Hello everybody and welcome back to another episode
of the Everyday Defender podcast. My name is
Koos and I'm joined here once again with my friend
from Down Under, Chris. Hi Chris, how are you
doing? Hey Koos, great to see you man. It's always
great. It's like my favorite part of the month
when I get to sit down and do this recording
with you. So yeah, great to see you. Well, from
the looks of it, you're not in Sydney right now,
right? Yeah, no, I'm not in my regular dungeon.
I'm actually in Brisbane at the moment. So just
a little bit up the north coast of Australia.
Well, I guess north from Sydney, up the coast.
And yeah, I'm working with a customer over here
for the week. So I didn't want to stall or delay
the recording. So I've got a little makeshift.
uh recording studio here with like the furniture
being rearranged and whatnot so that i could
actually sit down and have some sort of decent
light yeah yeah that's right i was hoping for
a little bit more hoping for some more sunshine
as well but uh for some reason it just started
raining this afternoon so that's why it's also
like dark but hey what can you do well at least
you don't have snow over there in wintertime
so uh here it's much worse well we have a nice
summer still actually yeah you guys have been
having some pretty good weather over there in
europe i think Yeah, yeah. Well, it's a little
bit too good at some places. We had some very
high heat. And even in the south of Europe, there
are some problems with some fires going on in
forests and everything. So that's not very good.
So it's very hot in the south, over 40 degrees,
45 degrees or something like that. MVP Renewal
Week obviously was last week. Sorry, everybody,
for your LinkedIn feed being spammed with all
the updates. And to my surprise, I gained an
additional category, which is the Identity in
Access category. So apparently I talked way too
much about Entra and Passkeys in the past. So
Microsoft awarded me a second category. And well,
I thought, let's stick to it. Let's talk about
Entra ID, B2C and External ID today. since I
was working with that recently for a client.
And you, Chris, you're going to talk about patch
management, am I right? Yeah, patch management.
But yeah, firstly, congrats on the renewal, mate.
I do firmly believe that you are one of the most
deserving MVPs in the community. You really do
work very, very hard for those renewals. So congrats
on that coming through. for you. Talking about
patch management and vulnerability management
and all this stuff, I think it's very topical
at the moment. There's obviously a lot going
on when it comes to patching and patches and
we've been saying for a while to everyone, patch
your stuff. But I wanted to break into some of
the nuances of that and some of the confusion
that I see. Something I've been working on myself
with my current customer a fair bit as well.
Hopefully it'll be a fun topic. It's going to
be a little bit more theory today. When I was
putting the notes together for this, I realized
that there's so much you could dig into when
you start talking about the technology and everything
behind it. So I figured today we'll just sort
of crack it open and just talk a little bit about
the theory and define what we're talking about.
And then possibly as a follow -on or a part two,
we'll dig into maybe the tech and the technology
behind it. So watch the space. Already a little
bit of a spoiler going on there. Well, it's an
important topic and I think underlooked very
much still in practice. Yes, definitely. Yeah,
so I recently had to help a customer get their
Entra ID B2C, business to consumer tenant, connected
to our SOC, actually. And I knew what a B2C was
and where it lived when I did my... Azure exams
in the early days, for example. But I never really
needed to interact with it before. And now I
needed to look into how I'm going to connect
it to the SOC. And I discovered that B2C was
also now replaced by external ID, different product
name. And I thought it was a good idea because
I found some challenges. It's a little bit finicky
here and there, setting things up. There are
some pros and cons to each. So I thought it would
be an interesting topic to bring along for today's
episode. So first of all, what is B2C? If people
do not know it, it's what Microsoft called Customer
Identity and Access Management Platform or CM.
This is introduced in 2016 already. So it is
old. So it was part of my early Azure exams,
I guess, back in the day. And it's meant for
identities outside of your organization. So your
customers signing into your web shop, perhaps
if you're running some government services, maybe
perhaps even citizens using some government portal
or partners using your applications, that kind
of thing. So identities you don't want to...
bring into your workforce tenant for your employees
and want to separate off in a separate container,
so to speak. And in the past, it was even possible
to connect third -party services like Google
and LinkedIn and Facebook so people could bring
in their own virtual identities and authenticate
to your application, et cetera. And then Microsoft
introduced in 2023 the next generation of B2C.
And that's when they called it external ID. They
did not rename B2C. It was actually a new product
introduced in 2023. And I believe it became general
available in 2024, I believe, from the top of
my head. So for the B2C scenario. Just like B2C,
you create an external tenant. So B2C went a
little bit differently, but the external ID has
a very similar look and feel. to what you're
used to with the Entra portal, with the Entra
page. So it looks like an additional tenant in
your organization, but since it's an external
tenant instead of a workforce tenant, there are
some buttons which do not work and there are
some limitations, and that is where the finicky
part gets in as well. Have you worked with B2C,
Chris, or XRID? Yeah, I've worked with BTC back
in the day. I did some work with the scenario
that we worked on was with a school, right? So
they had a directory, their intro was, which
is where their sort of faculty or the teachers
and students lived. And then they also needed.
identities for the parents so the parents would
live in the b2c tenant um yeah it was complicated
stuff man just even provisioning and all of those
workflows you had to really write a lot of your
own or customize your own stuff there there wasn't
a lot of stuff out of the out of the box so i've
not worked with the external id part of it or
the new version of it so keen to keep to hear
your findings here and you know what you come
up with Yeah, so since I have a lot of discussions
with clients who want to onboard our manage detection
and response services, and they come up with
all kinds of things that are important to them,
and they want to bring them into our services.
