Welcome to the Azure Security Podcast, where
we discuss topics relating to security, privacy,
reliability, and compliance on the Microsoft
Cloud Platform. Hey, everybody. Welcome to Episode
110. This week is myself, Michael, and I'm here
with Gladys, and our guest is Sharon, who's here
to talk to us about... Securing Gen AI Apps with
Antro. This is number three of four. So if you
haven't seen or listened to the other two, I
would probably urge you. They are kind of independent
of each other, but it's worthwhile looking at
episodes one and two. But before we get to our
guest, let's take a little lap around the news.
Gladys, why don't you kick things off? Okay,
so I only have two news articles that I'm going
to talk about. The first one is regarding...
Defender for Endpoint in Azure Government. As
some of you may know, we are deprecating Log
Analytics Agent, or MMA, if you see that acronym
around, in Azure. So in order to enable capabilities
with file integrity, a new file integrity monitoring,
or FIM, has been developed and now is general
availability in Azure Government. So just make
sure that you are able to migrate this configuration
because soon that functionality will stop working.
But basically, it allows you to meet compliance
requirements by monitoring critical files and
registering in real time and auditing the changes.
It also helps you identify potential securities
issues by detecting suspicious files, file content
changes, and things like that. The next news
that I wanted to talk about, which I think is
very relevant to this talk today, so I'm not
going to talk a lot about it, is about Microsoft
Graph. Microsoft Graph is one of the most important
aspect that enables AI. And in order to secure
access that is being done through the Microsoft
Graph, there's several permissions that have
been developed and more extensions are being
enabled. So there's more extensions that have
been released lately. There's an article that
I'm putting as part of the website. And hopefully
we talk a little bit more during our talk in
the next few minutes. I have a couple of items.
Actually, I have more than a couple. I have like
five or six items. So the first one is we've
now... added a thing called API Security Posture
Management. As you probably know, most cloud
-based applications use REST endpoints of some
kind. And what this new capability allows is
things like identifying APIs that are exposed
to the internet, automatically discovering sensitive
information that may be traveling through those
endpoints. There's all sorts of other things
that it does as well. So well worth looking into
that if you're using REST endpoints, which odds
are good you are. Next item is the general availability
of FEP 140 Level 3 HSM's premium key vault is
now available in China. This is good to see.
It's good to see, you know, very robust ways
of storing credentials and secrets and keys.
Next one, which has got nothing to do with securing
or storing credentials at all, which is the way
you should go, which is Fabric Data Warehouse
now supports service principles. huge fan of
using things like service principles and managed
identities rather than storing a credential somewhere.
So this is always good to see. Next one, which
actually has nothing to do with security whatsoever,
but the only reason I'm really talking about
this because A, it's important, and B, it's my
old stomping ground, which is Azure Data. So
Azure Data Studio is being retired. The actual
retirement will be, I believe, like February
28th, 2026, so next year. And what we're recommending
people do is go to use Visual Studio Code with
the appropriate MS SQL extension. If you kind
of look at it, I don't know if you guys know
or not, but essentially they're a very, very
similar tool. They're written using Electron,
both tools are. And the code bases, you know,
it's kind of similar in some way. They kind of
look the same and feel the same. It didn't really
make sense having two bits of code that were
kind of the same. So anyway, that's what we're
going to do. So as your data studio is being
retired and you should be moving over to using
VS Code with the MS SQL extension and frankly,
all the other extensions that you would normally
have as well. A good friend of the podcast, Meryl
Fernando, has a couple of posts up on X talking
about Microsoft Graph permissions as well as...
Talking about some ways of detecting device code
flow. So the first one on Microsoft Graph, there's
a new least privilege permission that's been
added. Historically, if you wanted to see if
somebody had their account enabled or disabled,
you would probably have to grant something like
readwrite .all, which is... A lot more than just
asking to determine if an account is enabled
or not. So the Microsoft Graph folks have actually
added a new grant called Enable Disable Account.
And just grant an account or a principal that
particular permission and off you go. So you're
really restricting what the user can actually
access. And then the last one, the ability to
block device code flow. And this is available
now in Microsoft Entry ID Conditional Access.
device code flow just simply should just not
be used. It's an incredibly insecure OAuth 2
flow and you just shouldn't use it. And so now
you can block it, which is really, really cool.
