>> Hey friends. As you might expect
from a company the size of Microsoft,
we've got hundreds and hundreds of
Azure subscriptions that run
our internal line of business apps.
Marc Jacobs is here to show us how we find and mitigate
security risks across all those subscriptions
with the DevOps kit that you can use, too.
I'm learning how today on Azure Friday. Hey friends.
I'm Scott Hanselman and it's
another episode of Azure Friday.
I'm here with Marc Jacobs and we're going to talk about
the Secure DevOps kit for Azure.
Now, this isn't a sample or a toy.
This is real stuff doing real work.
>> That's right.
>> Why give it to the people? Why not keep it a secret?
>> Because we believe that it's
really important to show not
only what we do as
our own enterprise but to make those same tools,
that same experience, available to our customers.
In fact, we showcase it
with our enterprise customers today.
>> Really. This is like we are Microsoft working with
Microsoft but it's almost as if
our internal line of business is a business.
It's a whole company like
a Walmart or like a Chase Manhattan,
it's a big oil company that happens to be
a customer of Azure.
>> That's right. Yeah, we use
the same tools that our external customers use.
So, we like to look at things the
same way our customers might need this.
>> Do you have to think about
billing any stuff like that.
Are we paying?
We don't get like free Azure time for all, right?
It's a real company.
>> Absolutely, it is a real company,
we get real bills and we really do
try and optimize as well as our customers do.
>> So, certainly, that means that there's
no free lunch whether it
comes from billing or whether it comes to security.
All of these things need to be dealt
with in the most formal way possible.
>> That's right. So, we looked at the tool kit
as an opportunity for how can we visualize what we have,
enumerate the risks within
our resources in Azure and then make this an easy to
use tool for engineering teams to use and
deploy and understand the risks and take action.
>> Now, how is this
a formal tool versus like sometimes you'll see in
an enterprise there's a loosely confederated group
of scripts that people build up over a year and it
becomes this kind of knowledge
that is spread with rumor and innuendo.
Is this an app or is this
a collection of best practices and docs?
What is this shaped like?
>> It's a little bit of everything, actually.
So, it is glue at its very core.
However, that glue takes the best practices,
takes the configurations that we can find in Azure
and quickly pull it into one easy to use resource.
>> Very cool. Is it evolving,
is this a moment in time
or is there an endpoint or is this
always best practices are
always being developed and refined?
>> Well, it is speed of Azure.
So, new services come online all the time.
That means we need to
consider what are those configurations?
What are the risks?
If we are looking at new resources,
do our engineering teams have the insight, the tool,
in order to understand that and then move on so
they can go and create great apps and code?
>> So, what is this website that we're looking
at that's now public?
>> So, this is our public site for the DevOps tool kit.
On here, it gives you
information about the documentation.
We have all sorts of how-to and guidance
because the kit is
a powerful module but it is so much more.
So, what it can do is run test against your environment.
It covers over 30 Azure services today.
>> Wow.
>> It has over 290
different security controls that it looks at.
Those are going to range from automated experiences
where I can enumerate do I
have my configuration turned on or not?
In fact, it will also generate fixed scripts.
So, if I find something,
I can fix it automatically.
>> Nice. Is this
something where the script is going to run all the time
or I run it like I set up
my own process and run it once a
week or are there any continuous checks?
>> Great question. So, part of
the kit that we use internally
at Microsoft is something that
we call continuous assurance.
What that does is it
establishes an automation account with
the run book and it scans our subscriptions once daily.
So, that way we can detect drift,
we can correct and ultimately
provide tremendous visibility across our environment.
>> It does make me wonder,
since we are or you are closer to Azure
than the typical customer in
the sense that you're at least in the same city.
Do you take any of these security best practices,
share them with their team that
they may someday show up in
a security adviser and be part of Azure itself?
>> Absolutely. So, one of
the best things that we do is we take our learnings,
we take the kit and work with
our partners and the various product groups.
In fact, a lot of the goodness
that's coming out of the security of
DevOps tool kit is coming into our up and coming
capabilities with an Azure such as
Azure Policy and Azure Security Center.
>> What about run books and
security scripts from big companies?
Like, I can't think of
any giant companies right now that
I'm allowed to mention the names of,
but let's say a big Co is an Azure customer.
They have a relationship with the Azure field people.
Can they flow their security best practices
into your tool kit and then ultimately back into Azure?
>> Well, the nice thing about the tool kit
is there's a lot of flexibility.
So, you can pick and choose.
In fact, when you run a scan on your subscription,
it's only going to enumerate
the controls that are relevant.
So, only if I have
a certain resource types would it ever come on a report.
But we do have a partner program.
So, we involve other customers,
we like to get feedback and
input and that way it makes for
a much richer experience
especially internally and externally.
>> Very cool. I noticed right up there in
the upper right hand corner I see a GitHub.
>>That's right.
>> So, this is open source which means I could fork it.
I could bring it into my company.
I can use it as is.
I can look at put
a pull request or comment on the issues.
>> You can definitely look at all of it.
We don't keep anything a secret.
If you want to look at the actual source when
you pull down the module when Power Shell.
You can read all of the code if you would like.
>> Very cool.
