>> Hey, everybody.
In the latest episode of the Azure Enablement Show,
I'm joined by Brian and Mark
who are going to be talking to me
about the new secure methodology,
and save the Cloud Adoption Framework
and security as a whole in your Cloud adoption journey.
[MUSIC]
Hey, everybody.
My name is Sarah Lean and welcome
to the Azure Enablement show.
In the show, we're going to be having
technical conversations with Microsoft experts,
trying to tackle some of the questions
or obstacles that you may have
along your Cloud adoption journey.
Now, in previous episodes,
we covered off the Cloud adoption framework,
and what it is and how it can help you
with your Cloud adoption journey.
In today's episode, I am joined by
Brian and Mark who are going to walk me through security,
and how that fits in with the Cloud Adoption Framework.
Thank you both for joining me today.
>> Thank you.
>> Thanks for having us, Sarah.
>> Awesome.
Now. my first question is for you Brian.
How does the new secure methodology fit
inside the Cloud Adoption Framework?
>> Yeah, let's start with an understanding
of the Cloud Adoption Framework.
We have an easy visual for that.
If we think about the Cloud Adoption Framework
on this first line here,
we break down the Cloud adoption journey
into multiple methodologies.
We do that because first off,
nobody should ever try to read the whole thing.
You'd be bored to tears and fall asleep
for yet a few pages on.
But when you've got a problem with Cloud Adoption,
these methodologies help you.
We have some for governance and management,
and we have some around planning and strategy,
and just adopting the Cloud in general,
and security comes up in a lot of those.
We'll talk a little bit later about how this fits.
But what we'd watch now
is a new methodology that's similar
to govern and manage to help you
with those operational questions around security.
>> Awesome.
Now, switching over to Mark.
Mark, I know the Cloud has changed
how we do IT quite fundamentally.
If we're thinking about security,
how has the Cloud actually changed security for us?
>> Yeah, a great question.
There's two different things that we see
that security teams are really wrestling with.
One is the continuing evolution of threat environment.
These attackers are finding new ways
to make money, better ways to attack,
more efficient ways to attack,
or sometimes, they're nation-state objectives,
but a lot of it is profit-driven with the ransomware.
They're wrestling with this continuing evolution of the attacks.
At the same time, they're wrestling with,
hey, the things that we're protecting
are being changed out from underneath them
as IT goes to the Cloud.
They now have to protect,
"What the heck is an Azure function?"
They're really trying to wrestle
with both of those things at once.
That's central to the way we were
thinking about the secure methodologies.
How do we help organizations,
based on all the lessons as we've
seen really address that dual challenge?
>> Awesome.
Now, Brian thinking about this secure methodology
and when you were creating it,
did you think about what Mark has just told us
when you were actually building it out?
>> Absolutely. Yeah.
When we build any of these methodologies,
they're very customer-intensive.
We thought about customers a lot
when we built out the secure methodology,
and we really structured it around
the challenges we see customers go through
as they're taking on these new things
that Mark is talking about.
To really address some, we had to
break it down into a couple of things.
First, that thought around business alignment of new process,
and how you get things done,
focusing on areas like how do we help the business
understand this data involved around risk,
and get some security insights,
so that they can make wise decisions?
Then how do we help integrate
all of the different pieces of security,
and to the best practices,
not just IT,
but business behaviors as well?
It can become a real team sport.
Then finally, as we're thinking through security,
how do we keep focused on that key goal
of operational resiliency?
No matter what happens,
you're not going to lose the business,
because of these attacks that come in at you.
If for some reason you do have a compromise,
you can recover really quickly
and get that full functionality back.
It's also business side.
Then we thought if we're helping
the business understand these pieces,
how do we get this on the inside of information technology
to really get discipline and security?
We broke this down into palatable chunks,
so people can address it a little more easily.
Mark is going to go deep on a number of these.
But just going left to right,
access controls are a great starting point.
How do we set up the right access model?
Then security operations,
that's really that thought of how
do we detect, respond, and recover,
and how do we make sure that
we're watching what's going on,
and that we're seeing these threats,
and really treating them the respect they deserve?