All right. So now we've got the news out of the
way, let's turn our attention to our guest. This
week, as I mentioned, it's Sharon, and she's
here to talk to us about securing Gen A apps
with Entra. Again, this is part three of a four
-part series, and the focus in this particular
chat is about monitoring and governance. So Sharon,
welcome to the podcast. Would you like to take
a moment and introduce yourself to our listeners?
Yeah, thanks, Michael. Yeah, my name is Sharon
Chahal. I'm a principal product manager within
our customer experience engineering team within
ID &A. I have the pleasure of leading our efforts
within Security Copilot and Entra. Identity protection.
So identity protection is the risk -based policies,
conditional access policies, and looking at all
up in securing AI as well. So it's particularly
initiatives of helping our organizations out
there to protect their assets, protect their
identities, and sort of really protect their
devices when they start exploring the world of
Gen I. So this is all about monitoring. So can
you sort of explain what that means and also
kind of how it relates, if it does, to governance?
Absolutely. So when we're monitoring access for
securing a guy, it's ensuring that only authorized
users and systems can interact with AI resources.
So, you know, in cases, AI systems may handle
sensitive data and make critical decisions. So
controlling who can access these systems, preventing
misuse or data breaches, or if you think about
malicious manipulation. By continuously tracking
access patterns and behaviors, you can identify
or organizations can identify potential threats.
or suspicious activities such as that unauthorized
attempt to influence an ai decision making or
gain access to confidential information so when
we really think about it it's the level of monitoring
that provides a proactive defense ensuring the
integrity along with the security of both AI
and its surrounding infrastructure as well. So
it's really crucial to ensure the reliability
of those particular governance requirements and
being able to monitor them to prevent the vulnerabilities
from being exploited and also ensuring the integrity
of AI -driven processes and data. So recently
I was working on an attack chain that I was drawing
regarding how Malicious actors may use AI. And
I realized that with AI, of course, the original
exposure may be like the normal one, emails,
endpoint, networks, so forth. But at the end,
where they meet is identity, applications, and
data. how do we control these let's start maybe
like access review can you talk a little bit
about that So one of the key things that we think
about, and you brought this up around, is around
access permissions, right? So access permissions
is really identified as a security risk. So say,
for example, you have an employee with overly
broad access that modifies, for example, an AI
module or some data they're not meant to get
access to. It could be confidential, like financial
data. So it's really exposing it to unauthorized
users. So when we look at Entry ID and helping
how to sort of monitor and mitigate that, we
have, you know, RBAC, which is role -based access
control and least privilege. So that's restricting
the AI module access to necessary roles that
do actually need access. And then we talk about
access reviews. Access reviews is really down
to regular auditing and removing unnecessary
permissions. So say if someone in the organization
had left. You have a process where we've spoken,
I've spoken to multiple organizations where they
automatically trigger perhaps a... a flow to
a manager to say, hey, this person is no longer
an organization. Can you validate that? It'll
be either click or a yes or a no. That's kind
of a one -step prong that you can take into to
be able to ensure that the necessary or unnecessary
permissions, so we say in this context, are actually
removed from that user as well. And it could
be also a case of, hey, there's been a project
that a particular person could have been working
on and now that project is finished. Do they
still continue? Do they need access to that data
know okay what we need to do have that access
review do those regulative audits and what we
found is that with organizations who adopt that
they've managed to really reduce their attack
service and remove the the privilege kind of
the privilege misuse when it comes down to the
access permission side of things so talking about
access reviews what kind of core tools would
you use in order to manage those That's a great
question, Gladys. This is definitely a question
I get asked every day. Well, I'd say partially
when I go and meet my customers is that, you
know, when we look at the core tools that's available
in Entra today, we have sort of conditional access
policies, applying MFA using risk -based access.
