
45
00:02:00,920 --> 00:02:03,200
And I'm sure we'll have some people,
46
00:02:03,200 --> 00:02:05,160
in fact, we'll have to go find some people, Michael,
47
00:02:05,160 --> 00:02:07,920
to come on and have a chat to us about that.
48
00:02:07,920 --> 00:02:09,080
For some other announcements,
49
00:02:09,080 --> 00:02:12,120
then we've also got Defender for Cloud.
50
00:02:12,120 --> 00:02:17,320
They have announced that they've now got GA for GCP onboarding.
51
00:02:17,320 --> 00:02:19,120
So if you're using GCP
52
00:02:19,120 --> 00:02:23,320
and you want to use Defender for Cloud to monitor your VMs over there,
53
00:02:23,320 --> 00:02:24,440
you can do that.
54
00:02:24,440 --> 00:02:26,880
And you could do it at the organization level
55
00:02:26,880 --> 00:02:28,560
rather than having to do each project,
56
00:02:28,560 --> 00:02:30,480
which is much nicer.
57
00:02:30,480 --> 00:02:33,720
We've got just-in-time access for AWS VMs.
58
00:02:33,720 --> 00:02:37,920
So it's not just an Azure thing anymore.
59
00:02:37,920 --> 00:02:40,400
I'm not gonna list all of these,
60
00:02:40,400 --> 00:02:45,520
but Defender for Cosmos DB is also GA now.
61
00:02:45,520 --> 00:02:48,880
And I'm gonna jump in and steal Michael's thunder.
62
00:02:48,880 --> 00:02:53,480
We're also, Defender for Cloud is also offering protection
63
00:02:53,480 --> 00:03:00,280
for SQL servers running on AWS EC2, GCP Compute Engine,
64
00:03:00,280 --> 00:03:02,040
and a couple of other ones as well.
65
00:03:02,040 --> 00:03:04,880
So sorry, Michael, I know I shouldn't touch SQL
66
00:03:04,880 --> 00:03:07,720
because that's your baby.
67
00:03:07,720 --> 00:03:09,560
So, yeah, again, I'll link in the show notes.
68
00:03:09,560 --> 00:03:10,360
I'm not gonna...
69
00:03:10,360 --> 00:03:14,160
And then, of course, I've got to finish with my baby Sentinel.
70
00:03:14,160 --> 00:03:16,240
Not as many things to talk about,
71
00:03:16,240 --> 00:03:19,360
but our main thing is that we're really
72
00:03:19,360 --> 00:03:21,720
expanding our solutions marketplace.
73
00:03:21,720 --> 00:03:24,160
That's the thing that comes under Content Hub.
74
00:03:24,160 --> 00:03:26,680
So we've got now...
75
00:03:26,680 --> 00:03:29,280
There's more than 175 solutions.
76
00:03:29,280 --> 00:03:30,480
If you don't know the difference,
77
00:03:30,480 --> 00:03:33,120
I'll just recap because I couldn't not...
78
00:03:33,120 --> 00:03:34,800
If you don't know the difference between a solution
79
00:03:34,800 --> 00:03:36,360
and a data connector,
80
00:03:36,360 --> 00:03:39,160
we used to very much focus on data connectors in Sentinel,
81
00:03:39,160 --> 00:03:41,160
but now we focus on solutions.
82
00:03:41,160 --> 00:03:44,240
So a solution is a data connector.
83
00:03:44,240 --> 00:03:47,520
It can also be workbooks, notebooks,
84
00:03:47,520 --> 00:03:50,040
analytics rules, hunting queries.
85
00:03:50,040 --> 00:03:52,240
A solution is like the whole package of things
86
00:03:52,240 --> 00:03:55,400
that you need to work with a particular data source.
87
00:03:55,400 --> 00:03:58,200
And going forward, we'll definitely be talking
88
00:03:58,200 --> 00:04:00,760
about solutions rather than connectors.
89
00:04:00,760 --> 00:04:02,400
So go and check that out.
90
00:04:02,400 --> 00:04:03,360
We're also...
91
00:04:03,360 --> 00:04:05,760
Another thing that's gonna be really cool
92
00:04:05,760 --> 00:04:08,120
is we're gonna have a unified GitHub community
93
00:04:08,120 --> 00:04:10,760
for our CIM and SOAR and XDR
94
00:04:10,760 --> 00:04:13,440
because you may know, if you spend time in our GitHub,
95
00:04:13,440 --> 00:04:16,560
that Sentinel is currently separate for two defender.
96
00:04:16,560 --> 00:04:18,560
And of course, they are all...
97
00:04:18,560 --> 00:04:19,880
They all work together
98
00:04:19,880 --> 00:04:22,080
and there are overlaps between the two.
99
00:04:22,080 --> 00:04:25,640
So we're actually gonna unify all of that
100
00:04:25,640 --> 00:04:28,880
into a new GitHub community, which is really nice.
101
00:04:28,880 --> 00:04:31,040
And I'm gonna stop there.
102
00:04:31,040 --> 00:04:32,960
That's my news for this time.
103
00:04:32,960 --> 00:04:35,040
Over to you, Michael.
104
00:04:35,040 --> 00:04:37,040
So in case you missed it,
105
00:04:37,040 --> 00:04:41,440
so Sarah just mentioned that SQL Server is my baby.
106
00:04:41,440 --> 00:04:43,640
So even though we announced this,
107
00:04:43,640 --> 00:04:45,440
I announced it briefly in episode 54.
108
00:04:45,440 --> 00:04:48,320
Yes, I've moved over now from working directly
109
00:04:48,320 --> 00:04:52,040
with our customers to the Azure database platform.
110
00:04:52,040 --> 00:04:54,440
So I'm working on SQL Server,
111
00:04:54,440 --> 00:04:58,000
Azure SQL DB, Cosmos DB on the back end,
112
00:04:58,000 --> 00:04:59,760
security compliance, governments,
113
00:04:59,760 --> 00:05:00,640
all that sort of good stuff.
114
00:05:00,640 --> 00:05:03,120
So really nice low level engineering stuff.
115
00:05:03,120 --> 00:05:05,440
So I get to work on code and designs
116
00:05:05,440 --> 00:05:07,120
and threat models and that sort of stuff,
117
00:05:07,120 --> 00:05:09,000
which is right in my wheelhouse.
118
00:05:09,000 --> 00:05:11,240
I'm super excited for that move.
119
00:05:11,240 --> 00:05:12,400
It's also interesting, Sarah,
120
00:05:12,400 --> 00:05:13,760
that you mentioned Microsoft Entra.
121
00:05:13,760 --> 00:05:16,840
So something else that's not been talked about,
122
00:05:16,840 --> 00:05:17,920
but I'll mention it briefly.
123
00:05:17,920 --> 00:05:20,600
So myself and two colleagues,
124
00:05:20,600 --> 00:05:23,080
Heinrich Ganssenbein and Simone Kurtz,
125
00:05:23,080 --> 00:05:25,400
are working on a book for Microsoft Press right now,
126
00:05:25,400 --> 00:05:26,480
tentatively entitled,
127
00:05:26,480 --> 00:05:29,160
Designing and Developing Secure Azure Solutions.
128
00:05:29,160 --> 00:05:31,560
We're on the last chapter right now,
129
00:05:31,560 --> 00:05:33,360
which is actually on identity.
130
00:05:33,360 --> 00:05:35,240
I left it to the last chapter on purpose
131
00:05:35,240 --> 00:05:37,760
because I'm absolutely terrified of the topic.
132
00:05:37,760 --> 00:05:39,160
But as we're sort of writing this thing,
133
00:05:39,160 --> 00:05:41,600
next thing you know, this whole suite of products
134
00:05:41,600 --> 00:05:43,800
comes out that sort of wraps products
135
00:05:43,800 --> 00:05:44,640
that we're talking about,
136
00:05:44,640 --> 00:05:46,360
like as your active directory.
137
00:05:46,360 --> 00:05:47,200
So we've had to go through
138
00:05:47,200 --> 00:05:48,720
and make some little edits to the document.
139
00:05:48,720 --> 00:05:50,800
But yeah, so we're really excited about this book.
140
00:05:50,800 --> 00:05:53,160
Scott Guthrie is writing the forward for the book.
141
00:05:53,160 --> 00:05:56,120
We're gonna be covering design, development,
142
00:05:56,120 --> 00:06:01,120
compliance, cryptography, network for developers.
143
00:06:01,320 --> 00:06:02,920
We're gonna cover the whole gamut.
144
00:06:02,920 --> 00:06:04,480
So I'm really excited for the book to come out.
145
00:06:04,480 --> 00:06:05,640
Not sure the exact date yet,
146
00:06:05,640 --> 00:06:07,680
but yeah, we're on the last chapter right now
147
00:06:07,680 --> 00:06:08,760
in terms of the drafts anyway.
148
00:06:08,760 --> 00:06:10,480
So I'm really excited about that.
149
00:06:10,480 --> 00:06:12,320
So on the topic of news,
150
00:06:12,320 --> 00:06:13,800
so I have a couple of items.
151
00:06:13,800 --> 00:06:16,080
Yes, thank you Sarah for stealing that one from me
152
00:06:16,080 --> 00:06:19,240
about the SQL Server databases on AWS.
153
00:06:19,240 --> 00:06:22,320
But anyway, first one is we now have some new server roles
154
00:06:22,320 --> 00:06:25,360
for Azure SQL Database and SQL Server 2022.
155
00:06:25,360 --> 00:06:27,440
These are in public preview.
156
00:06:27,440 --> 00:06:30,080
They allow you to do certain levels of administration
157
00:06:30,080 --> 00:06:32,880
within the SQL Database without being an admin.
158
00:06:32,880 --> 00:06:34,400
And that is really cool
159
00:06:34,400 --> 00:06:37,920
because that is a great example of least privilege, right?
160
00:06:37,920 --> 00:06:39,520
I mean, historically there are some tasks
161
00:06:39,520 --> 00:06:41,400
that require you basically be the sys admin,
162
00:06:41,400 --> 00:06:43,640
come on in and do all these things.
163
00:06:43,640 --> 00:06:44,800
Well, the problem is a sys admin
164
00:06:44,800 --> 00:06:47,800
has basically unfettered access to absolutely everything.
165
00:06:47,800 --> 00:06:50,080
And that can be really problematic for some customers.
166
00:06:50,080 --> 00:06:53,400
So now we have some new server roles
167
00:06:53,400 --> 00:06:56,320
that will allow you to grant people specific rights
168
00:06:56,320 --> 00:06:58,280
to do certain administrative tasks
169
00:06:58,280 --> 00:07:00,240
without being able to do everything else.
170
00:07:00,240 --> 00:07:04,520
So really granular access and that's really great to see.
171
00:07:04,520 --> 00:07:07,480
Another one, which is another one from SQL Server
172
00:07:07,480 --> 00:07:12,480
is we now have common criteria EAL4 certification
173
00:07:12,520 --> 00:07:15,880
for the SQL 19 series of products.
174
00:07:15,880 --> 00:07:20,000
So EAL4 is a big deal for certain customers,
175
00:07:20,000 --> 00:07:23,520
especially those in governments or in the military.
176
00:07:23,520 --> 00:07:26,480
They require certain levels of assurance.
177
00:07:26,480 --> 00:07:28,040
Notice we say assurance.
178
00:07:28,040 --> 00:07:30,360
There's more to security than just security.
179
00:07:30,360 --> 00:07:33,640
There's basically trustworthyness of the system.
180
00:07:33,640 --> 00:07:36,680
And so we've now attained the EAL4 certification.
181
00:07:36,680 --> 00:07:40,720
Again, I'll provide notes for that in the show notes.
182
00:07:40,720 --> 00:07:43,000
We now also have, funnily enough,
183
00:07:43,000 --> 00:07:45,720
another SQL related news item.
184
00:07:45,720 --> 00:07:49,280
We now have import and export of SQL database
185
00:07:49,280 --> 00:07:50,680
using over private link.
186
00:07:50,680 --> 00:07:52,240
So this is actually a big deal
187
00:07:52,240 --> 00:07:55,800
because right now for the import and export service
188
00:07:55,800 --> 00:07:58,400
requires you basically trust Azure services,
189
00:07:58,400 --> 00:07:59,640
which basically means you trust absolutely
190
00:07:59,640 --> 00:08:01,120
all the Azure services.
191
00:08:01,120 --> 00:08:04,120
And some customers just don't like that.
192
00:08:04,120 --> 00:08:06,640
So in public preview right now,
193
00:08:06,640 --> 00:08:08,240
we have private link support.
194
00:08:08,240 --> 00:08:11,200
And again, as I mentioned, there's some private podcasts
195
00:08:11,200 --> 00:08:13,240
that you'll see more and more PaaS offerings
196
00:08:13,240 --> 00:08:15,280
moved to using private link
197
00:08:15,280 --> 00:08:18,720
for their sort of network isolations story.
198
00:08:18,720 --> 00:08:21,160
One other one is Azure Bastion now allows you
199
00:08:21,160 --> 00:08:25,040
to use IP based connections rather than just DNS names.
200
00:08:25,040 --> 00:08:28,080
This is just to make it easy for some types of customers
201
00:08:28,080 --> 00:08:31,640
who prefer to use IP addresses versus DNS names.
202
00:08:31,640 --> 00:08:34,240
Historically, it would only work with DNS names.
203
00:08:34,240 --> 00:08:36,880
And the last one talking of naming
204
00:08:36,880 --> 00:08:39,680
is as you container apps now has full support
205
00:08:39,680 --> 00:08:42,160
for custom domains in TLS certificates.
206
00:08:42,160 --> 00:08:45,040
So back in prior to now,
207
00:08:45,040 --> 00:08:48,240
you had to use sort of Azure wildcard certificates.
208
00:08:48,240 --> 00:08:49,240
Well, now you don't have to.
209
00:08:49,240 --> 00:08:50,840
You can have your own custom domain
210
00:08:50,840 --> 00:08:53,880
and you can have your own TLS certificate in there.
211
00:08:53,880 --> 00:08:56,040
So that sort of wraps up the news.
212
00:08:56,040 --> 00:08:58,840
So now let's turn our attention to our guest.
213
00:08:58,840 --> 00:09:01,680
Thank you so much for joining us this week, Matt.
214
00:09:01,680 --> 00:09:03,880
Do you want to give us a quick overview
215
00:09:03,880 --> 00:09:06,120
of kind of what you do at Microsoft?
216
00:09:06,120 --> 00:09:07,840
Yeah, thanks again for having me.
217
00:09:07,840 --> 00:09:12,720
So, so Matt Sosman, I've been at Microsoft 10 years,
218
00:09:12,720 --> 00:09:14,200
multiple roles,
219
00:09:14,200 --> 00:09:16,040
working in our consulting services division,
220
00:09:16,040 --> 00:09:18,160
worked in marketing for a while,
221
00:09:18,160 --> 00:09:20,720
worked in our field as a field seller.
222
00:09:20,720 --> 00:09:23,560
And now I'm over on the identity engineering team.
223
00:09:23,560 --> 00:09:28,280
And so my primary focus is the strategy for ISV partners
224
00:09:28,280 --> 00:09:29,880
when it comes to zero trust.
225
00:09:29,880 --> 00:09:31,640
So we'll talk a little bit about that today
226
00:09:31,640 --> 00:09:33,400
and what that means.
227
00:09:33,400 --> 00:09:36,760
But I really try to think about zero trust all day long
228
00:09:36,760 --> 00:09:39,160
and see how we can go out and help our customers
229
00:09:39,160 --> 00:09:40,440
get out there and get secured.
230
00:09:40,440 --> 00:09:41,800
So that's a little bit about me.
231
00:09:41,800 --> 00:09:44,960
We've had two other people talking about zero trust
232
00:09:44,960 --> 00:09:47,720
and I always say the very same thing
233
00:09:47,720 --> 00:09:49,640
which I'm going to say right here,
234
00:09:49,640 --> 00:09:52,760
which is a lot of people see zero trust
235
00:09:52,760 --> 00:09:54,600
and they think, oh, that's just architecture, right?
236
00:09:54,600 --> 00:09:56,560
That's just some marketing speak,
237
00:09:56,560 --> 00:10:00,680
you know, some marketing speak for buying Microsoft products.
238
00:10:00,680 --> 00:10:01,680
I don't agree with that.
239
00:10:01,680 --> 00:10:03,400
I've seen a lot of customers actually take
240
00:10:03,400 --> 00:10:06,240
a very, very practical view of zero trust.
241
00:10:06,240 --> 00:10:09,680
I've just been working recently with a bank, a large bank,
242
00:10:09,680 --> 00:10:14,000
looking at a zero trust sort of plan of attack
243
00:10:14,000 --> 00:10:15,880
for the next few years.
244
00:10:15,880 --> 00:10:19,240
And they're looking at very specific areas around zero trust
245
00:10:19,240 --> 00:10:20,640
and then adopting technologies,
246
00:10:20,640 --> 00:10:23,480
some of the technologies they already have.
247
00:10:23,480 --> 00:10:25,760
But one of the key things is doing like a gap analysis.
248
00:10:25,760 --> 00:10:27,920
Let's find out where you're missing some defenses
249
00:10:27,920 --> 00:10:31,440
that can help sort of flesh out the zero trust story.
250
00:10:31,440 --> 00:10:33,880
So kind of what's your perspective on zero trust
251
00:10:33,880 --> 00:10:36,920
and how are you seeing customers practically use it?
252
00:10:36,920 --> 00:10:38,520
Yeah, it's a great question.
253
00:10:38,520 --> 00:10:41,440
You know, it's funny when you go out and talk to people,
254
00:10:41,440 --> 00:10:43,560
everybody has a kind of a different definition
255
00:10:43,560 --> 00:10:45,720
of zero trust and how they think about it.
256
00:10:46,800 --> 00:10:48,880
And different vendors out there have their own definition.
257
00:10:48,880 --> 00:10:51,200
But for me, when I look at it,
258
00:10:51,200 --> 00:10:54,560
it's more around having a structure and a rhyme
259
00:10:54,560 --> 00:10:57,040
and a reason to your security program
260
00:10:57,040 --> 00:11:01,160
and making sure that it's set up in such a way
261
00:11:01,160 --> 00:11:04,040
that it actually enables the business.
262
00:11:04,040 --> 00:11:05,560
You know, oftentimes I've been doing IT
263
00:11:05,560 --> 00:11:07,360
for ongoing 20 years now.
264
00:11:07,360 --> 00:11:11,480
And oftentimes as an IT pro, we forget about,
265
00:11:11,480 --> 00:11:13,280
you know, what we're actually trying to do for the business.
266
00:11:13,280 --> 00:11:15,240
And so, you know, with zero trust,
267
00:11:15,240 --> 00:11:17,400
it's around enabling users to be more productive,
268
00:11:17,400 --> 00:11:19,560
but also what are the business outcomes, right?
269
00:11:19,560 --> 00:11:20,760
In other words, what are you trying to do
270
00:11:20,760 --> 00:11:22,080
and why are you trying to do it?
271
00:11:22,080 --> 00:11:25,760
Let's not just lock down that SQL database because we can,
272
00:11:25,760 --> 00:11:27,800
what does it actually mean to do it?
273
00:11:27,800 --> 00:11:29,800
And how does that help us in the outcomes
274
00:11:29,800 --> 00:11:32,200
we're actually trying to drive as an example?
275
00:11:32,200 --> 00:11:35,240
And so, you know, so when I think about my definition
276
00:11:35,240 --> 00:11:37,080
around it, it's how do we take those,
277
00:11:37,080 --> 00:11:40,720
the foundational principles to zero trust, right?
278
00:11:40,720 --> 00:11:43,800
Verify explicitly, use at least privilege access
279
00:11:43,800 --> 00:11:45,280
and assume breach.
280
00:11:45,280 --> 00:11:48,920
And how do we translate that into business terms
281
00:11:48,920 --> 00:11:51,120
that can allow the business to take advantage
282
00:11:51,120 --> 00:11:53,680
of the technology and not the other way around?
283
00:11:53,680 --> 00:11:56,200
And so one of the ways we do that
284
00:11:56,200 --> 00:11:59,560
is through meeting the customer where they're at.
