>> Hey everybody, stay tuned.
Where Brian and I, and we'll be talking about
Identity Management and how that
can help on your governance journey.
[MUSIC]
Welcome to the Azure Enablement Show
where we're having technical conversations with
Microsoft day experience [inaudible] Some of the obstacles or
questions you may face on your Cloud adoption journey.
Now in an earlier episode of the show,
we started to talk about governance and
the five different pillars that you have.
Now, today we're talking about the Identity Pillar
and to help me on that conversation journey is Brian.
Brian, welcome back to the show.
>> Hey Sarah. Thanks for having me again.
>> It's nice seeing you. I often
hear people talk about, if you have
a good Identity Management Scheme or a good identity posture
is a great line of defense
for your organization. Is that fair to say?
>> I wholeheartedly agree with that.
In the traditional world of datacenters,
we have walls that gave us that sense of protection and boundary.
When we look to the Cloud,
those walls aren't there.
We have to put up new boundaries and
new protections to keep things safe inside of those.
Identity is one of those frontline boundaries that really
help establish a safe perimeter
around everything that we hosted in the Cloud.
Getting that right is really important.
>> How do people actually start to govern
their identity strategy and start to plan it out.
>> Well, it all depends on where you start from.
If you're already a Microsoft customer that's invested in Office 365.
You've probably already got
identity integration into what's called Azure Active Directory.
That brings all your users over from Active Directory.
If you don't, then you have to do a little bit of work to get
that synchronization go on from
your identity provider to Active Directory.
But once you're there,
and Azure Active Directories in place,
you've got the foundation for an Identity Baseline.
You still have more work to do.
There's a couple of things that you'll have to put
in place to avoid some common pitfalls.
But that's a great start,
is just get an Azure Active Directory in place.
>> Once you've go Azure Active Directory in place,
what are those next steps that they need to think about?
>> Well, that really depends on what you're doing in the Cloud.
How high-risk your exposure is,
how comfortable you are in your risk tolerances,
though, the way you manage identities.
In the governance world,
we don't make all those decisions.
We make all those decisions consistent.
The focus with the
Cloud Adoption Frameworks Govern Methodology is to
focus on taking those identity rules that are set in place,
and using things like Azure Blueprint or
Azure Policy that consistently deploy
identity requirements across everything
you do so that you don't have
any unexpected surprises with
your identity profile or your identity plan.
>> You talk to lots of customers, Brian.
I know this from previous conversations with you.
You must see some common mistakes
or pitfalls that our customers fall into.
Is there any stories you could tell us,
and prepare audience avoid those pitfalls themselves?
>> Yeah, definitely. When it comes to identity,
the most common mistakes are really
more accidental human errors more than anything else.
When we think about Identity Governance,
it's all about putting policies in place that prevent guard,
or put up guardrails that prevent accidental human errors.
One of my favorite ones is that I've got
a good friend in the Fortune 500 who is a CISO,
and I can't share his name
because I want to keep him as a good friend.
But he followed suit with a common pattern I see.
Microsoft has a lot of Hands-On Labs to teach you things.
In those Hands-On Labs were not focused on security.
We were focused on how do you use this tool?
There's some behaviors inside of those,
like using a username and password,
where it's admin and the password is password.
Having a VM that's exposed to the outside world.
Well, the CISO friend of mine went through
a Hands-On Lab and fast-forward a little bit
that Hands-On Lab became a production instance of
something that ended up going out into the real world,
and everyone forgot that six months ago,
this was a very insecure Hands-On Lab.
When they went to push it out to production out when a VM that
had admin and password as the admin credentials on that VM.
You wouldn't think a CISO would make that mistake.
But if they can, we can too.
It's commonplace stuff that
we're not infallible and we forget things.
Putting in policies in place that protect
against those type of common human errors,
and make you a whole lot safer
and allow governance and identity to work
together so that developers
don't have to remember every step they've taken.
They just have to remember what steps are
important to protect their identities.
>> How do we implement those policies?
Is there tools that can help us do that?
Or is it just a case of making sure
you have the message written on a Whiteboard,
and your office was that people remember to do those policies?
>> I think there's a little bit of each there.
Writing things on a Whiteboard helps for a while.
Then eventually you stop looking at
Whiteboard and put a picture over the top of it and it's gone.
If we look at the overall
Cloud Adoption Framework Govern Methodology,
there's a few steps that can help you get there.
Across the top, corporate policies,
the most important part.
Understanding those business risks,
understanding what you're doing in the Cloud.
Are you building a lot of new things?
Or you just migrate number what you already have.
Are you putting out high-risk data,
sensitive data, or mission critical applications.
Those all change your risk profile,
and they're going to change type policies
that you write to govern the Cloud.
Once you get those defined,
it's really easy to take those identity-related policies and
say we're going to turn those into Azure Policies.
Which Azure Policy then automates that corporate policy for you.
Makes it where you can erase the Whiteboard and you don't have to
worry about remembering because you're
now automating that protection,
or at minimum auditing for violations.