And sometimes we have to figure out some custom
lock ingestion stuff for it. But it was actually
the first time a large customer came with a B2C
offering to us and wanted to connect that as
well. And it makes sense, right, in theory, because
the tenant handles sign -ins. to their customer
-facing applications. So if somebody's trying
to abuse accounts over there or, I don't know,
reset a password or something, you want to know
of this in the SOC. So it makes sense from a
security standpoint that the customer is really
wanting to protect the identity part of their
application. The problem with B2C, however, is,
well, first of all, I cannot enroll it anymore.
So when I first heard about this, I was like,
okay, let's set it up and try to figure out how
it all works. You cannot do that anymore. Since
external ID has replaced it, B2C is still working.
And I believe it is retiring. Yeah, the support
will be there until 2030. Customers running B2C
still have some time, but eventually they need
to migrate to external ID. But the problem is
with this customer, they weren't able to migrate
just yet due to some custom workflow stuff going
on. More on that later. So they asked me, well,
we're sticking with B2C for now, so just see
if we can make it happen. But another problem
was with B2C is that Microsoft recently stripped,
actually recently in March this year, stripped
a lot of the security features out of B2C. So
in the past, your B2C environment was protected,
could be protected with P2 security features,
just like your workforce tenant. So all of the
identity protection features were there, but
Microsoft stripped them down in March to, I don't
know, maybe even force companies to migrate to
external ID eventually. But the thing is, because
you don't have any insights like the risky users,
risky sign -ins, for example, and... in conjunction
with conditional access you could say if a user
appears to be risky based on microsoft telemetry
and everything you could determine if the user
is risky we don't want to allow them on the application
for example you can do that any longer because
the features were stripped down so i looked into
this and yes you can connect your sign -in logs
and audit logs from b2c to sentinel and then
you can create some kind of detections um but
Obviously, with KQL queries, you aren't able
to replicate the full set of identity protection
functionality. So the added security benefit
is relatively slim, in my opinion. So, yeah,
so I had a discussion with a customer about this.
It might be interesting anyway to do at least
do some form of identity -based use cases on
those logs from B2C. But eventually, I would
always advise to look into the path of migrating
to external ID. The thing is, however, external
ID looks like the successor of B2C. So I was
actually assuming that all the P2 security features
were back and live again in external ID. But
that's not the full story, unfortunately. So
Microsoft did bring a lot of security features
in external ID. So now you can also leverage
passkeys, for example, which is obviously a great
addition. But the risk state, the risk determination,
the identity protection stuff, it's still not
there. So it's still stripped. And well, I'm
not sure if it's coming back eventually. It doesn't
look like it. So that's actually a shame. So
that was actually a very powerful thing you can
do. But like I said with pass keys and a conditional
access you can even enforce some very strict
MFA to your external ID users much more so that
you could do with B2C. Let me see. So the only
thing I encountered next is when you wanted to
connect the logs from B2C or external ID it works
the same matter actually. You have to connect
your diagnostic settings to a Log Analytics workspace
running Sentinel. But the thing is a B2C or an
external ID tenant cannot have an Azure subscription
attached to it. So that external tenant is a
separate entity. You can actually go into the
tenant switcher in your Azure portal or your
Entra portal and switch to the external ID tenant.
But from there, you're unable to connect any
Azure subscription. So you wouldn't be able to
deploy a Log Analytics workspace to select. as
a target for the logs. And the way Microsoft
worked around this is by leveraging Azure Lighthouse.
I'm not sure if you're familiar with that, Chris,
Azure Lighthouse. Yeah, so... We use this as
well in our services where you delegate permissions
from one tenant on Azure resources in another
tenant. So Microsoft leverages Azure Lighthouse
as part of an onboarding wizard. So when you
go into the external ID tenant for the first
time, you're greeted with a wizard asking you
to set up a couple of things. So one of the things
it asks if you want to send some logs somewhere.
And when you just go through that wizard. you'll
eventually encounter an option to send it to
log analytics workspace. It will automatically
provision a resource group, a workspace, and
the Azure Lighthouse delegation to get access
on that to store the logs. But it all happens
in one sweep. And in the end, yeah, you have
a separate workspace. But in my case, I wanted
to use an existing workspace already containing
my analytic rules and my other sign -in logs.