285
00:11:59,560 --> 00:12:00,800
And what that means,
286
00:12:00,800 --> 00:12:03,480
and we'll probably get more into this here in a little bit,
287
00:12:03,480 --> 00:12:06,720
but helping them understand how do we take
288
00:12:06,720 --> 00:12:09,240
that heterogeneous architecture you have
289
00:12:09,240 --> 00:12:11,880
and how do we help connect to the dots?
290
00:12:11,880 --> 00:12:14,320
So if you have technology from vendor A
291
00:12:14,320 --> 00:12:16,400
and technology from vendor B,
292
00:12:16,400 --> 00:12:18,440
how do we bring both of those together
293
00:12:18,440 --> 00:12:20,520
that can help your overall zero trust posture
294
00:12:20,520 --> 00:12:22,320
and help that program move forward?
295
00:12:22,320 --> 00:12:24,360
So that's kind of my overall approach to it
296
00:12:24,360 --> 00:12:25,520
and how I think about it.
297
00:12:25,520 --> 00:12:26,640
That makes complete sense.
298
00:12:26,640 --> 00:12:29,520
And I'd like to sort of throw sort of my hat into the ring
299
00:12:29,520 --> 00:12:32,840
here and explain how we did it with this one bank
300
00:12:32,840 --> 00:12:35,520
that really, really resonated with the customer.
301
00:12:35,520 --> 00:12:37,960
And I'd like to sort of get your feeling.
302
00:12:37,960 --> 00:12:39,240
So as you mentioned,
303
00:12:39,240 --> 00:12:41,680
there are three pillars to zero trust,
304
00:12:41,680 --> 00:12:44,520
at least the way we talk about it at Microsoft.
305
00:12:44,520 --> 00:12:48,880
Number one is assume breach.
306
00:12:48,880 --> 00:12:50,160
By the way, these are in no particular order,
307
00:12:50,160 --> 00:12:51,160
but number one is assume breach.
308
00:12:51,160 --> 00:12:53,040
Number two is verify explicitly.
309
00:12:53,040 --> 00:12:55,640
And number three is lease privilege.
310
00:12:55,640 --> 00:12:58,920
And then we have the sort of six major categories.
311
00:12:58,920 --> 00:13:01,160
So we have identity endpoints,
312
00:13:01,160 --> 00:13:04,800
applications, network, infrastructure and data.
313
00:13:04,800 --> 00:13:06,440
And so what I did for this customer was I said,
314
00:13:06,440 --> 00:13:08,120
okay, let's look at these six categories
315
00:13:08,120 --> 00:13:09,840
and let's look at the three pillars of zero trust
316
00:13:09,840 --> 00:13:11,960
and let's map what current products you have
317
00:13:11,960 --> 00:13:15,440
that sort of meet the goals of this intersection.
318
00:13:15,440 --> 00:13:17,120
And let's see where there are gaps.
319
00:13:17,120 --> 00:13:19,800
And so let me just pick on just on two, for example,
320
00:13:19,800 --> 00:13:22,920
verify explicitly and identity.
321
00:13:22,920 --> 00:13:24,520
So what they were using there was
322
00:13:24,520 --> 00:13:27,880
as your active directory and conditional access.
323
00:13:27,880 --> 00:13:30,320
And that made absolute sense to me, right?
324
00:13:30,320 --> 00:13:33,520
So you've got conditional access policies coming into play
325
00:13:33,520 --> 00:13:35,280
and perhaps they may force the use
326
00:13:35,280 --> 00:13:37,280
of multifactual authentication for certain accounts
327
00:13:37,280 --> 00:13:40,040
or based on some signal that's coming in to say,
328
00:13:40,040 --> 00:13:41,240
hey, this guy's, you know,
329
00:13:41,240 --> 00:13:43,400
well, this person's logging in from a, you know,
330
00:13:43,400 --> 00:13:45,120
an interesting IP address.
331
00:13:45,120 --> 00:13:47,800
We need to prompt for a second fact or that kind of stuff.
332
00:13:47,800 --> 00:13:49,440
Another one they have, which is really interesting
333
00:13:49,440 --> 00:13:52,480
is in the area of assume breach and data,
334
00:13:52,480 --> 00:13:55,720
they were using Microsoft information protection.
335
00:13:55,720 --> 00:13:57,440
The nice thing about that is, you know,
336
00:13:57,440 --> 00:13:59,200
if you assume breach and the attack is on the network
337
00:13:59,200 --> 00:14:00,600
and the attacker has access to everything,
338
00:14:00,600 --> 00:14:03,080
then the attacker only has access to the ciphertext, right?
339
00:14:03,080 --> 00:14:05,840
They don't have access to the plain text messages
340
00:14:05,840 --> 00:14:07,680
because everything is covered by a MIB policy
341
00:14:07,680 --> 00:14:09,960
and Microsoft information protection policy.
342
00:14:09,960 --> 00:14:12,160
And what was really cool here is we took,
343
00:14:12,160 --> 00:14:14,240
what essentially ends up being these 18 sections,
344
00:14:14,240 --> 00:14:17,320
again, it's assume breach, verify explicitly
345
00:14:17,320 --> 00:14:19,680
and lease privilege.
346
00:14:19,680 --> 00:14:22,280
And then that was actually on the Y axis.
347
00:14:22,280 --> 00:14:25,320
And then on the X axis, we had identity, endpoints,
348
00:14:25,320 --> 00:14:28,120
applications, network, infrastructure and data.
349
00:14:28,120 --> 00:14:30,120
And we filled in each of those 18 sections
350
00:14:30,120 --> 00:14:32,320
and said, what do you currently have here?
351
00:14:32,320 --> 00:14:33,720
And then are there any gaps?
352
00:14:33,720 --> 00:14:35,360
And we actually found like four gaps
353
00:14:35,360 --> 00:14:36,920
that had absolutely nothing whatsoever.
354
00:14:36,920 --> 00:14:39,440
And one of them was, for example,
355
00:14:39,440 --> 00:14:42,240
lease privilege and network.
356
00:14:42,240 --> 00:14:45,840
They actually had nothing to sort of restrict
357
00:14:45,840 --> 00:14:48,000
network access to, you know, lease privilege manner.
358
00:14:48,000 --> 00:14:49,760
And another one was actually
359
00:14:49,760 --> 00:14:52,480
lease privilege again and infrastructure.
360
00:14:52,480 --> 00:14:53,320
So it was really interesting
361
00:14:53,320 --> 00:14:55,600
because this really gave the customer a nice insight
362
00:14:55,600 --> 00:14:59,120
into what they currently had in terms of services
363
00:14:59,120 --> 00:15:03,840
and both Microsoft and other vendors
364
00:15:03,840 --> 00:15:05,640
to see what they currently had,
365
00:15:05,640 --> 00:15:07,280
what their inventory looked like today
366
00:15:07,280 --> 00:15:09,400
and what they should do moving forward.
367
00:15:09,400 --> 00:15:12,760
And that made absolute sense to the customer
368
00:15:12,760 --> 00:15:16,360
because it's not sort of ethereal anymore, right?
369
00:15:16,360 --> 00:15:18,240
You're sort of saying, here are these three parts
370
00:15:18,240 --> 00:15:20,480
of zero trust and here are these six, you know,
371
00:15:20,480 --> 00:15:22,560
things that we sort of focus on.
372
00:15:22,560 --> 00:15:25,120
What products or services do you have
373
00:15:25,120 --> 00:15:26,520
in each of those areas?
374
00:15:26,520 --> 00:15:27,840
One that they had, which turns out one thing
375
00:15:27,840 --> 00:15:31,920
they had a lot of for assuming breach, lease privilege
376
00:15:31,920 --> 00:15:33,760
and verify explicitly was like things like
377
00:15:33,760 --> 00:15:35,200
Microsoft Endpoint Protection.
378
00:15:36,280 --> 00:15:38,080
They made heavy use of that.
379
00:15:38,080 --> 00:15:40,560
So, I mean, is that the sort of thing that,
380
00:15:40,560 --> 00:15:43,280
the sort of thinking that you're seeing some customers use
381
00:15:43,280 --> 00:15:45,360
or am I just totally off track
382
00:15:45,360 --> 00:15:47,400
and you've seen customers do other things?
383
00:15:47,400 --> 00:15:49,680
And by the way, I'm totally open to being said
384
00:15:49,680 --> 00:15:51,760
that, hey, what I did wasn't great.
385
00:15:51,760 --> 00:15:52,600
That's my hit.
386
00:15:52,600 --> 00:15:53,840
I'm here to learn as well.
387
00:15:53,840 --> 00:15:55,760
Personally, I don't think there's any right or wrong way, right?
388
00:15:55,760 --> 00:15:57,920
It's, you know, every customer is going to be different.
389
00:15:57,920 --> 00:16:00,600
Every organization's other group is going to be different.
390
00:16:00,600 --> 00:16:02,960
And so they have to do what they need to do
391
00:16:02,960 --> 00:16:04,440
that works best for them.
392
00:16:04,440 --> 00:16:06,280
And so, you know, what you outlined,
393
00:16:06,280 --> 00:16:07,880
that sounds like a great approach
394
00:16:07,880 --> 00:16:11,120
for what their needs were and what they had to do.
395
00:16:11,120 --> 00:16:13,440
What I find interesting about it is,
396
00:16:13,440 --> 00:16:14,560
you kind of lose this,
397
00:16:14,560 --> 00:16:16,200
when you start peeling back the onion
398
00:16:16,200 --> 00:16:18,320
and you get into the technology,
399
00:16:18,320 --> 00:16:19,360
the technology is really cool.
400
00:16:19,360 --> 00:16:21,600
I mean, I can geek out on that all day long,
401
00:16:21,600 --> 00:16:24,960
but what's even cooler about it is when we can distill that
402
00:16:24,960 --> 00:16:28,520
into terms that, dare I say, a business executive,
403
00:16:28,520 --> 00:16:31,080
something that's non-technical at the organization,
404
00:16:31,080 --> 00:16:33,760
i.e. the CIO, can actually understand
405
00:16:33,760 --> 00:16:36,360
to go tell the rest of the C-suite,
406
00:16:36,360 --> 00:16:37,880
that's when the magic starts to happen.
407
00:16:37,880 --> 00:16:38,960
I'll give you a great example.
408
00:16:38,960 --> 00:16:40,520
You talked about MIP a little bit.
409
00:16:40,520 --> 00:16:41,840
So, you know, over the pandemic,
410
00:16:41,840 --> 00:16:45,200
we saw the boom and work from home and work anywhere.
411
00:16:45,200 --> 00:16:47,000
Yeah, people are starting to come back to the office,
412
00:16:47,000 --> 00:16:48,880
but we do see organizations out there
413
00:16:48,880 --> 00:16:52,040
that they're actually thinking about going 100% remote
414
00:16:52,040 --> 00:16:55,480
or majority of their work force being remote.
415
00:16:55,480 --> 00:16:57,280
And this is where previously,
416
00:16:57,280 --> 00:16:58,360
they never would have entertained it
417
00:16:58,360 --> 00:17:00,320
because the security team, you know,
418
00:17:00,320 --> 00:17:01,800
it's like, oh, that's too insecure.
419
00:17:01,800 --> 00:17:03,720
How would we ever even do this?
420
00:17:03,720 --> 00:17:05,520
But when you start to look at something like MIP,
421
00:17:05,520 --> 00:17:06,680
it encrypts the data.
422
00:17:06,680 --> 00:17:09,160
And so, I can send you whatever I want.
423
00:17:09,160 --> 00:17:11,960
I could send you highly proprietary information,
424
00:17:11,960 --> 00:17:14,400
but it's encrypted, AES-256.
425
00:17:14,400 --> 00:17:16,040
Now, you have to have my identity to open it,
426
00:17:16,040 --> 00:17:17,400
and I would have to explicitly assign you
427
00:17:17,400 --> 00:17:19,400
permissions to open it.
428
00:17:19,400 --> 00:17:21,480
But the cool part about it is I could revoke that data.
429
00:17:21,480 --> 00:17:23,320
So, if I accidentally send you something
430
00:17:23,320 --> 00:17:24,640
and you have permissions to it,
431
00:17:24,640 --> 00:17:27,280
I can actually revoke it in flight with MIP.
432
00:17:28,200 --> 00:17:30,080
And there's all sorts of other controls around it,
433
00:17:30,080 --> 00:17:32,800
auditing and like even block screenshots.
434
00:17:32,800 --> 00:17:34,640
Like, I mean, there's so many details there.
435
00:17:34,640 --> 00:17:35,840
Well, when you started to steal that,
436
00:17:35,840 --> 00:17:38,240
you take that to one of these executives.
437
00:17:38,240 --> 00:17:41,760
What we saw in a particular customer example I had
438
00:17:41,760 --> 00:17:42,840
in the last six months,
439
00:17:42,840 --> 00:17:45,960
where they're thinking about enabling more of their workforce
440
00:17:45,960 --> 00:17:48,440
to actually be permanently remote,
441
00:17:48,440 --> 00:17:51,160
they got a concern around, well, how do we prevent data
442
00:17:51,160 --> 00:17:53,560
from being accessed on personal devices, right?
443
00:17:53,560 --> 00:17:55,880
You're at home, you've got a personal computer right next
444
00:17:55,880 --> 00:17:56,720
to your work computer.
445
00:17:56,720 --> 00:17:58,920
How are you preventing data spillage?
446
00:17:58,920 --> 00:18:00,680
Well, in comes MIP.
447
00:18:00,680 --> 00:18:03,840
And now, all of a sudden, the ideas start flying around.
448
00:18:03,840 --> 00:18:06,880
Here's how we can, we might be able to make this work
449
00:18:06,880 --> 00:18:07,840
kind of thing, right?
450
00:18:07,840 --> 00:18:09,800
And so, and that's where it gets excited.
451
00:18:09,800 --> 00:18:11,920
And then you start going above and beyond
452
00:18:11,920 --> 00:18:13,640
the other technologies.
453
00:18:13,640 --> 00:18:16,240
And that's where the use cases really start
454
00:18:16,240 --> 00:18:17,240
coming out of the woodwork.
455
00:18:17,240 --> 00:18:20,560
And the business starts seeing the potential
456
00:18:20,560 --> 00:18:23,440
and going back to my kind of my introduction there.
457
00:18:23,440 --> 00:18:24,760
It's all about what are you trying to do
458
00:18:24,760 --> 00:18:25,760
and why are you trying to do it?
459
00:18:25,760 --> 00:18:27,760
But in business terms, how does this,
460
00:18:27,760 --> 00:18:29,360
what's the outcome for the business?
461
00:18:29,360 --> 00:18:31,640
How does it actually move us forward?
462
00:18:31,640 --> 00:18:35,880
Well, if I can enable my data to be securely accessed
463
00:18:35,880 --> 00:18:38,840
anywhere anytime, well, that enables me to, you know,
464
00:18:38,840 --> 00:18:40,920
work remotely like in this case.
465
00:18:40,920 --> 00:18:43,760
Now, all of a sudden, that enables all sorts of new outcomes,
466
00:18:43,760 --> 00:18:44,080
right?
467
00:18:44,080 --> 00:18:48,560
Think about contractors, think about vendors, even customers.
468
00:18:48,560 --> 00:18:51,120
So what you did, I wouldn't say it's not wrong, right?
469
00:18:51,120 --> 00:18:53,320
It's absolutely right for those circumstances
470
00:18:53,320 --> 00:18:55,240
of that customer, but everybody's different.
471
00:18:55,240 --> 00:18:58,080
But it's a matter of getting creative, I think is my point.
472
00:18:58,080 --> 00:19:01,280
And that requires an understanding of what
473
00:19:01,280 --> 00:19:03,080
are you trying to actually do?
474
00:19:03,080 --> 00:19:04,920
Because there's so many times out there
475
00:19:04,920 --> 00:19:06,480
where you get into these conversations.
476
00:19:06,480 --> 00:19:09,480
And we're so deep in the technology,
477
00:19:09,480 --> 00:19:11,920
we kind of lose sight of the pot of gold
478
00:19:11,920 --> 00:19:13,680
into the rainbow, right?
479
00:19:13,680 --> 00:19:16,520
We almost had to take a step back, regroup,
480
00:19:16,520 --> 00:19:19,120
and actually understand what's our objective.
481
00:19:19,120 --> 00:19:20,600
And if we get that clarity, then we
482
00:19:20,600 --> 00:19:23,200
could start to figure out, OK, now how do we use that technology
483
00:19:23,200 --> 00:19:24,080
to get there?
484
00:19:24,080 --> 00:19:27,480
So in your case, you did exactly that with MIPS
485
00:19:27,480 --> 00:19:28,760
and some of those other technologies.
486
00:19:28,760 --> 00:19:31,560
So that was kind of a long, long-winded answer.
487
00:19:31,560 --> 00:19:34,440
But that's kind of how I think about it.
488
00:19:34,440 --> 00:19:36,680
And everybody's different too.
489
00:19:36,680 --> 00:19:39,160
And so that's where, if you don't have an understanding
490
00:19:39,160 --> 00:19:41,800
of the technology, it's not necessarily a bad thing.
491
00:19:41,800 --> 00:19:44,800
But that's where you need to get help.
492
00:19:44,800 --> 00:19:47,040
And you need to understand that, hey, maybe we
493
00:19:47,040 --> 00:19:49,960
need to bring in some outside help, a consultancy firm,
494
00:19:49,960 --> 00:19:53,680
or whoever that can come in to help you understand
495
00:19:53,680 --> 00:19:55,880
the technology that you already own.
496
00:19:55,880 --> 00:19:57,400
Now, yeah, I work for Microsoft, right?
497
00:19:57,400 --> 00:20:01,320
But let's pretend for a moment, you're my customer, Michael.
498
00:20:01,320 --> 00:20:03,760
And Sarah works at your company as well.
499
00:20:03,760 --> 00:20:05,760
And obviously, you use Microsoft technologies,
500
00:20:05,760 --> 00:20:07,800
but you're going to use third-party security vendors
501
00:20:07,800 --> 00:20:08,840
as well, right?
502
00:20:08,840 --> 00:20:13,400
So now it's about having a deep understanding
503
00:20:13,400 --> 00:20:15,480
of how all those technologies work,
504
00:20:15,480 --> 00:20:18,360
and then figuring out how do we piece them together
505
00:20:18,360 --> 00:20:19,920
so we can achieve those business outcomes.
506
00:20:19,920 --> 00:20:23,120
And that's often the challenge.
507
00:20:23,120 --> 00:20:26,080
And again, that's kind of what I'm looking at here at Microsoft,
508
00:20:26,080 --> 00:20:29,000
is how do we help a customer stitch that together?
509
00:20:29,000 --> 00:20:31,120
Let me pause here, kind of going on a tangent here.
510
00:20:31,120 --> 00:20:33,040
But that's how I'm thinking through it.
511
00:20:33,040 --> 00:20:36,400
Yeah, so back to this bank scenario.
512
00:20:36,400 --> 00:20:41,280
So at Microsoft, we have this zero-trust maturity
513
00:20:41,280 --> 00:20:42,920
sort of assessment.
514
00:20:42,920 --> 00:20:45,440
You talk about sort of the pragmatics of it.
515
00:20:45,440 --> 00:20:47,280
So what we do with this customer is we actually went
516
00:20:47,280 --> 00:20:49,240
through this maturity assessment.
517
00:20:49,240 --> 00:20:50,560
It's relatively short.
518
00:20:50,560 --> 00:20:55,600
And the whole point is to understand sort of how mature
519
00:20:55,600 --> 00:20:58,760
you are in these different areas, like what do you use
520
00:20:58,760 --> 00:20:59,680
for endpoint protection?
521
00:20:59,680 --> 00:21:01,040
Where is the endpoint protection?
522
00:21:01,040 --> 00:21:03,400
What do you use for information protection?
523
00:21:03,400 --> 00:21:05,920
There's a whole bunch of stuff.
524
00:21:05,920 --> 00:21:09,520
And then from that, we end up, one of the outcomes of that
525
00:21:09,520 --> 00:21:12,400
is a whole bunch of user stories.
526
00:21:12,400 --> 00:21:16,240
So for example, you could load them into Azure DevOps or GRO
527
00:21:16,240 --> 00:21:21,560
and whatever your system is for managing stories or work items.
528
00:21:21,560 --> 00:21:23,720
Then you assign those to people and people go and investigate
529
00:21:23,720 --> 00:21:25,960
to find out what they have and where the gaps are
530
00:21:25,960 --> 00:21:26,960
and what have you.
