[Music]
Good morning! Hey there we go that's good for 11:35 on a Tuesday. thank you so much
for coming coming up on the show we take a look at some of the new announcements
around the built in security and operations management in Azure there
helps with your productivity through native intelligence including machine
learning based recommendations and threat information sourced from the
Microsoft Intelligence Security Graph centralized update management to keep
your VMs patching up today granular policies to enhance control within your
infrastructure and much more now I'm joined by Jeremy Winter whose team's run
the management services for Azure so give him a warm round of applause hey
thanks for having me it's good to see ya tell us a little bit about what's built
in security and operations management is all about and helped us understand some
of the announcements yeah absolutely so when we think about management and we
think about platform we see them as the same management platform platform
management so what we really wanted to do here is just bring management and
security just native into Azure so as you're sitting here thinking about as I
move my workloads there it's just there it's already in you don't have to go
look for a separate set of tools and it really gives that enterprise that level
of confidence that we've got these core capabilities there so as you can see on
this in the screen as we think through it it's just really whether you have
governance or security which is what we're gonna talk a bit today about we
also have a whole bunch areas around configuration monitoring and how to
protect your data from backups and disaster recovery so we're just quite a
bit of stuff now just built into India and there's some additional
announcements we made at the conference yeah yeah so just at the conference
we've been announcing a handful of things these are just a cute few of the
key ones where we're thinking as we look at off as we look at announcing threat
investigation what we're doing is adaptive whitelisting so we can see
what's going on inside the apps to help you there this really new advanced log
analytics it's a next-generation of what we've already had and a much more
advanced way for deep queries and then we bring din and we brought in update
management and then this policy I'm gonna look at some of those so yeah yeah
let's dive into some of these announcements in a little bit more depth
and naturally Security's on everybody's mind it's an incredibly important topic
and it's good to know that security and management is just
built-in but what does that really mean for the yeah yeah so built-in we really
just wanted to make this pretty simple and so inside this is the azure portal
and the Azure Portal we just look at it is management and so you've got all the
dashboards and things that I can pin into just view and have that
extensibility but you just talking about like how do we make it easy just where
do we find these things built in so if I just choose the VMs I'm just selecting
the different VMs that are installed in there and if I just do a quick just
search we're just gonna look for those contoso VMs you can see here's all these
VMs that are inside Linux and Windows now if I come in and just look let's
pick a Windows machine here's Contoso web - I'm able to now
quickly write it inside the VM itself we've added operations and monitoring so
here's your section operations are just built in you can go do it directly
within the VM they're all centered right there front and center for you to go so
you know you look at updates right you talk about security yep boy this is one
where we really just try to make sure that all the core elements are
up-to-date so that we don't get those vulnerabilities inside credibly
important yeah so this is where we've just built update management it's
included in your Azure subscription you can go ahead and use it it's it's at no
cost you're able to come in and start to look at all those missing updates on
that VM again for Linux or Windows okay cool and so I can quickly just go in and
look at all the different updates that are needed and I can schedule those
updates but a lot of times we want to look at updates not just on one machine
but them all and so we have the ability to look at the entire real estate of
that environment for your updates I could see all the compliant
non-compliant machines that are inside whether they're Windows or Linux and I
can go scheduled so let's just do a real quick schedule since we may want to do
something a bit reactive and get like jada quick patch I can classify so I can
go choose like look I just want this critical update and I may want to go
exclude updates or do the right timing set up the schedule for this reoccurring
and even a maintenance window the maintenance windows key because people
maintain those to ensure they can patch yeah in those little times so we are
loud and clear that is we think about those core capabilities give me the
schedule right as well as that and to reiterate this update service is free
it's included yeah yeah it also does it for your non Azure
resources so you'll see right inside I can do mine on Azure so you can use the
same technology to reach back to your on site we want to make sure you're using
Azure is you start to think about this hybrid and I've got it I have
environments in both areas let's use let's use our patch and our other
elements to go reach on site or even environments that aren't on our cloud
like AWS or Google so this really just gives you that level of I'd say
protection and that view to really make sure you're managing those updates
across the environment now buck in the list of operations you could perform
there I saw something that's traditionally very hard to keep up with
for IT and that's change tracking yeah tell us a bit about that yeah so good so
change tracking this is one of the elements that we also added when we
think about change sometimes change is just happening inside the environment
and so here's a Linux machine that I'm looking at what's changed across the
environment and so we have the ability now to be able to see what's going on
inside the guest you're able to go look at what's happening inside weather
analytics the events the files the VMs the software in your Windows
we're thinking about our registry and Windows services it's the same piece
inside and I can show you that but here's you're just looking across the
overall change it's also super valuable because as we start to think about
change in the environment these are elements that you may want to keep from
a compliance point of view so the change that's occurring inside the guest goes
to our overall Azure activity log where all the systems all the elements are
writing the changes and the activities that are going on and so now you're also
