(upbeat music)
- Hi, I'm Sue.
I'm here today with Ruoting.
We're gonna talk about how Microsoft and Duo work together
in order to help secure users in a multi-cloud environment.
So welcome.
- Thanks for having me Sue, great to be here.
- Some viewers might be surprised
that we're sitting here together today,
since we both have multi-factor authentication solutions.
Microsoft has come to realize and accept
that a heterogeneous environment is normal
for our customers, and that choice is actually
good for our customers.
- Yeah, I think that's a really great point.
Even on the Duo side, what we've seen over the last,
I would say five, 10 years is that there's broader
macro trends around consumerization of IT
that our customers are experiencing every single day.
And a lot of that is brought on by a reduction
in the friction of being able to use
different enterprise tooling.
And so customers are much more willing to use
best in breed tooling for each specific problem
that they're looking to solve.
And as a result, interoperability
really is the name of the game.
And so we're thrilled to be partnering with Microsoft
across a variety of different solutions
to help customers solve some of the really hardest problems
that they're seeing in their environment today.
- So how do you think the partnership's going?
- I think it's been a very fruitful partnership.
So we... you know...
Duo and Microsoft launched our first partnership,
and the first integration about 2 1/2 years ago.
And it was really around enabling Microsoft customers
that were moving from on-premises active directory
into Azure active directory, to allow them to have
the same security efficacy and the same security policy,
and leverage the same security investments
that they had made in the on-prem world,
as they transition to the cloud.
What we wanted to make sure was that,
from a security vendor perspective,
we weren't the bottleneck in helping customers
make the digital transformation, and move to the cloud.
And so we had to have kind of feature parities, so to speak,
of all the things that a customer could enable
for their security posture on-premises,
we wanted to make sure that was the same case
for the cloud environment when they went over
to Office 365, Azure Active Directory,
and so on and so forth.
So, I think it's been a very fruitful partnership.
- Tell me a little bit about the University of Michigan.
- The University of Michigan has actually been
a longtime Duo customer for a while,
they were actually one of our first customers.
Today we protect about 75,000 user accounts
at the University of Michigan.
That includes the undergrad population,
the graduate population, as well as the staff and faculty.
As you can imagine, in higher education,
it's not just unique to the University of Michigan,
but a lot of your students don't necessarily care
about cyber security and good password hygiene.
And so U of M initially came to us
to stop a lot of account takeover
and credential theft scenarios that they were seeing.
Today we integrate with Microsoft Azure AD,
as well as Office 365, to protect student and faculty logins
to their email, to other Office 365 collaboration tools,
as well as to anything that is actually federating
against their Azure AD instance.
- So you mentioned that students don't care
about cyber security, or they don't care
about their passwords.
We find that that's true for everyone,
it's not just students.
(laughs)
- That's true.
Yes, it absolutely is true.
I think phishing training and security awareness
has become a much more prevalent part of corporations today,
because cyber security really is at the center
of a lot of issues that we see.
I think it's a good thing that there is as much awareness
around this as we see today, and I hope it continues.
- And I think what we've seen is,
now is the security perimeter moving away
from being on-prem to being everywhere.
So, you're working mobile, you have all kinds of users,
all kinds of devices, so it really requires
that we think about security in a broad way.
So let's talk about Zero Trust for a second.
Zero Trust is a concept that spans the entire ecosystem.
And it's impossible for one vendor to do it all.
- As one of the defacto cloud platform
providers for customers, Duo really wanted
to work with Microsoft to make sure
that it's customers were moving to the Microsoft cloud.
That they could take the same security principles
that they had on-premises and apply them
to the Microsoft cloud.
For us Zero Trust really is around a couple of principles.
One, it's establishing the identity of the user
as they're accessing the application.
Two is establishing that you can trust the device,
or the end point that they are using
as they're accessing those applications.
And the last piece of it is really
where interoperability comes in.
Which is that it doesn't matter, or it shouldn't matter
where that application or that workload is hosted.
That application could be hosted on-premises,
it could be in a data center somewhere,
it could be in the Microsoft cloud,
it could be in the Google cloud, it really doesn't matter.
The idea is really to be able to secure
those users and those devices accessing those applications,
no matter where they are.
And that's really the fundamental challenge,
or the fundamental premise around Zero Trust.
(calm music)
For me personally, what kind are the necessary means,
in the context of Duo, is a few things.
One is radical empathy for everyone that we work with.
So that's not just limited to our customers.
We obviously are customer first,
and so there's a lot of customer empathy.
But it also means employee empathy.
And I think that is actually very important
in terms of fostering an environment
where diversity and inclusion can really thrive.
So for us it's about fostering an environment
where people are comfortable taking risks.
That they're not going to be penalized
for taking a risk and failing.
It's about embracing failure, it's about encouraging people
to learn the lessons that are associated
with when something doesn't work out.
So that's the first part.
The second part of that is assuming positive intents.
There's a lot of scenarios in the business world
where we don't have the context
into everything that happens 24/7/365.
And we often are seeing a small sliver
of the outcome of a set of actions that were taken.
And it's very easy to assume negative intent, actually.
And so one of the things that we try to do,
and we practice very consciously at Duo,
is assuming positive intent.
Meaning taking a step back, trying to understand
from the other person or the other team's point of view,
in terms of why they made the decisions that they made.
And having the belief that everyone
really is on the same core mission
of advancing the company forward.
And that we have different perspectives
on how we're going to get there,
but ultimately everyone is focused on the same thing.
- As I heard you talk I hear things that remind me
of Hit Refresh by Satya Nadella.
He talks about his own journey to develop empathy.
And I think that's one of the things
we're working hard at Microsoft,
is to build our culture to be kinder, gentler as well.