And it wasn't an option to do that because obviously
in the pull down menu, I couldn't select any
other workspaces because they weren't there and
there was no delegation set up to the other resource
groups. So when people encountering this and
hearing this, you have to set up an Azure Lighthouse
delegation beforehand or afterwards manually
and delegate permissions to your resource group
containing your Sentinel workspace. with the
external ID tenant. And then when you go into
the wizard, then you can actually select that
existing workspace from the pull -down menu and
it will skip all the other steps. The thing is,
however, if you completed the wizard, I had a
very hard time to find that wizard again. For
some reason, it's buried somewhere in the menu.
So I put it in the show notes where you can find
it. So it took me a while to figure that out
since I already completed it the first time and
then wanted to correct it afterwards. I made
things a little bit harder. So that's why I thought
I'd bring it up this week. And then eventually
when you have your logs, your sign -in logs and
your audit logs into Sentinel, they look very
similar to the things you're used to from your
workforce tenant. And you can apply detections
on that, like maybe some brute force attempts
or maybe some MFA abuse or maybe some changes
to accounts being done. But again, it's still
not P2 identity protection. So I think you still
should also look into enforcing pass keys or
some proper MFA for those external users as well.
However, the problem, however, migrating from
B2C to external ID isn't that easy. And this
customer already brought it up in one of my first
conversations with them. It has something to
do with the identity experience framework, some
kind of XML policy stuff going on into B2C. Maybe
this rings a bell with you, Chris, when you set
it up. Oh, no. Okay. Well, since you mentioned
it, it was kind of hard to set it up B2C in the
early days. Apparently, there's a lot of custom
stuff you can do, which you cannot do any longer
with external ID, and you have to figure out.
some new custom authentication extensions instead
of that. And that was actually the reason why
this customer is a little bit blocked on migrating
right away. And then even if you want to migrate,
it's not a simple toggle, unfortunately. It never
is, I guess, where you can just migrate into
external ID. You actually have to set up your
external ID separately from your B2C. You have
to take an inventory first of all your applications,
your user flows, your identity providers, everything.
then obviously you have to create all your users
into the external ID. There is no way to sync
password hashes to the external ID, so you have
two options. You either ask everybody to reset
their password once they land on the external
ID, or there is actually a quite clever password
hash harvesting workflow thing available. I'll
put a link in the show notes, but this is where
your app... connecting to B2C and external ID
is able to if your user is successfully logging
in from B2C, it is actually capturing the hash
and storing it through graph in the external
ID for the same user. So if you have it running
in parallel for a while, you'll probably bring
over most of the frequently used accounts automatically.
So it's quite involved. Unfortunately, and there
are some challenges with it, but I think if you're
listening and you're using B2C, please consider
looking at external ID because of the security
features and the fact that B2C will be end of
support in 2030. Yeah, this is going to be an
interesting process and journey for a lot of
orgs, right? Because if you think about the B2C
use cases, it's almost always unmanaged. identities
from from consumers or outside parties right
yeah it's really really difficult if you've gone
and invested time into building something like
this and then now you've got to you know do stuff
or change stuff right that's uh it's definitely
an interesting one for sure yeah and i also had
some conversations with the customer that maybe
not relying only on protecting these identities
is the proper way to do because like you said
it is out of your control, right? So those customers
have their own identities. They log in from their
own endpoints, not managed by your organization.
They're coming from Tor browsers or VPNs or all
over the world, whatever. So I think you should
assume that everything that's landing on your
front door could be potentially problematic.
So enforcing a proper MFA would be one thing,
but the second thing obviously would be also
to protect the workload. workloads in the back
end. And obviously with Defender for Cloud, with
Defender for Containers, with Storage, with App
Security, you have a lot of ways, databases,
you have a lot of ways to protect the front end
and the back end services. And I think that's
perhaps even more important than focusing solely
on these identities, to be honest. There's a
reason, obviously, why you split them up from
your workforce tenant in the first place. So
maybe just leave it there. Yeah, that makes sense.
Yeah. So it was quite a journey figuring out,
especially because B2C wasn't able to get recreated
nowadays anymore. So it was a little bit touching
around in the dark here and there. But yeah,
it was a fun project. The lighthouse stuff and
the wizard got me off board a little bit, off
guard a little bit. But yeah, well, eventually
it was... We managed to solve it and I learned
a thing or two. So that's always good. I think
I still have a BTC tenant or directory kicking
around in my tenant because of the work that
I had previously done. But you're right. It's
always difficult when you've got to try and replicate
something so you can come up with a solution,
but you can't actually build the thing. So always
challenging. But yeah, it sounds like it was
a fun experience and something interesting to
learn for sure. I noticed you've got a ton of
links in the show notes again, which is really
cool. So, you know, folks can kind of find more
detailed information anyway. Indeed. I didn't
want to go into all the weeds of the stuff and
all the migrating. So, yeah, I put a bunch of
links in there. And, yeah, I hope it's informative
for people listening, running B2C. Yeah, very
cool. Thank you for sharing that. I'm sure there
are some folks out there that are going to run
into this at some point. So very cool. Yeah,
and like I said, especially the whole lighthouse,
the wizard thing, it was kind of weird. So I
hope people hearing this, they don't stumble
upon the same issues as I did. Yeah, fair enough.
