Welcome to the Azure Security Podcast, where
we discuss topics relating to security, privacy,
reliability, and compliance on the Microsoft
Cloud Platform. Hey everybody, welcome to episode
120. This week it's just myself, Michael, with
a guest that we had on a few months back now,
Meryl, who's here to talk to us about the Zero
Trust Workshop. But before we get to Merrill,
I have one little news item to talk about. As
many of you know, many because I keep talking
about it, I was in Azure Data before joining
the Red team, and that includes products like
Azure SQL Database, Cosmos DB, and so on. And
I mainly worked on, well, obviously I worked
on the security side of things, but a big part
of what I worked on was cryptography. And Peter
Van Hover, who's a security PM over in the Azure
data team, has written a blog post called Everything
You Need to Know About Transparent Data Encryption
Key Management for Database Restore. We were
asked many times for sort of some of the minutiae
around cryptography in SQL Server and Azure SQL
Database and Cosmos DB for that matter. So it's
really great to see Peter writing this blog post
explaining. basically all the minutiae of cryptography
in transparent data encryption key management
when doing a database restore. All right, that's
all the news I have. I said it would be short.
So let's turn our attention to our guest. As
I mentioned, our guest this week is someone we've
had on the podcast before, Meryl. Meryl, welcome
back to the podcast. We'd like to take a moment
and introduce yourself to our listeners. Hey,
Michael. It's good to be here. My name is Meryl
Fernando. I work in the Microsoft Entra customer
experience team. And I'm from Melbourne, Australia.
So very excited to be here. My role, my day job
is to help customers deploy Microsoft Entra,
secure their environments. And identity is something
that takes a long time because you need, it impacts
people. So it's not like an Azure feature you
just turn on or deploy in the backend. It really
impacts people, you know, the sign -in experience,
how they get. to their applications or how they're
blocked from their app. So when everything's
working fine, people don't even see us. It's
single sign -on, it's all hidden. But when things
go wrong, everyone in the world knows. You'll
see newspapers and articles written and it'll
come on the news saying there's a Microsoft outage
and all of that. So it's a very critical, important
piece of the world. But Entra is not just sign
-in. There's a lot happening there. So I help
big enterprise customers deploy Entra. And the
key in my role as customer experience PM is to
bring that feedback. into Microsoft. I'm sort
of like the voice of the customer in the product
feature reviews and giving early feedback and
involving our customers in new features and things
that we work on. And these days, there's a lot
happening in AI and all of that space. So it's
a very busy time leading up to Ignite. Hey, so
before we get on to the topic, which is the Zero
Trust Workshop, You have a weekly podcast, right?
So why don't you spend a little bit and just
talk about that, like what sort of objectives
you're trying to achieve with it? Yes, yeah.
So like everything that I do and I like create
a lot of tools on my website, you can go to merrill
.net and see some of the ones that I've created.
It's something where I wanted it and it didn't
exist. So I sort of like, yeah, I'll go ahead
and create it. So I'm new to security. It's about
like five or eight years since I came into security.
I started as like a VB, VB5, VB3 programmer and
been a dev my whole life. But there are a lot
of dev podcasts. There's a lot in that space.
You have a lot of choice to pick from. So when
I came onto nTribe, it was like, okay, I need
to learn from people, learn from the experts,
and hear what they see as the problems they are
solving and so on. And I didn't really find anything
on security. And Azure Security was one that
I was like, oh, yeah, there's something now,
at least on security. And I was very excited
when you launched. Was it five? About four years?
Yeah, man. I think it's about five years ago.
It's crazy. Look, I'm going to be honest. I'm
really kind of pretty impressed that we've been
going this long. Actually, I'll make a comment.
There was a comment that was made before we started
this podcast where someone, I'm not going to
name who it was, said, you won't have enough
content to do it. And I'm like, have you been
in the security space at all? It's like, really?
There's going to be plenty of content. We have
no problems getting people on the podcast who
want to talk about security. And it's a case
of just, honestly, the big impediments, if anything
else, is just our time. That's all. It's a lot
of work, editing and coming up with what to talk
about and so on. But yeah, no problems at all.
But thank you for bringing that up. Yeah, it's
been about five years now. It's been crazy. So
I was very keen. And so the Azure Security Podcast
really filled the gap, bringing on different...
pms feature teams and i love learning about all
the different spaces but i come from identity
and entra and there is very little to like no
content you might get like one episode in you
know over over a 12 month 10 month period on
identity so i was like i need to bring in and
my uh i had a selfish goal i wanted to talk to
very interesting people. And it's a way to build
up a lot of friendships and, you know, connect
with people. So I've had a lot of fun. I made
it a weekly one. And so, yeah, if someone said
it's a challenge for security, I'm doing just
on Entra. It's called Entra chat, Entra .chat.
I got the domain as well. So it was really good.