In fact we've used the OKR objectives
and key results model for our goal setting,
and both at the cloud and AI division level and for identity
we have our first objective is about people,
and about making sure people can bring
their authentic self to work.
- Yeah, it's one of the core principles within Duo culture
is actively thinking about diversity and inclusion.
And I'm curious, as a female in tech,
what has your experience been with diversity and inclusion?
Well, it's a topic that's near and dear to me.
It is one of Microsoft's culture pillars,
and it's one that we're working on hard at Microsoft.
I think that one of my personal "aha's"
was going from being a person that was in it,
to stepping out and saying, what's my role in that?
And I realized that, as a woman in tech,
that I have assimilated to be more
like the rest of the engineers, rather than just be myself.
And, as we've learned what the experience
of some of the other women that are more early,
in career have had, I realized I've gotten used to it.
A lot of us had that realization
that that's just the way it is,
what's up with that?
And then when you realize that that's really not okay
to just accept that we're supposed to act differently
because we're in a man's world,
what I did is, I went and got a certification
from Equinow, now DNI.
Because I felt like I didn't have the tools.
I had grown up in it, I had been assimilated, as I said,
and so it was much easier for me to go take a class,
be able to actually use words like assimilation,
differentiation, talk about what it means
to have psychological safety, and equip me in a way
that I could help my peers and help my team.
But I guess, what I would say overall is,
it's been a realization that I had to start with myself.
I had to really look at the fact that I have biases,
that I have done some of the things
that I accuse other people of doing to me,
and then really stepping back and observing that.
And then, like I said, getting the certification
so I felt like I was actually in a position to help others.
- I think it's fascinating that you bring up
the tools piece.
For me as a male in tech, the first thing
was recognition of unconscious biases that we all have.
- I went to a gender speak training,
and one of the things that they talked about is that,
whether you believe this or not,
but it resonated with me, is that men are goal oriented,
and women are process oriented.
And so what it will turn out to be
is a man will come in and ask a woman,
let's go do this project.
And then she'll start asking a bunch of questions.
And the man's thought bubble is, well she's not bought in.
Why is she asking all these questions,
why doesn't she just go do it?
And what the woman is actually doing
is gathering information.
That's okay because she's gonna go do it,
but she just wants to know what to do to move forward,
and that's the process oriented piece.
I actually went to, in Vegas once,
one of these Defending the Caveman shows.
And they talked about men are hunters
and women are gatherers.
Even in shopping, men go in, shoot the shirt,
buy it, walk out.
Women walk in and go, oh, a new line of socks.
Oh, did you see they now have that line in black.
And a woman will actually traverse a store
in a very different way than a man,
because they have these different objectives.
So anyway, back to the story.
So the idea is that, if women are process oriented
they're going to collect a lot of information.
And so I go back to my office and literally,
it was like half a day later, I get a mail from an executive
who said, hey, is there a way that we can find customers
that have at least five SAS apps,
that are doing blahbitty, blahbitty, blah.
Looking for some specific solution opportunity.
And my first thought was, well do you want to see
people who have a premium license?
Do you want to talk to customers that are in the enterprise,
or do you want to look at small and medium businesses?
Are you thinking about people that are global,
or should we start in North America?
And I start writing this mail with a bunch of questions.
And then I realize that I was doing exactly
what I had heard in this seminar.
And I thought, okay, I'm gonna rewrite this.
So I go, okay, I'm gonna get on it.
My assumptions are, we're gonna look at premium licenses,
we're gonna do enterprise customers first,
and let's start with North America.
Does that work for you?
And so I wrote so that I was going out to, you know,
shoot the shirt, rather than gather the information,
but I did it by writing down my assumptions,
rather than asking a bunch of questions.
So a big difference.
A pivot, but a big difference.
- Yeah, absolutely.
And I think that is the reason why diversity
is actually so important in the modern workplace today.
I think back to your example, and I frame it in the context
of design thinking, where you have convergent thinking
and you have divergent thinking.
Some people are better at convergent thinking,
other people are better at divergent thinking.
But you really need both to be able
to actually get to the best solution possible.
Things like diversity and inclusion,
and how we approach our problem solving,
I think are very closely tied together.
And frankly, I think we need more women in the workplace
to help us look at a broader set of solutions.
Because, to your point, men do tend
to be more goal oriented.
So we start at the starting line,
and we have the finish line in mind,
we know what we're looking for.
And it's just about what is the path to getting there.
But sometimes that path, the most efficient path
is not the best path.
And it does take some divergence, and risk,
and it takes a culture that rewards risk taking
to look for alternate paths that might actually
end up being better for our customers,
for our partners, for employees, for everyone involved.
(upbeat music)
- I'm a voracious reader, so I'm wondering
if you have a recommendation for me to put on my list.
- I do.
I recently just finished When Breath Becomes Air
by Paul Kalanithi.
It's a memoir about a Stanford neural surgeon
that actually discovers that he has stage four lung cancer
in his last year of residency.
And so the whole book is kind of an autobiography
of him trying to discover his purpose,
and what everything is for.
It's about his reflections on his work life balance.
Obviously as most people know,
when you're in residency you work non-stop.
And to find out that you have stage four lung cancer
in your final year is pretty heartbreaking.
It's about him reconnecting with his wife and his children.
And he also happens to actually be
an English major from Stanford.
And so the prose of the book is just absolutely beautiful.
It's a pretty short read, but it definitely has become
one of my favorite books of all time.
- Well thank you, and I'll definitely put that on my list.
And thank you Ruoting, for spending the time
with me here today.
- Yeah, thanks for talking with me,
it was a pleasure to be here.
(upbeat music)