So we need to patch our stuff. Is that right?
We need to patch our stuff. I was going to say,
another thing that should be topical for folks
or top of mind for folks is patching. And I think
we've definitely mentioned it before, talking
about patching things, making sure things are
updated. And I understand that that's not always
as easy as just auto -updating things, right?
Especially when your organization gets larger,
it becomes a little bit more difficult to automatically
deploy massive amounts of patches to things.
Software can be nuanced. Different folks use
different software. You patch one thing, you
break something else. All of these things, they
happen in large environments, right? But I think
that we're in a place now where attackers are
getting so good at reverse engineering patches
and CVEs and stuff that we can't be lagging so
far behind that patching cycle. I mean, I don't
know if you've worked... I imagine you did work
in large environments back in the day when, you
know, patches hit. There was a test environment
and you take weeks to go from, you know, the
patch actually becoming available, putting it
in the test environment, having people test it,
report, blah, blah, blah, blah, before you eventually
would push that patch into production. We can't
do that. You can't do that nowadays any longer.
You know, you're almost better. better off breaking
things in the production environment by getting
the patches out there. And I'm not saying go
and do this, I'm just saying you're almost better
off because you can't rely on it. So if you haven't
been following along, I have some stats here
from this is just Microsoft patch Tuesday for
the last couple of months. So in June we set
a record with 198 CVEs that were patched across
Microsoft patch Tuesday. 32 of those were critical
and at the time, which is June of 2026, that
was the largest release of patches in the history
of Microsoft Update patching program. The previous
record was I think from sometime in October 2025.
Now fast forward, this was June, fast forward
to July which was last week we had Patch Tuesday
for July and again that record was broken. This
time More than 600 CVEs were patched, 60 critical
vulnerabilities. There were three zero days of
which two of them were actively being exploited,
right? And I think one was an ADFS thing and
there was something on SharePoint as well. And
there were actively exploited privilege escalation
vulnerabilities. So we're seeing this sort of
avalanche of updates and patches. The reason
behind it is maybe quite obvious and maybe it
isn't, but it's because of AI, right? And AI
sort of powered vulnerability scanning, right?
We've heard, I'm sure we've all heard of Mythos
by now and how amazing Mythos is at finding vulnerabilities.
Microsoft obviously have MDash, which I guess
is what they use for something similar or to
do the same thing. But, you know, I'm just talking
specifically Microsoft here. if you think about
that sheer number 622 CVEs in one patch release
attributed to AI scanning and AI actively looking
at things through the code base. Now the challenge
here is that the bad guy also has access to these
tools in many instances. And so we've gone from
a place where a CVE would happen, the vendor
would release a patch, the bad guy would take
the patch, reverse engineer it to figure out
what the flaw was, and then start attacking the
flaw, right? To try and get hold of folks that
haven't yet patched. There was a time there,
like that time to exploit was fairly long because
they would wait for the patch, they would reverse
engineer it, and then they'd try and find targets.
Well, we're at a place now where the bad guy
has the same tools that the good guys have. they
can also scan the code base. They can also look
for stuff, right? And look for vulnerabilities.
And so you have this like massive narrowing of
this sort of time to exploit. And it's a real
problem. So given all of this background and
all of those things, I really, I kind of wanted
to, I guess, ask the question, right? If you're
responsible for patching your estate today, let's
say you're in the server team or you're in the
EUC team and you're responsible for patching
your endpoints. how confident are you that those
622 CVEs that were identified and patches were
released for last week, how confident are you
that all that stuff is patched and up to date
today, right? I would say to say that a lot of
folks are probably scratching their heads going,
I might want to go and check that or maybe I
should go run a report. And that's probably the
right answer because you want to be sure, right?
One of the things I found over time is that there's
a bit of confusion between sort of the concepts
of patch management and vulnerability management
and sort of where they sit within, I guess, the
maturity framework of an organization. And I
thought, you know what, it'd be a good idea to
kind of lay the foundation, talk about these
things and, you know, help folks, I guess, understand
where these things sort of sit and play and where
they all sort of fit together, right? And if
you're not looking at the show notes, I have
the... The classic meme of Spider -Man, two Spider
-Men pointing fingers at each other. Because
to me, that's often how this feels. It's like,
well, patch management points at vulnerability
management, who's pointing back at patch management,
right? So if we break it down just a little bit.
