[Music]
all right let's get
going you all made the right choice glad
you're
here I mean it's either this or
Hollywood Video so you got to make a
choice either way
right um Okay cool so we are going to
talk about a lot of things in a short
amount of time so I've prepared a lot
more content than I have available to
talk about in a deck which is this and
uh made it available to you immediately
after this so right after this go ahead
and download it and uh some of the
slides I'm going to just kind of bust
through pretty quickly and just kind of
leave it there as a reference and some
of them I'm going to focus on kind of
spending some actual time on on so U I
want to give you more information than
less so I'm going to focus on giving you
more information and then as we kind of
move through some of these some I'll
just kind of hit very quickly and some I
won't so little bit of an introduction
on me uh my name is Nathan lesnoski I'm
the CTO for concurrency I've been in
Milwaukee
for TW 24 years I started Consulting 21
years ago I'm the CTO for concurrency
it's about a 160 person consulting
company we probably work with a lot of
you already I know a fair number of you
in this audience um I am uh I've been
largely working with Enterprises for the
mo majority of my Consulting career
usually around the kind of like 5,000
user kind of up kind of organizations
with these same Concepts apply across
the stack um do a lot of work in the
Microsoft space I'm a 13-time Microsoft
MVP um so what that means is I just get
really involved in the community doing
things over the last 13 years and that's
been a huge blessing to me um I am am a
father of eight uh that's my that's my
wonderful family up there my daughter is
here for the first time she's actually
not in the room uh she thought someone
else's presentation is much cooler than
[Laughter]
mine um so yeah I'm I'm a father of
eight I'm also a triathlete so I I I do
Iron Man uh 140s and uh there's been
something really interesting that I've
learned from being in tech for as long
as I have and um uh being triathlete is
that there's always someone smarter than
you and there's always someone faster
than you so uh and that person who's
faster than you than me has now become
my daughter uh which is a a point of
Pride or embarrassment depending upon
the day um but I think what's what's
really interesting about that to me is
that this is just an opportunity for me
to share the little bit that I've I know
from coming about this and Consulting
some things that I've learned some
things that maybe I haven't learned and
for you to take advantage of that but
I'm sure all of you know tons of things
that I don't know so it's just simply
opportunity for me to share a little bit
about what I've come across and
hopefully for that to be a benefit to
you and kind of hopefully vice versa and
we get to know each other a little bit
more so I'm going to spend uh this hour
talking about five architectures that I
if I if I had known about these
architectures or had learned about them
earlier I wish other business had
learned with them earlier they'd be in a
position to be able to mitigate a lot of
the ransomware and other issues that
they run into in their organizations so
things that I have this sort of like oh
what if they had just done this you I
think all of us have had those
experiences uh hindsight being 2020 so
my goal is simply to share some of those
with you I've tried my best to make them
very top you know uh topology oriented
so every one of these I focused on
giving you a diagram in accompanying
some of that with text so leverage that
diagram as you try to go to work and
attacking some of these and I've started
from like most likely bad things to
happen to a little bit more aspirational
bad things to happen how's that so right
at the front here we going to try to
talk about what's the most likely thing
that you should be trying to protect
yourselves against and how do you do it
and then at the tail end is going to be
more like hey there's some things that
are kind of coming down the field that
are interesting to us but may not happen
tomorrow but are still interesting for
us to be considering sound good all
right cool so first conversation we'll
dig into here I'll spend about 10 to 15
minutes on each one is modern and user
Computing and I think this is probably
the most interesting thing for us to be
talking about because I was actually I
was explaining this to my daughter
earlier today and I said something to
the fact she like why why are so many
things being hacked why dad you know why
do so many things get compromised so you
know I we train puppies as a family
interesting right uh my daughters have
trained 25 puppies in the last year they
train them for two weeks and then they
return them to their owner and uh I said
Maddie what what would happen if you
took four puppies and you put them into
one crate well we do this at dinner time
because like we need to break and we put
them in this crate it's a big crate and
she's like well they just get they they
they they rustle and they tussle and
they fight with each other blah blah
blah blah blah I said well what if you
put like little things they had to jump
over in that crate and you let them kind
of keep you try to kind of prevent them
from getting in each other's faces she's
like oh they just jump over them they
just get around well it's like that's
kind of what cyber secur has been like
for the last 21 years of my life has
been we kind of put everything in one
crate and we make these little barriers
around the crate hoping it's going to
keep things from interacting with each
other and we just ultimately fail
because we're our architectural model is
wrong our architectural model for
keeping puppies from interacting with
each other is probably put them in four
separate crates right it's just sort of
logical but that's not how we work when
we design Enterprise networks our
Enterprise networks tend to look like
one gigantic crate with maybe a couple
little Hoops that things jump over so
when I think about the two most
significant bad things to happen to you
a lot of us like to think about AI is
going to take over the world and I'm
sure Elon Musk has got a lot to worry
about but what the most significant
things that I see happen in
organizations is just pretty simple
stuff ransomware and targeted attacks
ransomware being the majority of things
that people get compromised by and when
I have a customer that comes to us and
this has been either thousands of
computers compromised a couple hundred
computers compromised the entire OT
Network compromis it's usually because
some guy's laptop got taken advantage of
and it moved from person to person to
person to person and then it compromised
