Welcome to Office Mechanics. Coming up on the show we're going to catch up again today
with Mark Russinovich, we'll access the risks
of moving to the cloud, we'll look at the partnership between was Microsoft does
to manage the cloud, as well as your roll
in managing your information and we'll take a look at some real customer
examples along the way. Stay tuned.
Microsoft Office
Office Mechanics
So Mark welcome back.
Thanks Jeremy. Thanks for having me.
So we're talking about assume breach, we're talking about the way that we actually
manage the cloud, what's different here, what's new?
One of the things that's new about the cloud is a different perspective on
security than
traditionally has been in place and IT enterprises
in the enterprise there was a belief that the perimeter is what you should
focus on
creating a strong line of defense against the attackers and there was
little emphasis on
dealing with attackers once they got into the network. The fact is though
as we understand the case after case of public breach tells us
that a determined adversary will get in no matter how strong your perimeter is
we've had a lot of cases recently where there have been these types of breaches with
even on premises customers doing a lot to protect their data in
some cases
not a lot to protect their data but we're going to talk about some things that
are different when you move to the cloud.
So this really is about it
what we call an assumed breach mentality that we have when it comes to our cloud
infrastructure
which is we have to assume that attackers will get and we have to assume
that we're going to get breached and that leads to a different way of looking at
not just
protecting and setting up a strong perimeter but making sure that when an
attacker gets in that you can detect them as quickly as possible
and then you got mechanisms in place to isolate them once there inside and then
to get them out as well
Right, all is very important in terms the running the cloud from our
perspective as well as your perspective but even beyond all that
the cloud itself is a bit of a different attack surface right I mean there are some
appealing aspects
of trying to attack cloud service providers
yeah so obviously there's free trials which you can sign up for an
anonymously many cases are with the throwaway phone so attackers get an
opportunity to get
huge amount to compute and network bandwidth that they can use for
malicious purposes
they also from the perspective of targets the
cloud makes an attractive target because there's a rich
environment there are many customers up there that are not following security
best practices and leaving themselves exposed
there's large IP blocks that the attackers know belong to public clouds
so they can go scanning those for those vulnerable targets
Really when you think about what that means is that from a cloud services
perspective it's really a shared responsibility
on the Microsoft side you can explain some other things
were doing there and I'll take the admins perspective in terms of things that
you can do to protect
your own environment
Yes, from a shared responsibility perspective
obviously we can't do it all for you your configuring your applications and
your users in the cloud and so you've got some responsibility there
now when it comes to us in our infrastructure that you're running on of
course that's our responsibility
and what we're looking at more and more is providing technologies that help you
be secure by default so
make it easier for you to do your responsibility by us helping you with
security as a service essentially
So we do what we can to lock down for
operations perspective the service make sure everything is secure the facilities are
secure all of the
kind of table stakes of running and managing the service but when you think about it
as an admin using things like multi-factor authentication rolling all
your passwords making sure that
your operating as securely as you can at the end of the day
you want to make sure that your tenant is secured and lockdown and that you're not leaving
any vulnerabilities there
That's right so standard best practices we see a lot of companies not
following ones that they've been following in their on-prem enviroment
so they haven't been patching their
applications or their operating system they haven't been setting up network rules to
prevent
inbound or outbound access in from
locations that shouldn't be accessible from there
applications we see these kinds of exposures just because people aren't
really treating this as part of their infrastructure which they should be
we should really dig into some internal stories from the cloud things that we are
actually seeing as we're
operating that because there are really some internal thing that we're doing from a management
perspective and some things that were observing
in terms of people using cloud services across Azure
as well as Office 365 and other parts for the Microsoft cloud
Yep so we'll walk-through
example of a real-life case of a tenant getting breached in Azure and what we did
to help them out
we'll talk about some real-world examples of vulnerabilites showing up
in software that's being used inside of Azure and by our customers and how we
respond to that
talk about how we protect our infrastructure from malicious insiders
or attackers that
end up compromising one of our devops personal that wants access to the
infrastructure, the cloud. and finally we make a use of
machine learning and data analytics when it comes to detecting
security breaches
That's really cool. We can use the power of the cloud and all of the
compute to actually run
manage and secure the cloud so let's start with tenant breach
so this is a a real world example of a customer that we detected
had VM's exhibiting anomalous activity huge amounts of egress traffic
to locations outside the United States where the
application was deployed we detect this as part of a normal
network monitoring we're monitoring the network traffic owner networks on our public
cloud networks continuously
to identify anomalies bugs in configuration that we might introduce
and then we also pick up examples like of customer
VM's that have been breached and performing malicious activity
this particular case we notify the customer that they were breached
they connected to their virtual machines they had installed anti virus in their virtual
machines they had done the best practice
have those anti virus logs emitted to Azure storage where they were
could then be processed and alerts be configured on them but it turned out
that they hadn't been
watching those alerts they had been looking at those logs so they had
no idea
that they've been breached and that their VM's were serving a malicious purpose
when they did go to investigate forensically what was on the VM their
event log showed that two days before we notified them
that a user account had been added to the admin group on that virtual machine
and this is just a close-up of that event log record a
of that user being added to that administrator group to give the attacker
a place to do their business. So what we did at that point was
notify them. They followed best practices they put in place have
having their network traffic go through on their on-premise firewall
or appliance they also had their analytics logs now be processed
through their on-premises sim so that they could get alerts
as appropriate in the future. But we see this all the time customers that are
just leaving themselves exposed like this
we of course try to do what we can to help them
like we did in this case but it's part of the shared responsibility here
You have to pay attention to those logs but we we'll do we can
Let's move onto infrastructure protection, cause there's a lot of things that we're doing here
A lot of really famous vulnerabilities, viruses, malware that have been
in a while over the last couple months. Why don't you explain that.
