Welcome to the Azure Security Podcast, where
we discuss topics relating to security, privacy,
reliability, and compliance on the Microsoft
Cloud Platform. Hey everybody, welcome to episode
117. This week is myself, Michael, with Sarah.
Everyone else is busy. And our guest this week
is Russ Rogers, who's here to talk to us about
a topic we have never discussed, which is gaming
security. But before we get to our guest, let's
take a little lap around the news. By the way,
we have a lot of news this week. Sarah, so why
don't you kick things off? lots of AKS stuff.
So let's run through it. So Azure Bastion will
now connect to a private AKS cluster. So if you
need to do that, it's a nice way of connecting
securely. I would call it a jump box, but it's
all managed by Microsoft if you haven't used
Azure Bastion. Confidential VMs for Ubuntu 24
.04 are now also available in AKS. So if you
want to use a confidential compute, you can do
that with your Ubuntu. We've also got deployment
safeguards and now GA and AKS. So they are helping
enforce particular configurations, which get
rid of potential security issues and non -compliant
things. You can do them in warning or you can
do enforcement. So again, some nice safeguards
to reduce bugs and misconfigurations. And we
know that can be... Bad for your security. Also,
we've got application gateways for containers,
which is one which is now in public preview.
Now, we've talked about WAF before. You should,
if you're running a web application in your containers,
you should be using a web application firewall.
So go do the thing. And obviously the thing at
the moment, we've got in public preview the AKS
MCP server. So that means that you can use the
AKS MCP server to advertise your cluster as a
tool. So go and do that if you are wanting to
have your LLMs access AKS. But as we talked about
a few episodes ago, obviously there are security
considerations to take into account. So definitely
have a think before you do that. AKS has now
got a security dashboard, which is super exciting.
That means that you can actually have a look
at your security posture across your whole cluster,
which is nice for visibility. And then last but
not least, for all the product things, we have
the app service is now supporting inbound IP
version 6 support. So eventually everyone's going
to have to do IP version 6. So get ahead of things
and go have a look at that. So I'll take a breath
for a second. And that is all our product stuff.
But also, we've mentioned this before, we've
been releasing our developer security questions
that we recorded at Build a few months ago. And
there's a couple we put in the show notes to
highlight. We did keys or tokens, and we asked
everyone what they would prefer to use. And they've
got a lot of views so far. And also, what's your
worst security coding mistake? And what's the
best advice you received as about coding securely.
Now, that's my personal favorite one. I won't
give it away why it's my personal favorite, but
it's the answer from David Favler, which was
hilarious. And I know... A lot of people have
asked you, Michael, I think. This was not rehearsed,
just to say again. Yeah, 100%. It was great,
the fact that they were not rehearsed. Their
responses were absolutely gorgeous. They really,
really were. Actually, I have a ton of news as
well. First one is CodeQL support for Rust is
now in public preview. This is huge. CodeQL is
one of my favorite tools. It is a static analysis
platform. It's been around for a while, supporting
C, C++, C Sharp, JavaScript, Python, and a few
other languages. but we now have support in public
preview for Rust as well. The nice thing about
CoQL is you can write your own little rules.
You don't have to pay someone $50 ,000 to write
a bunch of rules. You can actually go ahead and
write your own. Next, ASP .NET Core now supports
passkeys. Big fan of passkeys because the credential
is maintained in some hardware device or on your
laptop or whatever. So it's great to see the
support now being added to ASP .NET Core. Key
thing with passkeys is that they are phishing
resistant. Next is in public preview is Roslyn
Analyzer for durable functions in .NET isolated
as available. Okay, quick history lesson. Back
in the day, the managed code tool chain, so C
Sharp, VB .NET, and all those other tools were
rewritten and the project name was Roslyn. A
key part of Roslyn is the ability to add your
own analysis tools or use off -the -shelf analysis
tools that plug into the environment. It's not
the same as CodeQL, it's quite different. But
at the various stages of the compilation process,
like all the lexical analysis, all the syntax
parsing, all the code generation, all that sort
of optimization, all that sort of stuff, you
can actually add your own code in that process
to do your own analysis. I don't believe that's
the case here, but you can certainly put your
own coding constraints by using Roslyn. So this
is great to see. I'm a huge fan of anything that
makes detection of issues early is a good thing.
