Building Your Organization's Security Foundation with Microsoft

At Microsoft joining us for this interactive session, Vasu will be discussing be discussing building your organization Security Foundation. Just before we get kicked off here, a few housekeeping notes that we encourage. We encourage you guys to keep your cameras on and your audio muted and you can use the zoom chat box in the bottom toolbar of your screen. If you would like to directly chat with the speaker, please turn your camera on and when appropriate you can unmute yourself or use the raised hand function. The session will be recorded and posted post event. So please join me in welcoming Vasu and please take it away.

Thank you so much Sterling and it's great to be here with you all. What I thought we'll do is just start from the really top like what's happening there on the front lines in our world around cybersecurity and then delve into some of the lessons that we have learned as defenders ourselves. So with that, if we can get started. Lesley, if you can go to the next slide please. Great. So as you can see from the headline of the slide, we believe security is truly at an inflection point today. There's no question that it is now top of mind for business leaders across the world. And even as some people start to transition back to the office, we expect a future where remote and hybrid work is really the norm. For Forrester, which is an analyst firm, predicts that once people have settled into their new work patterns post pandemic, the world's a new place and we're going to see a 300% increase in employees working remotely from before the pandemic levels as we really embrace hybrid models. In fact, our own Microsoft Work Trend index indicates that 46% of people plan to move because they can now work remotely. What this means is that people are working on corporate networks and home networks and there's this mangling between them. They're moving fluidly across business and personal activity thanks to the technologies intertwined with both aspects of our daily routines. And for organizations, the corporate network is suddenly now without firm borders. It's boundaryless. Employees, home networks and devices are now very much part of this corporate network. And increasingly we are operating in a perimeterless world. At the same time, if you pause and step back and look at the cybersecurity landscape, it's fundamentally changed, as evidenced by some recent large scale attacks like Nobelium in the fall related to the solarwinds supply chain hafnium and more recently the Colonial pipeline. These attacks are not an outlier anymore. They are norm. Hackers are launching an average of 15 million password attacks every single day. And phishing attacks have increased. Phoneware attacks on the rise, Ransomware is on the rise, extortion on the rise. So you take all that and you have an incredibly complex cybersecurity landscape across sophistication, across complexity, across frequency and proliferation. At Microsoft, we used to track a handful of threat groups and now we are actively tracking more than 40 nation state actors and over 140 threat groups ourselves, representing 20 countries. It just talks to the escalation of this cybersecurity landscape. Now, you couple all of that with the pressures of rising costs and economic pressures and growing concerns around investment return, plus the incredible talent shortage that we all face in the security industry. And all of us are facing tougher choices about security than ever before. So as we look at this landscape. If we can go to the next slide, please, Leslie, I would love for us to just pause and ask you the question, what is it that you are grappling with today? What are the biggest security challenges that you have? How can we all be on a path to solving it? So if you have any thoughts on that, please use the chat functionality, put that there. And we have some time for Q and A at the end. Or we can take them offline as well with that, if you can go to the next slide, Leslie. So some of you may ask, well, why am I even here? Why is Microsoft talking about these things? I thought I'd start there. The reason I'm here, the reason Microsoft cares, is because we are defenders ourselves and we work with defenders across the world. Today we help secure more than 400,000 organizations and countless of end users as a security company, which gives us a unique vantage point on the security landscape. There are many, many, many learnings across the spectrum that we have being on the front lines of the industry's response. And a number of these high profile recent attacks that I just talked to you about has enabled us to elevate our own defenses as well as help protect the companies that we serve and we work with. In addition, we process 8 trillion signals every single day. And through those signals and analyzing them using machine learning, we have really great learnings on how can we prevent, detect, respond and mitigate threat attacks in real time using technologies like the cloud. As an example, in 2020 alone, we saw incredible scale of cyber threat attacks. Our own technology like a Defender for email or Office365 prevented 30 billion email attacks. And we continue to see phishing and email attacks as a rising concern. So that's why I'm here And hopefully all these learnings that we've had over the many years together with our community can help us strengthen our collective defenses. So let's take a look at some of these learnings now. Thank you, Lesley. We believe there are four fundamental ways to strengthen our foundation, your foundation. The first one is we've got to take a comprehensive view of security today. Attacks come from everywhere, and if we don't have this comprehensive view, we are not really protecting our digital estates. Second, we've got to adopt a zero trust approach, and I'll come to more on that in a bit. Third, where possible, embrace the cloud. And the fourth one, which is particularly close to my heart is Skilling. We've got to strengthen our defenders everywhere through skilling and teaching and awareness. So let's take a look at some of these with a double click. Thank you. So, talking about the end to end approach first and comprehensive security. When we think about risk to an organization, it really just isn't about security breaches and external attacks. One of the things we know for sure, that business risk can come in many forms and in many ways from anywhere. And at the end of the day, protecting yourself from one form of risk while leaving yourself vulnerable to another is not really effective. Security threats can come from outside the organization in the form of intrusive and destructive attacks sometimes, but they can also come from inside. Insider threats are on the rise. Sometimes they're intentional, sometimes they're not. But the data loss that results from either can be very costly, no matter the intent behind it. And finally, falling out of step with data privacy laws like GDPR can have major business implications, not only in a financial sense, but also in a brand trust and customer loyalty. So to protect against all these kinds of business risks, external and internal companies need to think holistically and approach digital safety from every angle. Today, a strong security posture is one of resilience. That means looking at security end to end, starting with identity and access management through endpoint and email and application security, to data loss prevention and into cloud security and siem, which is security information Events management. But it really can't stop there. We know from recent attacks the importance of extending protections to your entire ecosystem, all platforms, all clouds, in an integrated way, because internal and external threats will exploit any vulnerability or gap between them. So the