531
00:21:26,960 --> 00:21:29,440
And that's why we end up coming with this grid, right?
532
00:21:29,440 --> 00:21:32,280
With the shows, the three areas of zero trust
533
00:21:32,280 --> 00:21:34,680
and then these six categories.
534
00:21:34,680 --> 00:21:37,200
Because that then helps take these stories
535
00:21:37,200 --> 00:21:40,760
and assign them a point on this grid.
536
00:21:40,760 --> 00:21:43,120
So that way we could always find out who the right person was
537
00:21:43,120 --> 00:21:44,960
to assign them to.
538
00:21:44,960 --> 00:21:48,320
And again, that really helped drive the customer.
539
00:21:48,320 --> 00:21:50,160
I'm not going to be wrong, these customers,
540
00:21:50,160 --> 00:21:52,240
this customer is incredibly savvy.
541
00:21:52,240 --> 00:21:54,760
They just wanted some guidance on just the structure
542
00:21:54,760 --> 00:21:56,080
of zero trust.
543
00:21:56,080 --> 00:21:58,480
They like the idea of the three pillars of zero trust.
544
00:21:58,480 --> 00:22:01,200
They like the idea of assuming breach.
545
00:22:01,200 --> 00:22:05,600
And that's a whole mental flip, assuming breach.
546
00:22:05,600 --> 00:22:08,000
I'll give you another example of that.
547
00:22:08,000 --> 00:22:10,760
I was working with a large bank in South America.
548
00:22:10,760 --> 00:22:13,160
I'm not going to name, even name the country.
549
00:22:13,160 --> 00:22:15,120
There's a very large bank in South America
550
00:22:15,120 --> 00:22:19,240
and they were going online with an online presence.
551
00:22:19,240 --> 00:22:23,520
And I was reviewing the security architecture of their design
552
00:22:23,520 --> 00:22:28,000
and we got to a point where they were storing passwords.
553
00:22:28,000 --> 00:22:31,560
And I'm like, so what are you actually storing?
554
00:22:31,560 --> 00:22:32,880
And they said, well, we're encrypting.
555
00:22:32,880 --> 00:22:34,400
We're encrypting the passwords.
556
00:22:34,400 --> 00:22:36,600
So where's the key stored to decrypt that?
557
00:22:36,600 --> 00:22:38,480
Well, it's over there.
558
00:22:38,480 --> 00:22:41,320
It doesn't matter where over there is, it's over there.
559
00:22:41,320 --> 00:22:43,680
I said, but what happens if the attacker gets that key?
560
00:22:43,680 --> 00:22:45,160
Well, they can decrypt everything.
561
00:22:45,160 --> 00:22:47,480
Well, OK, so now we need to stop and think about this
562
00:22:47,480 --> 00:22:51,040
for a minute because let's assume breach.
563
00:22:51,040 --> 00:22:52,560
Let's just think about that for a minute.
564
00:22:52,560 --> 00:22:54,280
Assume breach, the attacker is on the network
565
00:22:54,280 --> 00:22:57,680
and has unfettered access to absolutely everything.
566
00:22:57,680 --> 00:23:02,240
Well, now the attacker can decrypt every single password.
567
00:23:02,240 --> 00:23:04,400
And the customer nodded.
568
00:23:04,400 --> 00:23:07,200
Didn't like the fact they had to nod, but they nodded.
569
00:23:07,200 --> 00:23:09,280
I said, yeah, we need to think a little bit harder than that
570
00:23:09,280 --> 00:23:12,480
because you're a large bank and what you're doing
571
00:23:12,480 --> 00:23:16,840
is significant and will be attacked, guaranteed.
572
00:23:16,840 --> 00:23:19,480
So let's assume breach.
573
00:23:19,480 --> 00:23:22,120
So I said, do you actually need to know the password
574
00:23:22,120 --> 00:23:25,680
or do you need to know the user owns the password?
575
00:23:25,680 --> 00:23:28,640
And I said, well, we just need to know the user owns the password.
576
00:23:28,640 --> 00:23:30,840
Well, rather than encrypting it, we can do it.
577
00:23:30,840 --> 00:23:32,920
I don't want to get into all the crypto wonkiness here,
578
00:23:32,920 --> 00:23:34,480
but I'm going to.
579
00:23:34,480 --> 00:23:37,840
We can store a what's called a salted iterated hash
580
00:23:37,840 --> 00:23:40,080
of the password.
581
00:23:40,080 --> 00:23:42,480
The nice thing about that is you can quickly verify
582
00:23:42,480 --> 00:23:44,400
the user possesses the password, but not actually
583
00:23:44,400 --> 00:23:46,120
store the password.
584
00:23:46,120 --> 00:23:49,200
So now actually look at it from an assumed reach perspective.
585
00:23:49,200 --> 00:23:50,840
So if the attacker gets on the network
586
00:23:50,840 --> 00:23:53,720
and has absolutely unfettered access to absolutely everything,
587
00:23:53,720 --> 00:23:56,360
let's just say it's 10 million people,
588
00:23:56,360 --> 00:23:58,880
the data that the attacker gets is something
589
00:23:58,880 --> 00:24:00,520
the attacker cannot use.
590
00:24:00,520 --> 00:24:01,480
It's not the password.
591
00:24:01,480 --> 00:24:02,320
You can't decrypt it.
592
00:24:02,320 --> 00:24:03,720
There is no password to decrypt.
593
00:24:03,720 --> 00:24:06,840
You're just basically storing something that verifies
594
00:24:06,840 --> 00:24:08,840
the user actually owns the password.
595
00:24:08,840 --> 00:24:09,960
That's all you're doing.
596
00:24:09,960 --> 00:24:12,800
It's nothing the attacker can replay.
597
00:24:12,800 --> 00:24:14,600
So they had about just a few weeks
598
00:24:14,600 --> 00:24:16,200
to go until they were finally shipping,
599
00:24:16,200 --> 00:24:17,800
and they made this small change.
600
00:24:17,800 --> 00:24:19,040
And it was a relatively small change.
601
00:24:19,040 --> 00:24:21,120
And obviously we had to go through all the appropriate checks
602
00:24:21,120 --> 00:24:24,360
and tests to make sure that it didn't cause regressions.
603
00:24:24,360 --> 00:24:27,360
But they ended up shipping with this change,
604
00:24:27,360 --> 00:24:30,000
or they went live with this change, I should say.
605
00:24:30,000 --> 00:24:32,240
And we made a point of telling upper management
606
00:24:32,240 --> 00:24:34,440
that the change that was made, even though it was relatively
607
00:24:34,440 --> 00:24:38,400
late, supported zero trust ideas of assumed region.
608
00:24:38,400 --> 00:24:39,640
If the attacker is on the network,
609
00:24:39,640 --> 00:24:42,640
the attacker has nothing that they can use, nothing whatsoever.
610
00:24:42,640 --> 00:24:46,000
Doesn't matter by any stretch of anyone's imagination,
611
00:24:46,000 --> 00:24:48,480
there's just nothing you can use there.
612
00:24:48,480 --> 00:24:50,360
And the board loved that, especially
613
00:24:50,360 --> 00:24:52,600
when it was a very small engineering change.
614
00:24:52,600 --> 00:24:55,000
But the main change wasn't just the engineering change.
615
00:24:55,000 --> 00:24:57,640
It was actually basically a mental change.
616
00:24:57,640 --> 00:25:01,400
Was it just thinking about the design of the system?
617
00:25:01,400 --> 00:25:03,360
Let's just assume the attacker is on the network
618
00:25:03,360 --> 00:25:06,160
and has access to absolutely everything.
619
00:25:06,160 --> 00:25:07,760
Now what?
620
00:25:07,760 --> 00:25:11,840
And if the answer is, well, we're in deep trouble,
621
00:25:11,840 --> 00:25:13,560
that's not the right answer.
622
00:25:13,560 --> 00:25:16,400
You need to think longer and harder than just,
623
00:25:16,400 --> 00:25:18,240
well, we're in trouble.
624
00:25:18,240 --> 00:25:22,560
So I like that idea of putting new concepts into people's heads
625
00:25:22,560 --> 00:25:25,280
because it will help you design systems in a much more
626
00:25:25,280 --> 00:25:26,640
secure manner.
627
00:25:26,640 --> 00:25:28,440
Yeah, that's a great point.
628
00:25:28,440 --> 00:25:31,800
That's kind of what I meant by my comment around,
629
00:25:31,800 --> 00:25:35,440
if you were my customer, I may make a recommendation,
630
00:25:35,440 --> 00:25:38,000
bring in a consultancy firm to help you think through that.
631
00:25:38,000 --> 00:25:41,200
Because it is a huge mental mind shift
632
00:25:41,200 --> 00:25:43,640
to think about what if an attacker is actually
633
00:25:43,640 --> 00:25:46,440
on the network, what could be compromised right now
634
00:25:46,440 --> 00:25:47,840
that maybe we don't know about?
635
00:25:47,840 --> 00:25:50,840
And when you start to think about in large enterprise,
636
00:25:50,840 --> 00:25:53,280
many of these legacy line of business apps,
637
00:25:53,280 --> 00:25:56,680
they were written years ago, the person, or Tina wrote it,
638
00:25:56,680 --> 00:25:57,720
they're long gone.
639
00:25:57,720 --> 00:26:00,800
It's just kind of, the lights are still being kept on,
640
00:26:00,800 --> 00:26:03,000
but nobody's really maintaining it.
641
00:26:03,000 --> 00:26:05,040
Well, when we start to think about assumed reach,
642
00:26:05,040 --> 00:26:06,360
it means a lot of different things.
643
00:26:06,360 --> 00:26:09,240
But one of it means, let's go back and start to review,
644
00:26:09,240 --> 00:26:12,160
are there passwords stored in the database?
645
00:26:12,160 --> 00:26:16,840
How are these legacy apps functioning and architected?
646
00:26:16,840 --> 00:26:19,680
Do we need to start looking at maybe third party solutions
647
00:26:19,680 --> 00:26:22,480
that can help secure some of these apps that are legacy,
648
00:26:22,480 --> 00:26:24,680
that maybe the developer no longer supports
649
00:26:24,680 --> 00:26:27,360
or anything like that, but there's solutions out there
650
00:26:27,360 --> 00:26:30,560
that can help to protect those and specialize in it.
651
00:26:30,560 --> 00:26:33,240
So it causes you to start to think about a lot.
652
00:26:33,240 --> 00:26:34,960
Another thing around assumed breach
653
00:26:34,960 --> 00:26:39,320
that I come across frequently is from a SOC perspective,
654
00:26:39,320 --> 00:26:42,240
are you actually monitoring the things that are important?
655
00:26:42,240 --> 00:26:45,960
So oftentimes we think about, oh, just send all the logs.
656
00:26:45,960 --> 00:26:49,400
Okay, that's, yes, that's helpful,
657
00:26:49,400 --> 00:26:52,600
but somebody has to put in the logic,
658
00:26:52,600 --> 00:26:55,120
and somebody has to write the workflows
659
00:26:55,120 --> 00:26:58,120
and all of the other automation pieces around,
660
00:26:58,120 --> 00:27:00,440
what do you do with that data coming from the logs?
661
00:27:00,440 --> 00:27:02,840
Not only that, but you also have to think about manpower,
662
00:27:02,840 --> 00:27:05,000
and you have to think about how is your SOC structured?
663
00:27:05,000 --> 00:27:08,640
And the phrase that I keep hearing time and time again
664
00:27:08,640 --> 00:27:10,920
is if nobody's behind the wheel,
665
00:27:10,920 --> 00:27:13,680
or you have a couple of people behind the wheel,
666
00:27:13,680 --> 00:27:15,320
and you have a lot of wheels,
667
00:27:15,320 --> 00:27:17,120
you're probably gonna get alert fatigue,
668
00:27:17,120 --> 00:27:19,200
and you're gonna have gaps in visibility.
669
00:27:19,200 --> 00:27:22,280
So now how do we become more efficient?
670
00:27:22,280 --> 00:27:25,200
And that's another lens of assumed breach,
671
00:27:25,200 --> 00:27:27,240
and how do we actually monitor
672
00:27:27,240 --> 00:27:28,920
when there is something going on?
673
00:27:28,920 --> 00:27:31,800
And making sure we have the right solutions in place
674
00:27:31,800 --> 00:27:32,880
from a technology perspective,
675
00:27:32,880 --> 00:27:34,760
make sure we have the right processes in place
676
00:27:34,760 --> 00:27:35,880
to respond to it.
677
00:27:36,800 --> 00:27:39,880
And it goes way beyond just looking at data in a log.
678
00:27:39,880 --> 00:27:42,560
And so that's kind of that other mental mind shift,
679
00:27:42,560 --> 00:27:45,640
for years we've been used to just send all of the
680
00:27:45,640 --> 00:27:48,600
syslog data to the SEM, and the SEM will deal with it.
681
00:27:48,600 --> 00:27:50,080
May not always be the case.
682
00:27:50,080 --> 00:27:52,000
And so you definitely wanna go through
683
00:27:52,000 --> 00:27:54,280
and make sure that things are properly set up
684
00:27:54,280 --> 00:27:56,280
and that you've accounted for that.
685
00:27:56,280 --> 00:27:59,760
Mind if I share a quick story here about Zero Trust?
686
00:27:59,760 --> 00:28:01,200
Yeah, go for it.
687
00:28:01,200 --> 00:28:04,920
So back when the pandemic first started,
688
00:28:04,920 --> 00:28:08,040
and it was like the first week of March 20th,
689
00:28:08,040 --> 00:28:10,480
and the world sent everybody to work from home,
690
00:28:10,480 --> 00:28:13,080
we started having customers call us,
691
00:28:13,080 --> 00:28:16,200
phone was ringing off the hook, how do we do this?
692
00:28:16,200 --> 00:28:18,520
There was one customer, they were a bank,
693
00:28:18,520 --> 00:28:20,600
they had this culture,
694
00:28:20,600 --> 00:28:24,280
they never actually sent people to work from home.
695
00:28:24,280 --> 00:28:28,320
So they actually all had desktop PCs, very old school,
696
00:28:28,320 --> 00:28:30,600
but they had desktop PCs,
697
00:28:30,600 --> 00:28:33,040
and okay, now we all gotta work from home.
698
00:28:33,040 --> 00:28:34,600
And this was not a large enterprise,
699
00:28:34,600 --> 00:28:36,080
this was more of a mid-sized organization,
700
00:28:36,080 --> 00:28:38,200
but it was a big struggle for them.
701
00:28:38,200 --> 00:28:39,680
So they went out and told their employees,
702
00:28:39,680 --> 00:28:42,200
just go out and here's a stipend,
703
00:28:42,200 --> 00:28:45,080
go out there and buy the laptop of choice.
704
00:28:45,080 --> 00:28:48,240
We started having people buy iPads and Macs and PCs
705
00:28:48,240 --> 00:28:49,240
and who knows what.
706
00:28:50,160 --> 00:28:52,040
And then they started figuring out,
707
00:28:52,040 --> 00:28:56,160
well, with the pandemic came the Great Reshuffle
708
00:28:56,160 --> 00:28:57,360
and the Great Resignations,
709
00:28:57,360 --> 00:29:00,240
and some of these employees started leaving the organization.
710
00:29:00,240 --> 00:29:01,960
Well, here they have a personal device
711
00:29:01,960 --> 00:29:06,320
that they are using to access company data on.
712
00:29:06,320 --> 00:29:07,480
They now left the organization,
713
00:29:07,480 --> 00:29:10,240
the company data is still there.
714
00:29:10,240 --> 00:29:11,960
So you've left the organization,
715
00:29:11,960 --> 00:29:13,360
but you still have data on the device.
716
00:29:13,360 --> 00:29:14,560
Now, have they been using MIPS?
717
00:29:14,560 --> 00:29:18,080
Sure, that would have helped provide some protection.
718
00:29:18,080 --> 00:29:19,400
So make a long story short,
719
00:29:19,400 --> 00:29:21,400
we started working through some scenarios with them
720
00:29:21,400 --> 00:29:23,560
and what we came to the conclusion was,
721
00:29:23,560 --> 00:29:24,880
let the employee go out there
722
00:29:24,880 --> 00:29:27,840
and purchase whatever device they want with that stipend,
723
00:29:27,840 --> 00:29:30,960
but let's employ something like Azure Virtual Desktop
724
00:29:30,960 --> 00:29:32,560
or some kind of VDI,
725
00:29:32,560 --> 00:29:35,800
where everything you're accessing is within that workspace.
726
00:29:35,800 --> 00:29:39,400
And you can't spill data outside that workspace.
727
00:29:39,400 --> 00:29:42,120
So if I'm on my personal iPad
728
00:29:42,120 --> 00:29:45,080
and I try to copy a file from that Azure Virtual Desktop
729
00:29:45,080 --> 00:29:48,000
to my local iPad, policy will block it.
730
00:29:48,000 --> 00:29:49,840
So we started looking at that with that customer
731
00:29:49,840 --> 00:29:50,800
and make a long story short,
732
00:29:50,800 --> 00:29:53,880
I just talked to them about three or four months ago.
733
00:29:53,880 --> 00:29:56,040
You're doing quite well from a security perspective
734
00:29:56,040 --> 00:29:57,640
because everything is happening within
735
00:29:57,640 --> 00:30:00,280
that Azure Virtual Desktop kind of instance, if you will,
736
00:30:00,280 --> 00:30:02,560
everything's being monitored
737
00:30:02,560 --> 00:30:04,040
and they've got policy
738
00:30:04,040 --> 00:30:05,960
where they can actually control the flow of data.
739
00:30:05,960 --> 00:30:08,040
And if employee leaves the organization,
740
00:30:08,040 --> 00:30:10,800
their standard process of killing email access, of course,
741
00:30:10,800 --> 00:30:14,360
but then killing access that Azure Virtual Desktop instance.
742
00:30:14,360 --> 00:30:17,000
So that's another way of looking at zero trust
743
00:30:17,000 --> 00:30:21,800
is kind of containerizing how your employees access the data.
744
00:30:21,800 --> 00:30:25,000
One more short story for you is kind of the opposite.
745
00:30:25,000 --> 00:30:27,320
How do we give the employee the ability to do
746
00:30:27,320 --> 00:30:28,400
whatever they want?
747
00:30:28,400 --> 00:30:30,680
And so we had another organization during the pandemic
748
00:30:30,680 --> 00:30:33,640
that went out, they purchased Microsoft 365
749
00:30:33,640 --> 00:30:36,280
and they got all the great productivity tools.
750
00:30:36,280 --> 00:30:38,360
One of the really cool parts about security
751
00:30:38,360 --> 00:30:40,640
that Microsoft has, like MIP as an example,
752
00:30:40,640 --> 00:30:42,440
it's actually integrated with all the tools.
753
00:30:42,440 --> 00:30:43,280
For this organization,
754
00:30:43,280 --> 00:30:45,280
they never had to actually think about
755
00:30:45,280 --> 00:30:49,760
how do we get MIP encryption to work in an office?
756
00:30:49,760 --> 00:30:51,320
It just works, right?
757
00:30:51,320 --> 00:30:52,560
I mean, sure, there's policy,
758
00:30:52,560 --> 00:30:54,120
you have to configure and that kind of thing,
759
00:30:54,120 --> 00:30:56,440
but you're not having to go out and make code changes
760
00:30:56,440 --> 00:30:59,640
or anything like that, API calls and that kind of thing.
761
00:30:59,640 --> 00:31:01,640
So what I'm trying to say is, again,
762
00:31:01,640 --> 00:31:04,440
you have to kind of look at what are you trying
763
00:31:04,440 --> 00:31:05,560
to actually get done
764
00:31:05,560 --> 00:31:07,520
and how does it actually help the business?
765
00:31:07,520 --> 00:31:08,640
And then from there,
766
00:31:08,640 --> 00:31:10,040
try to figure out the right technology.
767
00:31:10,040 --> 00:31:12,280
Now, what we often hear is,
768
00:31:12,280 --> 00:31:14,440
man, I'm not using everything that's from Microsoft, right?
769
00:31:14,440 --> 00:31:18,600
Sure, I've got maybe Sentinel or I've got MIP as an example,
770
00:31:18,600 --> 00:31:22,320
but I might be using a third-party EDR platform.
771
00:31:22,320 --> 00:31:27,080
I may be using a third-party identity provider.
772
00:31:27,080 --> 00:31:29,080
How do I get all of those to work together?