So if you head over to entra .chat, I'm at week
25 now. So it's like 25 episodes. It's a baby
compared to the Azure Security Podcast. But there
are people who are in the space, identity, IAM
experts. For me, I'm not looking for like a big
audience, but people who are really in this space
for them to see what others are doing, learn
from them. And especially IAM is not a... field
where you go and train for it it's an it's an
area where people actually fall into this domain
by accident like they're they're just put in
as the m365 admin or they're an exchange admin
most of the time it's an exchange or ad admin
And this whole space is new to them. They learn
on the go. There are no like courses that you
can follow to become an identity or IAM, access
management expert. There are some vendor related
things. There is no like a degree, et cetera,
even that you do. So it's a very unique space,
but it's like I see people share on Twitter and
so on. It does pay well because it's a very niche
space as well. So from a career perspective,
it's really good. Because every company needs
identity. You can take out other products and
services, but every org needs identity. And it's
now at the forefront of a lot of the security
initiatives. And I'll talk about the Zero Trust
Workshop and the SFI initiatives we have. If
you see the pillars that Microsoft has from SFI,
a lot of the work that we're doing to fix things
is at the identity layer and the control plane.
very central to every organization. There is
no clear -cut path to learn from it. And that's
the whole reason I started the IntraChat to bring,
and I bring a mix of lots of MVPs and customers.
My two, like the very popular episodes, one with
the McDonald's identity architect, George, and
they manage like 1 million users in their tenant,
right? So this is like a global thing, 1 million
tenants, challenges. they face are unique, but
at the same time, there's a lot that every identity
admin faces the challenges some of that, you
know, the folks at McDonald's face with the same,
you know, Entra suite that everyone is using,
Entra ID. Whether you're like 1 million users
in your tenant or whether you have 10 to 100
users in your tenant, you're using the same portal
to manage all of this. So there's a lot of knowledge
that we can learn from each other and so on.
So it's been very fun doing that on a weekly
basis, getting feature PMs, talking about their
products, getting MVPs who have lots of experience
coming in and sharing. yeah so I've had a lot
of fun it's never a challenge to find people
I have people like a lot of people asking me
to come on the podcast because they have stories
to tell and I try to focus more on that because
it's a podcast We just talk and share stories.
You know, how do you learn? Because I don't want
them to sit through like just a feature description
about how a particular feature works. But, you
know, how they think that happened, like, you
know, the stories, the water cooler stories,
because those are areas I feel people can learn
and relate to as well to what they're doing in
their day job. Let's finish bringing that up.
When we recorded the episode with Mark Racinovich,
we had an agenda to go through. We didn't stick
even closely to it. Mark started meandering off
into things and then I helped meander even further.
I found a couple of rabbit holes to go down.
Mark Simons was the one who sort of pulled us
back up into reality. It was actually kind of
funny, but it was a great episode because it
was just a couple of nerds. you know, talking
about post -quantum cryptography, it was really
a good episode. But you're right. I mean, you
also get to meet a lot of good people. And I
think that's critically important too. All right,
so let's get back. Talking about going down a
rabbit hole. So let's get to the actual topic
of this podcast, which is the Zero Trust Workshop.
So why don't you tell us the origin story for
the Zero Trust Workshop? And hopefully on the
way, you explain kind of Zero Trust as well.
Yes, yeah, absolutely. So the origin story is
it didn't even start off as zero trust. We in
identity saw that when we go to customers and
we tell them to do things, there are certain
things that need to be done like in a sequence.
So, for example, if you tell one of the best
practice we tell is. you need to do device compliance,
right? When someone is signing into your application,
signing into your tenant, you need to say, okay,
are they coming from a known device? Does it
have the firewall turned on? Does it have antivirus
deployed? Is it compliant? Does it have BitLock
encryption turned on? So there are all those
things that you need to do. So we tell them,
look, you must have a conditional access policy
that knows whether you're coming from a device
that is secure, it doesn't have malware on it,
et cetera, versus something you have from somewhere
else. And that would include the Linux and Mac
analogs to all of those things as well, right?
Yes, absolutely, yeah. It's like cross -platform
as well. So our best practice is, yeah, just
do this, turn on this policy. But before you
can even get to that, you need to make sure that
the device is managed, is the device enrolled
into Intune. If you're doing a domain join device,
there is something you need to do called intra
-hybrid join. And intra -hybrid join, you can't
just flick one switch. You need to do things
like in the intra -connect sync, you need to
configure the connect sync, make sure the devices
are synced from on -premiere to intra -ID. So
there's a whole bunch of steps you need to do
before you can turn it on. And I've been in customer
projects where it's taken like six months, sometimes
even a year to do that. that one thing to get
the devices inter -joint when you're talking
like 100 ,000 devices across the company. So
what might be like a simple activity is it takes
a lot of time to do it. And a lot of people don't
know that. Like my role is to help customers,
you know, walk them through these plans and we
have SMAs who, you know, help in that flow. But
what we realized is there's always like a sequence
of things you need to do. And customers are very
paralyzed. I don't even know where to start.
There's so much to do. Even if you take something
as simple as rolling out MFA to everyone, there's
a lot you need to do. You need to make sure that
they're using devices that are capable of doing.
If you want to enforce authenticator, what version
of the mobile are people using? There's a lot
of work that they need to do to plan for those.
So that's how it started out as just identity.
All of our, like my team, we have like 100 plus
people spread out across the globe. And each
region has different challenges from Germany,
having European challenges to the US folks and
in Australia as well. So we sort of took our
collective knowledge and we were like, how do
we... communicate this to people. It started
as like a PowerPoint deck, like Mark would know,
Mark Syvers would. We had this PowerPoint slide
which said, you know, these are the things you
need to do. And there were all these slides that
were there. And then what we did is we moved
into like an Excel sheet. So I came up with the
idea, like let's make people flick, like we do
a way where we ask questions from customers.
we can say what state they are in. So we came
up with the idea of creating a spreadsheet. So
we have the Zero Trust Workshop now where you
can go download the spreadsheet. It has the knowledge
of lots of different SMEs. It's evolved from
identity to lots of other pillars and we'll get
into them. And what you do is... You can set
up a workshop with a customer and you can go
through a sequence of these questions with them.