Then we also think about PIM using that's privileged
identity management. just -in -time as well,
just access to securing, for example, a service
account. Looking at sort of the audit logging
and sign -in logs, we have those available in
Entra as well. A lot of sort of when we look
at the anomaly detection, so we also monitor
the access and behavior of accounts that could
be classed as risky as well. So we have a plethora
of products that are available to be able to
help just time to cater and help organizations
to be able to reduce the attack surface. All
right, let's start at the very top then. Okay,
so we've got access reviews, RBAC, audit logs,
monitoring, and conditional access. So why don't
we start at the very, very top. Do you want to
give us a brief overview of each of these? So
let's start with access reviews. access reviews.
We have this capability available already in
Entra and obviously through Microsoft Identity
Governance for those who are familiar with it.
You can set up, so say for example, be part of
a joiner, mover, leaver process, also referred
to as a JML process. is putting in automated
sort of workflows for those, for people who are
actually coming on board. So you're doing account
provisioning, you could do that. You can trigger
that in a template and add them to a particular
group. So say if they are engaging, for example,
on an AI project, you'd have a dedicated security
group, which you can compass within a workflow.
And as soon as someone joins, they will go through.
It's just a click of a button. Everything will
be sort of the access that the need will be designated
through that workflow. Similar case for deprovisioning
as well. We know that can be a bit of a hurdle
for organizations. Coming in, setting up those
workflows and templates, putting in that as soon
as a person leaves or an account is blocked,
a workflow is then triggered and all of the sort
of the higher privilege access and the access
that they have to sort of organizational artifacts
and materials, their systems are completely blocked.
So it's kind of a one way of what you can do
around access. Okay, so let's talk a little bit
about RBAC. What would you do in order to protect
the data and applications? It's a really good
question, Gladys. When we think of RBAC, we know
we're kind of aligning to least privilege, right?
So in terms of figuring out who your admins are,
so, you know, an independent, you'd have a couple
of your global admins, then you'd have sort of
your application admins, and then you'd have
your security admins. So these are roles that
we fundamentally have built in today within Entra,
which you can also see in the Azure portal as
well. By really restricting access to, you know,
as those who require it, the least privileged
kind of side of the business, you're able to
really provide, prevent sort of privilege creep.
So here you're really ensuring that compliance
with policies that you may have already defined
within your organization are being met. So by
allowing, and you could time gate it as well.
So by saying, look, I'm a developer. I need access
to this resource by, for example, navigating
to go to a PIM portal or you could apply it for
a security group. You're then applying the correct
permission for that developer. So you're not
providing an overprivilege. on their account
so they can run amok, so to speak. You're making
sure that you are specifically using those RBAC
roles to protect your overall environment. So
what tools would you use to monitor that? So
as I said, you can have that. So they are inbuilt
in Entra today. You can navigate into the portal.
Typically what we see is a lot of organizations,
they create security groups. By going into the
Entra portal, you can use it. You can create
a cloud security group, or if in some cases organizations
are in a hybrid mode, you can also sync your
groups that you may have on -prem over to the
cloud. It could be through Entra Connect or Entra
Cloud Sync. And then using those particular groups
and targeting it in the in -built roles that
we have in Entra today. So it is initially applying
it through there. We don't really see sort of
scenarios where you would do it individually.
So say, for example, Sharon needs access to this.
I'm actually going to apply just the user administrator
role to her account. It's more, hey, Sharon needs
access. as a user administrator in this portal,
or even this particular piece where she might
be working on a project, we're just going to
add her to that security group. So that would
be really consequential of what you would do
in the portal today. So when you're using PIM,
Privileged Identity Management, I can time gate
that as well, right? So Sharon has access for
the next 60 minutes. Yes, you can absolutely
do that. Yeah, you can go in, you can customize
it. So, hey, Sharon's just going to get 60 minutes
of this because that's all she needs in order
to complete her task within her particular role
in this particular project. And then that access
is completely removed. Okay. And I really want
to stress just how important lease privilege
is. When I look at, you know, attacks against
Azure, like what people are trying to do, one
of the biggest weaknesses that we see, you know,
people make is they run applications with much
higher privilege than is needed. And if that
application is compromised, you know, the attacker
is now running with those, you know, elevated
capabilities. So I really want to stress just
how critically important lease privilege is.
And it's certainly a big focus that we have on
Secure Future Initiative. So just sort of piggybacking
on what Gladys said. So what kind of audit logs
are produced and, you know, how can they be consumed?
Good question there. So within Entry ID, we have
the sign -in logs. We also have the audit logs.