773
00:31:29,080 --> 00:31:31,680
And so that's where, here at Microsoft,
774
00:31:31,680 --> 00:31:33,680
we've got a program called MISA,
775
00:31:33,680 --> 00:31:36,280
the Microsoft Intelligence Security Association,
776
00:31:36,280 --> 00:31:39,280
where we've gone out and we've worked with these third parties
777
00:31:39,280 --> 00:31:43,880
to perform native integrations with our first-party products
778
00:31:43,880 --> 00:31:48,280
and kind of analogy of we're able to tie the knot together.
779
00:31:48,280 --> 00:31:51,480
So if you're using a third-party,
780
00:31:51,480 --> 00:31:53,880
whatever, third-party EDR platform,
781
00:31:53,880 --> 00:31:54,880
how do we make sure it works
782
00:31:54,880 --> 00:31:57,480
with the rest of your Microsoft tool sets?
783
00:31:57,480 --> 00:32:00,080
Well, through that MISA program, we've gone out and done that work.
784
00:32:00,080 --> 00:32:02,080
And so that can help benefit those customers out there
785
00:32:02,080 --> 00:32:04,480
that have that heterogeneous architecture
786
00:32:04,480 --> 00:32:05,480
without having to worry about,
787
00:32:05,480 --> 00:32:08,480
oh, do I need to go out and flesh out everything for vendor A
788
00:32:08,480 --> 00:32:10,480
to vendor B and that kind of thing?
789
00:32:10,480 --> 00:32:12,080
Let's take a look at it,
790
00:32:12,080 --> 00:32:14,080
because more than likely what you already own
791
00:32:14,080 --> 00:32:15,480
is included at MISA program,
792
00:32:15,480 --> 00:32:17,480
where we actually already have pre-billed integrations
793
00:32:17,480 --> 00:32:19,480
that just need to be enabled and configured.
794
00:32:19,480 --> 00:32:22,080
So again, that's kind of another way to look at zero trust
795
00:32:22,080 --> 00:32:24,480
and that last mile,
796
00:32:24,480 --> 00:32:27,080
but that's often your biggest risk.
797
00:32:27,080 --> 00:32:29,080
And so just wrap my tangent here.
798
00:32:29,080 --> 00:32:32,680
You could do everything that you can to try to protect it
799
00:32:32,680 --> 00:32:34,680
and try to get these policies configured,
800
00:32:34,680 --> 00:32:37,080
but that last mile is still going to be a problem for you.
801
00:32:37,080 --> 00:32:40,080
Whether that last mile is third-party solutions,
802
00:32:40,080 --> 00:32:42,080
try to integrate with Microsoft first-party,
803
00:32:42,080 --> 00:32:44,080
or it's the end user.
804
00:32:44,080 --> 00:32:48,080
And like an example I gave about them using personal devices.
805
00:32:48,080 --> 00:32:52,080
And so as IT, that's something that we often don't really think about.
806
00:32:52,080 --> 00:32:54,080
And so I think kind of the moral of all these stories
807
00:32:54,080 --> 00:32:56,080
is bringing it back to zero trust
808
00:32:56,080 --> 00:32:58,080
is a mindset change.
809
00:32:58,080 --> 00:33:01,080
And it's not a product, you don't go out and buy it.
810
00:33:01,080 --> 00:33:03,080
It's not an end state.
811
00:33:03,080 --> 00:33:06,080
It's not a, hey, how long will it take us to achieve zero trust?
812
00:33:06,080 --> 00:33:09,080
It's what's our structure and our framework?
813
00:33:09,080 --> 00:33:11,080
What's the journey look like that we're going to take?
814
00:33:11,080 --> 00:33:13,080
And how are we going to do it?
815
00:33:13,080 --> 00:33:15,080
And what changes need to be made in the organization
816
00:33:15,080 --> 00:33:16,080
to allow us to do it,
817
00:33:16,080 --> 00:33:19,080
not just with technology, but organizationally as well.
818
00:33:19,080 --> 00:33:24,080
So lots to think about, but I'll pause there.
819
00:33:24,080 --> 00:33:27,080
I'm going to have to jump in here because you talked about SOCs
820
00:33:27,080 --> 00:33:32,080
and as a security operation center.
821
00:33:32,080 --> 00:33:34,080
Matt, what's your take?
822
00:33:34,080 --> 00:33:36,080
Because you know I love to talk about Sentinel.
823
00:33:36,080 --> 00:33:38,080
Everybody knows that.
824
00:33:38,080 --> 00:33:41,080
Going back more to that, because one of my favorite phrases,
825
00:33:41,080 --> 00:33:43,080
and I used to have stickers with it on,
826
00:33:43,080 --> 00:33:45,080
and I need to get them reprinted,
827
00:33:45,080 --> 00:33:47,080
is that collection is not detection.
828
00:33:47,080 --> 00:33:53,080
You know, just collecting logs is not in itself going to do anything.
829
00:33:53,080 --> 00:33:55,080
So what are your thoughts on that,
830
00:33:55,080 --> 00:34:00,080
assuming breach and collecting logs in that security operations environment?
831
00:34:00,080 --> 00:34:03,080
I mean, if we rewind 10, even 20 years, right,
832
00:34:03,080 --> 00:34:06,080
and we look at sending log data to a SEM,
833
00:34:06,080 --> 00:34:09,080
SEM seemed, you know, whatever we want to call it, right,
834
00:34:09,080 --> 00:34:12,080
but send it to that centralized platform that collects all the log data.
835
00:34:12,080 --> 00:34:14,080
Somebody still has to look at that.
836
00:34:14,080 --> 00:34:16,080
And so we started to think about years ago,
837
00:34:16,080 --> 00:34:18,080
well, let's hire the best talent.
838
00:34:18,080 --> 00:34:21,080
Let's send to Vegas every year, go to the conferences from the vendor,
839
00:34:21,080 --> 00:34:23,080
throw all the certifications at them,
840
00:34:23,080 --> 00:34:26,080
and then they can go through the log data and try to figure it out.
841
00:34:26,080 --> 00:34:28,080
Well, fast forward, that didn't work out too well,
842
00:34:28,080 --> 00:34:33,080
because no human can possibly go through the massive volume in these logs, right?
843
00:34:33,080 --> 00:34:34,080
So that doesn't work.
844
00:34:34,080 --> 00:34:37,080
So now we need machine learning to look at patterns.
845
00:34:37,080 --> 00:34:40,080
We need, you know, artificial intelligence to be able to make decisions.
846
00:34:40,080 --> 00:34:47,080
But we also still need humans that possess the skill to build out the policy.
847
00:34:47,080 --> 00:34:50,080
So like in Sentinel terms, analytic rules.
848
00:34:50,080 --> 00:34:54,080
So I've got all this data that's coming in from this, you know, security tool,
849
00:34:54,080 --> 00:34:56,080
all this log data.
850
00:34:56,080 --> 00:34:59,080
Sentinel can, you know, obviously, and so you could talk way more about this on IKAM,
851
00:34:59,080 --> 00:35:01,080
but it's intelligent.
852
00:35:01,080 --> 00:35:05,080
But however, there's probably some additional context around that log data
853
00:35:05,080 --> 00:35:08,080
that I would need to build some rules in so that Sentinel's aware of it.
854
00:35:08,080 --> 00:35:11,080
So my point is like somebody has to do the work.
855
00:35:11,080 --> 00:35:15,080
And then on top of that, somebody has to be behind the wheel to actually monitor.
856
00:35:15,080 --> 00:35:19,080
And so I once met a managed service provider just a couple of years ago.
857
00:35:19,080 --> 00:35:23,080
They did all of this work to send, and they weren't using Sentinel.
858
00:35:23,080 --> 00:35:26,080
They were using another SIM, but they did all this work to send all of their log data
859
00:35:26,080 --> 00:35:29,080
from all their tools to a SIM.
860
00:35:29,080 --> 00:35:32,080
But they didn't have anybody actually monitoring it.
861
00:35:32,080 --> 00:35:35,080
They were relying on just email alerts.
862
00:35:35,080 --> 00:35:38,080
It's like, well, it's a little bit more to it than that, right?
863
00:35:38,080 --> 00:35:42,080
And so you don't want to also get that false sense of security, right?
864
00:35:42,080 --> 00:35:44,080
Oh, we'll just send it all to the SIM and be done with it.
865
00:35:44,080 --> 00:35:49,080
But you know, there's a lot more that you need to invest in that from time and energy
866
00:35:49,080 --> 00:35:52,080
to be able to build this out in such a way, but then have that process
867
00:35:52,080 --> 00:35:57,080
to make a green field to where you're constantly iterating on it and you're documenting it, right?
868
00:35:57,080 --> 00:36:00,080
And then what's the reporting structure around it, right?
869
00:36:00,080 --> 00:36:03,080
How often are you sitting down, running the reports and sitting down
870
00:36:03,080 --> 00:36:07,080
if you're a managed service provider running with your clients or sitting down with the SOC
871
00:36:07,080 --> 00:36:12,080
and maybe the CSO and reviewing what's happened over this past quarter according to the data
872
00:36:12,080 --> 00:36:15,080
and trying to do better, right?
873
00:36:15,080 --> 00:36:20,080
So I mean, there's a lot that goes in there that, again, that assumed reachment mindset
874
00:36:20,080 --> 00:36:23,080
and the whole zero trust mindset, it starts to unpack all of that.
875
00:36:23,080 --> 00:36:26,080
But, you know, Sarah, I would love to get your thoughts on that,
876
00:36:26,080 --> 00:36:30,080
but that's how I start to think about just from a SOC perspective.
877
00:36:30,080 --> 00:36:32,080
We got to do it differently than we have been.
878
00:36:32,080 --> 00:36:34,080
I think it's my point.
879
00:36:34,080 --> 00:36:38,080
Yeah, I mean, we probably don't have enough time on the podcast right now
880
00:36:38,080 --> 00:36:42,080
for me to talk about all of my thoughts, but I'll tell you a story as well.
881
00:36:42,080 --> 00:36:45,080
Seeing as we're in story mode this week.
882
00:36:45,080 --> 00:36:52,080
I once saw a couple and again, it wasn't Sentinel, it was a different scene.
883
00:36:52,080 --> 00:36:55,080
But in some of my previous consulting life,
884
00:36:55,080 --> 00:37:00,080
they had some organizations that were working to a particular standard
885
00:37:00,080 --> 00:37:03,080
that was part of their industry vertical.
886
00:37:03,080 --> 00:37:08,080
And the standard basically said that they needed to log to a central place.
887
00:37:08,080 --> 00:37:12,080
And so they locked to a central place that they put a seam in place
888
00:37:12,080 --> 00:37:16,080
and they were sending logs to it, but they didn't actually look at it.
889
00:37:16,080 --> 00:37:21,080
But because the requirement that the standard they were following
890
00:37:21,080 --> 00:37:27,080
just said they had to log it, they had met that standard that they could tick a box.
891
00:37:27,080 --> 00:37:30,080
Was it really very useful from a security perspective?
892
00:37:30,080 --> 00:37:32,080
I would argue definitely not.
893
00:37:32,080 --> 00:37:34,080
But these are the things we see, right?
894
00:37:34,080 --> 00:37:39,080
And definitely we can have a whole different discussion on standards
895
00:37:39,080 --> 00:37:44,080
and whether adhering to standards, well, compliance, well, compliance is not security.
896
00:37:44,080 --> 00:37:46,080
That's probably an episode in itself.
897
00:37:46,080 --> 00:37:49,080
But yeah, I know exactly what you mean.
898
00:37:49,080 --> 00:37:52,080
Yeah, you know, again, like when I think of my,
899
00:37:52,080 --> 00:37:56,080
when you talk about, you know, how do I approach your trust differently than maybe others?
900
00:37:56,080 --> 00:37:58,080
I think everybody has their own approach to it, right?
901
00:37:58,080 --> 00:38:01,080
But again, like my approach, I look at it from a practical standpoint,
902
00:38:01,080 --> 00:38:03,080
but more from a business standpoint.
903
00:38:03,080 --> 00:38:07,080
And how do we actually make this work for the organization?
904
00:38:07,080 --> 00:38:09,080
How does it help us move things forward?
905
00:38:09,080 --> 00:38:16,080
And in many cases, we've seen Zero Trust do wonderful things at a business level, right?
906
00:38:16,080 --> 00:38:19,080
I.e. enable a company to outsource more.
907
00:38:19,080 --> 00:38:24,080
If that was their end goal was let's outsource more, but security was stopping it.
908
00:38:24,080 --> 00:38:27,080
We've seen Zero Trust actually empower that and enable that and drive that.
909
00:38:27,080 --> 00:38:33,080
We've seen Zero Trust do things like help the company acquire more customers,
910
00:38:33,080 --> 00:38:37,080
because now they're able to, you know, interact with customers in a digital way
911
00:38:37,080 --> 00:38:40,080
and Zero Trust comes in and provides a security layer for that.
912
00:38:40,080 --> 00:38:45,080
So we've seen all sorts of great use cases, but you do have to take a step back and think about,
913
00:38:45,080 --> 00:38:48,080
you know, what are we trying to do and why?
914
00:38:48,080 --> 00:38:50,080
Really, why is the most important part?
915
00:38:50,080 --> 00:38:51,080
You probably want to start with that.
916
00:38:51,080 --> 00:38:54,080
But it does require almost a rewrite of the book.
917
00:38:54,080 --> 00:38:58,080
And it's tough for me to say, because I've been an IT professional most of my career,
918
00:38:58,080 --> 00:39:02,080
but you do need to make sure that leadership is on board
919
00:39:02,080 --> 00:39:05,080
and making sure that not only are you making technical changes,
920
00:39:05,080 --> 00:39:10,080
but also make an organizational changes, i.e. strategy and mindset shift
921
00:39:10,080 --> 00:39:16,080
and cultural shift and all of those things, if you really want Zero Trust to have an impact.
922
00:39:16,080 --> 00:39:17,080
So it's interesting to bring that up.
923
00:39:17,080 --> 00:39:21,080
So Sarah and I actually have had a conversation over the last week or so.
924
00:39:21,080 --> 00:39:26,080
Like if you look at the audit logs that come out of SQL Server or Azure SQL DB,
925
00:39:26,080 --> 00:39:32,080
they're pretty hard to understand unless you actually know what each of the line items means.
926
00:39:32,080 --> 00:39:37,080
But, you know, when you fold in some of the kind of intelligence that's built into Sentinel,
927
00:39:37,080 --> 00:39:43,080
the fact that it's got functionality built into it to actually make sense of SQL logs,
928
00:39:43,080 --> 00:39:47,080
again, it just makes so much more sense about what's going on in your Azure SQL DB
929
00:39:47,080 --> 00:39:51,080
or your SQL MI or your SQL Server on-prem or in a VM,
930
00:39:51,080 --> 00:39:55,080
it makes so much more sense so you actually understand precisely what's going on.
931
00:39:55,080 --> 00:40:00,080
Make no mistake, those things can produce absolutely massive series of logs.
932
00:40:00,080 --> 00:40:05,080
And so, yeah, it's great to see tools like Sentinel making sense of all that.
933
00:40:05,080 --> 00:40:11,080
Alright Matt, so one question that we ask all our guests is if you had just one thought to leave our listeners with,
934
00:40:11,080 --> 00:40:13,080
what would it be?
935
00:40:13,080 --> 00:40:15,080
You know, I'm going to be really simple.
936
00:40:15,080 --> 00:40:18,080
Great question. Just do the basics.
937
00:40:18,080 --> 00:40:26,080
If you go out and you read the breach reports from Verizon and Microsoft and IBM and whoever,
938
00:40:26,080 --> 00:40:33,080
usually what you'll find in the root cause of these data breaches is the basics were missed.
939
00:40:33,080 --> 00:40:37,080
Identity hygiene or patching of systems.
940
00:40:37,080 --> 00:40:41,080
Again, it's hard for me to say as an IT pro, but you want to almost take a step back
941
00:40:41,080 --> 00:40:45,080
and figure out where we're missing on the basics.
942
00:40:45,080 --> 00:40:50,080
And let's go back in and make sure we are covering the basics first.
943
00:40:50,080 --> 00:40:52,080
And I mean basics, right?
944
00:40:52,080 --> 00:40:57,080
If it's making sure you've got multi-factor authentication deployed for every user,
945
00:40:57,080 --> 00:40:59,080
go through and double check kind of thing, right?
946
00:40:59,080 --> 00:41:04,080
Or your patching program or whatever it may be, password stored in a database.
947
00:41:04,080 --> 00:41:09,080
So that's kind of the final thought I'll leave is just make sure you're doing the basics.
948
00:41:09,080 --> 00:41:12,080
And as you go through that journey, you will like,
949
00:41:12,080 --> 00:41:17,080
guarantee you will start to figure out additional things that you can add to that roadmap
950
00:41:17,080 --> 00:41:20,080
and then start building up your zero trust strategy.
951
00:41:20,080 --> 00:41:21,080
So that's what I'll leave us with.
952
00:41:21,080 --> 00:41:24,080
Yeah, thanks for that. I think, yeah, people need to, you know,
953
00:41:24,080 --> 00:41:26,080
perhaps not take a cynical approach to zero trust.
954
00:41:26,080 --> 00:41:27,080
It's not a marketing term.
955
00:41:27,080 --> 00:41:29,080
It's not a, but it's by the same token, it's not a product.
956
00:41:29,080 --> 00:41:32,080
It's not a product Microsoft will sell to you.
957
00:41:32,080 --> 00:41:33,080
It's a series of practices.
958
00:41:33,080 --> 00:41:34,080
It's a series of technologies.
959
00:41:34,080 --> 00:41:35,080
It's a series of tools.
960
00:41:35,080 --> 00:41:39,080
It's a series of mindsets with a goal of sort of protecting environments
961
00:41:39,080 --> 00:41:43,080
and this sort of this modern world, you know, within which we live.
962
00:41:43,080 --> 00:41:46,080
So again, thank you so much for taking the time to see us this week.
963
00:41:46,080 --> 00:41:51,080
And to all our listeners out there, stay safe and we'll see you next time.
964
00:41:51,080 --> 00:41:54,080
Thanks for listening to the Azure Security Podcast.
965
00:41:54,080 --> 00:42:01,080
You can find show notes and other resources at our website azsecuritypodcast.net.
966
00:42:01,080 --> 00:42:06,080
If you have any questions, please find us on Twitter at azuresetpod.
967
00:42:06,080 --> 00:42:32,080
Background music is from ccmixter.com and licensed under the Creative Commons license.
00:00:00,000 --> 00:00:09,200
Welcome to the Azure Security Podcast,
2
00:00:09,200 --> 00:00:12,360
where we discuss topics relating to security, privacy,
3
00:00:12,360 --> 00:00:16,680
reliability, and compliance on the Microsoft Cloud Platform.
4
00:00:16,680 --> 00:00:20,120
Hey everybody, welcome to Episode 55.
5
00:00:20,120 --> 00:00:22,400
This week is myself, Michael and Sarah.
6
00:00:22,400 --> 00:00:24,800
Glad there's a mark of taking a vacation.
7
00:00:24,800 --> 00:00:26,280
We also have a guest this week,
8
00:00:26,280 --> 00:00:28,840
Matt Sosman, who's here to talk to us about
9
00:00:28,840 --> 00:00:31,080
some of the practicalities of Zero Trust.
10
00:00:31,080 --> 00:00:32,520
But before we get to Matt,
11
00:00:32,520 --> 00:00:34,440
let's take a quick lap around the news.
12
00:00:34,440 --> 00:00:36,120
Sarah, why don't you kick things off?
13
00:00:36,120 --> 00:00:37,800
At the time we're recording this,
14
00:00:37,800 --> 00:00:40,320
it was RSA last week.
15
00:00:40,320 --> 00:00:42,960
I didn't go to RSA this time,
16
00:00:42,960 --> 00:00:46,280
but as you would expect at RSA,
17
00:00:46,280 --> 00:00:48,600
there's quite a few announcements.
18
00:00:48,600 --> 00:00:50,400
The big one, of course,
19
00:00:50,400 --> 00:00:53,960
is we announced Microsoft Entra.
20
00:00:53,960 --> 00:00:59,920
Entra is our suite of identity-based security solutions.
21
00:00:59,920 --> 00:01:02,880
So that includes good old Azure AD,
22
00:01:02,880 --> 00:01:06,320
Microsoft Entra permissions management.