Yes. So of course we pay close attention to when there's a vulnerability and some software that we
or some customers might be using here's a
three examples from the last year or so heartbleed, ShellShock and an S channel
vulnerablity in Windows itself
our reaction or incident response to these we treat is a security incidents
in terms of going and looking to see if the infrastructure itself is vulnerable
in any of these
in the case of Heartbleed and ShellShock within an hour or less
we determined their infrastructure was not vulnerable that we're not exposed in any
of our software to this
at the same time we also did scans our customer VM's to see if they were
vulnerable to these and we did notify them
in the case of Heartbleed and ShellShock. In the case of these Linux VM's that
works but to this we notified
sent customers her notifications that they were exposed
in cases where we saw their machines being used maliciously because attackers
were exploiting less
we gave them notice that we're gonna shut down their virtual machines within
48 hours unless they corrected
the situation because they were cut
causing a problem for other customers in Azure as well as people in the
outside world by having their machines
serve up malicious content to perform the DDOS attacks on other customers
right that's all those things when you're running infrastructure the
service is still a lot of times your responsibility to patch those machines
because
they are just VMs that the end the day that you are managing the patch state of
we have then the ability on the server side as we have to do things like meet
compliance and regulation requirements
we're patching these things continuously making sure they're as secure
and hardened as they possibly can be let's go beyond information protection
because just in time in a role base controls are also super important here
we've got a picture
the lockbox process we announced in Office 365 that we actually
add customers to this they can actually approved any required access to
information
on that temporary basis and the same thing that we've got on on Azure for just
in time but this way
a customer in Office 365 will get to be able to vote yes you can access my data
temporarily
to triage what's going on that's right so in
this just in time access model which is limited scope access
just to the resources that the developer needs access to troubleshoot a problem
has been something we've had in Azure from the start
a developer when there's an incident on a are a piece of infrastructure or
customer VM
there's a ticket that's open that grants access
to that particular resource for
a particular user and that particular or group users when a particular use
group users goes on request access they've got a reference the ticket
the ticket is verified that grants them access and then the scope access is
given
just to that resource in its time bombs as well so
after some certain amount of time if the developers not done they've gotta go
request access in this prevents the case of somebody adding
permissions to a resource forgetting about in the now you've essentially got
a standing admin
our goal is zero standing admins of course it's
really impossible to completely operate that way there's a few master keys
that we have to have just in case a real emergencies but
for the most part we operate with no standing admin access to the
infrastructure
know we like to think about as well as from an automation standpoint if we run
the service
it's as humming along in the right ways we don't have to have humans actually
access the service with all that
is being done for automation all the logins been parsed through
health models all the big data and cloud control that we have their so
really it's about not having this there's any permissions think that you
might happen on premises manager perspective
walking those up from the cloud service but beyond the
role back controls data scientists work it's really compelling because we
have now
machine learning image now look for a for a brief second there
a couple seconds ago but we can basically take some other
though information that we're seeing and detect what's going on in the
environment and there's a lot of really cool things
yes, machine learning like I mentioned data analytics heavily used in
infrastructure
of obviously for anomaly detection that can help us identify bugs
in are infrastructure and software but also heavily used for security as well
that
just in time access process that I mention audited and then there's
data analytics that are looking at that for anomalous patterns in the just in
time access so we could detect
for example a compromised employees that where the attacker is leveraging
there
access in a way that is abusive and getting them access to the
infrastructure
and giving us alerts we've got a philosophy inside of Azure which is
first party equal third party which means whatever we do and build for ourselves
to operate our systems
we believe that customers might find it useful this is a great example of us
taking that same kind of technology maybe not the exact thing
same thing but the principal the philosophy behind it and making it
available to our customers
and this is the case of Azure Active Directory anomaly detection services
which
use of Brad talk about in the keynote on Monday where we
have machine learning analyzing login patterns throughout Azure Active
Directory to detect
anomalous situations Brad talked about the impossible traveler scenarios for
somebody's logging in from United States
and twenty minutes later logging in from China and that's
obviously a situation that doesn't make any sense and
the algorithms will send alert to the administrator so there where that
they've
likely got a compromised credential your wanna make sure that these reports and
this information is as pervasive
as it can be that you have the transparency for things like
is impossible global login that you can do you know within five minutes be in
New York and and
and Shanghai the same time will be able to serve this up inside of Azure
and Active Directory as well as inside the Office 365 work was a really really
great stuff coming there
across the Microsoft Cloud really bring a lot of transparency to what's
going on behind the scenes so
we've covered quite a bit here in terms of all the different things that we can
if course we can't cover everything
in our compressed time frame but when you think about
all the things that you can do from our for a protection perspective we have
controls in place to prevent tenant breach to prevent any any the infrastructure
requirements in the things you want to do to patch locally just in time control
even customer lockbox
RBAC, data science to use the power of the cloud early secure the cloud
a lot of things that we're doing a lot of things that were helping with in
terms of making sure your compliant
making sure systems our patched making sure they're a secure as possible
that's right there's an ongoing journey like i mentioned we want to bring more
and more of our technologies and
systems and approaches and make them available to you so even with
for that part of the responsibility that's yours we want to make it as easy
as possible on
that data science application to anomalous logins is just one example a first
step in that direction course all this information for you
tweet a lot you know you blog a bit all of this can be found on the Office blogs also on
the Azure blogs
this is about all the time we have to talk about all the different things today but
there's a lot more content out there in terms of being able to see what we're
doing for Microsoft perspective and what
even Marks presented in the past so check all of that out that's all the time we have for this
show
thanks for watching and goodbye for now