Have you done this? Have you done this? Like
one of the first things we ask is, have you stopped
acquiring apps that have legacy authentication?
Like we consider like Kerberos and LDAP legacy
because you can't apply conditional access on
them. Like they're just network level protocols.
There's no way to have. checks in in the middle
whereas with the modern auth like oidc and open
id open id connect saml with the modern authentication
you can actually have policies that do the device
checks that can do a lot more things in between
before we allow the user to access the application
so one big question is have you stopped procuring
those products like have you in your organization
so it's not even a technology thing It's like
you go to the procurement team and tell them,
like, this is one of the criteria, like don't
acquire apps that are not working on modern authentication.
So that workshop embodies a lot of all of our
knowledge and best practices that we poured into
that. And I can talk a lot more about, you know,
what we've done in that space. And it's now evolved.
to a lot more than just Entra. And it's growing.
We have some big plans for it. You bring up Kerberos.
So what is it about OpenID Connect that makes
it conditional, accessible, and Kerberos not?
What is it that, I'm not going to say unique
to it, but what is it that we look for? Yes,
that's a really good question, right? When we
say legacy protocols with Kerberos, NTLM, basic
authentication, the ones we were used to from
the 90s, and people, if you're in legacy, in
enterprise today, it's still used heavily, right?
You go to some website, most of the time it just
works, but suddenly you see a Windows pop -up
dialog asking you for the username and password,
then you need to fill that in. So those are using...
what we call chatty protocols, because they were
created for the world, which was for a different
era, right? Like the 80s, 90s eras, when the
LANs and servers just first came into being.
And they all connected over local network. They
would keep talking back to the server whenever
the user tried to do anything. So there's a lot
of traffic going back and forth. It works really
well when you're on the LAN. But once you move
to the internet and you have people from all
over the world and the whole latency of doing
things, it becomes really unusable. So those
protocols don't really work well in the internet
era and especially like with mobiles, right?
your battery would just die with all the pinging
that happens because every time you do something,
there are three parties in the old protocol.
There is the Windows Domain Controller, there
is the Windows Server that you are using, and
the actual application server you're accessing.
There are all these three, and if the Domain
Controller goes down, you lose access to your
application, right? And you can't really do a
lot there. With Entra and the new protocols,
we have this, we moved to tokens. Like there
is this MS Build TikTok I keep seeing all the
time where they ask people tokens or passwords.
And Mark, Mark, like they ask everyone and they
go, like everyone goes tokens. Because the new
identity world is built on these modern protocols.
We realized like. Kerberos and all of that's
not going to work. So the whole world came up
with these protocols where you get a token and
for one hour, usually an hour, you don't need
to go back to the identity provider. So even
if, for example, Intra goes down, you can still
be using your application for that one hour,
however long that token that you have. You don't
need all three parties involved in that mix.
One of the key things it does is it does a web
-based authentication. So there's a flow there
where there's a web -based auth, which allows
Entra to do a lot of things in the browser. Like
it can check for certs on the device. It can
check what IP location you're coming from. There
are all these activities that are happening with
conditional access being as a policy engine for
Microsoft. that can go and evaluate all these
things before saying, okay, I'm now going to
let you access the application so you are allowed
to go, which you can't do with Kerberos. All
it does is when it comes to the server in that
protocol, it just says these are the user's credentials,
like the basic username, password, or the Kerberos
token that it has, a ticket that comes with it.
It has no context about... the IP address of
the user, where they're coming from, what sort
of device they're coming from. Not even whether
I would say if it's a Mac or Windows. As long
as the protocol was meeting the requirements,
it was let through. So that was a huge change
from the old world to the new world. And almost
everything today is built on the new protocol.
But most people are... I wouldn't say lazy, but
they sort of stick to the old things and they're
like, yeah, let's just use Kerberos. Like, it's
there, so let's keep using it. But if you want
to do zero trust, especially, you need to stop
using those legacy apps and legacy protocols.
Microsoft, we're actively trying to kill some
of those older ones, like, you know, relying
on things like Samba and so on. It's funny you
should bring that up. That was the security PM
for IIS 5, the web server. And that was the version
of the web server that integrated Kerberos for
the first time. So you're saying that all my
work I did back then is now, well, it's all for
nothing. That is tight at the time. It was really,
really cool. It was awesome. I mean, we could
make a connection to, we could actually flow
the identity through the environment. It was
really, really, really nice. I mean, for me,
it is still awesome to this day, especially when
it comes to as a developer. With Kerberos, I
didn't have to do anything. I just wrote my ASP,
classic ASP or ASP .NET app, threw it on IIS,
and suddenly when someone came to my site, I
knew who the user was. I wrote zero code. I just
write one line and say user .identity, and it
lets me know who the user's details are. That
flexibility hasn't come to... the the modern
auth it's very complicated like even i keep i
struggle with oidc and the protocol and the tokens
and id token and oauth and like it's a very complex
subject on its own and devs struggle a lot like
as a dev i'm building an application you know
building it on azure i'm worried about the business
story and the business scenario authentication
always always gets in the way And it's such a
complex thing that it's a huge beast. Devs don't
really understand it. It took me a long time
to understand it, even as a dev. And even now
I keep forgetting like, oh, ID token, refresh
token, and the audience claim and this claim.
