Cloud, Security and Technology

In the past several blogs I introduced the work I've been doing associated with the Azure Secured Workstation. I note that this solution IS an ideal 0-trust protection model that any organization looking to protecting key roles and service administrators from compromise is a must. And as this Zdnet's article identifies attacking a weak link is still the most prevalent means to get into your network. In the article the Robin Hood ransomware was deployed using a targeted attack, and the installation a malicious driver. In this case the vulnerability in the Gigibyte driver makes the job of the hacker much simpler, but it's clear that if the targeted user (most likely an administrator) was using an isolated identity to manage their network, malware described in the article would fail to extend its foot hold in an organizations network. What should you do. First and foremost - create a new identity domain/forest. This can be pretty simple thanks to cloud compu...

The update to the Secured Workstations Reference Architecture was released this week, and reflects the addition of several Key updates include - Here's the new content in summary: Setting up WAF blocking all outbound connections This is an interesting section that was provided by a colleague who helped define a set of white-listed URL's and by design block all other traffic. I'd note this is a benchmark of URL's you can use and block when managing Azure.   Improved conditional access Conditional access is also important to ensure that workstation is the only way you manage your Azure subscription. The addition addresses the limitation of managing your cloud from ONLY a secure workstation, and prevent legacy protocols that may not be as secure. Setting up ATP, sentinel for monitoring Detecting and monitoring your network with the newly minted Azure SIEM. Sentinel offers a great way to agriggate your detection platform. This also provides a good means to co...

Two months ago I introduced the Azure secure workstation, and I’ve had the privilege to present the ideal to some great audiences. From the discussions, a common question I’ve been asked is a pattern that would provide the Secured PAW model lock down scenario to exclusively manage an Azure Portal (EG how to I assure only secured workstation, and users assigned to the program can manage my cloud services)? In this article I’ll provide the NEXT step to accomplish exactly that outcome. This includes additional configurations that I only lightly covered, or net new technology to apply since the publishing of the doc. Proposed outcome “ How do I” Use a Secured workstation (that I can trust) to manage my Azure cloud. Here’s how I would deploy the solution. First I will start by deploying the Secured Workstation model this using the secured profile. New technology, and capabilities to add: Hardware root of trust – in our solution we post the idea that you can...

A Shared responsibility journey requires that you consider how you use the cloud. A while back I discussed the need to make sure you understand the responsibility you share with your cloud provider and consider that in cloud your responsibility to mange your services changes based on the cloud model your considering. IaaS, and PaaS you need to look at protecting network, and applications, which requires that you build with SDL in mind. In all services you need to ensure you design and implement good authentication, and authorization. This can at times be as simple as enabling 2FA.  In the blogs I've published I've noted that the device you use to connect to your services also needs to be designed and configured correctly. This includes your development workstations, and administrative clients. This is essential since there is very little guarantee that the device you use is already owned, and managed by an hacker.  If your lucky they will only mess with your workstatio...

Last month I finished a project with the Azure team that involved building a secure PaaS based solution that provides a step by step guidance and automation to allow researcher to be able to use Machine Learning to run scientific experiment securely. Key thing here is that it's built to be /Secure/ Problem Most times when a traditional experiments are run, an experimenter or researcher starts with a data set they got their hands on, and uses tools such as Jupyter notebook to create an R or Python based experiment. Frequently this experiment is using a simple data science VM or a workstation. The scientist will then run the experiment (which maybe computationally intense) and turn to a cloud solutions to score the experiment in Google or Azure, and finally run Tableau or PowerBI or Excel for visualization. Since researchers are not security experts and do not think that what they are working on should consider their work as possibly sensitive they may expose their work...

I've been asked several times as to what are the building blocks to build a secure cloud solution. In my last 2017 blog I revisit the paper I wrote a while back called " 13 Effective Security Controls for ISO 27001 Compliance " and reconsider the 13 security measure that help meet compliance controls. One important update for this blog over the paper, is that I will not look at IaaS services a whole lot. Protecting a OS or VM has been done to death.   IMHO organizations need to get out of the business of managing the health of OS's/VM's and WebServices.  Moving to Containers with an orchestration engines such as Kubernetes , or Platform such as provided by Azure, or AWS is one of the best long term security investments. No more AV, Patching, or Host services maintenance…  The process is to get most companies away from the IT business, and into their core competency with a High tech offering that provide a capability on demand. Moving...

Wow, the PCI DSS blueprints been out for almost 2 months! Time for an update. Our friends in the App Services team recently released a new version of ASE.  and we incorporated it into the blueprint. As of now the Azure PCI DSS blueprint is built with ASE v2. Here's what  ASE v2  App Service environment introduced. Here are the newest features. Faster deployment  Offers a more effective pricing model Built in flow management, no need to build your own worker pools anymore It has 100 workers over the 50 in V1 Twice the memory, and much bigger size for the workers  Hope you have a chance to try it out!

A while back I worked with a great Architect general guru of secure code. Adam Shostack who is a foremost expert when it comes to threat modeling . He does a great job in help educate us all in how you should plan a secure solution before you build it. A threat model should be seen as a key design element before code is started, similar to a floor plan in a house design. In this blog I wanted to illustrate the value and methods required to build a threat model, and tie it back to work I recently published, Payment Processing Blueprint for PCI DSS-compliant environments which included sample threat model for a cloud based PaaS solution. Wow, that’s great a free starter threat model to an architecture, what else can you ask for? What does it take to create your very own threat model? Think like an attacker, it’s important to see the problem from the attackers point of view when designing, or architecting a solution. For instance that includes thin...