You're like, hey, Sharon, what's the difference,
right? So the activity logs for the audit logs
is really around sign -in, is around information
about sign -ins and how your resources are actually
used by your users within your organization.
They could also be around provisioning, you know,
activities that is performed within a provisioning
service. Like a really good example is a creation
of a group in ServiceNow. If you create that,
you're also monitoring that as well. We've been
able to add even more. It could be the case of
what groups have been recently added, what applications
were recently added. I think this seems to be
a bit of a pain point for our customers is really
to be able to determine and like, hey, okay,
we have a ton of applications. How are we able
to monitor this? You have this in audit logs
today. Those activity logs, they seem to be that
central point that people are navigating to.
And the way they're actually extracting that,
it could be to a SIEM tool. That's kind of sort
of the heavy usage, especially for SOC teams
who need to investigate incidents. So if it could
be like Sentinel, we know we have Microsoft Sentinel.
There's a connector there. You can connect that,
the audit log, straight to an Azure log workspace.
And from the Azure log workspace, you can connect
that to Sentinel. So all of that information
is being correlated in one area for a deep investigation
that a SOC analyst may need to do. Auditing logs
help out a lot with security, but a lot of people
kind of forget that it helps also in planning
because if you have incorrect configuration,
you could see it in there. But I love more things
that can be done in almost real time. So can
you talk about conditional access as a method
of protecting in almost real time? Absolutely,
Gladys. And this kind of brings me to a great
point. So one of the areas that we've been kind
of working around in conditional access is really
to protect AI. So, you know, it could be when
we say protect AI, we're talking about sort of
gen AI apps. In this scenario, we could use like
Microsoft Security Copilot or Microsoft 365 Copilot,
which are now, you know, organizations are adopting
these and protecting those services. from misuse.
can be accomplished. Let's say, for example,
if you already have conditional access policies,
which you would set up through the Entra portal
as well, you can apply those policies to those
specific Gen AI services, and then that will
target all of your resources. So that goes down
to all of your users. We have risky users, which
is part of conditional access policies when we
think of risk -based users. You can and users
with insider risk as well. And so what we found
is through conditional access policies. Target
your application, right? One of the big things
that we've definitely been speaking to across
the board is complete vision -resistant MFA,
right? When we think about it, vision -resistant
MFA from pass keys to Windows Hello for Business
or even a point of using a FIDO2 key, for example,
that's a really good way to be able to secure
who's logging in. So really that's the authentication
piece. And once you pass that authentication
piece, it's an authorization, right? So you can
apply compliant devices. So with conjunction
with Intune, if you're using Intune, you use
device policies as well. So being able to put
that into action, and I'm going to hamper on
that phishing -resistant MFA, I think it's because
we have that internally at Microsoft today, is
really securing it through conditional access
policies. Hey, this may sound like a really stupid
question, but can we block someone completely
if they're not using phishing -resistant MFA?
Great question, Michael. Yes, you can. You can
set a conditional access policy. So for example,
you can target specifically to admins. It'll
be like, hey, you need to use at least phishing
-resistant MFA, like a FIDO2 key, right? So let's
talk about FIDO2 key. If this person doesn't
have it, you know what? you can't have access
to this resource. But I do want to emphasize
that you have to be careful when you put in these
conditional access policies in because you can
select all of your users to put in that group.
But also thinking about the group, the set of
groups that you may not want to include. For
example, you could have organizational emergency
access or break glass accounts as well. So with
conditional access policy, it's really good to
kind of list out who are your sort of high targeted
users and then think about other accounts that
particularly may not need that um especially
if you're gonna they break glass accounts always
tend to be the top ones yeah i really want to
stress something that's just so important here
and that is people say oh you know i'm just going
to receive multi -factor authentication on my
phone using an sms message that's broken it is
completely broken if you're a high enough profile
target someone can easily be bribed. Look, I'm
making up an example scenario, but we've seen
it. If you're a high enough value target where
someone can actually clone your SIM card or have
someone, I hate to say it, but perhaps someone
who has insider knowledge, and I'll just leave
it at that, and be able to clone your SIM. And
at that point, someone else is responding to
your SMS messages. It is actually a real attack.