Like you can do the wrong thing and like the
code will still work. It's a less secure product.
So that simplicity of Kerberos hasn't come to
the dev side. Like today, if you're going to
do modern auth, you need to write like hundreds
of lines of code. With Microsoft, we try to simplify
it. We create this library called msal. And we
say, yeah, put this in, follow this pattern and
everything will just work because we have a whole
team building that library and they keep updating
it with all of, you know, we find new vulnerabilities,
they fix that library. It's a complex topic.
You need to know a lot about the OIDC protocol
and all of that. But Kerberos, and that's why
they're still popular because... The vendors,
all of them, they just like it because you don't
really even need to think about it. There is
no certificates. There is no configuration needed.
So it's an amazing experience for devs from that
side of it. You can thank me later. We need to
crack the nut on that one. I agree with you.
When I wrote with Heimlich and Simone, when I
wrote Designing and Developing Secure ASI Solutions,
I wrote the identity chapter. And it was hard
to write because the stuff is so complex. And
I hark back to when I wrote a book on Windows
2000 and included Kerberos and IIS. It was easy.
It was really, really easy. But anyway, why don't
we get back to the topic at hand? I think you
and I, we should just, you know, if we start
talking about something else, we should just
like pull ourselves back out of the rabbit hole.
This is one thing I love about podcasts, right?
Is that some things like that are really, really
interesting. And I think we need to make things
like that more public. Some things are not as
easy as perhaps they used to be, but they're
more secure and they're more flexible and like
you say, with conditional access and so on. And
the rationale and the reasons why they are the
way they are are sometimes lost. And so I think
that's great that you bring those topics up,
but we are so far away from the Zero Trust Workshop
at this point. So let me bring ourselves back
in and say, okay, now we've gone through the
origin story. By the way, I love the idea of
the fact that it was, you know, basically necessity
being the mother of invention, right? There's
something that was needed and you invented it.
And I think that's always great when things are
sort of built from the grassroots upwards. So
what is the Zero Trust Workshop and how is it
sort of delivered to customers? How can people
use it? You know, give us a scoop. Yeah, so essentially
what we did is I'm an SME on Entry and Identity.
And in Microsoft security, it's a huge stack.
It's a huge business at Microsoft as well under
Charlie Bell. And there are lots of different
services and products. So when you say zero trust.
Most people think of, oh, if I just do a zero
trust network access, I deploy it and yay, now
I'm zero trust. But it's actually a lot more
than all of that, right? Like there's a lot we
need to do. Like we took the example of legacy
protocols and legacy apps. Like you need to modernize
your apps and that's no product you can buy that
can fix it. You need to do this whole work to
go and get rid of all these legacy apps in your
environment or, you know, wrap them. into a way
that they're more secure it's a whole company
strategy on moving to newer modern ways of doing
things that you can secure it so it's not just
about getting a product and deploying it it's
a whole thinking around how you would do zero
trust where you don't trust anything just because
it comes with a you know token or credential
so What we did with the Zero Trust Workshop is
we started with identity and our customers loved
it. What we do is we run a workshop. We bring
everyone in from identity and the security team
and various other teams, the security operations
team, and we go through this blueprint that we've
created. And we ask them questions like, have
you done this? Have you deployed conditional
access? Have you, not even before you deploy,
do you have a design for conditional access?
What is your conditional access strategy, right?
Should everyone be able to come into your network
or do you have a policy that says maybe when
you're accessing Azure, you need to be only on
a fixed device, like a known device, or whether
you come from a particular network. you need
to come up with your strategy for that. So we
walk them through these questions from, are you
using legacy apps? Are you doing this? Are you
still using things like access reviews? Like
are people, do you regularly review who has access
to your Azure environment, right? Every three
months, has someone moved roles and do they still
have access to a Cosmos DB that they shouldn't
have access to? They are no longer in HR, they
move to something else, but they still have access
to maybe, you know, payroll and other information
which they don't need. So all of that's part
of identity governance. And we go through all
these questions. It's typically a two to three
hour workshop that we run just on identity because
we want to give them like a full picture of what
is their current state. And as we go through
the workshop, we made this very visual. So there's
like a roadmap with swim lanes. There are boxes
for each thing. And every box or question, you
have a dropdown and you can say, yeah, we haven't
thought about it. Or you can say, yes, we are
in the process of planning or we actually have
a project that's running that's doing this. We
are deploying a solution. Or you can say things
like we are using a third -party solution. Like
it doesn't need to be a Microsoft solution if
you're using like SailPoint for identity governance
or Jam for device management. The workshop is
very like we try to make it platform agnostic
so it's more usable to everyone because... Every
enterprise in reality has a mix of different
security solutions. So it's not going all in
with Microsoft. So we try to make this very pragmatic
about being able to call those things out. So
once you finish that, you end up with a neat
roadmap of, oh, these are gaps. We haven't thought
of this before. And we need to do these things.
And it gives you a sequence. this is a better
way to do it because we've taken the knowledge
of hundreds of our practitioners who have done
like thousands of customer deployments where
we've gone through and done these deployments.
So we've taken that essence of that knowledge
of everyone and put them into this sort of workshop
that you can run. And a lot of customers, like
we've done this now for a few years, some of
our early customers who went through this exercise,
they've come back saying, This has been amazing.