Next thing in private preview, we have confidential
VMs now support Intel TDX. If you're familiar
with SGX, that's now been replaced by trusted
domain extensions or TDX from Intel. So those
VM series of confidential VMs is DC ESV6 and
EC ESV6. Next, from my own stomping ground in
Azure Data, in public preview, Azure Cosmos DB
from MongoDB. now supports encryption with customer
-managed keys. I've said this a billion times,
I'll say it again, it's great to see key support
being given to the customers. If they opt in
to use it, you don't have to. You can obviously
use system -managed keys. But do be aware that
the keys are yours, and if you lose them, we
don't have a copy of them. So make sure you do
appropriate backups of keys. Next is, and this
is a bit of a mouthful, but it's generally available,
Private Application Gateway is now available
on Azure Application Gateway version 2. A keyword
there is Private Application Gateway. It gives
you things like a private IP -only front -end
configuration, enhanced control over network
security groups, and things like control over
route table rules and forced tunneling support.
Great to see anything that provides extra layers
of network isolation. I'm a big fan of. Back
to confidential VMs in public preview, we now
have confidential VMs for Azure Linux. That is
essentially the Microsoft distribution of Linux,
so great to see that as well. Generally available
is the network security perimeter support. This
allows organizations to define a logical network
isolation boundary for PaaS services. So for
example, Azure storage accounts or Azure SQL
databases. This is, again, it's another way of
defining an isolation. This case, it's obviously
the network layer, but you can do things like
provide private access to various resources within
the network environment, within the network security
perimeter, without exposing them publicly. Another
one which is developer -related, even though
the CoQL one was developer -related, safeguarding
VS Code against prompt injections. There's a
blog post up on GitHub. Long story short, if
you're using VS Code and you're using any of
the AI agents that are built into or have access
to within Visual Studio Code, you need to go
ahead and read this blog post. An old colleague
of mine, Simone Curtsy, has produced a tool called
QRisk Tree Editor. If you're really confused
about how to bridge the gap between threats and
organizational risk, This is a really cool tool.
I'm kind of sad that Mark isn't here because
he would be really ecstatic about this. Okay,
second to last item, I promise. I was interviewed
by the fine folks at .NET Rocks. The title of
the episode, which by the way is episode 1963,
which is insane. It was entitled 30 Years of
Application Security. And basically we just have
a good old chat about the history of... Application
security, how far we've come, things that are
still of concern, so on and so forth. Very laid
back conversation. And the last one, and I just
threw this in just out of interest. It sort of
passed my desk this morning. The first known
AI powered ransomware has been detected in the
wild. And if you want my opinion, this is just
the start. So I'll provide a link to that. I
haven't dug into it in any great detail, so take
it with a pinch of salt, but I don't doubt these
guys are telling the truth. All right, so now
that we've got the news out of the way, I think
it's actually the longest news section we ever
had. Anyway, so as I mentioned at the top of
the hour, our guest this week is Russ Rogers,
who is here from the Xbox team to talk about
gaming security. So Russ, thank you so much for
joining us this week. Would you like to take
a moment and introduce yourself to our listeners?