something more important and then that
moveed to something more important and
then they compromise the actor directory
and Bam they're done right the same kind
of story that a lot of the guys around
here that are lot smarter than me will
show you how to do in real life what I
care about is how can I architect out
these problems and that's kind of what
we're going to get into so that idea of
lateral movement right all of you guys
are Security Professionals you're very
aware of that this this is the problem
that we deal with the interesting thing
that I've run into and I've probably
been in every Enterprise organization in
Milwaukee is pretty much nobody's got
that locked down this situation that if
I do compromise something on your
corporate Network the ability for me to
sit there for a long time and you not
know it and move around that network is
pretty bad and most of the time when I
talk to cisos it's like yeah we had our
yearly you know red team pent test or we
had this pent test that got done and we
did really better than last time it took
us only two days to get compromised as
opposed to 24 hours like okay that tells
me a little bit about you and about how
you relate to everybody else so
everybody here has probably heard the
word zero trust right okay this has
totally become a little bit of a
buzzword in a sense and I think part of
the reason why it's become a buzzword is
because it's these are good things so
everybody gets on board with it but few
people have actually taken it to become
more of an architectural model they I
mean the idea of assuming breach the
idea of verifying in the idea of least
privileged a makes total sense but I
think what's really going on here is
they try to apply this to an existing
architectural model and just trying to
put more little jumps in front of the
puppies to keep them from talking to
each other rather than trying to
implement something which is
architecturally more sound and brings us
to a better space so I think this is a
little bit of a better diagram now I I
want to proxy something for a second I
work primarily with customers that are
imp M menting Microsoft technologies
that doesn't mean this is irrelevant to
someone who's completely a non-microsoft
shop there's equivalent Technologies to
allow these same scenarios so you'll
notice I have something like Azure ad on
there okay cool we'll talk about Azure
ad but let's say you're using Google's
platform okay cool we can talk about
that too let's just think about this in
the context that it could be any one of
these
Technologies okay so I'm going to sit on
this slide for a minute hopefully you
can see it in the back because I think
this is the most important slide I'd
like you to leave the meeting this this
whole conversation with so one of the
things that is probably the most
critical activity is to come up with a
way to prevent our crown jewels from
being
compromised now there's two states that
those crown jewels could be in they
could be Legacy workloads think Windows
domain join virtual machines think your
OT Network think the kind of traditional
workloads that are running on your ibms
and I series things like that and then
there's the modern workloads that you're
you have people building from the ground
up kubernetes uh SAS based platforms
situations where platforms are running
in U app Services things like that so if
we go to this sort of ransomware
scenario the things that we're mostly
being taken advantage of right now the
things that are just the most obvious
problems we need to deal with it's what
can we do to make ourselves in a better
position well the best thing that we can
do is get the laptops devices off the
corpet you know people say hey it be
great if not for the users well security
would' be great for the users too
right when we have our our workstations
living on the corpnet what happens one
gets compromise it moves to another
moves to another moves to the server
environment and moves
off the organizations that have been
really succeeding at protecting the
crown jewels protecting the server
environment have been taking the anused
Computing devices
and moving them off the corpet to their
own environment that is as you could
call it a guest Network you can call it
a home network you can call it whatever
but this idea that safety is coming out
of me VPN into something or being on the
corporate Network it didn't work 20
years ago and it certainly doesn't work
now so how do you go about doing that
well let's say you're starting an
organization that has no Legacy
environment now that is probably zero
view that happens to be
us but it's probably zero
view what you can do now is you can take
an end us your Computing device that
Ander Computing device does not join
ever to a Windows domain joined actor
directory that sits off a corpet not on
any it's on a guest Network or just call
it
anything isolate that device from every
single one of its friends your network
by default doesn't allow anything else
talk except to the internet that device
becomes Azure only joined or some other
identity but it's Azure only joined this
is not Windows actor directory joined
meaning it's not hybrid joined it's not
legacy Windows joined it's only Azure ad
join only to the cloud that then is
managed by some kind of cloudbased
management tool CL of course Chromebooks
operate that way today right we already
know that for school networks but that's
running on some some kind of cloud-based
management tool that allows us to focus
on SAS applications off 365 or Google
Cloud Print
scenarios in this case we're talking
about a organization that has zero on
premise dependencies all my come all my
collaborations in the cloud all my
communication my apps are in the cloud
that happens to look be my organization
today we have 160 some people we have no
on premise Network it's all cloud-based
capabilities and blah blah blah blah
blah right there's no file servers it's
all gone now what the hell do you do
with a regular old company that has all
the rest of the stuff right that's
really the big problem right like yeah
easy for you to say talk about every
Enterprise that doesn't have that going
on okay now what you can do is have your
workstations not at not Windows hybrid
joined not joined to the windows actor
directory domain that's really what it
means and facilitate authentication
through Azure ad or through another
authentication mechanism to your on
premise targets game one is can I
eliminate my file servers because that's
the biggest boat anchor that's tying you
down the second thing is can I
facilitate access to Legacy applications
in a way that doesn't require me to
access that application via a VPN can I
Silo it off and facilitate conditional
access only to that application
basically my goal is facilitate some