So vulnerability management really is that sort
of ongoing process where you're identifying and
assessing, prioritizing and remediating these
weaknesses, right? It's an ongoing sort of cyclical
thing where you're constantly looking at... scanning
your devices, looking for what vulnerabilities
exist, figuring out whether they are vulnerable
or is it a misconfiguration? Is it an actual
CVE? Are there vendor patches available? Things
like that. Then you want to sort of prioritize
those things and remediate them and sort of go
through this whole sort of process. And why this
matters is because As I said before, the time
to exploit keeps shrinking. We're getting to
this place now where it's a race between Microsoft
and the other vendors and the bad guys to get
to the export first because they no longer need
to wait for us or wait for the good guys to release
patches to be able to reverse engineer them.
They can just go and find the exports themselves.
Also, we have this challenge where... In some
cases, and in many cases, we can't patch everything,
right? This is a process and it's a process where
we have to look at what we have available. We
have to look at prioritizing the things that
need to be patched based on how critical they
are. to our business, not necessarily how critical
they are based on a CVSS score. So if you're
not familiar with the nomenclature, a CVE is
essentially the vulnerability database that lists
a critical vulnerability. And a CVSS score is
the severity of that vulnerability as a score.
I believe that score is out of 10. So anything
9 .8 and above usually is very bad. It's pretty
difficult to get a 9 .8. 9 .7, whatever the case
is, or 10 CVSS score. Now, oftentimes what happens
in organizations is, and I think we're just human,
right? We assume we find a list of 622 vulnerabilities,
go and find the ones that are the highest priority
based on their CVSS score and go and patch those
things. That's a good approach, but that doesn't
necessarily always ring true in all the environments,
right? Because you may have an environment, for
example, that is an OT environment. where you
run controllers and IoT type devices, that environment
may have concerning controls that actually help.
So for example, your OT environment may not have
internet access. So a CVSS score of 9 .8 in an
OT environment that doesn't have internet access
may not be as high a priority for you. as a CVS
score of seven or eight in an internet -facing
environment, right? So you kind of have to prioritize
these things based on what is relevant to you
and your environment and what other controls
exist. The other reason, I think the final point
of why this is important and why vulnerability
management is such an important thing for us
is it's about compliance and guaranteed if you
look at frameworks like CIS, Or if you're buying
cyber insurance, I'm sure pretty much everyone
is buying cyber insurance these days. And I don't
know if anyone has personally been responsible
for purchasing a cyber insurance program or policy.
I've been through that process a couple of times
now. The questionnaires that you fill in can
be kind of intimidating and almost certainly
they're always going to ask and they're going
to assume that you have some form of vulnerability
management process whereby you're managing. the
vulnerabilities and you have a process to update
things in a way. So an easy way to think about
this and the distinction between vulnerability
management and patch management is that vulnerability
management is that decision layer. How do we
figure out what's vulnerable, how bad it is,
and come up with some sort of determination as
to what are we going to fix first, what are we
going to fix second, what are we going to fix
third. That sort of decision layer, that's vulnerability
management. And typically in a large organization
or in a mature organization, that's a cyber function,
right? Patch management is the action of actually
patching things and remediating things. And we'll
talk about it in just a second where the remediation
doesn't have to be necessarily patch it, right?
Because patch it may not be an option. There
may not be a patch. It's that remediate action.
which is handed off. And typically that's something
where that gets handed off to an IT team or a
operational team, which is under IT, your server
team, your EUC team, et cetera, who actually
action that. So in essence, your patch management
is a component of a holistic vulnerability management
program that you have within your organization.
And you'll typically find, when I work with customers,
You can find this in various forms of maturity,
right? Smaller companies or companies that are
just sort of, they've just started or they've
just built their infrastructure, they're worried
about patching. Patching is the thing, right?
So that's where you start. Let's make sure we
can get everything patched. And as the company
sort of matures and their processes mature and
they potentially climb the ladder of compliance
and all of these other things, what you find
is that that matures into... going from that
very tactical let's find and patch things to
let's build out a like a framework for ourselves
whereby we have now we're stepping into this
vulnerability management arena where we have
this process right and I've sort of listed the
I guess what I see the the five steps of this
process to be and I've listed them sort of in
a linear fashion. But if you think about it,
it really should be more cyclical in a circle.
But you're discovering is your first phase. Discover,
I've called it. And what that is, it's asset
discovery and inventory. You can't secure something
if you don't know about it. So you have to actually
have some sort of inventory of all of the assets
in your estate. What service have you got? Where
do they live? What operating systems are on those
servers? what applications are on those servers,
right? Similarly with desktops and your client
fleet. How many Windows 10 devices have you got?
How many Windows 11 devices? What version? How
many Windows XP devices do you got? Yes, hopefully
none, but yes, that's exactly right. Server 2003?
Yeah, that's right. So no, but that's an exactly,
that's a very good point, right? Because again,
if you're a... a smaller business or a smaller
company and you've got 20 employees and all 20
of those employees have laptops that they bring
into the office every day, it's really easy to
walk around and go 1, 2, 3, 4, 5, 20. Okay, everyone's
got a Mac. When you start having 20 ,000 users,
it gets really difficult to keep track on stock.