We went to our business stakeholders. We showed
them the plan and we got funding to do this because
some of these are like multi -year projects that
you need to run. So they got extra funding from
the business. They were able to use the workshop
as a artifact for this. gone ahead and then deployed
you know mfa across the board and device compliance
and various other projects and initiatives and
they've improved their posture from where they
were to before and they can clearly show okay
this year last year two years ago we were at
this state now we've come so far in in the space
and they've moved on and we've also been updating
the workshop because We learn things at Microsoft,
like SFI happened and there are new breaches
happening. We learn new things and we have new
capabilities to address these different things.
So we also keep updating the workshop to include
the new things we learn. And so they're able
to say, okay, we've come this far, but there's
also more that we need to do over time. So the
Zero Trust Workshop, covers a number of pillars.
We now have three, six pillars in there all together.
For the Azure folks, we have one of the new ones
we introduced is an infrastructure roadmap, and
there's also a network roadmap. So the infrastructure
roadmap is all about how you go about, you know,
doing all of the Azure side, looking at things
from servers, you know, all of the different
things you need to consider. for all the servers
and VMs you're running? How do you set up Azure
governance? How do you set up SIEM? There's a
whole streamline on containers. How do you do
the various Kubernetes containers, whether you're
following the zero trust practices when it comes
to that, and various services like Azure Arc.
And there's a lot of SFI learnings that Microsoft
had, and we've taken and put those in as well.
So SFI is really interesting because we at Microsoft,
and Michael, you'll know, we've been doing a
lot of things internally at Microsoft based on
SFI learnings. And just to make sure everyone
who's listening knows, SFI is a secure future
initiative. It's a big initiative that started
quite some time ago now. basically because of
some attacks that have happened on our network.
There's some big changes that we're making across
the board. So, for example, a really simple example
is apps that are registered that have not been
used in N months are basically deleted because
they could be a pivot point for an attack. So,
yeah, millions of unused registered apps have
been removed from the environment. Other things
like cleaning up passwords to use managed identities
and enter ID in general, but for applications
using managed identities, lots and lots of other
things. I could keep going forever, but just
so everyone's aware, SFI is Secure Future Initiative.
Yeah, and everyone, Satya said, security is job
number one for everyone at Microsoft. So if we
are assigned a ticket that's related to security,
we have to drop everything else and make that
the first priority and make sure we address it.
before we go on to the other things. So there's
a lot of learnings that we've had and a lot of
things that Microsoft is doing internally, which
a lot of people don't see outside. Like we do
publish a quarterly report of all of Microsoft's
progress in this. So we're very transparent about
what we've done. A good example is like one of
the attacks. the attackers used like a test tenant
and then they pivoted to a corporate tenant from
there. We've gone ahead and we've been shutting
down all of the tenants, like millions of tenants
have been deprovisioned. Now, if you need a tenant,
you can't even get a dev tenant easily. You need
to go through a whole process and the tenant
that you get even for dev work is like, it's
short -lived, like it has a... 90 -day lifetime,
then the tenant is completely deleted and wiped.
So you need to now, you can get a trial tenant,
but you need to create it every 90 days so that
it makes sure there is no lingering access. And
there's a whole bunch of policies that are pushed
to it as well, right? I've noticed that network
security groups, for example, have some strict
policies on them. I mean, and you get that for
free. Congratulations. But that's just it, though.
It has to be the default, right? If it's not
the default, then people won't... err on the
side of security, and if it's the default, look,
I'm going to be honest, some defaults can be
painful, right? They can get in the way. But
it's a secure default, and if you need to deviate
from it, then so be it. But at least that's the
default to start off with. And I think that's
such a critically important part of SFI because
the second major pillar of SFI is secure by default.
So, yeah, I've spun up a, like you said, gone
through all the paperwork and, you know. whatever
I have to get done to get a tenant. And yeah,
when I deployed it, I noticed there's a whole
bunch of really good security faults, which is
a good thing. Absolutely. And that's all based
on our learning. And for me, fascinating thing,
this is the first time I've been at Microsoft.
I haven't been here at Microsoft, you know, for
the whole trustworthy computing and the other
eras that Microsoft went through. I'm fascinated
by Microsoft, like from the leadership down.
like how relentless they are about going and
making sure it's all fixed like i've worked in
other enterprises before it's never been that
like it's more like okay it's the security team's
problem like they'll do it but here it's like
relentless the way microsoft executes on going
and fixing like even like years down the line
making sure that these things get addressed we
have features that take sometimes years to build
and you'll see a new feature pop up which was
because of what we learned during like even solarigate
you know things that happens back five, six years
ago, they went through and did the right thing,
like, over time. So that's been really fascinating
to watch from the inside for me. And it's a story
I don't think many people see outside. They just
see, like, you know, the reports and, you know,
other things. But it's a whole culture at Microsoft
that I really like, you know. I also want to
pull on that a little bit. I've seen a lot of
that where a feature... let's just say two years
in the future. It was on the schedule for two
years in the future. I'm making numbers up, right?
But they got pulled forward, right? They got
bumped up the list because of secure future initiative,
because it's a requirement. I've seen features
that didn't have managed identity support that
we're going to have eventually, but all of a
sudden they have managed identity support. Yes.
because of SFI. Yeah, that's really good news.
So really briefly, you said there are six pillars.
Can you just go through those six pillars really
fast and give me a couple of examples of each
one? Yes, yeah. So these zero trust pillars are
based on industry standards. Like you have NIST.
and others who have published the Zero Trust
Pillars. So the first one is identity. So in
our workshop, we don't even use the product names.