level of proxy that prevents me that
allows me to access Legacy applications
and Legacy file server content via some
kind of published vehicle whether that's
Citrix or an avd published laptop or a
proxy vehicle there's a lot of different
kind of hybrid vpns that exist that can
take a modern end user device never
physically on the Corp net and allow it
via some kind of Internet vehicle to be
able to access these published endpoints
and the benefit of this and I can't
stress it enough the benefit of this is
that when this device is compromised it
creates a substantially more difficult
way for it to have to for it to be able
to compromise servers and F and and
applications that sit on your Corp net
because traversing from that point
requires a lot more checks a it's not on
the Corp net to begin with B it requires
conditional access in order to move from
point A to point B so this is a
fundamentally different structure that
is predominantly focused on creating a
from internet out internet down a
approach to accessing these applications
and moves away from this idea that
things just kind of are all on a Corp
net and are because they're contiguous
that allows them to talk trying to move
away from the contiguousness is really
where the modern Communications and uh
Communications environments are moving
and especially provides us the ability
to insert different protections around
this structure so this is something that
you know sort of obvious when you're
accessing Office 365 or SAS based
applications because it's just how it
works today it's not obvious to us
because we're still kind of hanging on
to some of these file server Legacy
environments that require that
contiguousness but if you make a hard
line and I'm working with organizations
that have 20 30 40 50,000 users that are
going straight to this model right now
or already on it what this means is that
one of their when one of their endpoints
is compromised their ability to isolate
that endpoint from someone else is
substantially increased over the ability
for them to isolate it when it's sitting
on a corpet and communicating so that's
sort of architecture one
now the components of that that make
that possible are some kind of
conditional access and there's a number
of technologies that facilitate that
conditional access being like required
thing one on you know do I know what the
device is is it managed is it healthy is
the user of the who they say they are is
the user healthy all those elements go
into whether or not I can facilitate and
move through that chain so I'm providing
all these chances for me to have a
killchain from point A to point B
through to that manag Network second is
that that's a modern desktop it's it's
Cloud joined it's in the context of
being Cloud joined it's then facilitated
to access different properties based
upon that cloud join authentication and
authorization and then as we get to the
data center conversation there's micro
segmentation happening on the back side
of this story as well which is more the
sort of data center conversation that
we'll talk about
next so this is sort of a comparison
between uh classic desktop
configurations and what you would call a
modern desktop configuration classic
being this idea of has to be
contiguously on the network it's this
sort of secm configuration manag or
managed name your other on- premise
management tool ecosystem um it's the
sort of high touch ecosystem our goal
with the modern desktop is essentially
to create replaceable endpoints that
have nothing valuable to them except the
fact that I authenticated to it and if
something's down it's broken I threw it
out somebody stole it I get a new one I
give it to them they access all their
stuff again and for the things that
we're already accessing through you know
G Suite or Office 365 or whatever have
you that's pretty obvious we already do
it today what we're trying to do is take
that same model of replaceability and
bring it to how we access those Legacy
apps instead of placing these devices on
the Corp net and making them their own
little special
snowflakes um also want to show you this
um if you haven't uh kind of read
Microsoft's Direct ction on sort moving
to Cloud manage this is sort of
complimenting the architecture I just
mentioned um there's a similar story for
some of the other Cloud identity
providers sort of State one is your
attached that's pretty much everybody
who has M365 right now if you're doing
hybrid join many of you probably are
that simply means that you are windows
actor directory joined and aure actor
directory join at the same time um there
is no supported way uh to move from a
hybrid join device to a Azure 80 only
join device except using some really
complicated transposing with profwiz
totally sucks um we figured out how to
do it but it's not it's not great so the
the best journey to sort of the cloud
only attach is new devices you know
you're rolling out new devices azurea
only joined it works and you kind of
figure out that like 75% of users could
do this tomorrow and there's like 25%
where it's a really big pain in the butt
so that process ends up being you know
part of the journey um ultimately then
you're trying to get to this point where
you're minimizing the windows act
director domain controllers because they
represent really your biggest compromise
point I mean if if there was one thing
that we're trying to prevent why why do
people want to be on my Corp net a it's
where much of my data is but B it's
where my identity is and if I can get
behind the identity of course that's
what a lot of people other of these guys
will talk about is I'm able to
compromise quite a bit so that's where
we're trying to avoid so there's a great
side in this AKA Ms A2 aser ad uh great
uh great story similar story with uh you
know other identity providers of course
moving to passwordless off U many of you
already started to get to this point um
you know it's interesting I didn't I
think one of the things I've most been
impressed by is the sort of move to even
like number matching in the context of
of passwordless off on multiactor I I
don't know if you realize what
percentage of people will prove a
multiactor off prompt on their phone
without ever looking at where it came
from um but it's ridiculously high um
and if you consider how much of your
personal apps uh you know people will do
that for it's gotten to a pretty bad
state so even with that uh you know the
advancement of passwordless au is pretty
pretty important to the same story
because then once you move away from the
idea of of uh you know contiguous
corporate joint devices to more of cloud
join devices what you end up dealing
with more and more is just how important
conditional access and ident identity