23
00:01:06,320 --> 00:01:09,720
Now that's our Cloud Infrastructure Entitlement Management,
24
00:01:09,720 --> 00:01:10,680
or CIM.
25
00:01:10,680 --> 00:01:13,160
I'm not sure how we're going to say that,
26
00:01:13,160 --> 00:01:14,400
because that's CIM,
27
00:01:14,400 --> 00:01:16,920
but then we have CIM within S as well.
28
00:01:16,920 --> 00:01:19,840
So I know some in the US,
29
00:01:19,840 --> 00:01:22,880
often people say CIM for the one that starts with an S.
30
00:01:22,880 --> 00:01:24,400
I pronounce them the same.
31
00:01:24,400 --> 00:01:26,760
So I guess we'll find out how you pronounce those.
32
00:01:26,760 --> 00:01:29,760
That was, for those of you who are aware,
33
00:01:29,760 --> 00:01:32,040
Microsoft Entra permissions management
34
00:01:32,040 --> 00:01:34,640
is what we're now calling what was Cloud Knox,
35
00:01:34,640 --> 00:01:38,400
which we acquired not too long ago.
36
00:01:38,400 --> 00:01:40,440
And then the other product in there
37
00:01:40,440 --> 00:01:43,000
is Microsoft Entra Verified ID.
38
00:01:43,000 --> 00:01:44,640
So a lot of stuff,
39
00:01:44,640 --> 00:01:48,520
a lot of cool things that we've put into one suite of products.
40
00:01:48,520 --> 00:01:51,160
So there's a lot of,
41
00:01:51,160 --> 00:01:54,240
we'll have links of course in the show notes as usual,
42
00:01:54,240 --> 00:01:56,440
but go check out Entra,
43
00:01:56,440 --> 00:01:58,200
because that is our,
44
00:01:58,200 --> 00:02:00,920
we call it our modern identity and access solutions.
45
00:02:00,920 --> 00:02:03,200
And I'm sure we'll have some people,
46
00:02:03,200 --> 00:02:05,160
in fact, we'll have to go find some people, Michael,
47
00:02:05,160 --> 00:02:07,920
to come on and have a chat to us about that.
48
00:02:07,920 --> 00:02:09,080
For some other announcements,
49
00:02:09,080 --> 00:02:12,120
then we've also got Defender for Cloud.
50
00:02:12,120 --> 00:02:17,320
They have announced that they've now got GA for GCP onboarding.
51
00:02:17,320 --> 00:02:19,120
So if you're using GCP
52
00:02:19,120 --> 00:02:23,320
and you want to use Defender for Cloud to monitor your VMs over there,
53
00:02:23,320 --> 00:02:24,440
you can do that.
54
00:02:24,440 --> 00:02:26,880
And you could do it at the organization level
55
00:02:26,880 --> 00:02:28,560
rather than having to do each project,
56
00:02:28,560 --> 00:02:30,480
which is much nicer.
57
00:02:30,480 --> 00:02:33,720
We've got just-in-time access for AWS VMs.
58
00:02:33,720 --> 00:02:37,920
So it's not just an Azure thing anymore.
59
00:02:37,920 --> 00:02:40,400
I'm not gonna list all of these,
60
00:02:40,400 --> 00:02:45,520
but Defender for Cosmos DB is also GA now.
61
00:02:45,520 --> 00:02:48,880
And I'm gonna jump in and steal Michael's thunder.
62
00:02:48,880 --> 00:02:53,480
We're also, Defender for Cloud is also offering protection
63
00:02:53,480 --> 00:03:00,280
for SQL servers running on AWS EC2, GCP Compute Engine,
64
00:03:00,280 --> 00:03:02,040
and a couple of other ones as well.
65
00:03:02,040 --> 00:03:04,880
So sorry, Michael, I know I shouldn't touch SQL
66
00:03:04,880 --> 00:03:07,720
because that's your baby.
67
00:03:07,720 --> 00:03:09,560
So, yeah, again, I'll link in the show notes.
68
00:03:09,560 --> 00:03:10,360
I'm not gonna...
69
00:03:10,360 --> 00:03:14,160
And then, of course, I've got to finish with my baby Sentinel.
70
00:03:14,160 --> 00:03:16,240
Not as many things to talk about,
71
00:03:16,240 --> 00:03:19,360
but our main thing is that we're really
72
00:03:19,360 --> 00:03:21,720
expanding our solutions marketplace.
73
00:03:21,720 --> 00:03:24,160
That's the thing that comes under Content Hub.
74
00:03:24,160 --> 00:03:26,680
So we've got now...
75
00:03:26,680 --> 00:03:29,280
There's more than 175 solutions.
76
00:03:29,280 --> 00:03:30,480
If you don't know the difference,
77
00:03:30,480 --> 00:03:33,120
I'll just recap because I couldn't not...
78
00:03:33,120 --> 00:03:34,800
If you don't know the difference between a solution
79
00:03:34,800 --> 00:03:36,360
and a data connector,
80
00:03:36,360 --> 00:03:39,160
we used to very much focus on data connectors in Sentinel,
81
00:03:39,160 --> 00:03:41,160
but now we focus on solutions.
82
00:03:41,160 --> 00:03:44,240
So a solution is a data connector.
83
00:03:44,240 --> 00:03:47,520
It can also be workbooks, notebooks,
84
00:03:47,520 --> 00:03:50,040
analytics rules, hunting queries.
85
00:03:50,040 --> 00:03:52,240
A solution is like the whole package of things
86
00:03:52,240 --> 00:03:55,400
that you need to work with a particular data source.
87
00:03:55,400 --> 00:03:58,200
And going forward, we'll definitely be talking
88
00:03:58,200 --> 00:04:00,760
about solutions rather than connectors.
89
00:04:00,760 --> 00:04:02,400
So go and check that out.
90
00:04:02,400 --> 00:04:03,360
We're also...
91
00:04:03,360 --> 00:04:05,760
Another thing that's gonna be really cool
92
00:04:05,760 --> 00:04:08,120
is we're gonna have a unified GitHub community
93
00:04:08,120 --> 00:04:10,760
for our CIM and SOAR and XDR
94
00:04:10,760 --> 00:04:13,440
because you may know, if you spend time in our GitHub,
95
00:04:13,440 --> 00:04:16,560
that Sentinel is currently separate for two defender.
96
00:04:16,560 --> 00:04:18,560
And of course, they are all...
97
00:04:18,560 --> 00:04:19,880
They all work together
98
00:04:19,880 --> 00:04:22,080
and there are overlaps between the two.
99
00:04:22,080 --> 00:04:25,640
So we're actually gonna unify all of that
100
00:04:25,640 --> 00:04:28,880
into a new GitHub community, which is really nice.
101
00:04:28,880 --> 00:04:31,040
And I'm gonna stop there.
102
00:04:31,040 --> 00:04:32,960
That's my news for this time.
103
00:04:32,960 --> 00:04:35,040
Over to you, Michael.
104
00:04:35,040 --> 00:04:37,040
So in case you missed it,
105
00:04:37,040 --> 00:04:41,440
so Sarah just mentioned that SQL Server is my baby.
106
00:04:41,440 --> 00:04:43,640
So even though we announced this,
107
00:04:43,640 --> 00:04:45,440
I announced it briefly in episode 54.
108
00:04:45,440 --> 00:04:48,320
Yes, I've moved over now from working directly
109
00:04:48,320 --> 00:04:52,040
with our customers to the Azure database platform.
110
00:04:52,040 --> 00:04:54,440
So I'm working on SQL Server,
111
00:04:54,440 --> 00:04:58,000
Azure SQL DB, Cosmos DB on the back end,
112
00:04:58,000 --> 00:04:59,760
security compliance, governments,
113
00:04:59,760 --> 00:05:00,640
all that sort of good stuff.
114
00:05:00,640 --> 00:05:03,120
So really nice low level engineering stuff.
115
00:05:03,120 --> 00:05:05,440
So I get to work on code and designs
116
00:05:05,440 --> 00:05:07,120
and threat models and that sort of stuff,
117
00:05:07,120 --> 00:05:09,000
which is right in my wheelhouse.
118
00:05:09,000 --> 00:05:11,240
I'm super excited for that move.
119
00:05:11,240 --> 00:05:12,400
It's also interesting, Sarah,
120
00:05:12,400 --> 00:05:13,760
that you mentioned Microsoft Entra.
121
00:05:13,760 --> 00:05:16,840
So something else that's not been talked about,
122
00:05:16,840 --> 00:05:17,920
but I'll mention it briefly.
123
00:05:17,920 --> 00:05:20,600
So myself and two colleagues,
124
00:05:20,600 --> 00:05:23,080
Heinrich Ganssenbein and Simone Kurtz,
125
00:05:23,080 --> 00:05:25,400
are working on a book for Microsoft Press right now,
126
00:05:25,400 --> 00:05:26,480
tentatively entitled,
127
00:05:26,480 --> 00:05:29,160
Designing and Developing Secure Azure Solutions.
128
00:05:29,160 --> 00:05:31,560
We're on the last chapter right now,
129
00:05:31,560 --> 00:05:33,360
which is actually on identity.
130
00:05:33,360 --> 00:05:35,240
I left it to the last chapter on purpose
131
00:05:35,240 --> 00:05:37,760
because I'm absolutely terrified of the topic.
132
00:05:37,760 --> 00:05:39,160
But as we're sort of writing this thing,
133
00:05:39,160 --> 00:05:41,600
next thing you know, this whole suite of products
134
00:05:41,600 --> 00:05:43,800
comes out that sort of wraps products
135
00:05:43,800 --> 00:05:44,640
that we're talking about,
136
00:05:44,640 --> 00:05:46,360
like as your active directory.
137
00:05:46,360 --> 00:05:47,200
So we've had to go through
138
00:05:47,200 --> 00:05:48,720
and make some little edits to the document.
139
00:05:48,720 --> 00:05:50,800
But yeah, so we're really excited about this book.
140
00:05:50,800 --> 00:05:53,160
Scott Guthrie is writing the forward for the book.
141
00:05:53,160 --> 00:05:56,120
We're gonna be covering design, development,
142
00:05:56,120 --> 00:06:01,120
compliance, cryptography, network for developers.
143
00:06:01,320 --> 00:06:02,920
We're gonna cover the whole gamut.
144
00:06:02,920 --> 00:06:04,480
So I'm really excited for the book to come out.
145
00:06:04,480 --> 00:06:05,640
Not sure the exact date yet,
146
00:06:05,640 --> 00:06:07,680
but yeah, we're on the last chapter right now
147
00:06:07,680 --> 00:06:08,760
in terms of the drafts anyway.
148
00:06:08,760 --> 00:06:10,480
So I'm really excited about that.
149
00:06:10,480 --> 00:06:12,320
So on the topic of news,
150
00:06:12,320 --> 00:06:13,800
so I have a couple of items.
151
00:06:13,800 --> 00:06:16,080
Yes, thank you Sarah for stealing that one from me
152
00:06:16,080 --> 00:06:19,240
about the SQL Server databases on AWS.
153
00:06:19,240 --> 00:06:22,320
But anyway, first one is we now have some new server roles
154
00:06:22,320 --> 00:06:25,360
for Azure SQL Database and SQL Server 2022.
155
00:06:25,360 --> 00:06:27,440
These are in public preview.
156
00:06:27,440 --> 00:06:30,080
They allow you to do certain levels of administration
157
00:06:30,080 --> 00:06:32,880
within the SQL Database without being an admin.
158
00:06:32,880 --> 00:06:34,400
And that is really cool
159
00:06:34,400 --> 00:06:37,920
because that is a great example of least privilege, right?
160
00:06:37,920 --> 00:06:39,520
I mean, historically there are some tasks
161
00:06:39,520 --> 00:06:41,400
that require you basically be the sys admin,
162
00:06:41,400 --> 00:06:43,640
come on in and do all these things.
163
00:06:43,640 --> 00:06:44,800
Well, the problem is a sys admin
164
00:06:44,800 --> 00:06:47,800
has basically unfettered access to absolutely everything.
165
00:06:47,800 --> 00:06:50,080
And that can be really problematic for some customers.
166
00:06:50,080 --> 00:06:53,400
So now we have some new server roles
167
00:06:53,400 --> 00:06:56,320
that will allow you to grant people specific rights
168
00:06:56,320 --> 00:06:58,280
to do certain administrative tasks
169
00:06:58,280 --> 00:07:00,240
without being able to do everything else.
170
00:07:00,240 --> 00:07:04,520
So really granular access and that's really great to see.
171
00:07:04,520 --> 00:07:07,480
Another one, which is another one from SQL Server
172
00:07:07,480 --> 00:07:12,480
is we now have common criteria EAL4 certification
173
00:07:12,520 --> 00:07:15,880
for the SQL 19 series of products.
174
00:07:15,880 --> 00:07:20,000
So EAL4 is a big deal for certain customers,
175
00:07:20,000 --> 00:07:23,520
especially those in governments or in the military.
176
00:07:23,520 --> 00:07:26,480
They require certain levels of assurance.
177
00:07:26,480 --> 00:07:28,040
Notice we say assurance.
178
00:07:28,040 --> 00:07:30,360
There's more to security than just security.
179
00:07:30,360 --> 00:07:33,640
There's basically trustworthyness of the system.
180
00:07:33,640 --> 00:07:36,680
And so we've now attained the EAL4 certification.
181
00:07:36,680 --> 00:07:40,720
Again, I'll provide notes for that in the show notes.
182
00:07:40,720 --> 00:07:43,000
We now also have, funnily enough,
183
00:07:43,000 --> 00:07:45,720
another SQL related news item.
184
00:07:45,720 --> 00:07:49,280
We now have import and export of SQL database
185
00:07:49,280 --> 00:07:50,680
using over private link.
186
00:07:50,680 --> 00:07:52,240
So this is actually a big deal
187
00:07:52,240 --> 00:07:55,800
because right now for the import and export service
188
00:07:55,800 --> 00:07:58,400
requires you basically trust Azure services,
189
00:07:58,400 --> 00:07:59,640
which basically means you trust absolutely
190
00:07:59,640 --> 00:08:01,120
all the Azure services.
191
00:08:01,120 --> 00:08:04,120
And some customers just don't like that.
192
00:08:04,120 --> 00:08:06,640
So in public preview right now,
193
00:08:06,640 --> 00:08:08,240
we have private link support.
194
00:08:08,240 --> 00:08:11,200
And again, as I mentioned, there's some private podcasts
195
00:08:11,200 --> 00:08:13,240
that you'll see more and more PaaS offerings
196
00:08:13,240 --> 00:08:15,280
moved to using private link
197
00:08:15,280 --> 00:08:18,720
for their sort of network isolations story.
198
00:08:18,720 --> 00:08:21,160
One other one is Azure Bastion now allows you
199
00:08:21,160 --> 00:08:25,040
to use IP based connections rather than just DNS names.
200
00:08:25,040 --> 00:08:28,080
This is just to make it easy for some types of customers
201
00:08:28,080 --> 00:08:31,640
who prefer to use IP addresses versus DNS names.
202
00:08:31,640 --> 00:08:34,240
Historically, it would only work with DNS names.
203
00:08:34,240 --> 00:08:36,880
And the last one talking of naming
204
00:08:36,880 --> 00:08:39,680
is as you container apps now has full support
205
00:08:39,680 --> 00:08:42,160
for custom domains in TLS certificates.
206
00:08:42,160 --> 00:08:45,040
So back in prior to now,
207
00:08:45,040 --> 00:08:48,240
you had to use sort of Azure wildcard certificates.
208
00:08:48,240 --> 00:08:49,240
Well, now you don't have to.
209
00:08:49,240 --> 00:08:50,840
You can have your own custom domain
210
00:08:50,840 --> 00:08:53,880
and you can have your own TLS certificate in there.
211
00:08:53,880 --> 00:08:56,040
So that sort of wraps up the news.
212
00:08:56,040 --> 00:08:58,840
So now let's turn our attention to our guest.
213
00:08:58,840 --> 00:09:01,680
Thank you so much for joining us this week, Matt.
214
00:09:01,680 --> 00:09:03,880
Do you want to give us a quick overview
215
00:09:03,880 --> 00:09:06,120
of kind of what you do at Microsoft?
216
00:09:06,120 --> 00:09:07,840
Yeah, thanks again for having me.
217
00:09:07,840 --> 00:09:12,720
So, so Matt Sosman, I've been at Microsoft 10 years,
218
00:09:12,720 --> 00:09:14,200
multiple roles,
219
00:09:14,200 --> 00:09:16,040
working in our consulting services division,
220
00:09:16,040 --> 00:09:18,160
worked in marketing for a while,
221
00:09:18,160 --> 00:09:20,720
worked in our field as a field seller.
222
00:09:20,720 --> 00:09:23,560
And now I'm over on the identity engineering team.
223
00:09:23,560 --> 00:09:28,280
And so my primary focus is the strategy for ISV partners
224
00:09:28,280 --> 00:09:29,880
when it comes to zero trust.
225
00:09:29,880 --> 00:09:31,640
So we'll talk a little bit about that today
226
00:09:31,640 --> 00:09:33,400
and what that means.
227
00:09:33,400 --> 00:09:36,760
But I really try to think about zero trust all day long
228
00:09:36,760 --> 00:09:39,160
and see how we can go out and help our customers
229
00:09:39,160 --> 00:09:40,440
get out there and get secured.
230
00:09:40,440 --> 00:09:41,800
So that's a little bit about me.
231
00:09:41,800 --> 00:09:44,960
We've had two other people talking about zero trust
232
00:09:44,960 --> 00:09:47,720
and I always say the very same thing
233
00:09:47,720 --> 00:09:49,640
which I'm going to say right here,
234
00:09:49,640 --> 00:09:52,760
which is a lot of people see zero trust
235
00:09:52,760 --> 00:09:54,600
and they think, oh, that's just architecture, right?
236
00:09:54,600 --> 00:09:56,560
That's just some marketing speak,
237
00:09:56,560 --> 00:10:00,680
you know, some marketing speak for buying Microsoft products.
238
00:10:00,680 --> 00:10:01,680
I don't agree with that.
239
00:10:01,680 --> 00:10:03,400
I've seen a lot of customers actually take
240
00:10:03,400 --> 00:10:06,240
a very, very practical view of zero trust.
241
00:10:06,240 --> 00:10:09,680
I've just been working recently with a bank, a large bank,
242
00:10:09,680 --> 00:10:14,000
looking at a zero trust sort of plan of attack
243
00:10:14,000 --> 00:10:15,880
for the next few years.
244
00:10:15,880 --> 00:10:19,240
And they're looking at very specific areas around zero trust
245
00:10:19,240 --> 00:10:20,640
and then adopting technologies,
246
00:10:20,640 --> 00:10:23,480
some of the technologies they already have.
247
00:10:23,480 --> 00:10:25,760
But one of the key things is doing like a gap analysis.
248
00:10:25,760 --> 00:10:27,920
Let's find out where you're missing some defenses
249
00:10:27,920 --> 00:10:31,440
that can help sort of flesh out the zero trust story.
250
00:10:31,440 --> 00:10:33,880
So kind of what's your perspective on zero trust
251
00:10:33,880 --> 00:10:36,920
and how are you seeing customers practically use it?
252
00:10:36,920 --> 00:10:38,520
Yeah, it's a great question.
253
00:10:38,520 --> 00:10:41,440
You know, it's funny when you go out and talk to people,
254
00:10:41,440 --> 00:10:43,560
everybody has a kind of a different definition
255
00:10:43,560 --> 00:10:45,720
of zero trust and how they think about it.
256
00:10:46,800 --> 00:10:48,880
And different vendors out there have their own definition.
257
00:10:48,880 --> 00:10:51,200
But for me, when I look at it,
258
00:10:51,200 --> 00:10:54,560
it's more around having a structure and a rhyme
259
00:10:54,560 --> 00:10:57,040
and a reason to your security program
260
00:10:57,040 --> 00:11:01,160
and making sure that it's set up in such a way
261
00:11:01,160 --> 00:11:04,040
that it actually enables the business.
262
00:11:04,040 --> 00:11:05,560
You know, oftentimes I've been doing IT
263
00:11:05,560 --> 00:11:07,360
for ongoing 20 years now.
264
00:11:07,360 --> 00:11:11,480
And oftentimes as an IT pro, we forget about,
265
00:11:11,480 --> 00:11:13,280
you know, what we're actually trying to do for the business.