People think, oh, it's all James Bond stuff.
It's not. Your nine -year -old child may not
be a target, but an executive or someone with,
major access to the environment may very well
be a target. So the world just needs to move
away from these non -phishing resistant credentials
and this non -phishing resistant MFA. Certainly
for your high value targets, most organizations
will have them. So, you know, it's not James
Bond, it's real. So you touched on integration
with a seam like Sentinel, but you also mentioned
co -pilot, security co -pilot. Do you want to
sort of elaborate on what you mentioned? Oh,
love it. I think for now this is one of my favourite
subjects. So for those who aren't familiar, Microsoft
Security Co -Pilot, we went GA with the product
of 1st of April of last year. No joke. We are
coming up to a year of the product being in GA.
So Microsoft Security Co -Pilot is a Gen AI powered
security solution. And it's really targeted to
security and IT professionals to respond to cyber.
threats, process signals, assess risk exposure,
sort of machine speed and scale. So you can use
it as proactively as you can to be able to really
get a hold of some of the attacks that could
potentially come in. And along with that, it's
natural language. So Copilot there is really
as an assistive experience to help SOC analysts.
But I want to expand this because we're We have
multiple integrations with our first party at
Microsoft. That's obviously Entra being one of
them, but Intune, Defender, we have Azure WAF.
There's so many products I could lose count,
but we've seen that integration grow in. And
it really is, when you'll hear me, there's kind
of two differentials. Like we have the immersive,
which is the standalone experience. And then
we have the embedded experience, which is really
the experience that you can have within the portal
so say for example today that would be in the
entry portal as well do you want to give me an
example of what a query might look like Okay,
so say if I'm in, it could be either, right?
So I really get to say could in either. Say if
a SOC analyst wants to go in, or it could be
an identity analyst, it could be an identity
admin, and they want to know, like, who are the
high -risk users? So you can go directly into
the experience, type it in, literally as you
would, and I would really recommend be as verbose
as you want. Say it's a one -on -one conversation
that I'm having with either Gladys or Michael.
I want to be as descriptive as possible. So if
I go in, pop in, say, I would like to know the
top five risky users identified as high risk
within my tenant, and I'm a big table person,
I'll ask for it to be converted into a table.
What security co -pilot will do, it will reason
over, like, okay, what is Sharon asking me? Now
I need to differentiate. Let me pull that, and
then we're going to see which. where a plug -in
that is okay that's the entra plug -in it will
then go to the orchestrator figure out exactly
what needs to do and i do want to emphasize that
we do have responsible ai uh catering around
that before you actually get a full response
and then it will bring back a response to me
and say these are all your five top users and
hopefully there aren't five, there may be three.
That's the big hope. But you'll get that list
and you can basically share that information
as well. So within Copilot today, within the
actual standalone experience or the immersive
experience, you have workspaces. So you can actually
share that with another analyst if there is actually
like an investigation that's going like, hey,
look, I've actually found this. Let me share
this with you. Or if you want to export that
information. can also export that information
as well. If there's some analysts that are working
together and one analyst has access to some data,
but the other doesn't, how do they share across?
Can the second analyst have access to that information?
So in Security Copilot today, we're actually
using the RBAC model. So say if Analyst A is
an identity admin and they have access to just
the Entra portal and they don't have access,
say, for example, to Intune and they need to
share information, you can actually do that through
workspaces. So if there's a workspace, you're
like, okay, I need to give, I'd say, for example,
I'm running an investigation as an admin. Michael
goes, I need to share that information. with
Michael. I can go through the workspace. I can
put his access on top of that and say, hey, there
you go, Michael. Here's the information that
I found in this particular incident, which I
feel would be pertinent for you when you're investigating
which device that you're looking at as well.