The first one is identity, which relates to Entra
and mostly about users and groups and all of
that side of things and access governance, access
to apps. Then we have devices. which is, you
know, what are the devices that people are accessing
their network from? Because when you use Zero
Trust, they're using some device, right? So mobiles
to laptops and so on. So that in the Microsoft
terminology is mainly about things on the Intune
side of the house. So how do you enforce, like
what I said, like BitLocker encryption on your
device? And have you rolled that out? Have you
rolled out Windows Hello for Business? You know,
the whole passwordless thing. And there's so
much more from the Intune side, like Defender
for Endpoint about securing the device on it
and all of the various XDR capabilities there
as well. So that's devices. Then the biggest
one is data and the most complex one. When you
say data, it's like all over the place. Data
from M365 in documents and emails to data in
Cosmos DB, in your SQL DBs. An organization has
data spread out across the board. And how are
you governing the data? How do you differentiate
what's very business critical to the chats that
people have on Viva Engage or Yammer? Some companies
just treat everything the same and they end up
having a weak posture because... they are trying
to put all of it in one bucket. But actually,
some things like your customer data needs a very
different sensitivity and encryption and things
compared to just a chat that you might have with
someone. So there is a whole pillar on data.
And the Microsoft story there is the Purview
side of the house and the capability that Purview
has. Then we have network. So network is like
the key, one of the big pillars. And Microsoft
now, we have our own zero trust network access
solution as well with intra -private access and
intra -internet access. So we cover all of what
you should be doing in that space. Infrastructure
is what I just told you about Azure. There's
a whole lot on the Azure side of the house, what
you would do. And the final one is security operations.
So it's a good combination of what people think
about from an Azure security on an Azure security
podcast. So the security operations is one of
the newest pillars we added. They go into all
of the Microsoft Defender suite of products and
Sentinel because you need to really be seeing
what's happening in your organization. You need
visibility. into what your users are doing and
also be able to track attackers, threat actors,
and so on. So that was one of the other newest
pillars we added. There are lots of services
there, all the MDA, MDI, MDO suite of things,
which is very comprehensive once you go through
all of that. We also have some really cool new
pillars that we are working on. Things like AI
and agents. So that's the new thing that's going
to be coming along. So we are working on adding
all of those additional pillars as well. It's
nice that it's so complete, right? Because a
lot of people think, oh, you know, just cover
this one thing and we'll be golden. But that's
never the case. Shall I give you an example of
why I say that? So my manager, Craig Nelson,
who was on the podcast some weeks ago, he's the
vice president of the red team at Microsoft.
He makes a comment which is, you own your terrain.
However, the terrain is different at different
layers. Networking terrain is different than
the identity terrain, which is different than
the app terrain, which is different than the
blah, blah, blah terrain. They're all different.
So it's fantastic that you guys are covering
all these things at different layers. Even though
they may all be at the application layer, they're
all sort of different. So that's really great.
So how do Microsoft partners fit into all of
this? Yeah, so that's one of the things like
we can't do this just by Microsoft. You need
a lot of SMEs. You know, you need people who
have the knowledge you have done these and deployed
successfully with customers. And when a customer
is doing it, they can get help from our partners.
So what we've been doing is we've been training
a lot of Microsoft partners on how to do these
workshops. And what I love is those practitioners.
They have done these things. They have helped
customers deploy these various solutions. They
have their own learning and knowledge. With the
workshop, they're able to take this blueprint
and bring their knowledge and expertise and then
scale it out to customers. So most of my team,
we work with the large enterprise customers,
but there are like hundreds and thousands. Like
the large enterprise customers are maybe like
10 % of Microsoft's overall customers when it
comes to the... products that people use. 80
% you would see like small and medium businesses,
you know, with 5 ,000 users, 10 ,000, even, you
know, 1 ,000 and less. So we need to be able
to go and help all of them deploy various things
as well. And that's where our partners come in
and partners at, you know, different scales.
So they are able to take these workshops and
then run it. We've been training and scaling
up all of our partners. on how to deliver these
workshops. And they've been sharing a lot of
feedback and helping improve the workshop as
well. Yeah, I mean, it's easy to be in the Microsoft
ivory tower sometimes. So I think it's great
to see other people chiming in as well. And I'm
really glad that you guys have made it essentially
technology agnostic as well, which is great.
So what's in the future? What are you guys looking
at? I mean, I have no doubt, no doubt that AI
has got some... It's somewhere involved in here
somewhere. Yeah, so there is an AI and apps that
we have, new pillars that will come to the workshop.
Another big part of the workshop is the assessment.
We have a very basic assessment today, which
tells you some things that you should do. But
there's something we are working on. We plan
to launch it with the next SFI report that comes
on. It's something I've been working on very
closely with because internally at Microsoft,
you've seen, right? We said, okay, apps shouldn't
be using secrets. And people have had to go and
remove all the secrets from their apps. We have
a way to track them and, you know, know what
they need to do. And our customers have been
telling us. look, it's good you are doing all
these things to secure your environment, but
we are also running Entra, we are also running
Intune and other services. Tell us how we can
secure, do the same things that Microsoft is
doing. So we've gone ahead and we've taken ISFI
learnings and we've published them. But there
are like 100 plus things you need to check as
part of SFI that we are doing from, you know,
the network zones to so much work happening at
Microsoft. So what we are trying to do is give
away for customers to run a script. We'll be
sharing with them like a PowerShell module that
they can run and they can get their own list
of, look, you have these 100 apps that have secrets
in them. These apps have secrets that are valid
for 10 years, which means anyone who's worked
at the company, they will have access because
if they have a copy of the secret and you don't
rotate your secret, they will have access even
if they are let go to connect to your environment
from outside. So insiders who are insiders today,
but they become outsiders and you have that threat.