really is to the rest of the story um in
gaining skills
here okay so identity governance uh
something I'll you can check out later
same with some tips in moving to Modern
uh modern State um and then uh this is
some of the blockers we've seen I want
to hit this really quickly
um ironically the things that kind of
keep us from moving to this our
traditional file servers are probably
the most significant thing because some
some companies they haven't moved to
cloud-based collaboration yet which is
like holy cow you haven't done that yet
but like a lot of them have these just
like really traditional file servers you
find out that like that ends up being
the biggest blocker but because most
companies have kind of moved to Modern
collaboration and the file servers end
up being kind of like these like boat
anchors for more traditional things you
can kind of make that a like side thing
um that only a subset of the users
really have to deal with like if you
give a new sales rep a device without
having access to the file servers a lot
of times you can get away with that
whereas maybe sometimes the engineers uh
they might need that so you can start to
take like Parcels of your organ
organization and get them Cloud
only okay next architecture is uh cloud
data center architecture you could take
the same concept into on- premise data
center architecture if you really wanted
to um understanding that you know same
security Concepts apply what I'm really
contrasting this against is like Legacy
data center architectures so when I
think Legacy data center architecture I
think everything's on a VMware cluster
every server can talk to every server
for the most part and we have no idea
what should talk to what it's really
kind of the key problem and ask yourself
the question of why have so few
organizations truly micr segmented their
data
centers it's because it's hard it's
difficult right I I have to have all
these application owners know what talks
to what well what I found is that when
companies move to the cloud I have to
figure that out anyway way so when I'm
doing a cloud migration or a company is
starting to load new workloads in the
cloud that is the number one time to say
stop this is a point where we can decide
and understand what should talk to what
and establish a cloud architecture that
establishes isolation within our
organization rather than allowing
everything to talk to it talk to
everything so a lot of these companies
it's like it's it's it's really too bad
like I was I was talking to a company
the other day they spend about $3.5
million a month on azure
and they had loaded everything into just
a big
contiguous Cloud environment with a
couple big subscriptions everything can
talk to everything they had no network
security groups nothing built out it's
like holy cow man like you missed your
shot like you had to talk to every part
of your organization to do this move and
you just missed it and now you now now
good luck going back and talking to
those parts of the business to try to
make a new change that's a breaking
change in their environment it's tough
so when I look at companies migrating
you know there's really these three
states the Horizon one state which is
what you'd call that Legacy data center
operation State everything talks to
everything this Horizon 2 state is we
have virtual machines whether they're
migrated to the cloud cloud or like some
on Prim sort of cloud equivalent that
are in a modern operational State
meaning infrastructure is code is the
how we did the deployment meaning they
have micr segmentation applied meaning
I'm using modern tools to backup and
control them and then we have Horizon 3
which is cloud native applications that
are operating within a cloud environment
right so this is like containers or uh
microservices or an app service both of
these Horizon 2 and Horizon 3 states are
tremendous opportunities for us to
change the game on the back end of zero
trust like that front end of zero trust
is like all right I want to make this
real I don't want these devices on my
Corp net in fact they're not going to
talk to anything except themselves and
their target they're going to pretend
like they're actually on the internet
and then we have the data Center side
where like I want to move away from
everything being contiguous and for the
virtual machine situation it kind of
looks like this there's an equivalent
architecture of this in AWS Google oci
Azure same kind of idea there's an
isolation each one of these represents a
application each application maintains
some level of network security group or
some kind of virtual firewalls inside of
each of these live your resources
becomes a verticalized network structure
that says this can talk to this but it
cannot talk to this just having that by
itself represents additional controls
that exist within our data center now
someone gets into it they can still move
around they can't move around quite as
easily as they did before yeah I'm kind
of putting up the blocks between the
puppies but at least those blocks are
there and I put other things in other
boxes so the idea behind micr
segmentation is truly to say my
application should only talk to what my
application should talk to and this is
one of the hardest things we have to do
in network security now there's some
capabilities uh vendors are producing
the sort of automated you know micr
segmentation tools and it's getting
better we're getting to a position where
we can start to lay that out but the
number of companies that have this
versus the number of companies that have
nothing is 20 to one and I can say that
from being in hundreds of companies and
seeing the same problem it's a state
that's really sorry and when we're
moving to a new architecture this is a
tremendous opportunity to make it better
like if every one of you guys went back
and said whether it's in our on- premise
data center or in a you know Azure
Google AWS name your Cloud we
implemented micr
segmentation you are getting a
tremendous win now you're going to have
to break some things to be able to make
it better but this is the time that you
have the chance to do it the other thing
I would call out is that when people are
building out their Cloud environments
the biggest mistake I see is they UND
segment the subscription structure so
this is an example of the Azure calf
Landing Zone there's a AWS similar state
to this looks pretty much exactly the
same and what you'll notice is that all
these subscriptions are broken out into
their own subscriptions in the landing
zones scale vertically this is can this
is sort of exponential hundreds of
subscriptions might exist in landing
zones and many of the organizations that
have done early moves and the and you
know moved thousands of machines they've