266
00:11:13,280 --> 00:11:15,240
And so, you know, with zero trust,
267
00:11:15,240 --> 00:11:17,400
it's around enabling users to be more productive,
268
00:11:17,400 --> 00:11:19,560
but also what are the business outcomes, right?
269
00:11:19,560 --> 00:11:20,760
In other words, what are you trying to do
270
00:11:20,760 --> 00:11:22,080
and why are you trying to do it?
271
00:11:22,080 --> 00:11:25,760
Let's not just lock down that SQL database because we can,
272
00:11:25,760 --> 00:11:27,800
what does it actually mean to do it?
273
00:11:27,800 --> 00:11:29,800
And how does that help us in the outcomes
274
00:11:29,800 --> 00:11:32,200
we're actually trying to drive as an example?
275
00:11:32,200 --> 00:11:35,240
And so, you know, so when I think about my definition
276
00:11:35,240 --> 00:11:37,080
around it, it's how do we take those,
277
00:11:37,080 --> 00:11:40,720
the foundational principles to zero trust, right?
278
00:11:40,720 --> 00:11:43,800
Verify explicitly, use at least privilege access
279
00:11:43,800 --> 00:11:45,280
and assume breach.
280
00:11:45,280 --> 00:11:48,920
And how do we translate that into business terms
281
00:11:48,920 --> 00:11:51,120
that can allow the business to take advantage
282
00:11:51,120 --> 00:11:53,680
of the technology and not the other way around?
283
00:11:53,680 --> 00:11:56,200
And so one of the ways we do that
284
00:11:56,200 --> 00:11:59,560
is through meeting the customer where they're at.
285
00:11:59,560 --> 00:12:00,800
And what that means,
286
00:12:00,800 --> 00:12:03,480
and we'll probably get more into this here in a little bit,
287
00:12:03,480 --> 00:12:06,720
but helping them understand how do we take
288
00:12:06,720 --> 00:12:09,240
that heterogeneous architecture you have
289
00:12:09,240 --> 00:12:11,880
and how do we help connect to the dots?
290
00:12:11,880 --> 00:12:14,320
So if you have technology from vendor A
291
00:12:14,320 --> 00:12:16,400
and technology from vendor B,
292
00:12:16,400 --> 00:12:18,440
how do we bring both of those together
293
00:12:18,440 --> 00:12:20,520
that can help your overall zero trust posture
294
00:12:20,520 --> 00:12:22,320
and help that program move forward?
295
00:12:22,320 --> 00:12:24,360
So that's kind of my overall approach to it
296
00:12:24,360 --> 00:12:25,520
and how I think about it.
297
00:12:25,520 --> 00:12:26,640
That makes complete sense.
298
00:12:26,640 --> 00:12:29,520
And I'd like to sort of throw sort of my hat into the ring
299
00:12:29,520 --> 00:12:32,840
here and explain how we did it with this one bank
300
00:12:32,840 --> 00:12:35,520
that really, really resonated with the customer.
301
00:12:35,520 --> 00:12:37,960
And I'd like to sort of get your feeling.
302
00:12:37,960 --> 00:12:39,240
So as you mentioned,
303
00:12:39,240 --> 00:12:41,680
there are three pillars to zero trust,
304
00:12:41,680 --> 00:12:44,520
at least the way we talk about it at Microsoft.
305
00:12:44,520 --> 00:12:48,880
Number one is assume breach.
306
00:12:48,880 --> 00:12:50,160
By the way, these are in no particular order,
307
00:12:50,160 --> 00:12:51,160
but number one is assume breach.
308
00:12:51,160 --> 00:12:53,040
Number two is verify explicitly.
309
00:12:53,040 --> 00:12:55,640
And number three is lease privilege.
310
00:12:55,640 --> 00:12:58,920
And then we have the sort of six major categories.
311
00:12:58,920 --> 00:13:01,160
So we have identity endpoints,
312
00:13:01,160 --> 00:13:04,800
applications, network, infrastructure and data.
313
00:13:04,800 --> 00:13:06,440
And so what I did for this customer was I said,
314
00:13:06,440 --> 00:13:08,120
okay, let's look at these six categories
315
00:13:08,120 --> 00:13:09,840
and let's look at the three pillars of zero trust
316
00:13:09,840 --> 00:13:11,960
and let's map what current products you have
317
00:13:11,960 --> 00:13:15,440
that sort of meet the goals of this intersection.
318
00:13:15,440 --> 00:13:17,120
And let's see where there are gaps.
319
00:13:17,120 --> 00:13:19,800
And so let me just pick on just on two, for example,
320
00:13:19,800 --> 00:13:22,920
verify explicitly and identity.
321
00:13:22,920 --> 00:13:24,520
So what they were using there was
322
00:13:24,520 --> 00:13:27,880
as your active directory and conditional access.
323
00:13:27,880 --> 00:13:30,320
And that made absolute sense to me, right?
324
00:13:30,320 --> 00:13:33,520
So you've got conditional access policies coming into play
325
00:13:33,520 --> 00:13:35,280
and perhaps they may force the use
326
00:13:35,280 --> 00:13:37,280
of multifactual authentication for certain accounts
327
00:13:37,280 --> 00:13:40,040
or based on some signal that's coming in to say,
328
00:13:40,040 --> 00:13:41,240
hey, this guy's, you know,
329
00:13:41,240 --> 00:13:43,400
well, this person's logging in from a, you know,
330
00:13:43,400 --> 00:13:45,120
an interesting IP address.
331
00:13:45,120 --> 00:13:47,800
We need to prompt for a second fact or that kind of stuff.
332
00:13:47,800 --> 00:13:49,440
Another one they have, which is really interesting
333
00:13:49,440 --> 00:13:52,480
is in the area of assume breach and data,
334
00:13:52,480 --> 00:13:55,720
they were using Microsoft information protection.
335
00:13:55,720 --> 00:13:57,440
The nice thing about that is, you know,
336
00:13:57,440 --> 00:13:59,200
if you assume breach and the attack is on the network
337
00:13:59,200 --> 00:14:00,600
and the attacker has access to everything,
338
00:14:00,600 --> 00:14:03,080
then the attacker only has access to the ciphertext, right?
339
00:14:03,080 --> 00:14:05,840
They don't have access to the plain text messages
340
00:14:05,840 --> 00:14:07,680
because everything is covered by a MIB policy
341
00:14:07,680 --> 00:14:09,960
and Microsoft information protection policy.
342
00:14:09,960 --> 00:14:12,160
And what was really cool here is we took,
343
00:14:12,160 --> 00:14:14,240
what essentially ends up being these 18 sections,
344
00:14:14,240 --> 00:14:17,320
again, it's assume breach, verify explicitly
345
00:14:17,320 --> 00:14:19,680
and lease privilege.
346
00:14:19,680 --> 00:14:22,280
And then that was actually on the Y axis.
347
00:14:22,280 --> 00:14:25,320
And then on the X axis, we had identity, endpoints,
348
00:14:25,320 --> 00:14:28,120
applications, network, infrastructure and data.
349
00:14:28,120 --> 00:14:30,120
And we filled in each of those 18 sections
350
00:14:30,120 --> 00:14:32,320
and said, what do you currently have here?
351
00:14:32,320 --> 00:14:33,720
And then are there any gaps?
352
00:14:33,720 --> 00:14:35,360
And we actually found like four gaps
353
00:14:35,360 --> 00:14:36,920
that had absolutely nothing whatsoever.
354
00:14:36,920 --> 00:14:39,440
And one of them was, for example,
355
00:14:39,440 --> 00:14:42,240
lease privilege and network.
356
00:14:42,240 --> 00:14:45,840
They actually had nothing to sort of restrict
357
00:14:45,840 --> 00:14:48,000
network access to, you know, lease privilege manner.
358
00:14:48,000 --> 00:14:49,760
And another one was actually
359
00:14:49,760 --> 00:14:52,480
lease privilege again and infrastructure.
360
00:14:52,480 --> 00:14:53,320
So it was really interesting
361
00:14:53,320 --> 00:14:55,600
because this really gave the customer a nice insight
362
00:14:55,600 --> 00:14:59,120
into what they currently had in terms of services
363
00:14:59,120 --> 00:15:03,840
and both Microsoft and other vendors
364
00:15:03,840 --> 00:15:05,640
to see what they currently had,
365
00:15:05,640 --> 00:15:07,280
what their inventory looked like today
366
00:15:07,280 --> 00:15:09,400
and what they should do moving forward.
367
00:15:09,400 --> 00:15:12,760
And that made absolute sense to the customer
368
00:15:12,760 --> 00:15:16,360
because it's not sort of ethereal anymore, right?
369
00:15:16,360 --> 00:15:18,240
You're sort of saying, here are these three parts
370
00:15:18,240 --> 00:15:20,480
of zero trust and here are these six, you know,
371
00:15:20,480 --> 00:15:22,560
things that we sort of focus on.
372
00:15:22,560 --> 00:15:25,120
What products or services do you have
373
00:15:25,120 --> 00:15:26,520
in each of those areas?
374
00:15:26,520 --> 00:15:27,840
One that they had, which turns out one thing
375
00:15:27,840 --> 00:15:31,920
they had a lot of for assuming breach, lease privilege
376
00:15:31,920 --> 00:15:33,760
and verify explicitly was like things like
377
00:15:33,760 --> 00:15:35,200
Microsoft Endpoint Protection.
378
00:15:36,280 --> 00:15:38,080
They made heavy use of that.
379
00:15:38,080 --> 00:15:40,560
So, I mean, is that the sort of thing that,
380
00:15:40,560 --> 00:15:43,280
the sort of thinking that you're seeing some customers use
381
00:15:43,280 --> 00:15:45,360
or am I just totally off track
382
00:15:45,360 --> 00:15:47,400
and you've seen customers do other things?
383
00:15:47,400 --> 00:15:49,680
And by the way, I'm totally open to being said
384
00:15:49,680 --> 00:15:51,760
that, hey, what I did wasn't great.
385
00:15:51,760 --> 00:15:52,600
That's my hit.
386
00:15:52,600 --> 00:15:53,840
I'm here to learn as well.
387
00:15:53,840 --> 00:15:55,760
Personally, I don't think there's any right or wrong way, right?
388
00:15:55,760 --> 00:15:57,920
It's, you know, every customer is going to be different.
389
00:15:57,920 --> 00:16:00,600
Every organization's other group is going to be different.
390
00:16:00,600 --> 00:16:02,960
And so they have to do what they need to do
391
00:16:02,960 --> 00:16:04,440
that works best for them.
392
00:16:04,440 --> 00:16:06,280
And so, you know, what you outlined,
393
00:16:06,280 --> 00:16:07,880
that sounds like a great approach
394
00:16:07,880 --> 00:16:11,120
for what their needs were and what they had to do.
395
00:16:11,120 --> 00:16:13,440
What I find interesting about it is,
396
00:16:13,440 --> 00:16:14,560
you kind of lose this,
397
00:16:14,560 --> 00:16:16,200
when you start peeling back the onion
398
00:16:16,200 --> 00:16:18,320
and you get into the technology,
399
00:16:18,320 --> 00:16:19,360
the technology is really cool.
400
00:16:19,360 --> 00:16:21,600
I mean, I can geek out on that all day long,
401
00:16:21,600 --> 00:16:24,960
but what's even cooler about it is when we can distill that
402
00:16:24,960 --> 00:16:28,520
into terms that, dare I say, a business executive,
403
00:16:28,520 --> 00:16:31,080
something that's non-technical at the organization,
404
00:16:31,080 --> 00:16:33,760
i.e. the CIO, can actually understand
405
00:16:33,760 --> 00:16:36,360
to go tell the rest of the C-suite,
406
00:16:36,360 --> 00:16:37,880
that's when the magic starts to happen.
407
00:16:37,880 --> 00:16:38,960
I'll give you a great example.
408
00:16:38,960 --> 00:16:40,520
You talked about MIP a little bit.
409
00:16:40,520 --> 00:16:41,840
So, you know, over the pandemic,
410
00:16:41,840 --> 00:16:45,200
we saw the boom and work from home and work anywhere.
411
00:16:45,200 --> 00:16:47,000
Yeah, people are starting to come back to the office,
412
00:16:47,000 --> 00:16:48,880
but we do see organizations out there
413
00:16:48,880 --> 00:16:52,040
that they're actually thinking about going 100% remote
414
00:16:52,040 --> 00:16:55,480
or majority of their work force being remote.
415
00:16:55,480 --> 00:16:57,280
And this is where previously,
416
00:16:57,280 --> 00:16:58,360
they never would have entertained it
417
00:16:58,360 --> 00:17:00,320
because the security team, you know,
418
00:17:00,320 --> 00:17:01,800
it's like, oh, that's too insecure.
419
00:17:01,800 --> 00:17:03,720
How would we ever even do this?
420
00:17:03,720 --> 00:17:05,520
But when you start to look at something like MIP,
421
00:17:05,520 --> 00:17:06,680
it encrypts the data.
422
00:17:06,680 --> 00:17:09,160
And so, I can send you whatever I want.
423
00:17:09,160 --> 00:17:11,960
I could send you highly proprietary information,
424
00:17:11,960 --> 00:17:14,400
but it's encrypted, AES-256.
425
00:17:14,400 --> 00:17:16,040
Now, you have to have my identity to open it,
426
00:17:16,040 --> 00:17:17,400
and I would have to explicitly assign you
427
00:17:17,400 --> 00:17:19,400
permissions to open it.
428
00:17:19,400 --> 00:17:21,480
But the cool part about it is I could revoke that data.
429
00:17:21,480 --> 00:17:23,320
So, if I accidentally send you something
430
00:17:23,320 --> 00:17:24,640
and you have permissions to it,
431
00:17:24,640 --> 00:17:27,280
I can actually revoke it in flight with MIP.
432
00:17:28,200 --> 00:17:30,080
And there's all sorts of other controls around it,
433
00:17:30,080 --> 00:17:32,800
auditing and like even block screenshots.
434
00:17:32,800 --> 00:17:34,640
Like, I mean, there's so many details there.
435
00:17:34,640 --> 00:17:35,840
Well, when you started to steal that,
436
00:17:35,840 --> 00:17:38,240
you take that to one of these executives.
437
00:17:38,240 --> 00:17:41,760
What we saw in a particular customer example I had
438
00:17:41,760 --> 00:17:42,840
in the last six months,
439
00:17:42,840 --> 00:17:45,960
where they're thinking about enabling more of their workforce
440
00:17:45,960 --> 00:17:48,440
to actually be permanently remote,
441
00:17:48,440 --> 00:17:51,160
they got a concern around, well, how do we prevent data
442
00:17:51,160 --> 00:17:53,560
from being accessed on personal devices, right?
443
00:17:53,560 --> 00:17:55,880
You're at home, you've got a personal computer right next
444
00:17:55,880 --> 00:17:56,720
to your work computer.
445
00:17:56,720 --> 00:17:58,920
How are you preventing data spillage?
446
00:17:58,920 --> 00:18:00,680
Well, in comes MIP.
447
00:18:00,680 --> 00:18:03,840
And now, all of a sudden, the ideas start flying around.
448
00:18:03,840 --> 00:18:06,880
Here's how we can, we might be able to make this work
449
00:18:06,880 --> 00:18:07,840
kind of thing, right?
450
00:18:07,840 --> 00:18:09,800
And so, and that's where it gets excited.
451
00:18:09,800 --> 00:18:11,920
And then you start going above and beyond
452
00:18:11,920 --> 00:18:13,640
the other technologies.
453
00:18:13,640 --> 00:18:16,240
And that's where the use cases really start
454
00:18:16,240 --> 00:18:17,240
coming out of the woodwork.
455
00:18:17,240 --> 00:18:20,560
And the business starts seeing the potential
456
00:18:20,560 --> 00:18:23,440
and going back to my kind of my introduction there.
457
00:18:23,440 --> 00:18:24,760
It's all about what are you trying to do
458
00:18:24,760 --> 00:18:25,760
and why are you trying to do it?
459
00:18:25,760 --> 00:18:27,760
But in business terms, how does this,
460
00:18:27,760 --> 00:18:29,360
what's the outcome for the business?
461
00:18:29,360 --> 00:18:31,640
How does it actually move us forward?
462
00:18:31,640 --> 00:18:35,880
Well, if I can enable my data to be securely accessed
463
00:18:35,880 --> 00:18:38,840
anywhere anytime, well, that enables me to, you know,
464
00:18:38,840 --> 00:18:40,920
work remotely like in this case.
465
00:18:40,920 --> 00:18:43,760
Now, all of a sudden, that enables all sorts of new outcomes,
466
00:18:43,760 --> 00:18:44,080
right?
467
00:18:44,080 --> 00:18:48,560
Think about contractors, think about vendors, even customers.
468
00:18:48,560 --> 00:18:51,120
So what you did, I wouldn't say it's not wrong, right?
469
00:18:51,120 --> 00:18:53,320
It's absolutely right for those circumstances
470
00:18:53,320 --> 00:18:55,240
of that customer, but everybody's different.
471
00:18:55,240 --> 00:18:58,080
But it's a matter of getting creative, I think is my point.
472
00:18:58,080 --> 00:19:01,280
And that requires an understanding of what
473
00:19:01,280 --> 00:19:03,080
are you trying to actually do?
474
00:19:03,080 --> 00:19:04,920
Because there's so many times out there
475
00:19:04,920 --> 00:19:06,480
where you get into these conversations.
476
00:19:06,480 --> 00:19:09,480
And we're so deep in the technology,
477
00:19:09,480 --> 00:19:11,920
we kind of lose sight of the pot of gold
478
00:19:11,920 --> 00:19:13,680
into the rainbow, right?
479
00:19:13,680 --> 00:19:16,520
We almost had to take a step back, regroup,
480
00:19:16,520 --> 00:19:19,120
and actually understand what's our objective.
481
00:19:19,120 --> 00:19:20,600
And if we get that clarity, then we
482
00:19:20,600 --> 00:19:23,200
could start to figure out, OK, now how do we use that technology
483
00:19:23,200 --> 00:19:24,080
to get there?
484
00:19:24,080 --> 00:19:27,480
So in your case, you did exactly that with MIPS
485
00:19:27,480 --> 00:19:28,760
and some of those other technologies.
486
00:19:28,760 --> 00:19:31,560
So that was kind of a long, long-winded answer.
487
00:19:31,560 --> 00:19:34,440
But that's kind of how I think about it.
488
00:19:34,440 --> 00:19:36,680
And everybody's different too.
489
00:19:36,680 --> 00:19:39,160
And so that's where, if you don't have an understanding
490
00:19:39,160 --> 00:19:41,800
of the technology, it's not necessarily a bad thing.
491
00:19:41,800 --> 00:19:44,800
But that's where you need to get help.
492
00:19:44,800 --> 00:19:47,040
And you need to understand that, hey, maybe we
493
00:19:47,040 --> 00:19:49,960
need to bring in some outside help, a consultancy firm,
494
00:19:49,960 --> 00:19:53,680
or whoever that can come in to help you understand
495
00:19:53,680 --> 00:19:55,880
the technology that you already own.
496
00:19:55,880 --> 00:19:57,400
Now, yeah, I work for Microsoft, right?
497
00:19:57,400 --> 00:20:01,320
But let's pretend for a moment, you're my customer, Michael.
498
00:20:01,320 --> 00:20:03,760
And Sarah works at your company as well.
499
00:20:03,760 --> 00:20:05,760
And obviously, you use Microsoft technologies,
500
00:20:05,760 --> 00:20:07,800
but you're going to use third-party security vendors
501
00:20:07,800 --> 00:20:08,840
as well, right?
502
00:20:08,840 --> 00:20:13,400
So now it's about having a deep understanding
503
00:20:13,400 --> 00:20:15,480
of how all those technologies work,
504
00:20:15,480 --> 00:20:18,360
and then figuring out how do we piece them together
505
00:20:18,360 --> 00:20:19,920
so we can achieve those business outcomes.
506
00:20:19,920 --> 00:20:23,120
And that's often the challenge.
507
00:20:23,120 --> 00:20:26,080
And again, that's kind of what I'm looking at here at Microsoft,
508
00:20:26,080 --> 00:20:29,000
is how do we help a customer stitch that together?
509
00:20:29,000 --> 00:20:31,120
Let me pause here, kind of going on a tangent here.