factor as well so we're building this assessment
that will give you a neat list of these are the
issues we found very similar way to how microsoft
is running things internally with our internal
tools where we look and monitor and we enforce
you know the newer things based on our learning
so the assessment is something people can look
out for it's going to really help you you know
overall assess the health of your environment
and these pillars so that's happening another
big part of it is we are building we're taking
our product teams are taking these learnings
and building it into the product so we today
have things like we are building agents so using
AI for security so we recently published a conditional
access optimization agent in Entra because over
time we see agents taking on this role. You don't
want to have a large identity or access team
that is chasing up behind people to remove their
secrets and so on. So we have plans where we
can use agents that can do a lot of the heavy
lifting for you. Ones that have come out are
like Conditional Access Optimization Agent and
there is an Identity Access Review Agent that
launched as well. And there's a lot more coming.
So wait for Ignite where we will be sharing all
of that. So we are taking these learnings. We
want to build it into the product as well and
make it a lot more easier to do these things
where it doesn't have to be manual. You will
have agents that will help you and guide you.
uh do a lot of that so that is like the long
-term vision of uh of this right like you don't
we want to move away from having experts like
me being able to go and work with you know individual
logs to having a lot more being done by agents
that can help guide iams to you know improve
that it's like it's like having an sme uh in
this in each domain space that they can work
with easily But humans have the final say though,
right? On the agents? Yeah. Okay, fantastic.
I mean, I don't know. We'll have to see. But
right now, the agent proposes things. It even
says, okay, I've come up with, you have like
10 CA policies. We can actually collapse this
into one because they're doing a very similar
thing. And it proposes a new CA policy. So today
the human, like we need to say, yes, yeah, I
approve that. You can go ahead and create that
policy. So that check is there today. Nice. Well,
I think we covered a lot of ground, including
a lot of ground that I never thought we would
cover. But anyway, there it is, just the way
it is. So let's start to bring this episode to
an end. I think since last time you were on,
we added a new sort of section to the podcast
episodes, which is, you know, what does a day
in the life of Merrill look like? Yes. Yeah.
So for me, it's an interesting one and I love
it. working at Microsoft and my role is sort
of a remote role as well. So it's a fun role
for me to balance my family and work life. I
have four kids. They are mostly still in school.
My eldest just started uni. So it's been like
a full hands -on for me with having a household
with four kids and many of them teenagers. For
me, the day starts really early because I'm in
Melbourne. And like today, my first meeting was
at 6 a .m. And this is like my third meeting
of the day. And it's only like 8 o 'clock, 8
.50. So it starts early. But what I like is I
can then go drop the kids off at school so I
can take a break in between. go take them to
school, and then I enjoy a nice walk and then
come back and start my day. So it's like the
morning time is with all the Redmond folks and
most of my team. I get to do that. Then I get
to have a break. Then I work with some of my
customers in Australia because their daytime
starts, help them out and, you know, various
projects and work that I do. So for me, it's
very neat because most of the people that ping
me are away. because it's Redmond evening and
they're off for the day. So I get done with all
the meetings in the morning and I have the rest
of the day for me to focus, do like focused work.
So I get to enjoy that, go pick up the kids from
school. And like, it's a really good work -life
balance that I have. And yeah, it's a lot of
fun, enjoyable work at Microsoft. Yeah, it's
a key thing, right? Enjoy yourself. It's fun.
Yeah. So, all right. So if you had one, you are
familiar with this because we had it on the last
podcast episode with you. But if you had just
one thought to leave our listeners with, what
would it be? For them. One big thing I would
say is in this day and age when I don't know
if I'll have a job tomorrow because that's how
the world is working, you might be let go for
no reason of your own, right? It's not something
your manager or anyone else can control. It's
to really do things that will accrue to your
career, right? One of the easiest things is your
access to writing blog, creating content on YouTube,
sharing things, sharing your knowledge. And a
lot of people are like, they do a lot, they learn
a lot of things, but they never end up sharing
it. And with my Entra chat, I do a weekly newsletter
where I take all the blog posts and things about
Entra. And I post them in a weekly newsletter
I send out. I have like 15, 16 ,000 subscribers
to that newsletter today. And creating content,
you know, showing your expertise, even if it's
like you learned something new, sharing it on,
you have your choice, right? Like you can pick
from LinkedIn to Twitter, whatever it is, sharing
that knowledge, writing blog posts on things
you learned, but you can make it generic. So
it doesn't need to be a company specific thing.
all of that accrues to your career, right? In
the future, that's going to help you stand out
when you are going to apply for a job. Because
I learned this, I was working before, like for
about 12 years in a company. I got let go. I
built a fantastic network within the company.
But the day I was let go, I had to then apply
for a job and do a resume. And there's no difference
between me and someone who might be, you know,
coming in new. someone had to read my resume
to know the difference and i was like there's
a lot i put in and i i lost all of that when
i left the company right like you lose complete
access to things within the company so for your
career you should try to build your profile outside
of your work like this will accrue for the rest
of your life like i'm towards the later end of
my career but for everyone starting out new you
have to have to get your sort of voice out write
blog posts, share things with the community.