The assets of protection,
how do we keep those assets safe?
How do we really keep that sensitive data
and those up and running systems
protected from hackers?
Then those security governance
scientists that thought of how do we
now continuously monitor or measure,
identify, and treat our automations
in ways that really respond
to those attacks and threats?
Then finally, security isn't just a central IT
or a Cloud center of excellence thing,
it's something that spans throughout all of technology.
How do we now partner with people
on the architecture side,
and on the workload side,
and make sure that we're bringing
that whole DevSecOps motion
to bring together the developers,
IT operations, and security together,
to partner together in solutions?
>> Awesome.
Now, Mark, over to you,
thinking about the leadership team
inside organizations and how security fits in there,
maybe some of the conversations people
have to have with the leadership teams,
how does that all work?
>> Yeah, that's a great question.
The chief challenge that we've seen
is that security has been treated
for very long as a technical problem.
CSOs typically report to the CIOs,
and so we use that as a technical problem.
You should be able to solve
this problem solution map, click [inaudible].
But in fact, it's actually an ongoing risk
and it's a resiliency problem,
which is one of the reasons why we highlighted
that business resiliency because you want
to prevent as much as you can.
But you've got to accept that stuff
is going to happen because you got a human adversary.
We are really focused on how do we build
a construct around that,
that the metrics and the culture
on the other elements the security teams need,
based on some of these leading programs
and bright spots that we've seen,
to help organizations really mature quickly
and structured so they can handle
those rapid changes from the Cloud
and from the attackers themselves?
That's really where we focus a lot of our energy,
and that top part is filling in that gap that we see a lot.
>> Now, thinking about what Brian said
about access control being the first discipline
that organizations often start with,
Mark, can you give me a bit more detail about that, please?
>> Absolutely.
The thing that we found about
the access control space
is many security teams grew out of
their networking technology teams.
They're very familiar with a very complex
and intricate domain of networking.
But they're not necessarily always familiar
with identity technical issues like Azure,
Active Directory, and Active Directory, and whatnot.
Bringing those things together and picking
the best solution for the right environment,
and getting that is a huge focus there.
Okay, we got to stop with this argument
of it's an A, it's a B.
We got to actually get together
and have a single coherent strategy,
pick the right tech for it,
bring the teams together and leverage.
Zero-trust principles is really that key theme
going forward in the access control space.
Zero-trust is a big, applies-everywhere theme,
but it really becomes apparent
when all of a sudden your firewall and network perimeter
aren't doing what you wish they did.
They're just not enough.
>> Awesome.
Now, I noticed that one of the disciplines
is the innovation security discipline,
which sounds quite interesting.
What does that entail?
>> That's a great question.
As Ryan mentioned,
the business organizations have developer teams,
and they're like, "Hey, I need to put out
an app to make some money.
They get it.
They understand the value of tech to their businesses."
We're seeing really two different things emerging.
One is professional developers moving to a DevOps,
DevSecOps type of approach.
We're also seeing citizen developers,
and Power Apps, and some of those elements.
We actually decided to abstract out,
have an innovation security
of how do you handle this,
how do you do this right programmatically?
Then have specialties underneath it
that focus on things like DevSecOps
and controls that make that happen.
That's really the way that we approach that space,
because it's a microcosm of everything
else just running faster,
and at that leading edge,
and you want to make sure
you're not shipping new things
that don't meet current standards.
That's a mad situation where you're just [inaudible] .
> Yeah. Now, I know also one of your disciplines
was in asset protection,
is that physical asset protection
or something else, Mark?
>> That's a great question.
We actually triggered and keyed on business assets.
We know that the business assets do have to translate.
My payment systems to make sure
that we actually make money,
that's going to be multiple IT systems,
and servers, and containers,
and apps, and websites, and whatnot.
We keyed on the business assets there as the main focus.
There's a hand-in-hand relationship
between asset protection and governance.
Governance is making sure you're doing the right thing,
and Brian is going to expand on that in just a moment.