510
00:20:31,120 --> 00:20:33,040
But that's how I'm thinking through it.
511
00:20:33,040 --> 00:20:36,400
Yeah, so back to this bank scenario.
512
00:20:36,400 --> 00:20:41,280
So at Microsoft, we have this zero-trust maturity
513
00:20:41,280 --> 00:20:42,920
sort of assessment.
514
00:20:42,920 --> 00:20:45,440
You talk about sort of the pragmatics of it.
515
00:20:45,440 --> 00:20:47,280
So what we do with this customer is we actually went
516
00:20:47,280 --> 00:20:49,240
through this maturity assessment.
517
00:20:49,240 --> 00:20:50,560
It's relatively short.
518
00:20:50,560 --> 00:20:55,600
And the whole point is to understand sort of how mature
519
00:20:55,600 --> 00:20:58,760
you are in these different areas, like what do you use
520
00:20:58,760 --> 00:20:59,680
for endpoint protection?
521
00:20:59,680 --> 00:21:01,040
Where is the endpoint protection?
522
00:21:01,040 --> 00:21:03,400
What do you use for information protection?
523
00:21:03,400 --> 00:21:05,920
There's a whole bunch of stuff.
524
00:21:05,920 --> 00:21:09,520
And then from that, we end up, one of the outcomes of that
525
00:21:09,520 --> 00:21:12,400
is a whole bunch of user stories.
526
00:21:12,400 --> 00:21:16,240
So for example, you could load them into Azure DevOps or GRO
527
00:21:16,240 --> 00:21:21,560
and whatever your system is for managing stories or work items.
528
00:21:21,560 --> 00:21:23,720
Then you assign those to people and people go and investigate
529
00:21:23,720 --> 00:21:25,960
to find out what they have and where the gaps are
530
00:21:25,960 --> 00:21:26,960
and what have you.
531
00:21:26,960 --> 00:21:29,440
And that's why we end up coming with this grid, right?
532
00:21:29,440 --> 00:21:32,280
With the shows, the three areas of zero trust
533
00:21:32,280 --> 00:21:34,680
and then these six categories.
534
00:21:34,680 --> 00:21:37,200
Because that then helps take these stories
535
00:21:37,200 --> 00:21:40,760
and assign them a point on this grid.
536
00:21:40,760 --> 00:21:43,120
So that way we could always find out who the right person was
537
00:21:43,120 --> 00:21:44,960
to assign them to.
538
00:21:44,960 --> 00:21:48,320
And again, that really helped drive the customer.
539
00:21:48,320 --> 00:21:50,160
I'm not going to be wrong, these customers,
540
00:21:50,160 --> 00:21:52,240
this customer is incredibly savvy.
541
00:21:52,240 --> 00:21:54,760
They just wanted some guidance on just the structure
542
00:21:54,760 --> 00:21:56,080
of zero trust.
543
00:21:56,080 --> 00:21:58,480
They like the idea of the three pillars of zero trust.
544
00:21:58,480 --> 00:22:01,200
They like the idea of assuming breach.
545
00:22:01,200 --> 00:22:05,600
And that's a whole mental flip, assuming breach.
546
00:22:05,600 --> 00:22:08,000
I'll give you another example of that.
547
00:22:08,000 --> 00:22:10,760
I was working with a large bank in South America.
548
00:22:10,760 --> 00:22:13,160
I'm not going to name, even name the country.
549
00:22:13,160 --> 00:22:15,120
There's a very large bank in South America
550
00:22:15,120 --> 00:22:19,240
and they were going online with an online presence.
551
00:22:19,240 --> 00:22:23,520
And I was reviewing the security architecture of their design
552
00:22:23,520 --> 00:22:28,000
and we got to a point where they were storing passwords.
553
00:22:28,000 --> 00:22:31,560
And I'm like, so what are you actually storing?
554
00:22:31,560 --> 00:22:32,880
And they said, well, we're encrypting.
555
00:22:32,880 --> 00:22:34,400
We're encrypting the passwords.
556
00:22:34,400 --> 00:22:36,600
So where's the key stored to decrypt that?
557
00:22:36,600 --> 00:22:38,480
Well, it's over there.
558
00:22:38,480 --> 00:22:41,320
It doesn't matter where over there is, it's over there.
559
00:22:41,320 --> 00:22:43,680
I said, but what happens if the attacker gets that key?
560
00:22:43,680 --> 00:22:45,160
Well, they can decrypt everything.
561
00:22:45,160 --> 00:22:47,480
Well, OK, so now we need to stop and think about this
562
00:22:47,480 --> 00:22:51,040
for a minute because let's assume breach.
563
00:22:51,040 --> 00:22:52,560
Let's just think about that for a minute.
564
00:22:52,560 --> 00:22:54,280
Assume breach, the attacker is on the network
565
00:22:54,280 --> 00:22:57,680
and has unfettered access to absolutely everything.
566
00:22:57,680 --> 00:23:02,240
Well, now the attacker can decrypt every single password.
567
00:23:02,240 --> 00:23:04,400
And the customer nodded.
568
00:23:04,400 --> 00:23:07,200
Didn't like the fact they had to nod, but they nodded.
569
00:23:07,200 --> 00:23:09,280
I said, yeah, we need to think a little bit harder than that
570
00:23:09,280 --> 00:23:12,480
because you're a large bank and what you're doing
571
00:23:12,480 --> 00:23:16,840
is significant and will be attacked, guaranteed.
572
00:23:16,840 --> 00:23:19,480
So let's assume breach.
573
00:23:19,480 --> 00:23:22,120
So I said, do you actually need to know the password
574
00:23:22,120 --> 00:23:25,680
or do you need to know the user owns the password?
575
00:23:25,680 --> 00:23:28,640
And I said, well, we just need to know the user owns the password.
576
00:23:28,640 --> 00:23:30,840
Well, rather than encrypting it, we can do it.
577
00:23:30,840 --> 00:23:32,920
I don't want to get into all the crypto wonkiness here,
578
00:23:32,920 --> 00:23:34,480
but I'm going to.
579
00:23:34,480 --> 00:23:37,840
We can store a what's called a salted iterated hash
580
00:23:37,840 --> 00:23:40,080
of the password.
581
00:23:40,080 --> 00:23:42,480
The nice thing about that is you can quickly verify
582
00:23:42,480 --> 00:23:44,400
the user possesses the password, but not actually
583
00:23:44,400 --> 00:23:46,120
store the password.
584
00:23:46,120 --> 00:23:49,200
So now actually look at it from an assumed reach perspective.
585
00:23:49,200 --> 00:23:50,840
So if the attacker gets on the network
586
00:23:50,840 --> 00:23:53,720
and has absolutely unfettered access to absolutely everything,
587
00:23:53,720 --> 00:23:56,360
let's just say it's 10 million people,
588
00:23:56,360 --> 00:23:58,880
the data that the attacker gets is something
589
00:23:58,880 --> 00:24:00,520
the attacker cannot use.
590
00:24:00,520 --> 00:24:01,480
It's not the password.
591
00:24:01,480 --> 00:24:02,320
You can't decrypt it.
592
00:24:02,320 --> 00:24:03,720
There is no password to decrypt.
593
00:24:03,720 --> 00:24:06,840
You're just basically storing something that verifies
594
00:24:06,840 --> 00:24:08,840
the user actually owns the password.
595
00:24:08,840 --> 00:24:09,960
That's all you're doing.
596
00:24:09,960 --> 00:24:12,800
It's nothing the attacker can replay.
597
00:24:12,800 --> 00:24:14,600
So they had about just a few weeks
598
00:24:14,600 --> 00:24:16,200
to go until they were finally shipping,
599
00:24:16,200 --> 00:24:17,800
and they made this small change.
600
00:24:17,800 --> 00:24:19,040
And it was a relatively small change.
601
00:24:19,040 --> 00:24:21,120
And obviously we had to go through all the appropriate checks
602
00:24:21,120 --> 00:24:24,360
and tests to make sure that it didn't cause regressions.
603
00:24:24,360 --> 00:24:27,360
But they ended up shipping with this change,
604
00:24:27,360 --> 00:24:30,000
or they went live with this change, I should say.
605
00:24:30,000 --> 00:24:32,240
And we made a point of telling upper management
606
00:24:32,240 --> 00:24:34,440
that the change that was made, even though it was relatively
607
00:24:34,440 --> 00:24:38,400
late, supported zero trust ideas of assumed region.
608
00:24:38,400 --> 00:24:39,640
If the attacker is on the network,
609
00:24:39,640 --> 00:24:42,640
the attacker has nothing that they can use, nothing whatsoever.
610
00:24:42,640 --> 00:24:46,000
Doesn't matter by any stretch of anyone's imagination,
611
00:24:46,000 --> 00:24:48,480
there's just nothing you can use there.
612
00:24:48,480 --> 00:24:50,360
And the board loved that, especially
613
00:24:50,360 --> 00:24:52,600
when it was a very small engineering change.
614
00:24:52,600 --> 00:24:55,000
But the main change wasn't just the engineering change.
615
00:24:55,000 --> 00:24:57,640
It was actually basically a mental change.
616
00:24:57,640 --> 00:25:01,400
Was it just thinking about the design of the system?
617
00:25:01,400 --> 00:25:03,360
Let's just assume the attacker is on the network
618
00:25:03,360 --> 00:25:06,160
and has access to absolutely everything.
619
00:25:06,160 --> 00:25:07,760
Now what?
620
00:25:07,760 --> 00:25:11,840
And if the answer is, well, we're in deep trouble,
621
00:25:11,840 --> 00:25:13,560
that's not the right answer.
622
00:25:13,560 --> 00:25:16,400
You need to think longer and harder than just,
623
00:25:16,400 --> 00:25:18,240
well, we're in trouble.
624
00:25:18,240 --> 00:25:22,560
So I like that idea of putting new concepts into people's heads
625
00:25:22,560 --> 00:25:25,280
because it will help you design systems in a much more
626
00:25:25,280 --> 00:25:26,640
secure manner.
627
00:25:26,640 --> 00:25:28,440
Yeah, that's a great point.
628
00:25:28,440 --> 00:25:31,800
That's kind of what I meant by my comment around,
629
00:25:31,800 --> 00:25:35,440
if you were my customer, I may make a recommendation,
630
00:25:35,440 --> 00:25:38,000
bring in a consultancy firm to help you think through that.
631
00:25:38,000 --> 00:25:41,200
Because it is a huge mental mind shift
632
00:25:41,200 --> 00:25:43,640
to think about what if an attacker is actually
633
00:25:43,640 --> 00:25:46,440
on the network, what could be compromised right now
634
00:25:46,440 --> 00:25:47,840
that maybe we don't know about?
635
00:25:47,840 --> 00:25:50,840
And when you start to think about in large enterprise,
636
00:25:50,840 --> 00:25:53,280
many of these legacy line of business apps,
637
00:25:53,280 --> 00:25:56,680
they were written years ago, the person, or Tina wrote it,
638
00:25:56,680 --> 00:25:57,720
they're long gone.
639
00:25:57,720 --> 00:26:00,800
It's just kind of, the lights are still being kept on,
640
00:26:00,800 --> 00:26:03,000
but nobody's really maintaining it.
641
00:26:03,000 --> 00:26:05,040
Well, when we start to think about assumed reach,
642
00:26:05,040 --> 00:26:06,360
it means a lot of different things.
643
00:26:06,360 --> 00:26:09,240
But one of it means, let's go back and start to review,
644
00:26:09,240 --> 00:26:12,160
are there passwords stored in the database?
645
00:26:12,160 --> 00:26:16,840
How are these legacy apps functioning and architected?
646
00:26:16,840 --> 00:26:19,680
Do we need to start looking at maybe third party solutions
647
00:26:19,680 --> 00:26:22,480
that can help secure some of these apps that are legacy,
648
00:26:22,480 --> 00:26:24,680
that maybe the developer no longer supports
649
00:26:24,680 --> 00:26:27,360
or anything like that, but there's solutions out there
650
00:26:27,360 --> 00:26:30,560
that can help to protect those and specialize in it.
651
00:26:30,560 --> 00:26:33,240
So it causes you to start to think about a lot.
652
00:26:33,240 --> 00:26:34,960
Another thing around assumed breach
653
00:26:34,960 --> 00:26:39,320
that I come across frequently is from a SOC perspective,
654
00:26:39,320 --> 00:26:42,240
are you actually monitoring the things that are important?
655
00:26:42,240 --> 00:26:45,960
So oftentimes we think about, oh, just send all the logs.
656
00:26:45,960 --> 00:26:49,400
Okay, that's, yes, that's helpful,
657
00:26:49,400 --> 00:26:52,600
but somebody has to put in the logic,
658
00:26:52,600 --> 00:26:55,120
and somebody has to write the workflows
659
00:26:55,120 --> 00:26:58,120
and all of the other automation pieces around,
660
00:26:58,120 --> 00:27:00,440
what do you do with that data coming from the logs?
661
00:27:00,440 --> 00:27:02,840
Not only that, but you also have to think about manpower,
662
00:27:02,840 --> 00:27:05,000
and you have to think about how is your SOC structured?
663
00:27:05,000 --> 00:27:08,640
And the phrase that I keep hearing time and time again
664
00:27:08,640 --> 00:27:10,920
is if nobody's behind the wheel,
665
00:27:10,920 --> 00:27:13,680
or you have a couple of people behind the wheel,
666
00:27:13,680 --> 00:27:15,320
and you have a lot of wheels,
667
00:27:15,320 --> 00:27:17,120
you're probably gonna get alert fatigue,
668
00:27:17,120 --> 00:27:19,200
and you're gonna have gaps in visibility.
669
00:27:19,200 --> 00:27:22,280
So now how do we become more efficient?
670
00:27:22,280 --> 00:27:25,200
And that's another lens of assumed breach,
671
00:27:25,200 --> 00:27:27,240
and how do we actually monitor
672
00:27:27,240 --> 00:27:28,920
when there is something going on?
673
00:27:28,920 --> 00:27:31,800
And making sure we have the right solutions in place
674
00:27:31,800 --> 00:27:32,880
from a technology perspective,
675
00:27:32,880 --> 00:27:34,760
make sure we have the right processes in place
676
00:27:34,760 --> 00:27:35,880
to respond to it.
677
00:27:36,800 --> 00:27:39,880
And it goes way beyond just looking at data in a log.
678
00:27:39,880 --> 00:27:42,560
And so that's kind of that other mental mind shift,
679
00:27:42,560 --> 00:27:45,640
for years we've been used to just send all of the
680
00:27:45,640 --> 00:27:48,600
syslog data to the SEM, and the SEM will deal with it.
681
00:27:48,600 --> 00:27:50,080
May not always be the case.
682
00:27:50,080 --> 00:27:52,000
And so you definitely wanna go through
683
00:27:52,000 --> 00:27:54,280
and make sure that things are properly set up
684
00:27:54,280 --> 00:27:56,280
and that you've accounted for that.
685
00:27:56,280 --> 00:27:59,760
Mind if I share a quick story here about Zero Trust?
686
00:27:59,760 --> 00:28:01,200
Yeah, go for it.
687
00:28:01,200 --> 00:28:04,920
So back when the pandemic first started,
688
00:28:04,920 --> 00:28:08,040
and it was like the first week of March 20th,
689
00:28:08,040 --> 00:28:10,480
and the world sent everybody to work from home,
690
00:28:10,480 --> 00:28:13,080
we started having customers call us,
691
00:28:13,080 --> 00:28:16,200
phone was ringing off the hook, how do we do this?
692
00:28:16,200 --> 00:28:18,520
There was one customer, they were a bank,
693
00:28:18,520 --> 00:28:20,600
they had this culture,
694
00:28:20,600 --> 00:28:24,280
they never actually sent people to work from home.
695
00:28:24,280 --> 00:28:28,320
So they actually all had desktop PCs, very old school,
696
00:28:28,320 --> 00:28:30,600
but they had desktop PCs,
697
00:28:30,600 --> 00:28:33,040
and okay, now we all gotta work from home.
698
00:28:33,040 --> 00:28:34,600
And this was not a large enterprise,
699
00:28:34,600 --> 00:28:36,080
this was more of a mid-sized organization,
700
00:28:36,080 --> 00:28:38,200
but it was a big struggle for them.
701
00:28:38,200 --> 00:28:39,680
So they went out and told their employees,
702
00:28:39,680 --> 00:28:42,200
just go out and here's a stipend,
703
00:28:42,200 --> 00:28:45,080
go out there and buy the laptop of choice.
704
00:28:45,080 --> 00:28:48,240
We started having people buy iPads and Macs and PCs
705
00:28:48,240 --> 00:28:49,240
and who knows what.
706
00:28:50,160 --> 00:28:52,040
And then they started figuring out,
707
00:28:52,040 --> 00:28:56,160
well, with the pandemic came the Great Reshuffle
708
00:28:56,160 --> 00:28:57,360
and the Great Resignations,
709
00:28:57,360 --> 00:29:00,240
and some of these employees started leaving the organization.
710
00:29:00,240 --> 00:29:01,960
Well, here they have a personal device
711
00:29:01,960 --> 00:29:06,320
that they are using to access company data on.
712
00:29:06,320 --> 00:29:07,480
They now left the organization,
713
00:29:07,480 --> 00:29:10,240
the company data is still there.
714
00:29:10,240 --> 00:29:11,960
So you've left the organization,
715
00:29:11,960 --> 00:29:13,360
but you still have data on the device.
716
00:29:13,360 --> 00:29:14,560
Now, have they been using MIPS?
717
00:29:14,560 --> 00:29:18,080
Sure, that would have helped provide some protection.
718
00:29:18,080 --> 00:29:19,400
So make a long story short,
719
00:29:19,400 --> 00:29:21,400
we started working through some scenarios with them
720
00:29:21,400 --> 00:29:23,560
and what we came to the conclusion was,
721
00:29:23,560 --> 00:29:24,880
let the employee go out there
722
00:29:24,880 --> 00:29:27,840
and purchase whatever device they want with that stipend,
723
00:29:27,840 --> 00:29:30,960
but let's employ something like Azure Virtual Desktop
724
00:29:30,960 --> 00:29:32,560
or some kind of VDI,
725
00:29:32,560 --> 00:29:35,800
where everything you're accessing is within that workspace.
726
00:29:35,800 --> 00:29:39,400
And you can't spill data outside that workspace.
727
00:29:39,400 --> 00:29:42,120
So if I'm on my personal iPad
728
00:29:42,120 --> 00:29:45,080
and I try to copy a file from that Azure Virtual Desktop
729
00:29:45,080 --> 00:29:48,000
to my local iPad, policy will block it.
730
00:29:48,000 --> 00:29:49,840
So we started looking at that with that customer
731
00:29:49,840 --> 00:29:50,800
and make a long story short,
732
00:29:50,800 --> 00:29:53,880
I just talked to them about three or four months ago.
733
00:29:53,880 --> 00:29:56,040
You're doing quite well from a security perspective
734
00:29:56,040 --> 00:29:57,640
because everything is happening within
735
00:29:57,640 --> 00:30:00,280
that Azure Virtual Desktop kind of instance, if you will,
736
00:30:00,280 --> 00:30:02,560
everything's being monitored
737
00:30:02,560 --> 00:30:04,040
and they've got policy
738
00:30:04,040 --> 00:30:05,960
where they can actually control the flow of data.
739
00:30:05,960 --> 00:30:08,040
And if employee leaves the organization,
740
00:30:08,040 --> 00:30:10,800
their standard process of killing email access, of course,
741
00:30:10,800 --> 00:30:14,360
but then killing access that Azure Virtual Desktop instance.
742
00:30:14,360 --> 00:30:17,000
So that's another way of looking at zero trust
743
00:30:17,000 --> 00:30:21,800
is kind of containerizing how your employees access the data.
744
00:30:21,800 --> 00:30:25,000
One more short story for you is kind of the opposite.
745
00:30:25,000 --> 00:30:27,320
How do we give the employee the ability to do
746
00:30:27,320 --> 00:30:28,400
whatever they want?
747
00:30:28,400 --> 00:30:30,680
And so we had another organization during the pandemic
748
00:30:30,680 --> 00:30:33,640
that went out, they purchased Microsoft 365
749
00:30:33,640 --> 00:30:36,280
and they got all the great productivity tools.