This was a huge ask. I just want to kind of emphasize
a huge ask from our customers to be able to share
workspaces and to also be complicit with the
RBAC models that they're actually using within
their organizations. And that's all audited,
right? That is correct. Yes, 100 % is all. Yeah,
that's incredibly important when it comes to
sharing stuff. Cool. So Sharon, let's bring it
all together. How would you put this with an
example? What exactly are we trying to protect
and what tools or capabilities we're using through
that protection? I love that, Gladys. So when
we think about scenarios, you know, there's so
many out there right now. If we, you know, if
you peep your head into... cybersecurity news
that's out there. We've had, there's companies
that are getting breaches. I think as those,
we were just talking about this today, actually,
in one of our team meetings, how, you know, there's
health professionals that are particularly, you
know, they'll be using chat GTP, sharing sensitive
information. There could also be scenarios where
people are using sort of the external tools,
could be IP, sort of intellectual protection.
the details that they're sharing in chat DTP
as well. So when we kind of think about AI systems
and how to protect it from an identity or even
devices and looking at security frameworks is
with monitoring, you're continuously tracking
AI interactions, right? That's user access and
system behavior to identify anomalies, preventing
security breaches and enforcing policies. And
the governance piece is really establishing security
frameworks. So that's where we talked about role
-based access controls, compliance rules, and
data protection policies to ensure that AI operates
securely. massive emphasis on ethical right that's
always a like hey am i sure that the information
that i'm actually getting from ai is accurate
as well um so when we think about entra and what
it does is to kind of put it all together enter
provides that robust identity governance framework
from least privileged access to automated account
life cycle management doing granular role assignments.
And if we think about Azure, that stands for
management groups, subscriptions, and resource
groups, and even looking at sort of resource
levels. So that's really ensuring that precise
access control. You can block apps. You can go
in and say, actually, do you know what? I don't
want... anybody at this organization to be accessing
chat tdp to you know to be taking that information
that's internal that's under nda we shouldn't
be putting that into external tools as well um
really with access reviews we've touched on it
integrated that we have today is integrated with
ml driven insight so it's continuously evaluating
and optimizing permissions for AI applications.
So reducing privilege creep and mitigating those
security risks as well. So really, if we were
to think about it, monitoring all of this and
monitoring the capabilities of creating applications.
organizations, you know, can achieve that sort
of zero trust element of identity management.
So reducing the attack surface and the AI workloads
protection that you can have with Entra ID. Yeah,
there's a couple things I want to add here. First
of all, I actually know quite a few companies
who have actually blocked access to chat GPT
and other tools of that ilk as well because they're
public and you don't want to start, you know.
start, hey, we're about to acquire a company,
please give me some, you know, some wording to
use in the cover letter, right? And now all of
a sudden you've disclosed potentially to somebody
that, you know, you're about to purchase a company.
So, yeah, so I know a lot of companies that have
actually blocked access to, you know, large language
model tools like ChatGPT and so on, and rather
use tools like, you know, Azure AI, you know,
using... their own subscription. That way the
data stays within their own environment and is
not used for any other purpose. The other thing
I really want to point out is there's multiple
ways of... mitigating you know these sort of
defense these sort of issues and a really interesting
way of kind of looking at it is you kind of have
preventative controls and then detective controls
and responsive controls and so for the detective
control so preventative controls which your first
one is just like our back right just blocking
someone from doing something preventing access
to chat GPT and other tools, right? So they are
all preventative controls. And least privilege
is another example of that. And then you have
detective controls, which is your monitoring,
your logging, your auditing, your copilot going
into query for certain things, all that sort
of stuff. And then finally, you have responsive
controls where you respond to something happening.
So it's always, I think, very useful to think
about what sort of controls are at your disposal
in those sort of two or three, I should say,
major buckets. I want to add something else,
Michael, to what you just said. Even governance,
right? Data governance. You have all the sensitive
labels, whether it's confidential or public data,
which adds encryption to the data itself. Your
DLP type of policies. And we're going to talk
more about these during the governance session.
But this is important because now an attacker
can basically, if they get an identity, they
could impersonate this person and just query
to AI. So now you are asking information to the
AI. This attacker may be asking information to
the AI and acquiring that information without
actually having to do things like reconnaissance
in the environment. So it is important, all this
monitoring to be in place, and it's important
for all the data protections. And we talk about
our bioconditional access to be in place. Yeah,
exactly. They do different things. They're all
incredibly important. But you do need to sort
of have mitigations or technology in each of
those buckets as well, right? You can't just
rely on monitoring. Well, you can, but you better
hope that, you know. you know you're catching
the right things but yeah you got to have the
you know the sort of the preventative controls
as well as the detective controls as well do
you want to add anything else there sharon or
are we just are we done with that topic no i
think um i think we're done i think we're done
with that actually do you know no there is there
is one thing right so i think what you've added
on in terms of everything, all the actions. And
I love the emphasis on proactive, right? So we
find in many cases where it might be too late.