had let's say 5 10 15 subscriptions at
Max and they haven't done enough
isolation within the environment to
truly put themselves in a position to a
mitigate human mistakes but B also put
them in a position where they can
mitigate security control mitigate
security disasters from somebody moving
around what you notice is that even on
the platform side things like identity
management and connectivity get isolated
a because they have different owners B
because they simply should each of these
elements are then deployed via
infrastructures code why because this is
the most frequent things people screw up
when we get called in people people's
Azure environments to help fix them the
number one thing we find in here is that
someone just messed it up and they don't
know what the good configuration was
they messed up their express route they
messed up their network configuration
they don't know why their active
directory can't talk to their
subscriptions anymore all these things
that people just caus a major disons
just because they don't know so
recoverability is as important as
security here fact it is security to a
degree so when you look at scale
structures over accentuate the breakout
of the sort of boxes that things go in
and you'll find that even though it adds
a little bit of management overhead it
really doesn't if you move toward an
infrastructure is code based deployment
approach to how you understand and
manage your entire Cloud environment and
you get to operating things as like you
ever hear the idea of like cows versus
pets you we probably all heard that idea
Jeffrey snow you know this that's sort
of the idea here right I'd rather have
more subscriptions run as cows than I'd
rather have less subscriptions run as
pets and I can can put myself in a
position where I can truly scale out the
environment okay so micro segmentation
hit that this is totally something you
can check out later but what I did is
provided a little bit of a breakdown of
common security function
responsibilities in a cloud ecosystem um
some of you may be living in like true
the security roles some of you may be
like in network engineering or Cloud
engineering or whatever um this was I
broke this out so you can kind of see
like across the different functions of
the security in the cloud how does that
start to change as you move from cloud
adoption to Horizon 2 to Horizon 3 and
people take on different
responsibilities so kind of check that
one out a little
later um so these are sort of my
non-negotiables as you think about
moving to a modern State micro
segmentation infrastructures code cloud
backup cloud patching hit those four
things especially the first two you
missed the first two don't come crying
to me those are the those are the things
that everyone should should do right at
the start of their project and if you do
that everybody's skills get uplifted I
think the you know the biggest reason
people don't do this is because
management is afraid people can't learn
it and I think that's really sad it's
really sad like people can learn this
stuff get out of your box learn to use
micro segmentation learn to use
infrastructure as code and this will be
easy you keep thinking about click click
next next deploy virtual machines and
it's just kind of too bad for you like
this is an opportunity for us to
modernize our skill sets um things to
avoid
don't shift without micr segmentation
don't avoid
don't not taking the time to implement
infrastructures code is just kind of a
tragic situation um and then these are
not security but cost management and
doing test recoveries are are pretty
critical too actually recovery really is
a is a security thing so critical things
for moving to that modern State um you
can hit these lack of knowledge things
later okay next
topic um next topic data mesh who's
heard of data mesh
before okay cool few of us okay so what
is a data
mesh a data mesh is the assumption that
data exists everywhere in your
environment and it's and in order for us
to apply consistent security and
Architectural controls to it we need to
make that assumption just like we make
the Assumption on assume breach we're
making an assumption that data exists
everywhere and we need to establish a
domain driven structure that facilitates
that autonomy to to exist in the
environment but for governance to exist
across the environment as well data mesh
can scale from zero to 100 different you
know organizations and domain driven
topologies its main focus is simply
around allowing us to function at scale
so uh it's a it facilitates the design
concept and its goal is to allow us to
exist at scale or just simply to
understand that there are different
aspects of that topology ology that that
we need to understand and have owners
for so here's a little bit of a buildout
now you will not be able to see these
words because they gave me a little
screen um but that's okay so it says
says things like executive Financial
visibility uh delivery visibility like
where's my truck Personnel optimization
content demand inventory optimization
manufacturing optimization like think OT
data um think quality optimization like
video content you went to some of the
keynote they had that video cont content
well like imagine you have a video
stream coming from your OT environment
that's about quality right you have
sales optimization content think your
CRM system digital optimization things
stuff coming from your uh your website
platform behind each of these exists a
functional data domain financial data
domain customer service data domain
employee sat data domain these are ways
to articulate the context of data that
exists across the environment that data
that is backed up by an owner the the
owner is a person who is accountable for
understanding the data exists in the
domain one of the biggest mistakes
companies make when they're moving to
cloud data States is they just throw
everything in a big data Lake and hope
for the best and they get themselves to
a position where it's a complete
Security Nightmare and they can't
operate at scale data domains are about
providing the necessary isolation within
the cloud data environment and then
building out Cloud products or on
premise products that fulfill the
domain's goals also maybe applying
standard products across the entire
stack or allowing diversity of products
based upon the goals of the
domain underneath that domain exist
consumers consumers are people like
business consumers data scientists that
have different goals a model built for a
business consumer is going to look a lot
like an an abstraction of data that runs
in a report whereas a uh data that a
data scientist might use would be
something like raw data that exists
maybe at state page two of the data
extraction process um so there's