Hey, thanks for having me. I appreciate it. It's
an honor. I am an old school hacker. I've done
penetration testing, red team, exploit dev, that
kind of stuff for many, many years, over 25 years
at this point. I was chief of operations for
DEF CON when I retired after 20 years. That was
a while ago. Now I went to work at Xbox. I actually
went back and got a second bachelor's degree
in game programming because I wanted to solve
some big data problems with security tools like
EDR, that kind of stuff, making the data more
intuitive. And it ended up landing me a job over
on Xbox. So I'm coming up on, oof, I don't know,
four or five years over here now. And that's
basically what I do. It's kind of a dream job
for me. I always wanted to work in the gaming
industry. I never assumed as a kid that it would
be working in security. But yeah, so that's where
I'm at now. I work in gaming security as the
new org. Love what I do. It's a good time. It
really is. So before we get stuck into this,
I want to sort of bridge the gap between Azure
and gaming. Again, it's a topic that we've never
discussed on this podcast at all. But at the
end of the day, many games, especially multiplayer
games, are hosted on cloud infrastructure, including
Azure. There's many games that you know and love.
that are also hosted on Azure. But it extends
beyond that, right? Because a lot of assets in
games, even single -player games, are stored
in quotes in the cloud, so that way you can hop
from device to device or whatever. But the key
point is that the cloud plays a really important
role in gaming, and cloud security obviously
plays a key role there as well. So I thought
I'd just give some, like, why are you guys actually
covering gaming security? Well, that's the exact
reason why. So before we get stuck into the questions
and the sort of commentary, so just so everyone
knows, the three of us spoke a few days ago about
some topics we want to talk about, and we came
up with a list. So we're going to go through
that list, and it'll be hopefully very conversational.
So the first thing I really want to point out,
which I sort of already touched on, is we've
never done gaming before. My background back
in the day, I actually worked on the Xbox 360
security on many of the defenses. that go into
that product, both at the hardware level and
at the software level. Fun fact, the first version
of Windows to actually have a hypervisor was
actually a variant of Windows running on the
Xbox 360. Not a lot of people know that, but
there you go. All right, so let's get into a
series of comments that we talked about a couple
of days ago. Okay, so Russ, there are so many
things I could ask you about gaming in general,
but we'll stick with security. What are the main
things that you have to work on and secure? The
software, the services, the client machines that
obviously are running things. Tell me more. That's
a great question. The landscape here is growing.
Xbox is evolving. The whole concept of gaming
for everyone and Phil Spencer's mission of...
providing gaming on any platform where there
are players that want to play our games. It's
really kind of expanded the attack surface. And
one of the things I thought Michael said that
was really interesting was the discussion on
cloud. And cloud is critical. to what we do in
the gaming industry, particularly within Xbox.
You know, even in situations where game services
or games themselves are using assets or services
in those clouds, there's intercommunication between
the various clouds, right? So while we have a
large footprint in Azure, as Michael kind of
stated already, there's stuff in other clouds
as well. And so we have to Look at security across
all the different cloud platforms as well as,
you know, on our clients. The software that gets
loaded by players, whether that be a handheld,
whether that's on a PC gaming computer like I
use, a Steam Deck, a console, right? One of the
Xbox Series S or Series X or, you know, one of
the older platforms. All of those things have
to be taken into consideration. And as Michael
also mentioned, we do have a lot of multiplayer
stuff. And those multiplayer games are connected
via services that run out on the internet, probably
in the cloud, right? And so there's a whole lot
that happens there. And what it really boils
down to is securing the software, right? The
secure software development lifecycle, making
sure we're running CodeQL, like Michael was talking
about in the news, right? We eat our own dog
food along those lines. We run these tools. We
improve these tools. And a lot of the stuff that
we do internally ends up being public because
those tools become very useful. It's funny you
should bring up the software security thing.
At the end of the day, a game is just software.
And that means the software will have vulnerabilities.
I mean, it's just a fact of life, unfortunately,
but it is what it is. I remember back in the
day, there was a vulnerability in a game. I can't
remember the game exactly, but there was a...
a memory corruption vulnerability loading a saved
file. That obviously isn't one of the older platforms.
But yeah, once there was a memory corruption
inside the game, then the bad guy could create
a malformed save file. You would load that save
file into memory and yeah, your malicious code
would potentially run inside the environment.