able to get what's going on inside the guest right cool that's a pretty
critical piece and we mentioned briefly protection and backups list out there as
well yeah yeah for sure so when we think about backup this is one of those core
elements that if I just go to backup we'll just dive in there why not take a
look right so this is a machine I have backup set on
so let's since we're talking security we had kind of some ransomware they kind of
spun up for us back a lot of us in June with wanna cry and we saw that a hint
you know we saw that quite a few customers started to go look at
protecting those workloads and so with backup you can whether it's on-site
workloads or the workloads on Azure you can start to back those up so then is
in a circumstance where you are locked out of those machines you have that data
protected and you have those instances protected back in the cloud and we have
multi factor auth to be able to ensure that if someone is working their way
back to those backup elements that you're able to have the authentications
and the validation make sure that no one's tampering with those so preventing
the run somewhere from out yes in the backups the sense yeah so I could
basically just go in to restore and restore at a checkpoint that we have and
off we go excellent so many of these areas are
reactive but how can we start to use some of the built-in management and
security and in a more of a proactive way yeah so that brings us to this
policy piece we just announced it it's limited preview you can come out onto
the azure comm and look it for policy and sign up for it there right but I'll
just show you where that is so this is policy now policy this has given us a
whole new opportunity to start to think about I as a custodian of the cloud how
do I still ensure those safeguards of my environment how do I ensure those
configurations and the elements that I want to have happen are happening but I
still can give the velocity to the developers or my other two business
teams I wanted to use the cloud and our services but I also don't want to get in
the way and so this is this notion of policy and initiatives policies we're
all pretty familiar with its what are the settings that I want to do to
monitor and make sure but initiatives allows us it's a new element that allows
us to group many many policies into one thing it's an example if I want to think
about like how do I secure my Express route how do I think about all the
policies that I want to go with that so I'll give you a show
so I just chose the security ExpressRoute initiative and you can see all the
policies that are listed most of them are already compliant but I have one
that's focused on out of compliant this is where I don't want any machines
configured to be outbound to the public IP address I want to protect my internal
networks and so if I go look I can choose I can select that it'll take me
right to those specific resources they're not compliant now this could be
an initiative I've already had in place but then something came and I noticed
people weren't doing public I weren't configuring the public IPs so I can just
add that to the initiative and then be able to track that as one point right
now this one we have set as an audit if you just look right here in kind of a
summary we have audit and this allows our customers
in us was we started to work with our big customers and MSIT or Microsoft IT
that we wanted to be able to audit first just to kind of get a state of where
we're at and then start to go in force right and for everyone that's thinking
about well how did they go build us we did this right on top of as a resource
manager so it's there for all your azure resources and if anyone's really
thinking about well how did they do the definitions it's really just set on top
of JSON and that as your resource manager so you can see here we've got
for us that looking at the JSON around this is my public of IP addresses these
are just Azure Resource Manager configurations and then we have it set to audit but this allows you
to really go manage all of those and it's easy to just go create your own if
I wanted to go create my own I keep my own definition we haven't built in and a
lot of common ones built in to help people with if I was a developer
speaking of JSON and arm templates I'm a developer building a standard template
and deploying images within Azure this would catch ya by if I forgot to yeah
you know I type a for instance yeah that's right and so at the time of when
I go in to create new and I just start to go choose those those resources it'll
block me right there and tell me why and allow me to go look at the policy okay
so yeah let's change directions slightly and talk about security threats that
might be happening we're right now yet like alright yeah like right now yeah
what can we do so this is the announcement we put around the azure
Security Center and so built into Azure we've added not only the Azure Security
Center but a whole bunch of new threat intelligence as well as investigations
to really help so why don't we pop take a look as your Security Center sounds
good so inside the Azure Security Center this is our hub for all things security
that's going on across Azure but one of the announcements we did is
also we made this hybrid so now all of these core capabilities can also be
reached back into the on site or other environments again we really just want
to make sure that as you use this new modern technologies and modern solutions
in the cloud you can leverage them back nice it so if we just take a look at
just quick little run-through of some of these we've got you know that we have
the standard compute and the recommendations that are inside so we'll
just give you recommendations you should just be able to leverage I mean who
wouldn't they're already built in yeah but these new announcements that we
were are really twofold right the application
controls and our overall security so let's look at the application of the
abductive application controls so what is this the adaptive application is
we've used machine machine learning and we'll watch how the apps are running
inside your environment now you may use desired state configure
other elements but a lot of times the apps are already out there and so we can
profile those apps and look at what are the VMS what are the applications and
the processes and we learn over time what the right state is going to be and
then from a security point of view you can set that as a configuration to then
later go make sure that of any deviant any changes from this such as a new
workload or an EXE drops into the environment you can quickly be flagged
on it from the security point of view right so here we look at recommended now
it takes some time for our systems to go learn but I can look at the contoso