And just a really random example of this is About
a year ago, I did a project with a very large
mining company here in Australia. And one of
the things we were doing was it was a separation
project where the mining company had sold off
a mine asset. So everything at a particular mine
was being sort of separated from the rest of
the network, right? So we also had to do a very
robust sort of asset discovery piece to figure
out which assets, you know, software, hardware,
everything else. belongs to that mine so that
we could separate that those assets um and we
thought we had done a really good job of figuring
out exactly what belonged where until the day
came where um or the week came where we were
starting to cut over workstations from one domain
to the next and people would turn up um you know
to the to the build room and they'd have like
three laptops and we're like you are you're you
know according to the asset list you only have
one laptop It was like, oh, these are my two
old ones. They were just in my drawer, right?
Or folks would go, you know, be off shift for
two weeks and the laptop would just sit in the
drawer and then they'd forget about it or whatever
the case may be. So that asset discovery piece
can be really difficult. It sounds simple, but
it can be really, really difficult to keep track
of assets, what you have, where they live, and
make sure that stuff gets updated, right? If
you get a new laptop, you need to make sure that
the laptop that was assigned to you before either
gets retired. or gets updated to the new person
who's going to get it, right? So that sort of
asset discovery, right? Really, really important.
Then the second part of this is assess. So you
want to look at actually assessing the vulnerabilities,
right? And this is kind of where you run scans
and stuff like that. And there are a bunch of
tools that you can use that will scan the environment
for assessments and it will query the CVE database
to look for vulnerable software and sort of give
you the reports around that. misconfigs, all
of those types of things just kind of shows up
in that sort of assessment phase. So then you
end up with a list. And if you've ever run a
vulnerability scanner in a large environment,
I'm sure you understand that you come up with
a list and it says, you know, you have 10 ,000
vulnerabilities, right? Because it will find
absolutely everything that is potentially deemed
to be vulnerable. And this is where the prioritized
phase, which is sort of phase three in this process,
becomes really important because this is where
you start looking at things and you go, okay.
Well, we've got 10 ,000 vulnerabilities. How
many of those are things that we need to worry
about today? And how many of those are things
that we can worry about next week? And you have
to sort of do that risk -based scoring to understand
how do we tackle this problem? Because we can't
just run after everything. We have to prioritize
things that are going to be really important
to us. And I talked about the example before
of... an OT environment perhaps where you have
compensating controls, that may actually mean
that the risk of that thing is lower than you
may think, right? Or what have you. Or you may
find that it's, you know, there's a CVSS of something
that's eight and it's a remote code execution
on a product that you have that's internet facing.
Well, that thing better shoot up to the top of
your list all of a sudden because you need to
get a hold of that thing and get it sorted and
updated pretty quickly. So that prioritization
seems simple, but... you need to really spend
the time to have the robust rules in place to
help you prioritize where you're going to spend
your time immediately. What stuff can you afford
to spend less time on or do later or what have
you, right? And that's where you sort of hand
that off into step four, which is that remediation.
Typically, the folks that run the vulnerability
management program are security and governance
folks. They're not the tactical people on the
ground who are going to go patch machines, crawl
under desks and find that one PostgreSQL server
that someone set up 10 years ago and it's been
running under a desk. So you hand this off to
your tech team to go and remediate. This is where
that sort of happens. And typically you want
to have this be a tracked request. An email that
says, hey you've got these risks, go fix them.
That's not really a good service management approach,
is it? You kind of want to have this be tracked
in some sort of request whereby the team has
this on their radar and they can go. And then
the remediation in itself can be one of three
things typically, right? You patch it. So in
most cases, if we're talking about the Microsoft
approach and Patch Tuesday, there's a patch for
it. So the patch already exists. So the easiest
thing is go patch it, right? Or you mitigate
it. So again... Maybe there isn't a patch or
maybe in order to patch that thing, you have
to reboot, you know, I don't know, a nuclear
turbine or something, right? Well, you can't
go just do that. There's got to be a little bit
of a process to it. You may be able to disable
a feature or maybe you isolate that thing on
the network or some sort of workaround until
such time that you can patch it. Or maybe you
just accept the risk, right? If you have to reboot
a controller that runs a turbine, And the downtime
of that turbine is going to cost the business
$10 ,000 a minute. Is it worth the downtime,
right, to fix the risk? Now, this is where risk
people and lots of smarter people than me come
into play to help sort of make that determination
as to whether we document the risk, accept it,
and move on, or whether we pull the trigger and
we patch it, right? But that's part of this vulnerability
management process that, as a business, you kind
of need to work through. And then the last part
of this is just reporting. It's great to say
something's been patched because we ran the executable
or we pushed the update in SCCM or Intune or
whatever, but you really need to be able to report
success on this. It has to be reported green.