different needs that exist within a
particular domain and then across that
has to exist something called a
certified data set policy visibility
lineage and governance and there's a
wide diversity of tools that can do that
things like um Informatica or perview or
name your tool right there's a whole
variety of tools the goal is that you
have something that can be the kind of
Master of Puppets across the environment
not to prevent more data from coming in
but simply to know it exists and to be
able to map it back to its
owners so um inside the context of that
you have data products and those data
products can be standard data products
this kind of normal normalization is
things that are used everywhere imagine
you're a powerbi or a tableau
environment you're kind of standardizing
on something you use for
visualization um generally accepted
across the domains they trying to scale
up on a thing however there's also
domain specific products this is very
much like think like data scientists
right now like there's a whole diversity
of tools that data scientists are using
if I try to like draw a line and say
well you will not use tensorflow but you
will use hazure machine learning or
you'll use this or use this like
whatever like there's it's advancing so
quickly you don't even have the rules to
be able to write that yet so domain
specific products are going to totally
align like if I'm talking about OT
environment I'll probably be using you
know Rockwell or ignition or something
that's really Centric to that so you're
going to make some choices around what
kinds of products are going toine line
across those
domains you're also going to make some
choices about what the level of security
uh and data uh control is as you move in
different implementation options so um
you know many less mature scenarios will
basically take data throw it into a raw
data Lake do some kind of transformation
on it and throw it in front of a
consumer the problem with that is you
start to miss some of those intermediary
needs the machine learning needs some of
the security needs some of the some of
the uh deidentification needs that exist
in some environments so that's where you
start to get to some of this like silver
gold Platinum sort of levels inside the
context of your data State and as you
get into some of these higher level you
know ultimately duplicating data uh sort
of topologies you're getting into a
position where some of the data State
needs to have that to exist for simply
compliance reasons so um we will not go
into this in detail but this is kind of
an example of how those data Lake flows
start to exist in an environment um and
then simply just the idea and we hit
this earlier the idea of a dual path
structure that your data domains are
going to be isolated based upon
functional area your governance of that
from a security perspective needs to
understand who are the owners who are
the people need to access that data at
different levels so think about it this
way in this top level structure
there's a report layer there's a data
Mart layer there's a Data Vault layer
there may be an ETL and even a raw data
Lake who can access what in that
structure and how do I control it that's
the whole point of building out domain
specific controls and security inside
the context of a data mesh so that
domain has rules and you're indicating
who and how do they have the right to
access data and where is it simply like
moving for the purpose of me containing
it and handing it versus allowing people
to access to the data and that's where
governance tools come into play so
establishing a governance layer is about
a knowing it exists because we can't
govern it if we don't don't know it
exists establishing a security policy
framework associated with data domains
and then establishing enablement
functions for those data domains
enabling people to be able to use it and
a lot of that might be the data
organization's responsibility but let's
face it this is a security
responsibility as well what data certain
C people have access to versus other
people have access to is one of the most
critical things that we think about why
do people want access to our corporate
Network so they can get our data this is
an opportunity for us to control it
working with an organization right now
they're feeding every second of their OT
data into a cloud environment so they
can do all sorts of different types of
reporting on it don't you think a hacker
like to have access to that absolutely
they would like this is an opportunity
for us to be able to govern it and make
sure it's done well so applying lineage
to it is absolutely critical knowing
where it came from and where it went and
then applying curation to labeling and
Au authentication requirements uh
different types of data that just simply
shouldn't move from one layer to another
the dis uh deidentification of
information for certain types of
reporting roles all super critical and
then ultimately kind of building these
meta models and I know you can't see
this it's just a tu super small but the
idea of a metal model is simply to say I
have an ability to classify data as it
moves from different stages that lets me
more flexibly apply security rights and
access to that to that data so think
about that in the context of things like
classification public confidential
sensitive data restricted data all that
needs to be applied in an addition to
just basic rights that go against those
verticalized
Towers all right any more questions on
that we'll hit it later I have a
detailed slide on how that looks and we
will definitely will not get into that
um the the summary of this is avoid
throwing all your data in one contiguous
Lake if your company is doing that now
they're making a mistake it's not the
right it's not a good practice it's not
the established Ford practice it's kind
of like uh this the one contiguous Lake
story is kind of like the one contiguous
subscription story for virtual machines
it was what everybody thought they
should do and a lot of people did it but
they ended up being a really bad idea so
this is really about avoiding that
problem establishing clear ownership
associated with each domain a person who
knows where that data came from and why
it's important and it clear pattern of
access that's understood and you know
who's accessing it I can guarantee you
this is not the state in most
Enterprises because I've seen a lot of
it um and this is an opportunity for us
to really build this out in a in a way
that's understood by the organization
from a security
perspective okay next topic I told you
you're G to get a lot of stuff here next
topic microservices we're we're going to
get done we got 20 minutes
yet okay microservices so um you know we