automation and it's gonna automatically if you look at the screen it allows me
to see the virtual machines and that resource group and the processes that I
typically know right so if all of a sudden I get hash EXE runs or something
that some other some other solution has dropped in we can flag that from a
security specific perspective excellent so we already have we have capabilities
inside Azure for Desired State Config and allows us to think about it from a
management but we also put this other piece from that over overall analytics
and machine learning piece good that's cool yeah so what about what about the
threat investigate yes yes this is a big one yep this is a big one so inside
let's go look at the alerts yeah and when we look at the alerts we can see
all the different threats or actions that we think you've already been
flagged inside the system and here we bundle security incident detected and we
bundle the different pieces that are inside that we see like con we see a
suspicious process executed in an RDP brute force this is something we want to
take a look at now typically we give a breakdown of this and this is where
prior to to ignite we had a core view that just told you what the description
is and kind of how to learn more about it well what we see even from our own
security teams at Microsoft is we need to do the investigation and right now
this is a call out you know as we think about this in the past it's a collection
of a variety of different data sources but since we have this rich analytics
engine that shared across all those management components that I talked
about earlier we're able to start to really get some powerful analytics that
down helps me see through that IT graph and where the actual attack vectors are
coming from and how I need to respond to it right and so this is if we look at
the overall security incidents that are inside I can start to use this graph to
drill in and say huh I had the security incident but we
talked about that RDP brute force and inside that brute force I can now see
that it impacted this contoso web machine and we had different actions or
players that were involved with it now if I went and did some exploration
inside this I could see we could use these built-in we could start to go see
other elements that are occurring with this machine and one of the examples we
could see is a be one of my users in my environment clear he's had some
additional suspicious activity she signed in from an unfamiliar location
that I wouldn't expect let's go take a look further and it just keeps working
down the graph visually for our security experts to be able to go see quickly yes
this is the machine there this is how Abby came in through a brute force with
ketosis or web but then laterally moved to another machine and executed as
suspicious process right now again if we had the anno as we have the analytics
we're able to start to go flow and if you use the elements like our
just-in-time control to have limited access to what ports or you use the
application where we're starting to see the white listing we'd be able to catch
this but we didn't hear no okay now we're gonna go investigate it a little
further a lot leads us on nicely because I'm curious about where all of this data
is coming from that's powering all of it yeah this rich kind of view that we've
got here yep and this is this is kind of at the heart of this analytics and we
have this advanced analytics element that we're in the middle we've we had
last year is what we'll call gen one and now we're rolling out Gen 2 analytics
it's really centered we're in the middle of the rollout right now it's in beta
everyone can come use it and here's how it works inside the security side but
this is again consistent across all the management components that we talked
about earlier so if I go choose that machine let's go back to contoso web
where it all kind of began I can do exploration and we've already
done some of the logic to point you to those champ to the areas that you should
focus on like the distinct processes that were executed the things we should
be watching for but behind that is log analytics now log analytics like I said
has been inside Azure for the last year we've seen an immense amount of usage of
this and really people starting to go customize and driving their data through
this both from a monitoring perspective as well as a security perspective this
is just a pretty rich capability for you to go drill down in use search context
pretty simply making me an arrow down on a timeframe to see what's happened and
we're groveling through millions of millions of logs to get it right there
right yeah I was going to ask is this just a few oh yeah a few logs or
millions and it's a lot yet it's we need fast it is so this we've had but the
piece that we've we're we now have is the advanced analytics and what that
does is it really allows us to have a much deeper and much more advanced
analytics capability you can write your own queries you can write your own joins
you can start to have your own logic around here you take your own apps start
to have your own custom apps your own custom logs and telemetry writing into
this we even see customers using this for their points to sell devices as
they're still a sure as your customers but using this to monitor their points
to sell devices and so this gives me this rich query capability as my
security personnel want to start to go drive down or even I as an IT need to be
able to see this information because security is on me too so we can just
look quickly like show me the specific non system processes are running I could
see do I have any computers where they're starting to wipe my logs because
when when that happen you know attacks you know start to clean my trail so this
just gives us a much more advanced capability to go run through and pretty
powerful and gives that level of advances not only from the the helping
you see the intelligence that we have with the with the charts and the graphs
and the ready-made intelligence but also just walking us through you know getting
us to the advanced analytics incredibly powerful awesome well thank you very
much Jeremy for walking us through the new announcements around the built in
security and management of Azure but the key question is where can people learn
more yeah so I get one good I'd go first off just go
out to AMSFree we already have it there get your hands on it and learn how to
create these VMs we have labs that are available for you
to start to go they're already pre-built so go out to the labs and start to go
learn but again free get your hands on it and go learn more
yeah and test it out awesome well thanks Jeremy and hey I'm for yeah thank you
very much it's live and we'll see you next time Microsoft Mechanics
[Music]