Are you using Microsoft Sentinel? Richard talks to Cloud Security Advocate Sarah Young about Sentinel, Microsoft's Security Information and Event Management (SIEM) solution. Sarah talks about the role of the SIEM in creating a common place for all security-related data to arrive. She mentions some of the many tools in the Microsoft suite to feed into Sentinel - Defender for Endpoints, Identity, and Cloud as examples. Specialized analysis tools send summaries to Sentinel, but Sentinel can also process raw logs as well - make sure you need the data because billing for Sentinel is connected to the number of ingress sources. There's a lot to learn, but also a lot of great documentation and information to work from. Check the show notes for links!

Links:

• Microsoft Sentinel
• ArcSight
• Defender Security Alerts
• Defender for Endpoint
• Defender for Identity
• Microsoft Digital Defense Report 2022
• Defender for Cloud
• What is CSPM?
• Security Baselines Blog
• Microsoft Security Copilot

Recorded April 6, 2023

Are your finance people suffering from Azure sticker shock? Richard talks to Aidan Finn about his experiences with organizations discovering they spend far more on Azure than expected. Aidan talks about designing systems based on on-premises requirements where hardware is over-provisioned, and new features in Azure are added without a thought to cost. Getting finance involved in an Azure migration from the beginning can help mitigate the shock and balance features and costs. Plus, there are great tools for cost management in Azure that can allow for budget projections, catch unusual spending early, and point out opportunities to save money with specific services available today!

Links:

• Azure Firewall Premium
• Azure Advisor
• Cloud Adoption Framework
• Azure Pricing Calculator
• Microsoft Cost Management
• Azure Monitor
• Azure Reservations
• Azure Hybrid Benefit

Recorded April 6, 2023

Is your organization ready to respond to a security incident? Richard talks to Paula Januszkiewicz about her experience helping organizations respond effectively when a security incident occurs. Paula talks about detection - attackers often have breached your infrastructure months before their attacks become visible. Once you've detected a potential breach, the next steps are to determine where the breach comes from, or as Paula says, who is patient zero? And what are the indicators of compromise? It's not enough to slam the door shut on an attack - how do you keep it from happening again? The conversation explores the idea of threat hunting, of understanding what the black hats are doing by being able to respond effectively to isolate exploited machines but not necessarily shut them down. An attack is an opportunity - seize it!
Links:

• Cqure
• Attack Surface Reduction Rules
• Local Administrator Password Solution
• Security Information and Event Management
• Azure Sentinel

Recorded April 4, 2023

Is your Exchange server one of the vulnerable ones? Richard talks to Gareth Gudger about the ongoing security concerns around on-premises Exchange servers. The conversation addresses a blog post by the Exchange server team about restricting access of potentially vulnerable Exchange servers to Exchange Online. But, as Gareth explains, this has to do with hybrid Exchange, where your on-premises server can access Exchange Online in a privileged state. What is the right thing to do to limit exploits in Exchange? Keeping up with the latest versions, patching, and ultimately maintaining your entire infrastructure, especially Active Directory - all play a role in securing on-premises infrastructure. Stay vigilant!

Links:

• Blocking Email from Vulnerable Exchange Servers
• Tony Redmond's Comment on the Blog Post
• Deprecation of Remote PowerShell
• Re-enabling or Extending RPS
• Exchange Online PowerShell v3
• Exchange Server 2013 End of Support
• Turning off your Last Exchange Server
• Office 365 for IT Pros

Recorded April 4, 2023

Moving to Azure Virtual Desktop (AVD) has never been easier! Richard talks to Jen Sheerin about her work with the Azure Virtual Desktop Accelerator tools. Jen describes how moving workloads to AVD is part of the Cloud Adoption Framework that helps you integrate virtual desktop workloads with standard security and licensing practices. The conversation explores the different folks who use the accelerator - even for greenfield implementations of new virtual desktops! There are more great tools to help you optimize your AVD implementation. Check the links in the show notes!

Links:

• Azure Virtual Desktop
• Remote Desktop Services
• Microsoft Cloud Adoption Framework
• AVD Remote Desktop Web Client
• Bicep
• Azure Virtual Desktop Accelerator
• Virtual Desktop Optimization Tool
• Windows 10 vs Windows 11 Benchmark
• License Universal Print

Recorded April 7, 2023

Large Language Models like ChatGPT are all the rage, but how will they impact work going forward? Richard chats with Paul Thurrott about the role of LLMs in the Windows ecosystem. Paul digs into the history of ChatGPT and how this whole wave of technology started more or less by accident until Microsoft grabbed on and created BingAI. Now with announcements for Copilot for security and M365, where else can the technology go? The conversation digs into the power of having a tool that can help you make sense of all the products you own and to go down the checklist of the right things to do when taking on a new task. We're still in the early days for large language models - the next version of Windows should be interesting!

Links:

• OpenAI
• Microsoft Security Copilot
• Microsoft Viva
• Microsoft 365 Copilot
• Removing the Bing Button from Microsoft Edge 111

Recorded April 3, 2023

The demand for effective data analytics within organizations continues to grow – how do you build your analytics team? While at SQLBits in Wales, panelists Maria Zakourdaev, Falek Miah, and Anupama Natarajan discussed their experiences with building teams - from recruiting to training, up-skilling, and retention. The discussion spans the different roles, including architects and data modelers, that help to provide the data sets analysts need. Do you train from within, hire into the role, or use consultants? There are many choices for growing your data analytics team!

Links:

• SQLBits

Recorded March 18, 2023

Ready to get some zero trust security inspiration? Richard chats with George Finney, author of Project Zero Trust, a fictional narrative about a company dealing with a security breach and the efforts to make the company more secure. George talks about the challenges of being a security professional and learning to speak to leadership in terms they can appreciate in their efforts to improve security overall. The conversation digs into the reality that security is about people, most of all, not so much as the problem but as the only viable solution. Want some help getting more resources for security? Read and share this book!

Links:

• Project Zero Trust
• Zero Trust Maturity Model
• Well Aware Security

Recorded March 21, 2023

How do you measure the productivity of your team? Richard talks to Angela Dugan about her work at 3Cloud, supporting groups that are primarily work-from-home and working with remote clients. What do you measure when you can't be face-to-face? Angela talks about using objective and subjective measures - time spent on a project- and how people feel about the work they are doing and the people they are doing it with. The conversation also turns to skill growth as part of measuring a team - making new skills portion of the work, sharing them with the team, and growing your value as an employee!

Links:

• Microsoft Viva

Recorded February 23, 2023

Are you ready for more IPv6 in your life? Richard talks to Pierre Roman about recent support added to Azure Active Directory for IPv6 - specifically around Conditional Access. Pierre talks about how in the past, IPv6 addresses weren't a part of Conditional Access - but now they are. This could cause problems for folks connecting to an Azure tenant via IPv6 if those IPv6 ranges aren't included as named locations. Even if this update hasn't impacted you yet, it can - changes to your ISP or when connecting to the internet can result in IPv6 access being required - don't get locked out!

Links:

• Google IPv6 Adoption
• Pierre's Blog Post on IPv6
• IPv6 Support in Azure Active Directory
• Azure DNS FAQ

Recorded March 27, 2023