Those are how we get there.
Start with making the right decisions in the right guardrails,
and then follow through by automating those guardrails.
>> Cool. I like to see things visually, Brian.
Is there any demos that you may have obviously
that you show us about how to do this today?
>> Yeah, gladly.
Fortunately the demo and I'll just
share the tools we're going to show off.
When we're talking about Identity Baseline,
the key tools here are things like Azure Blueprints.
Of course you're using policy features of Blueprints.
You're also using Role-Based Access Control or RBAC.
All the different versions of Azure AD,
and whether that's Directory Federation or Directory Replication,
we get those identities synchronized.
Those are the basic tools.
Let's show off a few of those in a demo here.
If we want to get started with overall identity-focused policies,
the best place to start,
I believe, is oftentimes in the policy definitions.
I'm going to go into "Azure", and go into "Policies".
Then once we're inside of the Azure Policy tool,
there's an authoring section around "Definitions".
These definitions are where you'll see all the policies you create
or built-in policies that you
might want to pull on for your environments.
On here, I'm just going to change this to
built-in definitions so we can see
what's already there that you can get for free.
One of the most common things we see
customer struggle with is that
elevated permissions and having privileges that cause problems.
Those often come from some administrator access.
Let's just do a search and see what we can do with add names.
In the policies that are already there today,
we can plug in things that say,
let's "Audit Windows machines that are
missing specific members in the admin group."
This helps us establish that we've got
the right administrative controls
should something come up, we need to change it.
But then on the other end, Let's see.
There are someone here about specific numbers,
and there's others on here. There we go,
"Audit Windows machines that have
extra accounts and the administrator group."
This is often one of the most common areas
where identity goes astray
is someone has to do a temporary elevated privilege on a machine.
They put someone in the admin group, and they forget about it.
Now, you've got one more whole that you have to plug in
case that person's identity is compromised in some way.
First, we want to avoid that approach.
We want to know if there's any extra accounts in the
admin groups even in early-stage development.
But we really want to limit and stop
that and anything production related.
These are two built-in policies that you have right away.
There's also other things on here that we can search for.
Let's look at some password settings.
Let's audit machines with insecure password security settings.
Or audit machines with passwords of a certain age to implement
certain reset policies or restrict that
they have solid passwords that have a certain password length.
These are all things that you get for free.
You can just pick up in Azure Policy and
say that you want to apply to any environment.
Likewise, you can do the same thing by including these
into a Blueprint, will show in just a second here.
Over time, you're going to want to build your own.
If we look at all of the Azure Policies,
one that we commonly use when we're doing things in
Linux is we want to audit SSH authentications.
It's another policy that we built that goes
into the actual machine configuration
and audits those SSH auths so that we can see who's logging in.
You can automate a number of things,
but it all depends on what policies you want to
enforce in environment based on your corporate policies.
>> That makes great sense Brian,
because I was on data often and people into the admin group,
and then forgot to take them out once they've completed the task.
Yeah, having those can audit policies
in when I was around would've been quite helpful.
>> Totally, I wish we had those in
the on-prem world before the Cloud came and we can just
help prevent some of
these silly mistakes if Microsoft a lot more secure.
>> Absolutely. You mentioned
you wanted to show the Blueprints as well,
could you, is that right?
>> We can add policies to an environment.
But if you're using things like the deployment acceleration,
this plan of Cloud governance,
which I believe will cover in a future video.
In that mindset, you're really looking at applying
repeatable infrastructures code techniques
using things like Azure Blueprint.
So if you're using the Cloud
Adoption Frameworks Foundation Blueprint,
you'd get a lot of things already with it.
But when you can do is go in and add
other artifacts like the policies we've just talked about.
You can add those same exact policy assignments that are all
built-in and add to
a package blueprint the same way you would any other policy.
Then once you apply that Blueprint to an environment,
all of those different policy assignments
coming together and are applied in that environment.
But you can also do other things as well.
Let's see here. We could
and different artifacts around a role assignment.
From here we can choose specific roles that we
want to give assignments to inside of that environment.
What this does is allows us to have
centralized control over what access is allowed and what isn't.
If we stick to standardize roles
like owner or a contributor or reader,
or other roles that you define consistently in your environment.
Now, you can make sure that those role assignments
happen inside of the Blueprint,
and get applied to the entire environment.
It's less likely that someone's going to come in and say,
"I need this custom role or this custom access."
When they do, you'll understand what rights they have
automatically in every environment consistently.
You'll understand where to make those deviations.
I don't simple things like adding a role.
You now set a basic Identity Baseline strategy
for that Blueprint and for every subscription
that it's applied too.
>> Awesome. That sounds really good, Brian.
Thank you so much for your time today and taking me through
the Identity Management Journey
the organizations have to think about as well.
I really do appreciate your time.
Now, Brian mentioned a lot of resources and we're going
to put the links in the description box below.
Make sure you check that out for further information and
remember to tune in for future episodes
of the Azure Enablement Show as well.
[MUSIC]