It may be isolated because it's running inside
a hypervisor controlled environment. It doesn't
matter, right? It's still a potential for serious
damage. So yeah, at the end of the day, it's
just software. That's all it really is. Which
then leads to another interesting thing that
always worries me from just looking at Microsoft
software from a general, industry software in
general, but Microsoft specifically, is supply
chain issues, dependencies and so on. One thing
that we track all the time is dependencies, right?
In fact, there's a Dependabot ability on GitHub,
right? So if one of your dependencies... as a
vulnerability, you will automatically get a message
saying, hey, you've got a problem, and it will
even provide a fix for you, like to bump up to
the next version. So do you guys have to worry
about dependencies as well? I mean, is that part
of the reason why perhaps sometimes an update
to a game is available? Absolutely. There are
public libraries that we use, functions that
we need to use either in services or client -side.
We track that stuff. There are entire programs
inside of Microsoft that we use within Xbox as
well, within gaming overall, where we track those
dependencies, where we track the version numbers,
we track when vulnerabilities or new CVEs come
out for those libraries that we utilize. We're
very, very careful with that. And you'll find
that these vulnerabilities get picked up by our
teams very, very quickly. And the reaction time
is usually a matter of hours. And those are things
that we worry about. But, you know, I think it's
important to state that that's a very common
vision for us across gaming. I know that all
of the teams at all the studios. And it's also
important here to point out that the development
that occurs within gaming is not strictly for
the clients and the services specific to a game
title. tools that we build for ourselves to make
our processes work better our operational support
as you were and so we look at the dependencies
and the software development stuff and the supply
chain where we're picking up libraries from entities
that are not internal to microsoft we watch those
very very carefully to ensure that anything we're
building is locked down, right? I mean, that's
a core process. And you see that coming out from
NIST and CISA and some of these other United
States -based regulation and standard organizations
where they're creating these software bill and
material requirements, right? This SBOM is what
we call them. And that's basically... So one
of the things I wanted to ask about is leaderboards.
I've heard that it is something that sometimes
people do. I mean, we used to do it offline back
in the day, right? How about tampering with leaderboards?
Is that actually something that, because that's
a risk that we wouldn't think of in the rest
of enterprise security? I think it's a really
good example because it's one of those things
where we get kind of locked into that corporate
mindset of what security means. I think it would
be really easy if you weren't a gamer to lose
sight of the frustration and the emotional attachment
that players have to their progress and to their
characters and to their gaming experience. And
leaderboards are critical to that. I mean, they're
just a huge part of it. And so I think it was
probably a few years ago was the last time I
saw an active leaderboard issue. And it was huge.
The players were understandably upset, right?
This isn't a situation where you get on and you
play for 30 minutes, 45 minutes, or a cell phone
game where you're standing in line at the bank
or a restaurant for some pickup and you play
a game for 12, 15 minutes. These are people that
play and they devote their time to... be it a
racing game or a fighting game or whatever it
is, right? They get on these leaderboards. And
so when people are able to manipulate the backend
services or the protocols, or maybe they manipulate
the client side and the data that gets sent up
to the leaderboards. And they get these impossible
records that are on the leaderboard that can
never, ever be beat by a human player. That's
big, right? That's disheartening. It's frustrating.
It's not just that you spent $40, $50, $60 on
this game. It's that you've spent all these hours,
weeks, months of your life playing these games.
Like you said, Sarah, these games have been around.
Some of these have been around for 10, 15 years.
And these leaderboards are hugely important to
the players. It is something we track. It is
something that when it pops up or we hear news
of a potential leaderboard issue, we start investigating
immediately. It's very, very important to us
to make sure that the players are having a good
time and that the environment is fair for everybody.
Okay, switching gears a little bit. So one thing
that always worries me from a security standpoint...
is essentially backward compatibility because
sometimes there may be decisions that are made
20 years ago, 15 years ago, that may have been
fine back then, but it may not be the greatest
thing today. Do you guys have issues like that
with legacy games running on the platform, especially
those that are multiplayer? Yeah, we've had to
change a lot of our focus on legacy games. It's
a big strategy for Phil Spencer and the rest
of Xbox gaming or Microsoft gaming. to ensure
that we keep the legacy games that are still
very popular with players around as long as we
possibly can. And some of these games were built
15, 20 years ago, completely different operating
systems, completely different hardware architectures,
languages, libraries, right? The list is endless.