If you can, you know, when there are calls for
speakers, apply and go and talk because you might
think you don't know much, but the little that
you know, the experience is something definitely
that at least one or two other people can learn
from. And just share that. It can be... It doesn't
need to be a blog post or a long YouTube video.
People have different specialties. The way I
got into social media is I created these small
diagrams of things and people love images and
diagrams. So I take some complex topic and I
say, hey, this is how pasta -sync works. And
I just do a very small visual and that helps
people, you know, learn something, which in the
day of, you know, micro -scrolling and so on,
you get that. my tip for everyone is this like
do this work you the payback it's like you know
depositing early into your savings account or
in your bank because it'll stick with you for
your entire career and it's something that will
open new doors new friendships uh take that extra
time your your work with companies there's not
much you know loyalty anymore you might be told
tomorrow like you know this is the end you you
need to find your own way so do things that will
accrue to your career. So that's my tip. It's
your portfolio, right? It's your portfolio of
knowledge and expertise. And the other thing
I want to point out, you raised something really
interesting there. You'd be surprised if you
don't think you're an expert at something, but
you put out there, hey, I did this thing today
and I learned this and I didn't think about it
this way. It's interesting how many people look
at things from a different perspective. And sometimes
you may read something where someone wasn't an
expert and said, hey, you know, I did this thing
today. And did you know it did A, B, and C, but
only if X, Y, and Z are set? And then you look
at it, you're like, oh my God, that's why I'm
having the problem because X, Y, Z are not set.
I didn't realize that. You'd be amazed at how
many times that kind of thing happens. So you
don't have to be, I often joke that being an
expert is just being one page ahead in the book.
There is some truth to that. And I agree a hundred
percent. You need to be writing things and posting
things and not being an idiot about things either.
I mean, if you, you know, stay technical, stay
professional, um, cause that stuff lasts forever.
So yeah, write things, book blog posts, come
on, come on our blog, you know, on our, on our
podcast, you know, it all, it all adds up. So
feel free to reach out. Like I get people reaching
out asking, Hey, can I come on your podcast?
I asked him, you know, what's interesting story
you have? Like a lot of people fear that and
rejection, but I mean, I do have to say no, because
I can only have so many guests, but like shoot
your shot, right? Like you have nothing to lose.
You just need to keep reaching out to people
and create your brand that then helps you. get
get on to podcasts and people go like he's doing
interesting stuff share your scripts uh you you're
writing scripts today at work you know take that
make it simple and just post it share it on a
blog post you can spin up like your like there
are so many free services from substack to uh
you know wordpress and blogging and like you
know notions uh you are like spoiled for choice
pick something, pick just even LinkedIn without
scrolling, like people consume content. I like
what Scott Hanselman says, right? Like you go
from being a consumer to creator. So one of my
New Year's resolutions like many years back was
I'm going to create content more than, not more
than, but I'm going to at least spend a little
bit of effort. creating content well there's
a lot to consume right there is a lot to consume
and in fact you could spend all day consuming
you can you could spend your entire life consuming
yes and i i really like that we need more people
like you and other people creating and you know
rather than just consuming consuming is very
passive exactly and you can find your own niche
right like you don't need to have hundreds and
thousands of followers right like that doesn't
even need to be a thing But I focus only on Entra.
When I started on this journey, I was like, I'm
only going to focus on Entra and I only focus
on a very specific part of Entra as well. But
it's so wide, right? You don't need to be very
generic. The more you're focused on a specific
area that you're working on daily, you will connect
and you'll find others who are doing the same
thing and you'll build these relationships. I've
now built so many relationships with people from
like from Germany to Denmark to even in Alaska,
like different parts of the globe that you wouldn't
imagine. And we worked on projects on like we
published open source tools, just pinging someone
and saying, hey, I saw this and chatting with
them. And you do amazing things. And it's a lot.
It's very rewarding and it stays with you. It's
not. it's not your career or a job that you have
and then when it suddenly ends you're like like
you you lose your identity um this stays with
you for a long time so that's that's my tip like
a takeaway yeah like create content like i give
this advice to everyone i see but i see very
few people following through so the competition
is really non -existent right For those who are
creating content, you can just start today and
you have a long career ahead. It doesn't, you
don't, it won't become like, like overnight sensation,
which people do, right? If you do some really
cool black hat presentations and so on, but you
can start small and, you know, it will open doors
that you cannot imagine. Like it's done for me.
Yeah. I mean, you can have like, it doesn't have
to be in black hat, right? It could be like a
local thing, you know, some local, bunch of people
get together on a every month or so and talk
about tech stuff you can talk about the thing
that you know excites you and you're you know
you're knowledgeable of you don't it doesn't
have to be black hat or rsa or anything like
that all right let's bring this to an end it
was supposed to be all about the zero trust workshop
but i think we actually covered a lot of ground
um but i think a lot of good ground a lot of
important ground so i'm very happy that we had
this uh we had this time together So with that,
let's bring this episode to an end. Meryl, thank
you again for joining us. It's always a pleasure
having you on the podcast. And to all our listeners
out there, we hope you found this episode useful.
Stay safe and we'll see you next time. Thanks
for listening to the Azure Security Podcast.
You can find show notes and other resources at
our website, azsecuritypodcast .net. If you have
any questions, please find us on Twitter at AzureSecPod.
Background music is from ccmixter .com and licensed
under the Creative Commons License.