You already know an organization's already been
sort of breached. There could be an attack. The
information could already be shared with some
of these shadow sort of IT elements of using
external tools. So I really want to emphasize
on that. just making sure that you have the right
insights. And along with that, with these tool
sets, being able to reduce that manual investigation
effort. So the key thing here is that speeding
up that response, you know, and getting real
-time efforts as well, especially during around
application threats that the AI can introduce
within an environment. So Sharon, how... does
a typical day in Sharon's life look like? And
I mean, in Microsoft work life. Ah, Gladys, it's
hectic. If I was to use one word, it's hectic.
But at the same time, it's also very exciting.
The one thing I could guarantee is that I am
learning something new every day. I really enjoy
what I do in terms of the team that I'm in. I
interact with organizations every day. I'm having
a conversation, especially around, obviously,
the security co -pilot pieces and along with
Entra. And also, you know, I get to work and
collaborate very closely with our engineering
teams. It's super important for us to listen
to our customers, especially when we're trying
to support their adoption within their environments
as well. You know, while I do that, I also have
the pleasure of managing eight people as well.
Wonderful people, might I add. So it definitely
adds a variety to my day to be able to help them
and coach them and guide them so that's definitely
an element that i enjoy doing as part of my role
you know it's interesting you know we've had
people on the on the podcast before we've asked
them the same question about you know what does
a typical day look like and even though we ask
people what does a typical day look like it's
funny how many people say they just love what
they do i think that's something i'm sure a lot
of companies are the same but you know i've been
here now for nearly 33 years and You know, you
get to work with some really smart people. You
think you're the smartest person in the room
and 99 times out of 100, you're not. There's
a lot of really clever people you can talk to
who are very insightful, you know, not just smart,
but also making a huge difference. And yeah,
it's great to be able to work with people like
that on a daily basis. All right. So one thing
we always ask our guests is if you had one final
thought to leave our listeners with, what would
it be? So I think in terms of, you know, when
we think of Gen AI, it's rapid, right? There's
always a new module that's coming out. I open
up my news app or I can open up LinkedIn and
it's like, well, OK, I'm oversaturated with so
much information. And it's a stark reminder that
when we think about how we can protect ourselves,
our organizations and even our families. Right.
So because people could download apps on their
phone is. We think about how it's crucial to
make sure that AI is operating safely. Real focus
on ethical as well. And also, you know, when
we talk about organization, there's alignment
with organization and even regulatory standards
as well. Continuous oversight, transparency,
adaptability are really key to mitigate risks
like bias, security threats, and even thinking
about model drifts as well. So if we think about
integrating the real -time monitoring, think
about your access controls, think about clear
accountability structures and how you can train
or how you can maintain trust and reliability
in AI systems as well. And, you know, one thought
is that how do we keep up with the trends of
emerging threats? Listen to podcasts. The Azure
podcast is one. There's so many out there. It
can be a struggle to keep up to date, but I think
that's where you can use the power of Gen AI.
Go in and say, hey, give me the top 10 news articles
that I need to be looking at when it comes to
threats to Gen AI and be as descriptive as possible.
Yeah, you've got to stay on top of things, right?
I mean, again, as I mentioned before, I've been
at Microsoft for a long time, yet I am still
learning every single day and actually make it
a priority of mine as well. But that's a discussion
for another day. All right, well, Sharon, thank
you so much for joining us this week. I know
you're very busy, so I always appreciate anyone
taking the time to come on the podcast. And as
usual, I always learn something. I know Gladys
probably learned a thing or two, even though
she knows a lot more about this stuff than I
do. And to all our listeners out there, we hope
you found this episode useful. Stay safe, and
we'll see you next time. You can find show notes
and other resources at our website, azsecuritypodcast
.net. If you have any questions, please find
us on Twitter at AzureSecPod. Background music
is from ccmixter .com and licensed under the
Creative Commons license.