And so it's a constant challenge for... the studios
to keep these games accessible in a in a manner
that's secure right and you talk about using
containers and stuff like that and using the
cloud all those things come into play as well
as making sure that we're really tracking those
those libraries we bring in that supply chain
that we already touched on you've got to figure
out how to keep those games accessible right
how do we keep those in game pass how do we keep
players playing those and keep the leaderboard
safe and keep the game functioning the way it
was intended um but make sure it's secure right
and that's those are very very real considerations
i deal with that on a weekly basis with with
what i do at work it's just It's huge, right?
It's very important to Microsoft gaming to keep
those titles available and accessible to players.
But we have to do it intelligently. We have to
do it securely. And we bounce our heads off of
brick walls, like I said, on almost a weekly
basis to try and create solutions that keep these
games accessible. And the teams do a fantastic
job at it, right? They're getting used to fighting
these kind of wars to keep those games out there.
That's a really good point out. That's a huge
issue. My guess is if I take my security hat,
if there's stuff that's really old that we don't
trust or stuff that could be potentially dangerous
or have insecure coding techniques because it
was written 15, 20 years ago, whatever, we would
normally run something like that in a highly...
virtualized or protected environment, some form
of isolation environment. Essentially, if you
look at Zero Trust, it's the whole, hey, let's
just assume this game is going to blow up, so
let's keep it isolated so at least if it blows
up, it blows up in its own sandbox and doesn't
start wrecking everything else around it. Is
that something that the gaming industry does
as well? We just tend to assume the worst, so
isolate the game? I think at this point it's
dangerous. You know, you've been doing security
a long time too, right? I think it's dangerous
to approach these kinds of problem sets without
assuming something's going to blow up. And so
while we want to keep games accessible and we
want as many players as we can, I think you have
to contain those and you have to limit the collateral
damage that could occur if something does get
popped. If a vulnerability is discovered that
you've known nothing about and it... destroys
that version of the game we have to have a situation
where we can roll back to a known good patch
the system get the game back up and it doesn't
hurt the players it doesn't impact their privacy
worst case scenario maybe they have you know
a few hours of downtime something like that but
yeah i you have to isolate it right that's that's
really the only way to do it you've got to limit
the trust boundaries These are considerations,
right? And when it gets really challenging, it
leads to conversations about, well, is this one
of those rare situations where we should consider
sunsetting a title? And we try very hard not
to do that, right? That's not our goal. Our goal
is to keep as many games out there as we can.
And so our perspectives... kind of change about
how we address this security problem. And isolation
is a big part of that, right? Keep them inside
a steel box. So if anything happens, you know,
it's contained. Yeah, really good analogy. And
then I'll hand over to Sarah. Really good analogy
is an office, right? So if you open up a document
that came from the internet, we run that in a
thing called protected mode, which is an isolated
boundary. It wasn't referred to as a low integrity
boundary. Because we assume that the document's
vulnerable. We assume that there's a bug in Word
and we assume that the document is going to cause
that vulnerability to, it may not be a vulnerability
we don't even know about. But again, you're just
assuming that bad things are going to happen.
So run the thing inside of a, as you put it,
like an iron box. Well, I think iron box is possibly
stretching things a little bit. Yeah, and a strong
boundary. So if it blows up, the damage is contained.
Yeah, 100%. So kind of building on, well, I'm
going back to my leaderboards and stuff. Russ,
another thing that, of course, we don't think
about in enterprise security, cheating. So I
know that when I was a kid, when I was playing
games, I used to know, and I'm aging myself,
of course, like I knew all my cheat codes and
there were other devices you could use to cheat.