The governance tells you what to do,
where to do it,
and then the asset protection
is the execution of those standards
on all these existing assets,
the melting points, identities, whatever.
But there's also new things coming out,
because Azure AWS came out
with this new type of service
that we have never seen.
We need standards for that.
Thank you, governance.
But we also need to apply those
standards consistently across them.
We really see those things going hand in hand.
>> Brian, if I can bring you back into the conversation,
because I know you have equity analogy
that helps us go deeper on talking
about security and governance,
and the Cloud Adoption Framework,
are you able to share that, please?
>> Yeah, I'd be happy too.
It can sometimes be confusing for people
to think about how security and operations,
and governance fit together.
Let's think about it like an office building.
If we look at two different types of office buildings,
one that's a brand new,
one that you're building fresh,
and one that's been around for a little while,
we can start to understand how they fit a little bit better.
In the existing building,
it was built a few years ago.
It's meeting the businesses means,
but decision makers now want to add more compliance,
maybe move things around a new environment.
Compared to a new building,
you get to take advantage of new technology right now.
It's an entirely new building,
and you get to rethink everything.
These give you some different options.
When we're thinking about those different options
and we look under the surface
of what people are doing in the building,
there's a couple of things that are always consistent.
There's your security, your governance,
your operations management,
general building design.
They both have these things,
but maybe they're a little bit different
for a new versus an old building.
When we think about the newer building,
we can take advantage of a lot more
of that technology and automate things.
Maybe there's a little bit less human security,
because you have more automated tools,
a little bit less management,
because you have automated tools.
Maybe governance is a little bit bigger
and more of an existing building,
there's a little bit more human effort
required for all those things,
but they all fit together really well.
When we start to think about how these fit together,
you have to think about what each
of those actors are doing.
In security, primary focus is keep out the bad actors,
minimize mistakes from good actors,
so people are doing the right things.
To do that, security is expected to bring that security staff.
In a building, that's your security desk
and keeping that desk staffed.
But they also establish security rules,
and start think about guidelines,
and how you recover when security is compromised.
They're responsible for leveraging
technology to monitor and react quickly.
Thinking through those things along for sure,
you could have just security,
and we're going to get really secure.
But now, when we start to think about
really optimized modern security,
we have to make it more of a team sport.
On the government side,
government is focused on automation.
Can we automate that detection and enforcement?
Now, we've got self-protecting boundaries.
If we think about the management side,
can we partner with operations management,
so that we'd get even faster recovery,
and bad actors get in for better monitoring
to watch what people are doing?
Then if we integrate with the building design,
now, we can start to put security strategically in every room,
and really make it a part of how that business functions.
Security shows up anomalies,
and the same is true for the Cloud Adoption Framework.
We see these same exact functions
show up in different places.
For instance, if we look at the earlier stage stuff
like planning [inaudible] Cloud Adoption Framework,
we'll start to see different things
around security show up when it comes
to the design of the building,
or in our case, the development of the Azure landing zone.
Or we'll see it show up in the governing methodology,
because we're automating security things
as part of governance.
Leading [inaudible] it show up in
the Operations Management for that recovery.
But we have a new methodology
that we've just launched inside
of the Cloud Adoption Framework,
which is really specific to just the needs of security
and fulfilling those roles as security needs to.
We see that nucleus of the security decisions there.
But then we also see it reflected
in all of those other pieces of the Cloud Adoption Framework.
You start to see all of the building come together that way.
This is how security fits with a lot
of other things that you may be doing,
and how you can interact with this more together.
>> Awesome. That definitely explains a lot.
Thank you so much for that, Brian.
If people want to look more in depth
into this secure methodology,
where's the best place for them to go?
>> The best short link is aka.ms/adopt/secure.
That will bring you right into the Cloud Adoption Framework,
secure methodology.
>> Awesome. Thank you.
Thank you both for joining me today.
It's been really informative,
and thank you to all of our viewers,
and please make sure that you check out
our past episode of the Azure Enablement Show
and watch out for future episodes as well.
[MUSIC]