Sometimes a reboot is required again or there's
some reason why the patch doesn't apply or land
or it requires something else or... whatever
the case may be. So, you know, you need to follow
the process through. And the only way you know
about that is by looking at sort of robust reporting
to understand that you've verified it, it's been
validated, and things are sort of as, you know,
as you intended. So I'm going to kind of leave
it there for now. I just wanted to really just
define, you know, patch management versus vulnerability
management, what these things are, and sort of
break down what, you know, vulnerability, typical
vulnerability management. process looks like.
And like I said, this is a constant sort of ongoing
thing within your business and it's really important
that if you are today still just patching and
you're just tactically running after patches,
I think the Americans would say whack -a -mole.
I don't know if you ever know what that is guys,
but you know the game where it pops out. That's
really what you're doing is you're playing whack
-a -mole, right? If you're just running after
patches. And even a small environment can be
really, really cumbersome to stay ahead when
you have that. And we're only talking about Microsoft
stuff here now. When you layer in third -party
software, right? Think about that. Like you've
got a large organization with third -party software.
Where are those packages coming from? Who updates
them? How do they get pushed out? How are they
deployed in the first place? it can get really,
really complicated. And I think probably what
I'll end up doing for next episode or at least
for another episode in future is I'll break down
a little bit more some of these phases and look
at some of the technology and maybe some technical
processes that you can use. Because the answer
isn't always go buy all of Defender because all
of Defender can do some of this stuff. There's
other ways that you can look at it. There's other
tools around as well that complement things that
you may have. And if you've got four users working
out of coffee shops all day, you're probably
not using SCCM, right? You might be using something
else. So I'll sort of dig into the technical
nuances of this, I think, in a future episode
to talk about some of the technical challenges
here. But I think for now, I really wanted to
just sort of share something that I've been thinking
about a lot, which is how do we, from a process
perspective, govern this? And how does this scale,
especially when we have... you know larger organizations
where we have lots of assets and lots of things
yeah and you're probably going into this in more
detail than in the next episode but uh when i
look at threat and vulnerability threat and vulnerability
management and defender It's a very powerful
reporting tool to give you insights in what your
organization is doing. We also, for our company,
we're frequently assessing those reports monthly
with our customers to zoom in on. But even if
you patch applications, a lot of applications
come with all kinds of packages inside or modules
inside which can contain vulnerabilities. And
I'm always amazed by... For example, we had a
customer last time where they were running thousands
of Firefox 1 .0 on their endpoints. And what
it appears to be, it was part of the installer
of some kind of Zebra printer they installed
in the logistics department, right? You have
a lot of vulnerabilities going on there while
you think you are fully patched, but some kind
of third -party supplier brought some malicious,
well, potentially abusable software into your
company. That's a really good example, too, because
my Mac that I use at Arenco is managed through
Defender, and we have our SecOps team that kind
of looks after that. And I get a report every
week, like a vulnerability report that they email
me. of things that need updating, right? It's
sort of like an internal workflow that we have
looking at all of our endpoints. And if you've
got stuff that needs updating, aka you haven't
been running your updates often enough, then
they will email alert you. And I received an
alert, an email telling me about some package
on the Mac. And I can't remember what it was,
but it was something I looked at and I was like,
no, I don't have that installed. This must just
be a mistake. So I deleted the email. And then
like the next week, I got the same thing. And
I was like, nah, and I deleted it. And then the
third week, I got the same thing. And eventually,
I pinged one of the guys, the SecOps guys on
Teams. I was like, hey, man, I'm getting this
email telling me about this package that I supposedly
have that's vulnerable. I don't know. I've never
used this thing in my life. I don't know. I don't
have it installed or anything. And we kind of
dug into it eventually. And actually, it was
Security Copilot that gave us the information.
It was a package that was installed as part of...
another installer. And so it's buried inside
the contents of another thing. So it doesn't
show up in my applications folder. It was buried
somewhere else. And that thing, even though the
main package wasn't vulnerable or was updated,
its reliance on this other thing meant that I
was still getting flagged. So yeah, it's a tough
problem to do, especially when you're at scale,
for sure. Yeah, and when you look at, I think
there are two examples that come to mind, Log4J
and SolarWinds. Those were very famous for actually
being able to be abused in the same way because
they were packaged with other software, actually.
Yeah, no, 100%. So, yeah, definitely, hopefully
this is on folks' mind. I think we are going
to have... continue to have an onslaught of updates
for not only for windows but for everything for
the next little while and you know if you listen
to um to steve gibson and security now i'm a
big fan so i listen to to that every week and
you know steve has this theory about for the
next six or seven months we're probably going
to see very very high numbers of updates and
patching and stuff because of ai but eventually
we're going to find that ai is going to catch
all of the all of the vulnerable software right
And so things will taper way down again and we'll
be good and closer to a place where software
is perfect because AI is starting to write so
much of our code and it's also finding all the
vulnerabilities, right? But at least for the
next little while, I think until the end of the
year or so, we're going to be seeing lots of
patches coming thick and fast. And we really
need to make sure that we're in a place where
we can actually get these things deployed out
to our endpoints in our state. very, very quickly.