750
00:30:36,280 --> 00:30:38,360
One of the really cool parts about security
751
00:30:38,360 --> 00:30:40,640
that Microsoft has, like MIP as an example,
752
00:30:40,640 --> 00:30:42,440
it's actually integrated with all the tools.
753
00:30:42,440 --> 00:30:43,280
For this organization,
754
00:30:43,280 --> 00:30:45,280
they never had to actually think about
755
00:30:45,280 --> 00:30:49,760
how do we get MIP encryption to work in an office?
756
00:30:49,760 --> 00:30:51,320
It just works, right?
757
00:30:51,320 --> 00:30:52,560
I mean, sure, there's policy,
758
00:30:52,560 --> 00:30:54,120
you have to configure and that kind of thing,
759
00:30:54,120 --> 00:30:56,440
but you're not having to go out and make code changes
760
00:30:56,440 --> 00:30:59,640
or anything like that, API calls and that kind of thing.
761
00:30:59,640 --> 00:31:01,640
So what I'm trying to say is, again,
762
00:31:01,640 --> 00:31:04,440
you have to kind of look at what are you trying
763
00:31:04,440 --> 00:31:05,560
to actually get done
764
00:31:05,560 --> 00:31:07,520
and how does it actually help the business?
765
00:31:07,520 --> 00:31:08,640
And then from there,
766
00:31:08,640 --> 00:31:10,040
try to figure out the right technology.
767
00:31:10,040 --> 00:31:12,280
Now, what we often hear is,
768
00:31:12,280 --> 00:31:14,440
man, I'm not using everything that's from Microsoft, right?
769
00:31:14,440 --> 00:31:18,600
Sure, I've got maybe Sentinel or I've got MIP as an example,
770
00:31:18,600 --> 00:31:22,320
but I might be using a third-party EDR platform.
771
00:31:22,320 --> 00:31:27,080
I may be using a third-party identity provider.
772
00:31:27,080 --> 00:31:29,080
How do I get all of those to work together?
773
00:31:29,080 --> 00:31:31,680
And so that's where, here at Microsoft,
774
00:31:31,680 --> 00:31:33,680
we've got a program called MISA,
775
00:31:33,680 --> 00:31:36,280
the Microsoft Intelligence Security Association,
776
00:31:36,280 --> 00:31:39,280
where we've gone out and we've worked with these third parties
777
00:31:39,280 --> 00:31:43,880
to perform native integrations with our first-party products
778
00:31:43,880 --> 00:31:48,280
and kind of analogy of we're able to tie the knot together.
779
00:31:48,280 --> 00:31:51,480
So if you're using a third-party,
780
00:31:51,480 --> 00:31:53,880
whatever, third-party EDR platform,
781
00:31:53,880 --> 00:31:54,880
how do we make sure it works
782
00:31:54,880 --> 00:31:57,480
with the rest of your Microsoft tool sets?
783
00:31:57,480 --> 00:32:00,080
Well, through that MISA program, we've gone out and done that work.
784
00:32:00,080 --> 00:32:02,080
And so that can help benefit those customers out there
785
00:32:02,080 --> 00:32:04,480
that have that heterogeneous architecture
786
00:32:04,480 --> 00:32:05,480
without having to worry about,
787
00:32:05,480 --> 00:32:08,480
oh, do I need to go out and flesh out everything for vendor A
788
00:32:08,480 --> 00:32:10,480
to vendor B and that kind of thing?
789
00:32:10,480 --> 00:32:12,080
Let's take a look at it,
790
00:32:12,080 --> 00:32:14,080
because more than likely what you already own
791
00:32:14,080 --> 00:32:15,480
is included at MISA program,
792
00:32:15,480 --> 00:32:17,480
where we actually already have pre-billed integrations
793
00:32:17,480 --> 00:32:19,480
that just need to be enabled and configured.
794
00:32:19,480 --> 00:32:22,080
So again, that's kind of another way to look at zero trust
795
00:32:22,080 --> 00:32:24,480
and that last mile,
796
00:32:24,480 --> 00:32:27,080
but that's often your biggest risk.
797
00:32:27,080 --> 00:32:29,080
And so just wrap my tangent here.
798
00:32:29,080 --> 00:32:32,680
You could do everything that you can to try to protect it
799
00:32:32,680 --> 00:32:34,680
and try to get these policies configured,
800
00:32:34,680 --> 00:32:37,080
but that last mile is still going to be a problem for you.
801
00:32:37,080 --> 00:32:40,080
Whether that last mile is third-party solutions,
802
00:32:40,080 --> 00:32:42,080
try to integrate with Microsoft first-party,
803
00:32:42,080 --> 00:32:44,080
or it's the end user.
804
00:32:44,080 --> 00:32:48,080
And like an example I gave about them using personal devices.
805
00:32:48,080 --> 00:32:52,080
And so as IT, that's something that we often don't really think about.
806
00:32:52,080 --> 00:32:54,080
And so I think kind of the moral of all these stories
807
00:32:54,080 --> 00:32:56,080
is bringing it back to zero trust
808
00:32:56,080 --> 00:32:58,080
is a mindset change.
809
00:32:58,080 --> 00:33:01,080
And it's not a product, you don't go out and buy it.
810
00:33:01,080 --> 00:33:03,080
It's not an end state.
811
00:33:03,080 --> 00:33:06,080
It's not a, hey, how long will it take us to achieve zero trust?
812
00:33:06,080 --> 00:33:09,080
It's what's our structure and our framework?
813
00:33:09,080 --> 00:33:11,080
What's the journey look like that we're going to take?
814
00:33:11,080 --> 00:33:13,080
And how are we going to do it?
815
00:33:13,080 --> 00:33:15,080
And what changes need to be made in the organization
816
00:33:15,080 --> 00:33:16,080
to allow us to do it,
817
00:33:16,080 --> 00:33:19,080
not just with technology, but organizationally as well.
818
00:33:19,080 --> 00:33:24,080
So lots to think about, but I'll pause there.
819
00:33:24,080 --> 00:33:27,080
I'm going to have to jump in here because you talked about SOCs
820
00:33:27,080 --> 00:33:32,080
and as a security operation center.
821
00:33:32,080 --> 00:33:34,080
Matt, what's your take?
822
00:33:34,080 --> 00:33:36,080
Because you know I love to talk about Sentinel.
823
00:33:36,080 --> 00:33:38,080
Everybody knows that.
824
00:33:38,080 --> 00:33:41,080
Going back more to that, because one of my favorite phrases,
825
00:33:41,080 --> 00:33:43,080
and I used to have stickers with it on,
826
00:33:43,080 --> 00:33:45,080
and I need to get them reprinted,
827
00:33:45,080 --> 00:33:47,080
is that collection is not detection.
828
00:33:47,080 --> 00:33:53,080
You know, just collecting logs is not in itself going to do anything.
829
00:33:53,080 --> 00:33:55,080
So what are your thoughts on that,
830
00:33:55,080 --> 00:34:00,080
assuming breach and collecting logs in that security operations environment?
831
00:34:00,080 --> 00:34:03,080
I mean, if we rewind 10, even 20 years, right,
832
00:34:03,080 --> 00:34:06,080
and we look at sending log data to a SEM,
833
00:34:06,080 --> 00:34:09,080
SEM seemed, you know, whatever we want to call it, right,
834
00:34:09,080 --> 00:34:12,080
but send it to that centralized platform that collects all the log data.
835
00:34:12,080 --> 00:34:14,080
Somebody still has to look at that.
836
00:34:14,080 --> 00:34:16,080
And so we started to think about years ago,
837
00:34:16,080 --> 00:34:18,080
well, let's hire the best talent.
838
00:34:18,080 --> 00:34:21,080
Let's send to Vegas every year, go to the conferences from the vendor,
839
00:34:21,080 --> 00:34:23,080
throw all the certifications at them,
840
00:34:23,080 --> 00:34:26,080
and then they can go through the log data and try to figure it out.
841
00:34:26,080 --> 00:34:28,080
Well, fast forward, that didn't work out too well,
842
00:34:28,080 --> 00:34:33,080
because no human can possibly go through the massive volume in these logs, right?
843
00:34:33,080 --> 00:34:34,080
So that doesn't work.
844
00:34:34,080 --> 00:34:37,080
So now we need machine learning to look at patterns.
845
00:34:37,080 --> 00:34:40,080
We need, you know, artificial intelligence to be able to make decisions.
846
00:34:40,080 --> 00:34:47,080
But we also still need humans that possess the skill to build out the policy.
847
00:34:47,080 --> 00:34:50,080
So like in Sentinel terms, analytic rules.
848
00:34:50,080 --> 00:34:54,080
So I've got all this data that's coming in from this, you know, security tool,
849
00:34:54,080 --> 00:34:56,080
all this log data.
850
00:34:56,080 --> 00:34:59,080
Sentinel can, you know, obviously, and so you could talk way more about this on IKAM,
851
00:34:59,080 --> 00:35:01,080
but it's intelligent.
852
00:35:01,080 --> 00:35:05,080
But however, there's probably some additional context around that log data
853
00:35:05,080 --> 00:35:08,080
that I would need to build some rules in so that Sentinel's aware of it.
854
00:35:08,080 --> 00:35:11,080
So my point is like somebody has to do the work.
855
00:35:11,080 --> 00:35:15,080
And then on top of that, somebody has to be behind the wheel to actually monitor.
856
00:35:15,080 --> 00:35:19,080
And so I once met a managed service provider just a couple of years ago.
857
00:35:19,080 --> 00:35:23,080
They did all of this work to send, and they weren't using Sentinel.
858
00:35:23,080 --> 00:35:26,080
They were using another SIM, but they did all this work to send all of their log data
859
00:35:26,080 --> 00:35:29,080
from all their tools to a SIM.
860
00:35:29,080 --> 00:35:32,080
But they didn't have anybody actually monitoring it.
861
00:35:32,080 --> 00:35:35,080
They were relying on just email alerts.
862
00:35:35,080 --> 00:35:38,080
It's like, well, it's a little bit more to it than that, right?
863
00:35:38,080 --> 00:35:42,080
And so you don't want to also get that false sense of security, right?
864
00:35:42,080 --> 00:35:44,080
Oh, we'll just send it all to the SIM and be done with it.
865
00:35:44,080 --> 00:35:49,080
But you know, there's a lot more that you need to invest in that from time and energy
866
00:35:49,080 --> 00:35:52,080
to be able to build this out in such a way, but then have that process
867
00:35:52,080 --> 00:35:57,080
to make a green field to where you're constantly iterating on it and you're documenting it, right?
868
00:35:57,080 --> 00:36:00,080
And then what's the reporting structure around it, right?
869
00:36:00,080 --> 00:36:03,080
How often are you sitting down, running the reports and sitting down
870
00:36:03,080 --> 00:36:07,080
if you're a managed service provider running with your clients or sitting down with the SOC
871
00:36:07,080 --> 00:36:12,080
and maybe the CSO and reviewing what's happened over this past quarter according to the data
872
00:36:12,080 --> 00:36:15,080
and trying to do better, right?
873
00:36:15,080 --> 00:36:20,080
So I mean, there's a lot that goes in there that, again, that assumed reachment mindset
874
00:36:20,080 --> 00:36:23,080
and the whole zero trust mindset, it starts to unpack all of that.
875
00:36:23,080 --> 00:36:26,080
But, you know, Sarah, I would love to get your thoughts on that,
876
00:36:26,080 --> 00:36:30,080
but that's how I start to think about just from a SOC perspective.
877
00:36:30,080 --> 00:36:32,080
We got to do it differently than we have been.
878
00:36:32,080 --> 00:36:34,080
I think it's my point.
879
00:36:34,080 --> 00:36:38,080
Yeah, I mean, we probably don't have enough time on the podcast right now
880
00:36:38,080 --> 00:36:42,080
for me to talk about all of my thoughts, but I'll tell you a story as well.
881
00:36:42,080 --> 00:36:45,080
Seeing as we're in story mode this week.
882
00:36:45,080 --> 00:36:52,080
I once saw a couple and again, it wasn't Sentinel, it was a different scene.
883
00:36:52,080 --> 00:36:55,080
But in some of my previous consulting life,
884
00:36:55,080 --> 00:37:00,080
they had some organizations that were working to a particular standard
885
00:37:00,080 --> 00:37:03,080
that was part of their industry vertical.
886
00:37:03,080 --> 00:37:08,080
And the standard basically said that they needed to log to a central place.
887
00:37:08,080 --> 00:37:12,080
And so they locked to a central place that they put a seam in place
888
00:37:12,080 --> 00:37:16,080
and they were sending logs to it, but they didn't actually look at it.
889
00:37:16,080 --> 00:37:21,080
But because the requirement that the standard they were following
890
00:37:21,080 --> 00:37:27,080
just said they had to log it, they had met that standard that they could tick a box.
891
00:37:27,080 --> 00:37:30,080
Was it really very useful from a security perspective?
892
00:37:30,080 --> 00:37:32,080
I would argue definitely not.
893
00:37:32,080 --> 00:37:34,080
But these are the things we see, right?
894
00:37:34,080 --> 00:37:39,080
And definitely we can have a whole different discussion on standards
895
00:37:39,080 --> 00:37:44,080
and whether adhering to standards, well, compliance, well, compliance is not security.
896
00:37:44,080 --> 00:37:46,080
That's probably an episode in itself.
897
00:37:46,080 --> 00:37:49,080
But yeah, I know exactly what you mean.
898
00:37:49,080 --> 00:37:52,080
Yeah, you know, again, like when I think of my,
899
00:37:52,080 --> 00:37:56,080
when you talk about, you know, how do I approach your trust differently than maybe others?
900
00:37:56,080 --> 00:37:58,080
I think everybody has their own approach to it, right?
901
00:37:58,080 --> 00:38:01,080
But again, like my approach, I look at it from a practical standpoint,
902
00:38:01,080 --> 00:38:03,080
but more from a business standpoint.
903
00:38:03,080 --> 00:38:07,080
And how do we actually make this work for the organization?
904
00:38:07,080 --> 00:38:09,080
How does it help us move things forward?
905
00:38:09,080 --> 00:38:16,080
And in many cases, we've seen Zero Trust do wonderful things at a business level, right?
906
00:38:16,080 --> 00:38:19,080
I.e. enable a company to outsource more.
907
00:38:19,080 --> 00:38:24,080
If that was their end goal was let's outsource more, but security was stopping it.
908
00:38:24,080 --> 00:38:27,080
We've seen Zero Trust actually empower that and enable that and drive that.
909
00:38:27,080 --> 00:38:33,080
We've seen Zero Trust do things like help the company acquire more customers,
910
00:38:33,080 --> 00:38:37,080
because now they're able to, you know, interact with customers in a digital way
911
00:38:37,080 --> 00:38:40,080
and Zero Trust comes in and provides a security layer for that.
912
00:38:40,080 --> 00:38:45,080
So we've seen all sorts of great use cases, but you do have to take a step back and think about,
913
00:38:45,080 --> 00:38:48,080
you know, what are we trying to do and why?
914
00:38:48,080 --> 00:38:50,080
Really, why is the most important part?
915
00:38:50,080 --> 00:38:51,080
You probably want to start with that.
916
00:38:51,080 --> 00:38:54,080
But it does require almost a rewrite of the book.
917
00:38:54,080 --> 00:38:58,080
And it's tough for me to say, because I've been an IT professional most of my career,
918
00:38:58,080 --> 00:39:02,080
but you do need to make sure that leadership is on board
919
00:39:02,080 --> 00:39:05,080
and making sure that not only are you making technical changes,
920
00:39:05,080 --> 00:39:10,080
but also make an organizational changes, i.e. strategy and mindset shift
921
00:39:10,080 --> 00:39:16,080
and cultural shift and all of those things, if you really want Zero Trust to have an impact.
922
00:39:16,080 --> 00:39:17,080
So it's interesting to bring that up.
923
00:39:17,080 --> 00:39:21,080
So Sarah and I actually have had a conversation over the last week or so.
924
00:39:21,080 --> 00:39:26,080
Like if you look at the audit logs that come out of SQL Server or Azure SQL DB,
925
00:39:26,080 --> 00:39:32,080
they're pretty hard to understand unless you actually know what each of the line items means.
926
00:39:32,080 --> 00:39:37,080
But, you know, when you fold in some of the kind of intelligence that's built into Sentinel,
927
00:39:37,080 --> 00:39:43,080
the fact that it's got functionality built into it to actually make sense of SQL logs,
928
00:39:43,080 --> 00:39:47,080
again, it just makes so much more sense about what's going on in your Azure SQL DB
929
00:39:47,080 --> 00:39:51,080
or your SQL MI or your SQL Server on-prem or in a VM,
930
00:39:51,080 --> 00:39:55,080
it makes so much more sense so you actually understand precisely what's going on.
931
00:39:55,080 --> 00:40:00,080
Make no mistake, those things can produce absolutely massive series of logs.
932
00:40:00,080 --> 00:40:05,080
And so, yeah, it's great to see tools like Sentinel making sense of all that.
933
00:40:05,080 --> 00:40:11,080
Alright Matt, so one question that we ask all our guests is if you had just one thought to leave our listeners with,
934
00:40:11,080 --> 00:40:13,080
what would it be?
935
00:40:13,080 --> 00:40:15,080
You know, I'm going to be really simple.
936
00:40:15,080 --> 00:40:18,080
Great question. Just do the basics.
937
00:40:18,080 --> 00:40:26,080
If you go out and you read the breach reports from Verizon and Microsoft and IBM and whoever,
938
00:40:26,080 --> 00:40:33,080
usually what you'll find in the root cause of these data breaches is the basics were missed.
939
00:40:33,080 --> 00:40:37,080
Identity hygiene or patching of systems.
940
00:40:37,080 --> 00:40:41,080
Again, it's hard for me to say as an IT pro, but you want to almost take a step back
941
00:40:41,080 --> 00:40:45,080
and figure out where we're missing on the basics.
942
00:40:45,080 --> 00:40:50,080
And let's go back in and make sure we are covering the basics first.
943
00:40:50,080 --> 00:40:52,080
And I mean basics, right?
944
00:40:52,080 --> 00:40:57,080
If it's making sure you've got multi-factor authentication deployed for every user,
945
00:40:57,080 --> 00:40:59,080
go through and double check kind of thing, right?
946
00:40:59,080 --> 00:41:04,080
Or your patching program or whatever it may be, password stored in a database.
947
00:41:04,080 --> 00:41:09,080
So that's kind of the final thought I'll leave is just make sure you're doing the basics.
948
00:41:09,080 --> 00:41:12,080
And as you go through that journey, you will like,
949
00:41:12,080 --> 00:41:17,080
guarantee you will start to figure out additional things that you can add to that roadmap
950
00:41:17,080 --> 00:41:20,080
and then start building up your zero trust strategy.
951
00:41:20,080 --> 00:41:21,080
So that's what I'll leave us with.
952
00:41:21,080 --> 00:41:24,080
Yeah, thanks for that. I think, yeah, people need to, you know,
953
00:41:24,080 --> 00:41:26,080
perhaps not take a cynical approach to zero trust.
954
00:41:26,080 --> 00:41:27,080
It's not a marketing term.
955
00:41:27,080 --> 00:41:29,080
It's not a, but it's by the same token, it's not a product.
956
00:41:29,080 --> 00:41:32,080
It's not a product Microsoft will sell to you.
957
00:41:32,080 --> 00:41:33,080
It's a series of practices.
958
00:41:33,080 --> 00:41:34,080
It's a series of technologies.
959
00:41:34,080 --> 00:41:35,080
It's a series of tools.
960
00:41:35,080 --> 00:41:39,080
It's a series of mindsets with a goal of sort of protecting environments
961
00:41:39,080 --> 00:41:43,080
and this sort of this modern world, you know, within which we live.
962
00:41:43,080 --> 00:41:46,080
So again, thank you so much for taking the time to see us this week.
963
00:41:46,080 --> 00:41:51,080
And to all our listeners out there, stay safe and we'll see you next time.
964
00:41:51,080 --> 00:41:54,080
Thanks for listening to the Azure Security Podcast.
965
00:41:54,080 --> 00:42:01,080
You can find show notes and other resources at our website azsecuritypodcast.net.
966
00:42:01,080 --> 00:42:06,080
If you have any questions, please find us on Twitter at azuresetpod.
967
00:42:06,080 --> 00:42:32,080
Background music is from ccmixter.com and licensed under the Creative Commons license.