How does that factor into the work you do in
Xbox land? Yeah, I would point out that a lot
of those cheat codes that you were using on the
controllers and stuff were actually backdoors
put in by devs. And so I would argue that, yeah,
okay, that's kind of cheating, but they put those
God codes in there for us to find and use. So
it was kind of a more benign situation back then.
You know, cheating in games, it's... It's more
or less on two different levels, right? There's
a service -level cheating, which for me is very
serious, right? And then there's the client -level
cheating, where you download a local game to
your game PC or to your handheld, and it's just
a single player, right? And I won't name any
game titles. But the idea being you're just sitting
there. You're enjoying your game by yourself.
It's not a multiplayer instance. If you're cheating
kind of in those situations, I feel like you're
basically cheating yourself, right? You're losing
the experience of the game as it was created
by the developers. Now, that doesn't mean it's
necessarily bad, right? Maybe you really enjoy
doing that. I think we see a whole lot fewer
of those back doors that developers put into
the games. You know, the up, up, left, right,
left, right, A, B, A, B, whatever, right? And
I think nowadays, if people are cheating at games,
there's a high probability somebody's got, you
know... IDA Pro or Oli Debug or something like
that. And they're trying to find the breakpoints
and the skip points in the running code and memory
and stuff like that so that they can give themselves
more resources, better armor, more grenades,
increase their score, right? Anything that will
give you a benefit either locally or at the service
level, right? My concern is if you do this at
the service level in multiplayer games. you've
kind of stepped past that gray area because now
you're impacting other players that are playing
the game. And that's my concern, right? We've
stepped outside that point where you're impacting
just yourself, only yourself, and you're doing
harm to other people that are trying to enjoy
the game. And so it does happen. Some people
cheat to try and gain value for themselves. There
are trolls on the internet that try to cheat
just to make other players miserable. That's
a very sad situation, right? Because maybe they're
not invested in the gaming community like I am.
But I just, I feel like that's, you know, that's
not the path I would follow. But cheating does
happen. We get reports of it. Luckily, we also
have a very active gaming community. And so we
get bug reports on various game titles. And we
take them seriously. We hear it. We try and replicate
it. We try and figure out what the cause is.
There are conversations back and forth between
the finder and the developers. This is a big
deal. We want the gaming experience to be enjoyable.
If it's not enjoyable, why are you gaming? And
so we try and limit how much third parties can
impact the players that are playing our games.
So back in the day, I remember I said that I'd
done some work on the 360. So one of the stats
I heard, was that if you have 3 % of the population
of a game cheating, then people start leaving
the game. I mean, obviously you need to actively
pursue, you know, putting protections in place
and also, you know, banning people if it's obvious
that they're cheating. But yeah, 3%, just think
about that. That's a tiny number. That means
if you're in a 32 person lobby, one person is
cheating and that's going to ruin your game experience.
Fun little fact, I may or may not have done a
bunch of cheating when I was a little kid. The
reason why I allegedly did it is because I was
really interested in breaking the game. The same
applied to copy protection back in the day. 99
times out of 100, I didn't even play the game.
Just the intellectual challenge of breaking the
game and being able to give myself infinite hit
points or whatever it was. Again, four single
player games. The risk was too high if I was
doing it for multiplayer games. Yeah, for example,
and again, I don't know the policies here, but
my guess is that back in the day for single player
Diablo 2, I don't think anyone really cared that
much, right? You were just making your Necromancer
or your Paladin better, but you weren't affecting
anybody else's game. But in Diablo 4, if you're
cheating and doing multiplayer, then that's a
whole nother ball of wax, right? Because now
you're making someone else's game miserable.
All right. So what else? Oh, yeah. Next big one.