started off with like I've got any user
Computing devices I'm trying to isolate
from everything right like the most
obvious thing we need to do in
information security move then into the
state of of uh servers and there all
servers can talk to each other we want
those micro segments okay cool now we're
getting better and then we get to data
that's sort of the next thing that
people are going to try to access well
now we're taking a journey into what is
the modern architectures that people are
are are building their applications
toward I was working with an
organization the other day and and you
know they're moving from a huge
monolithic application to a
microservices based application awesome
that's great you should do that um
however like this is a big Journey for
them skills-wise right because the
monolithic application is like running
on Windows Web servers and like this is
a a bunch of big SQL Ser Windows SQL
Server backend you know this whole like
kind of very centralized structure of
how they built out this application
microservices have very little in common
with that um well in a sense because
they it's really breaking it out in a
much more significant domain so this is
your traditional monolithic architecture
I remember going to see Scott Guthrie
when he came to net talks in Milwaukee
15 years ago talk about building things
on net based on this exact architecture
and that was a pretty cool story at the
time um but now really we're starting to
move into something more akin to this
which is really the idea that in a
microservice you start to isolate the
function to the database the function to
the database is really really the main
alignment um this is probably a better
shot at that which is the idea that
function to database function in
database function in database and then
putting things like API gateways in
front of the context of the services
serving from a client and then this
service talks to another service to
actually get what it gets done in the
context of orchestration that's where
you have things like kubernetes right
which is like each think of each one of
these as a container okay so each one of
these services
got a service each one of these Services
runs in a container that container can
be operating any number of particular
places on premise a cloud uh on premise
Cloud General Cloud a tier 2 Cloud
wherever it doesn't really matter um and
that functional area has the opportunity
to scale out the reason I bring this
architecture up is because most security
teams just haven't even really even
gotten into this yet like it's like I'm
working with a company right now they
got about 30,000 users they got about
you know 200,000 something customers all
these virtual machines moving into the
cloud environment but then the most
important application of the entire
organization is this new web app they're
building it's based on containers it's
used for every order in this
organization and no the security team
has no idea how it
works it's just it's it's tragic you
know it's but but it's but it's it's
funny because it's true um so it's it's
just like part of this idea that like
this is where we have to keep growing
our skills to be relevant to the
application development teams that are
doing really interesting and cool things
to scale their businesses um so
ultimately microservices architecture
then breaks out even further right and
you can you can play with this later but
the idea that you know you start to
factor all these things together one of
the things that becomes a danger zone of
like crossing the streams and
Ghostbusters but people are doing it
because it's the econom is the only way
to do it has this idea that think of
this as the modern architecture here is
the Interac action with the Legacy
system so we have this like old as dirt
Legacy system that we're interacting
with like it could be an i series it
could be the old web.net application
that we haven't upgraded and there's
this thing called an anti-corruption
layer which is basically away from with
another microservice in front of it
which is sort of a way for me to take my
modern stuff and talk to the old thing
um and this is where a lot of funny
business starts to happen because you
have to make things work and with the
Legacy application so I think one of the
things I'm really trying to get across
here without like having an entire class
on microservices is this is a really
good opportunity for you to index all
the applications that are important to
your business know which ones are being
built that are brand new and use that as
an opportunity to insert a person from
the security organization with the right
roles into that part of the picture to
understand what's going on and be
relevant in the context of that
architecture and you know because most
organizations they just simply aren't
like they have all they have identity
people they have like Legacy Windows
Virtual Machine people but people that
truly understand this part of the
picture are kind of they're just kind of
leaving it up to the appdev team or the
op the product team they're not really
sure how to how to build them um the
other thing that is a real issue here is
just the idea of container orchestration
so when people are building these
container based applications um like I
was talking to one that was doing a big
iot based platform for uh vehicle like
remote vehicle stuff and they had deploy
it into Azure kubernetes Services which
cool great but the problem is people
understand a Azure kubernetes Services
even less than they understand
containers um so like the infrastructure
team doesn't understand it and neither
does the application team it just kind
of exists and it's running something but
there's all sorts of ways to
misconfigure AKs um in a similar way to
you can on gcp and AWS so this is a real
opportunity for us to understand and
build the right security layers around
how we're maintaining the container
orchestration element and also patching
and updating the containers themselves
as they exist in production so one
recommendation I would give there is you
know they're becoming uh kubernetes or
container hosting solutions that do not
require you to maintain the the
kubernetes environment like AKs for
example you have to maintain that
kubernetes
environment uh things like Azure
container apps or gcps option like they
they kind of like abstract that away
which has a lot of advantages um just
from a hosting maintenance standpoint so
kind of think about where those could
come into play in your buildout because
then you can kind of get to a point
where you have to care less about this
but the only problem when people go down
that route is they they really don't
understand it at all they're just
deploying a container in somewhere so um