>> So, it's all available there and yes it's on GitHub.
All that documentation that you see here on
the pretty site is available there, too,
within our repo where you can start
getting some guidance on how
to install it and how to use it.
>> Now, is that something where
you can run a demo for me.
We could maybe do some checks.
>> Absolutely. Yes.
>> Let's do it.
>> So, just to note it on the screen here,
we have our page for installation and
it's very easy with the Power Shell.
You would simply install the module itself.
Once you have that, then
use your Power Shell and you'll notice that there's
a number of different commands already part of
that kit where we can start to use right from the start.
Now, say I'm a customer.
I just don't want to put everything in the kit today,
but I do want to get a quick read on my environment.
I can use a command here just run a scan on
my subscription and I'm
going to show you something really cool with the script.
>> Okay.
>> I'm going to generate a fixed script with it.
So, you can see how this works.
>> Oh. It actually makes script
that make scripts that are custom.
Nice. I love it.
>> That's right.
>> Let's do it.
>> Okay. So, we're just going to
let this run right now on my subscription.
>> So, I see that you're saying,
get- I would say Az.
How do you pronounce this? AZSK.
>> Well, that's a pretty long string.
>> Azure security kit?
>> That's right. So, it's just a
command-let and it's pulling
in various APIs that
are already leveraged within Azure today.
>> Right. So, you're sitting on top of public APIs.
>> That's right. We're not doing
anything different than what's already
available today through the different services
that we have for our customers.
We're just pulling it all together
into an easy-to-use kit.
So, what you can see that's happening right here is it's
checking each of the resources in my subscription.
There are six different resource types in there.
So, the controls that are
relevant for each of those will be checked.
Once it's done, it'll give me a summary
of what it found and it will
pull up a CSV file you can open in Excel-
>> Alright.
>> -to get a summary, not only of what
needs to be fixed but also the guidance on how to fix it.
So, say I didn't want to use that fixed script.
I could just follow the advice
within it and do it myself and that's fine.
Until you get more comfortable with how to you use it,
that might be the best path.
>> Okay.
>> So, you can see here, it finished the scan and it
automatically popped up a folder
that has the scan results in it.
>> There's a ton of stuff in there.
It didn't just make a CSV,
it made a bunch of folders, readme.txt.
You're going to spend the afternoon thinking
about what the next steps are.
>> Yes. You definitely could.
So, let's take a look at what's inside.
>> Look at this?
>> I know. There's a whole bunch of information here.
>> We'll do a filter and check out our status,
I'm seeing Manual, Passed, Verify. What's Failed?
>> A whole bunch of stuff. What has failed. Let's see.
Okay. Our two controls have failed, encrypted transit.
Now, this happens to be
something with our storage accounts.
So, one thing that's important to note,
both of these controls support auto fix.
>> I see. So, if it didn't support our fix it would
give me a list or a link to do the manual fix.
>> That's right. You might be more involved.
>> When you call this, I noticed that you put in
generate fixed scripts as a parameter-
>> Yes. I did.
>> -to the larger of things,
so then that fixed script
must be in that folder somewhere.
>> Yes it is. Let's take a look.
>> This is cool. I love stuff like
this because I feel like I could probably,
even though I'm a small enterprise I mean,
I could run this right.
I don't need to be a giant company
to run this on my own account.
>> No. Not at all.
Anyone can use this just by downloading the kit.
If you have a subscription,
I'm running against and getting that advice.
>> Very cool.
>> Now, whether you take it or not, that's up to you.
We do strongly recommend it.
Now, for those customers that
want to know what's in that fixed script.
We do provide the JSON.
So, that files right here you can investigate
it to see what would get fixed if I ran that.
>> No surprises. You don't want to
blindly run a script on your Azure account.
>> It's important to know what you're doing
with that if you're making a corrective change,
what the impact might be.
Alright? But we do make a point of making
sure that any of our advice is going to
be non impactful as best we can.
>> Okay.
>> So, I'm going to go ahead and execute
this fixed script.
That's going to validate against the subscription making
sure that I know exactly what it is that I want to fix.
So, there's two controls and it does
give you the chance to get out.
>> This is going to fix those two attributes of
our Azure security account that were
configured in a less than highly secure way.
>> That's right.
>> You even get a report on what it did?
>> That's right. I even get a report.
It gives you plenty of output.
You've got a trace of what you
did and one thing I want to show you,
did it actually fix it?
Well, here are my resources in the Azure portal.
>> Right.
>> If I take a look at that,
the setting itself is something that it's in
my configuration and this
is what we wanted to make sure was turned on.
Secure transfer.
So, that fixed script took it from
an insecure state to a secure city.
>> See, now I'm sitting here,
we're a little bit concerned.
We're filming an episode of Azure Friday and I'm
wondering if this is a problem on my own account.
So, I'll be excited to try this out later this afternoon.
Fantastic. So, show me the website
that people can go to get this information.
>> You bet. So, go
to this website azsk.azurewebsites.net.
That gives you the page with all the documentation and
again remember the GitHub link
is right in the upper right corner.
>> Very cool. I am learning all
about how to make Azure more secure,
with a secure DevOps kit for Azure today on Azure Friday.