Yeah. Yeah, I saw some recent announcements on
MDash recently as well. It might be a fun topic
to perhaps combine in our next episode to see
what Microsoft is doing to bring AI to the table
to be more secure on your patch and vulnerability
management. Yeah, absolutely. No, I think so.
I think so. Won't be the first time or the last
time that we talk about this for sure. Yeah.
So you brought a very fun community project this
month, Chris. Yeah, I think this one's a little
bit of fun this month. So we're not looking at
someone's application or GitHub project this
month. I've been talking to my friend Micah a
fair bit over the last few weeks or a few months.
If you don't know Micah, he's a security MVP
based, he lives in Seattle, so based out of Seattle,
out of the US. And one of the great things about
Micah is Micah is always building stuff. There's
not a time that I bump into Micah or see Micah
where he doesn't show me something cool and something
awesome. He's always building stuff. His imagination
is insane. But anyway, he's been working on this
little... security, it's like a Microsoft security
related quiz game called Who Wants to be a SISO?
And it's sort of, he hasn't really announced
it yet, but he shared it with myself, with me
and Nick, Nick Blank, a week or so ago. And I
did speak to him this morning. He was happy for
me to share this, you know, on the recording.
But essentially, I think he built it for... If
you're running a booth or something at a conference
and you have a very large screen, you know, you
can sort of get people to be interactive with
what you're doing. But I think this works really
well as, you know, like a fun version of Kahoot.
I know lots of folks do the Kahoot quizzes as
an icebreaker or something where, you know, if
you're doing a meetup talk or something, we have
a big screen and folks are, you know, so you
have the ability to start this up on a big screen
and then players can join. you know, with their
phone or whatever and sort of answer the quiz
questions and stuff. It's so well done. It is
incredibly well done. A lot of fun. And because
it's Microsoft and topical and sort of built
by someone in the community, I thought it'd be
really cool, cool one to share. So I've got a
link on it. You know, who wants to be a Sizer
.com. I think it's .com anyway. Yeah. Let me
click the link. Yes. Who wants to be a Sizer
.com. You can play it by yourself too. So if
you just, there's a sort of solo player mode,
if you want to just play it by yourself. But,
yeah, a really fun thing. Just, you know, think
about it for your next meetup or whatever. The
next time you have a large meeting and you want
to just, you know, break the ice or whatever,
it's a really fun one. It looks really professional
as well. Oh, yeah. No, he's put a lot of time
into it. It's pretty awesome. Yeah, it's a lot
of vibe coding, but also AI -generated graphics,
I assume. But it looks really cool. Yeah, we
had Micah talk to us on the Cloud Architects
podcast a few weeks ago. And we had an episode
about vibe coding specifically. And we talked
about some of the tool sets and the things that
he platforms that he uses and stuff. And I think
this was one of the things that came out of that.
So really, really fun. I've linked Micah's LinkedIn
as well. He's one of those cool guys in the community
that he's always open to being, you know. folks
to reach out to and connect with so you know
if you if you like what he's done say hi to him
and and uh yeah that's um that was what i wanted
to share for for this this week's community project
um i will say on the topic of on the topic of
community projects i have been working on connect
365 i know we talked about it a few episodes
ago um i've been working on it really really
pleased with sort of what um where it's going
in the direction that we're going so i'm hoping
by next I'm trying to keep myself accountable
here. So hopefully by next episode, next month,
I will be able to share more about the next gen
Connect 365 and where we go with that. Very cool.
And I think it's fun to have a community project
for a change, which isn't used on our day -to
-day basis or highly technical. It's a fun showcase
of what AI is bringing us and some positive things
as well. And let's link the Cloud Architects
episode with Micah talking about this as well
in the show notes. Yeah, good call. Good call.
We'll do that. That episode is live, so we can
link that one for sure. Cool. So then I guess
it's time to wrap up again, Chris, don't you
think? Yeah, time flies when you're having fun,
doesn't it? It is. Well, it's 9 a .m. in the
morning, so I'm about to start my workday, and
I think you're rounding it off there in Brisbane.
Rounding it off in Brisbane. I think I've got
a few emails and Teams messages to reply to,
but it won't be long now before I go grab some
dinner and settle in. Yeah, always good to see
you, as I said before, it's my favorite part
of the month. So thank you for making the time
and thank you folks for listening. Obviously,
as I said, please, if you have any questions
or comments or anything like that, please find
us on the socials. We are pretty much, LinkedIn
is probably the best one, but grab us on LinkedIn
or GitHub or anywhere else. Or leave a reply
on your podcast platform, Spotify, Apple Podcasts,
whatever you're using, we'll pick it up from
there as well. Yeah, yeah. very much so so yeah
we're always interested in any sort of comments
or suggestions or anything like that if not um
coast we'll see you uh see you again uh you know
next month and um thank you folks for listening
thanks everybody for listening have a great day
bye