(soft music)
- Welcome to Microsoft Mechanics
and our new series on Zero Trust Essentials.
In the next few minutes, I'll break down what you can do
to adopt a Zero Trust approach for security
and how Microsoft can help.
In the past, you may have focused your defenses
on protecting network access
with on-premise firewalls and VPNs
assuming that everything inside the network was safe.
But as corporate data footprints have expanded
to sit outside your corporate network,
to live in the cloud or hybrid or across both,
the Zero Trust security model has evolved
to address a more holistic set of attack vectors.
Based on the principles of verify explicitly,
apply least privileged access,
and always assume breach,
Zero Trust establishes a comprehensive control plan
across multiple layers of defense.
And this starts with identity
and verifying that only people,
devices and processes
that have been granted access to your resources
can access them.
Followed by device endpoints
including IOT systems at the edge
where the security compliance of the hardware
accessing your data is assessed.
Now, this oversight applies to your applications too,
whether local or in the cloud,
as the software-level entry points to your information.
Then there are protections at the network layer
for access to resources, especially
those that are within your corporate perimeter.
Followed by the infrastructure,
hosting your data both on premises or in the cloud.
This can be physical or virtual
including containers and microservices,
and the underlying operating systems and firmware.
And finally, the data itself across your files and content,
as well as structured and unstructured data
wherever it resides.
Now, each of these layers are important links
in the end-to-end chain of Zero Trust,
and each can be exploited by malicious actors
or inadvertently by users
as entry points or channels to leak sensitive information.
That said, core to Microsoft's approach for Zero Trust
is not to disrupt end users
but work behind the scenes to keep users secure
and in their flow as they work.
The key here is end-to-end visibility
and bringing then all this together
with threat intelligence, risk detection
and conditional access policies
to reason over access requests and automate response.
Here, as we'll explore in the series,
the good news is that both Microsoft 365 and Azure
are designed with Zero Trust
as a core architectural principle
and have built-in and best-in-class controls
to help deliver a Zero Trust environment.
And you can then use these tools to extend Zero Trust
to hybrid or even multi-cloud.
In fact, let me walk you through some highlights
for how Microsoft can help you implement Zero Trust
starting with identity.
Here, Azure Active Directory is the underlying service
that assigns identity and conditional access controls
for your people,
the service accounts used for apps and processes,
and your devices.
Importantly, beyond Microsoft services,
Azure AD can provide a single identity control plane
with common authentication
and authorization services for your cloud-based services
and your on-premises resources.
This prevents the use of multiple credentials
and weak passwords spread across different services
and helps you to universally apply
strong authentication methods,
like passwordless multifactor authentication for your users.
Also to make the authentication process
significantly less intrusive to users,
you can take advantage of real-time intelligence
at sign-in with conditional access and Azure AD.
You can set policies to assess the risk level
of the user or a sign-in,
the device platform along with a sign-in location,
to make point of log on decisions
and enforce access policies
in real time to either block access outright, grant access
but require an additional authentication factor
such as a biometric or a FIDO2 key,
or limit it for example, to just view-only privileges.
And moving on to end points,
because not all devices accessing corporate data
are managed or owned by your organization,
they can represent another weak link
in establishing Zero Trust.
They may not be up to date or protected
and run the risk of data exfiltration
from unknown apps or services.
Using Microsoft Endpoint Manager,
you can make sure that devices and their installed apps
meet your security and compliance policy requirements,
regardless of whether the device is corporate owned
or personally owned,
wherever they're connecting from,
whether that's on a network perimeter including over a VPN,
on the home network or the public internet.
Also on Microsoft Defender with its extended detection
and response or XDR management controls
can identify and contain breaches discovered on an endpoint
and then force the device back into a trustworthy state
before it's allowed to connect back to resources.
Next we've already touched on the benefits of Azure AD
as the single identity provider for authenticated sign-in
along with the use of conditional access,
and these recommendations also apply to cloud apps
and local apps
that connect to cloud-based resources as well.
Now for your local apps,
Microsoft Endpoint Manager can be used to configure
and enforce policy management for both desktop
and mobile apps including browsers.
For example, you can prevent work-related data
from being copied and used in personal apps.
that said on the SaaS side of the house
knowing what apps and services are in use
within your organization
including those acquired by other teams known as Shadow IT
is critical to mitigate any new vulnerabilities.
Microsoft Cloud app security and its catalog
of more than 17,000 apps
can discover and manage Shadow IT services in use.
And you can then set policies
against your security requirements to scope
how information may be accessed or shared
within those services.
For example, you can use policies to block actions
within the cloud app such as
downloading confidential files
or discussing sensitive topics while using
unmanaged devices.
And this brings us to our fourth layer, the network.
With modern architectures
and hybrid services spanning on-premises
and multiple cloud services,
virtual networks or VNets and VPNs,
we give you a number of controls
starting with network segmentation
to limit the blast radius and lateral movement of attacks
on your network.
We also enable threat protection
to harden the network perimeter from things like DDoS
or brute force attacks,
then the ability to quickly detect and respond to incidents
and encryption for all network traffic,
whether that's internal, inbound, or outbound.
Microsoft offers several solutions
to help secure networks such as
Azure Firewall and Azure DDoS Protection
to protect your Azure VNet resources.
And Microsoft's XDR and SIEM solution
comprising Microsoft Defender and Azure Sentinel,
help you to quickly identify and contain security incidents.
Next, for your infrastructure,
the most important consideration here
is around configuration management
and software updates so that all deployed infrastructure
meets your security and policy requirements.
For cloud resources, Azure landing zones,
blueprints and policies
can ensure that newly deployed infrastructure
meets compliance requirements and the Azure Security Center,
along with Log Analytics,
help with configuration and software update management
for your on-premises,
cross-cloud and cross-platform infrastructure.
Also monitoring is critical
for detection of vulnerabilities, attacks and anomalies.
Here again, Microsoft Defender plus Azure Sentinel
provide threat protection for multi-cloud workloads
enabling automated detection response.
Of course, at the end of the day,
Zero Trust is all about understanding,
then applying the right controls to protect your data.
Now we give you the controls to limit data access
to only the people and processes that need it.
The policies that you set along with real-time monitoring
can then restrict or block
the unwanted sharing of sensitive data and files.
For example, with Microsoft Information Protection,
you can automate labeling and classification
of files and content.
Policies are then assigned to the labels
to trigger protective actions, such as
encryption or limiting access,
restricting third-party apps and services and much more.
Additionally, for data outside of Microsoft 365,
Azure Purview automatically discovers
and maps data sitting across your Azure data sources,
on premises and SaaS data sources,
and works with Microsoft Information Protection
to help you classify your sensitive information.
So that was a quick overview,
the Zero Trust security model
and examples of some of the core ways
that Microsoft can help.
Moving to Zero Trust doesn't have to be all or nothing.
You can use a phased approach
and close the most exploitable vulnerabilities first.
Of course, keep checking back at aka.ms/ZeroTrustMechanics
for more in our series where I'll share tips
and hands-on demonstrations of the tools for implementing
the Zero Trust security model
across the six layers of defense that I covered today.
And you can also learn more at aka.ms/zerotrust.
Thanks for watching.
(soft music)