Distributed denial of service or denial of service
in general. I mean, that's got to be a huge problem
for cloud -based gaming platforms. Yeah, that's
big across most service orgs, right? And most
gaming nowadays that's not mobile, we could say,
is going to be service -based, right? So denial
of service, that's the quickest way to ruin.
fun for for everybody playing playing the game
right and that that expands and that's not just
a problem within microsoft gaming that expands
to you know all the big game companies that have
huge titles it's it's just you know it's it's
a problem um but the i think the thing that's
probably most useful to point out here is the
fact that in most cases ddos isn't solved strictly
by good software development practices right
now. We're talking about architecture, infrastructure,
the networking, the protocols, the alerting,
load balancing, right? There's so much involved
here to keep game services active and kind of
respond to that. There are entire companies out
there on the internet, I'm sure you could name
a few, that their entire business model is providing
some level of DDoS protection, whether it's Service
DDoS, where we're hitting specific ports that
we know, whether it's DNS, DDoS, right? We're
creating issues with DNS providers. There's just,
it's such a big business for people who like
to do bad things to good games. So DDoS is out
there. It is something we track. it is responded
to a little bit different than some of the other
things that we've already talked about, right?
Because the approaches to secure those things
and lock them down are a little bit different.
So it's a little bit more complex of a problem
to solve. But it's out there, and it is something
that we track. We don't hear about that as much
as some of the other problems we've seen, but
we definitely do hear about it. Yeah, I think
at the end of the day, like you say, for at least
network level denial of service that some of
you just leave to the platform. I mean, Azure
has built into it Azure DDoS protection, which
is great stuff. And what's interesting is that
service, with that service, I can't remember
the version of it, you get access to engineers
who are experts in distributed denial of service
attacks, which you're probably not. You're a
game developer. You're probably not that knowledgeable
about network level distributed denial of service
vulnerabilities. But that being said, there are
things that you can do in your code that are
good programming practices that mitigate certain
classes of vulnerabilities as well. But again,
for networking, yeah, absolutely. Leave that
to the experts. So Russ, I've got another question
for you about things that... the rest of us might
not have to worry about and the rest of security.
But what about obviously a lot of minors, kids,
people under 18, use gaming platforms. So what
are the concerns there? Yeah, protecting minors
is a huge goal, right? That's one of our top
priorities. There are a lot of youth. right that
play our games and so we need to protect their
anonymity we need to protect their experience
and there's there's a lot of risk here and i
hate to say it i don't think that we have direct
control over everything that happens there because
interactions with unknown human beings somewhere
else you don't know their their intent right
you can't judge somebody to be ethical and moral
um during these these game interactions and we
have situations and they get reported to us and
and what we do is we we try to find out where
we can augment security to protect minors so
if you consider like a game you know children
play minecraft minecraft's one of the most popular
games on the planet um but there are kids there
but there are also adults that play at the same
time And it's very easy for these kids to end
up in conversations with people that want to
try and take over computers, take over accounts,
things like that. And like I said, we do what
we can on our back end to limit the scope of
any damage that might occur to minors. Parents
are really responsible in a lot of cases. I've
seen children that will meet people who pretend
to be friends will get them logged into Discord
servers. get them to download plugins for games
that kind of bypass the, you know, the little
Windows warning that pops up or the Azure warning
that says, hey, this plugin's trying to access
your account information. Are you sure you want
to do that? Well, I'll tell you, an eight -year
-old child doesn't know how to answer that question.
And sadly, I'm not sure a lot of parents do either.