you know the at the net net of this is
understand microservices in respect to
the new applications being built and
understand the container hosting option
and how you uh apply security to it uh
further more understand the
recoverability of the container
environment specific to kubernetes
specifically if you're using Azure
kubernetes services or any other
container roasting option um because
recovering that is uh it's almost second
bad to like I screwed up my Identity or
express route it's it's like I have no
idea how to get my container environment
back up and running you know the whole
the whole idea behind containers is
redeployability at ease but um that's
not necessarily what we're running into
here okay so um I'll let you jump past
that lots of detailed diagrams
ultimately a number of security notes it
probably take the next 10 minutes to
walk through each of these but um I
think each of these are probably worth
you taking a look at um so these are
some summary container notes associated
with uh with making that better for
yourselves all right last one and then I
get an extra um
itot who knows much about OT in this
room yeah you're like the man um there's
some really good good talks uh uh in a
couple succeeding uh talks here on OT i'
totally recommend going to that because
that for me like over the last year that
turned from a black hole into something
I actually started to understand like
just barely um because OT is like the
graveyard of Windows
XP uh you walk around these factories
and you just basically have these airgap
Windows XP or like other Legacy PLC
platforms that are running the most
important Hardware in the entire
environment running like Vats of molten
metal and stamping machines and this and
that and you know you realize how
vulnerable we really are if someone
actually connected to these things so
it's just really scary um and that kind
of modernizes itself to the iot world in
like the connected garage door openers
and the connected boats and the
connected trucks and all these things um
but the same problem kind of exists
there it's just a bigger problem because
there's more of them um and it's people
are driving them there or they're making
their toast or they it could close on
their kids from the from the um garage
door opener you know it's got all these
other problems associated with it so you
know if you think about OT it's it's
generally user in a sense that like
nobody really interacts with the actual
platform itself except when it's updated
every once in a while um and it's
usually on like really Legacy
architecture infrastructure and it's uh
Limited in what it can do but it's very
high value it's really at the end day
it's super high value stuff and it's
exposed to people that walk around in
the environment and they have access to
these things all the time yes five
minutes
awesome okay so compromise angles um the
most obvious compromise angle is someone
has a deice and this happened to an
organization that we helped fix um is
you know they acquired this business
business got nuked because contractor
came in with a laptop that had been
compromised they plugged in the airgap
system to update it bam right because
now that airgap system can be controlled
via the compromised device so OT
environments are just
tremendously vulnerable but we just keep
them in locked rooms um and we hope
nobody goes in them but because we can
bring along writers into the Rock lock
rooms people can really compromise them
easily um these are the passwords and
the usernames used by most of the uh iot
compromised OT devices note everything's
added or root um easily compromised
environments lots of good studies done
on that I highly recommend the stride
model for iot security which is simply
an opportunity for you to understand you
have a user Zone you have a device with
a field Gateway and then a relationship
to what is your Cloud Gateway I think
the most important thing about iot is
understanding that like we have an
opportunity to be able to modernize this
environment and apply security to it as
they are trying to get data from these
environments like like five or six of
the projects I'm doing right now are
just getting data out of the OT
environment and applying AI to it well
they want to do all these modern things
but the most difficult part is just
getting the data out of the OT
environment safely in a lot of these
environments you can clean up by
actually fixing the way they're getting
data out of it today which are very
vulnerability U uh risk uh some
interesting elements associated with OT
security um each of these I think are
really important provided a link to some
of that data um and then kind of a
general word about OT environments which
is much of the data in the environment
uh that you're caring about is from OT
um the oneway feed solution can work um
but it's still dependent on like you
applying some sort of Hardware based
solution ultimately you know the best
way to address these problems is
applying some commodity capabilities
from things like ignition wonderwear
Rockwell Microsoft they all have kind of
industry 4.0 capabilities to modernize
the OT environment as you look at the
the
topology okay um I had a thing in here
about AI uh really the main thing I
wanted to say about AI before we move on
to like just closing this this guy down
is I only bring this up because we're
starting to do a lot of AI projects is
that as you are doing open aai projects
um you essentially provision a copy of
the openai instance in your Azure
environment or in your you know if
you're using another kind of open-
source platform right if using
specifically you're open using open AI
you're provisioning a copy of that in
your Azure environment um and that
becomes a a model that then is augmented
by tuning or embedding or other kinds of
uh injection via things like Azure
cognitive search and that becomes a
major attack pattern um that people can
take advantage of so that's you know you
could start this off by saying like hey
watch out for your AI models this is
going to be a problem you're going to
deal with it's probably not the one
you're going to deal with tomorrow be
down the road but it's less important
than everything else we just talked
about so everything else that took from
here to there is way more critical than
dealing with like did I have privacy on
that does chat GPT know about my uh my
this and that okay so uh I'll leave that
in the deck where to get the slides
here's your here's where you get them so
uh Nathan
questions or you want to argue with me
let's argue about it I'd love to have
that conversation um and uh it's been
really great spending some time with you
today I really appreciate you choosing
this session and uh let's talk later
[Applause]
thanks