And so from a Microsoft gaming perspective, we've
taken it on ourselves to try and make those messages
clear. where they're required, or just to lock
down the interactions entirely where they're
not needed. So protecting kids is huge. You know,
you want the kids to have a good time. That's
what this is all about. It's supposed to be a
safe environment to go explore and to adventure
and to play with friends that they know and they
trust. Every once in a while you get one of these
people that slip through and really put the miners
at risk. And there's, I can't tell you, the response
to that is huge because I think most of the people
that work in Microsoft gaming have children of
their own or grandkids, right? Like I now have
grandkids and I have concerns. And so there's
a huge response when those kinds of things pop
up. And so I think we probably see our most,
largest forward momentum when kids are at risk
right we we see those things we have very difficult
conversations people get very creative and we
come up with some great solutions to protect
the kids that are playing the games it's interesting
you should bring that up russ i mean what makes
this interesting this area interesting you know
policies and legal legal issues aside is that
there's such a huge social engineering aspect
to it with a vulnerable class of people So it
leads to very difficult problems, and I do not
envy the people that have to work on that on
the Microsoft gaming platforms, or any platform
for that matter. Yeah, no, it's challenging,
but we love the work we're doing. You get into
gaming because you love gaming. Most of the people
I know that are in Microsoft gaming didn't just
land here by accident. Most of them had a very
dedicated path to get here. So it means something
to them. And so, you know, I remember being a
kid. I remember playing Nintendo. I had an Atari
2600. And, you know, for me, I think of my kids
and my grandkids playing those games. It's the
same experience. And I want to protect that for
them. So, Russ, I think something that we always
ask our guests is, Two questions, which is what
is a typical day in your life look like? I know
that most of the people we ask this question
to don't really have a typical day, but we'll
try you anyway. And then also, if you had a final
thought to leave our listeners with, what would
it be? So a typical day in the life of Russ Rogers
at Microsoft Gaming is a lot of phone calls.
A lot of conference calls, I would say, usually
about security configurations, software development
lifecycle. We have conversations about, like
I said, incidents related to cheating or bugs
or vulnerabilities, things like that. It's probably
pretty close to what you would find at any other
organization where they develop software that
goes out to a wide population, right? And so
I don't know that anything other than psychology
makes it any more interesting to me. The fact
that these are video games we're talking about,
right, and that people are there to have a good
time, and we want them to have a good time, and
we want to protect them while they're doing it.
So pretty standard day in the life. I can't say
it's super exciting, but I love my job. I love
what I do. The advice I would give to people
is, you know, this is gaming. Try to enjoy it.
Try to be good to one another. Try to help other
people enjoy it. I think one of the things that
made Minecraft, and I'll go back to Minecraft
because it's so impactful. One of the things
that made Minecraft so popular is it was just
a joyful game. You get on there. It's ridiculous.
It's fun. It doesn't hurt anybody. People can
get on there and play together and build just
fantastic things in the world. The limit is truly
your imagination. And I don't think it makes
much sense to get in there and try and ruin it
for other people. And so that's probably the
biggest piece of advice I would give people is
just go out and enjoy the games. And if you're
interested in gaming, and you're interested in
security, there obviously is a path for you to
get to that. I'm proof of that, living proof
of that, even at my ripe old age at this point.
So never let your dreams die. Keep pursuing it.
Give it a shot. There are a lot of really passionate,
loving, caring people that love gaming, but also
love security that work in Microsoft. Yeah, I
want to add to that. And I really don't want
to add to your final thought because I've never
done it before, but I'm going to do it anyway.
It's like when multiplayer games that have chat,
just respect the people at the other end. Don't
start cussing them out. Don't start saying stupid
things. You know, you may get banned. I mean,
it's not nice. It's not clever. People just get
really angry with it. It ruins the gaming experience,
to your point. So just, you know, just be kind
to the other human beings who are playing the
game along with you. Even if someone stabs you
in the back in Battlefield, you know, it's like,
hey, just, it is what it is. It's part of the
gaming experience. All right. So with that, let's
bring this episode to an end. Russ, thank you
so much for joining us this week. I could easily,
honestly, have gone on for another hour. I love
this topic so much. So perhaps we should actually
get you on at another point in time and let's
discuss other topics in gaming. All right, so
that's bringing it to an end, as I mentioned.
Again, Russ, thank you so much for joining us
this week. And to all our listeners out there,
we hope you found this episode interesting. Again,
it was a little bit different. And if you want
to see different topics like this, let us know.
We're more than happy to talk about absolutely
anything security related. So stay safe and we'll
see you next time. Thanks for listening to the
Azure Security Podcast. You can find show notes
and other resources at our website, azsecuritypodcast
.net. If you have any questions, please find
us on Twitter at AzureSecPod. Background music
is from ccmixter .com and licensed under the
Creative Commons license.