best posture is one that which protects left to right, top to bottom, inside out, outside. In thinking of security compliance, identity, device management, privacy must be part of an interdependent whole. Traditionally, we've always looked at this as silos but we no longer can do that. We've got to think about protecting all devices, all data, all identities, all platforms, all clouds. And I know this sounds like a daunting task, but it really doesn't have to be. No security vendor should ever ask you to rip and replace. Use what you have. It's a journey. Start with where you have, identify those areas in which the gaps may exist and choose solutions that can integrate together. The most important thing is to understand where you may be at risk and take steps over time to to choose those areas of vulnerability. And remember, security is a team sport. No one company can do it, but together we all can stay a step ahead of the bad actors if we can. Go to the next slide, please. Lesley, thank you. The second thing you can do to build a strong security posture is to adopt a zero trust approach. Now, if you have listened to the recent Microsoft messages, we are all about zero trust. This is a big one for us. I would love to hear in the chat how many of you have heard about zero trust adopting a zero trust approach have alternate viewpoints on zero trust. We want to hear from you, so please put it in there. And again we'll have time at the end to talk about it. We view zero trust really as a cornerstone of effective protection, the foundation for organizational resilience in the future of security. Let's start with what does it even mean? And what's the definition of this? For those who are not familiar with zero trust, first, it's a mindset, an approach, an architecture, a framework, all of that. But essentially what it does is it assumes breach. That means it assumes that all activity, even by known users, could be an attempt to breach systems. It requires all users, even those within the organization, to be authenticated, authorized and continuously validated before being granted access. This approach leverages advanced technologies such as multi factor authentication, identity and access management, conditional policies, as well as things like next generation advanced security across endpoints to verify the user's identity and maintain that system security. Lastly, if I were to break this framework down, it would be in three pillars. The first one is verify explicitly. The second one is use least privilege access. And the third one, where we started, was always a zoom breach. Now, admittedly, this is a pretty significant departure from traditional network security. Well, once you are inside an organization's network, you're trusted. Adopting a zero trust strategy is the opposite of that. And as I said earlier, it's a journey. It's different for every single organization, but every single step you take will make you more secure. Many Times I get the question from our customers. So where do I start? I say if you're really wondering where to start, start with a strong cloud identity foundation as a first line of defense. It starts with authentication and providing access to start there gaps in protecting identities and we've seen plenty of that, right? I'll quote Asiso. He uses the term attackers don't break in, they log in. So true. So things like weak passwords or lack of multi factor authentication are opportunities for an actor to find their way to system and to move laterally across these environments. If you can protect against that, I would say start there. We're also big believers that you've got to take a comprehensive approach that I shared with you earlier. So integrating your threat protection and honestly just really simplifying that. There are new terms now, extended detection and response. It simply means that you need to have detection response protection across all your data devices so that you have end to end visibility. You take that and you integrate that with tools like your security information and events management, which allows you to analyze all of this data and act on all of that data. Just really simplifying your assumed breach toolset. I think this is gonna help customers improve their posture. And then lastly, as you think about zero trust, don't forget that inside out aspect. I know this is relatively new, but it's so important that inside out compliance protections that address risks related to can help you build an effective zero trust approach across your entire digital digital estate. If you can go to the next slide, please. Lesley, thank you. And then the third step is embrace the cloud where you can. Now, I do understand and recognize and I'm with you, this is a journey and everyone is on different journeys and we're all committed to protect everyone wherever they are on their terms. But the cloud has inherent advantages that it lends itself from a security standpoint. Today, the benefits of the cloud, especially for remote or hybrid workforce, are plentiful. Business critical information can be accessed over the network, making it easy for having workers in any location. And plus let's remember the capital savings, the elasticity, the resilience and the innovation that you're getting from many into this cloud. You know, over the last year as we faced the first inflection to remote businesses and we all had to transform into remote workforces overnight. And as we're seeing another inflection to hybrid work just happening right now, we're seeing a rapid migration to the cloud as companies recover from the pandemic and implement new infrastructure. I'll share some stats we have a partner organization called Microsoft Intelligence Security association, or misa, which is really a community. And it's so important to have that community where you learn and you benefit from each other's defenses as well as collaboration, innovations. So this community, we did a survey with them and 89% reported that customers have accelerated them over to the cloud due to the pandemic. That's pretty large numbers. So having a strong cloud posture does provide a level of security that most companies just simply cannot achieve on their own. And we saw that even in the recent high profile attacks. Having cloud security can be vastly beneficial. Baseline layers of protection simply cannot be enough for today's sophisticated threats. So think about your defense strategies, Think about where you can leverage the cloud. Think about how do you really layer up as you think about your cyber safety and your digital estate. If we can go to the next slide, please, Lesley. Okay. And then coming back to what is closest to my heart, Skilling. With this landscape evolving so quickly, what we're seeing is there's an inherent need for all of us to stay current not only on what are the threads and what's our response plan or how are we going to protect against that, but our own selves and our skills and that of our team. We know that attackers exploit not just our digital holes, but really the holes in our defender teams. And right now, most security organizations have two problems. One, we talked about this earlier, talent shortage. There are millions of jobs which are going unfulfilled today. And two, there's a lack of diversity within these teams, which can also cause us to just really have blind spots in our approach and thinking. This year, there will be an estimated shortfall of 3.5 million security professionals, which means businesses will continue to struggle to fill that gap. And shortages can lead not only to unfulfilled positions, but honestly, a lot of work on the shoulders of existing teams. Every single defender counts. And it's our collective responsibility to build new defenders and to enhance these defenders. At Microsoft. One of the reasons I joined and I'm here is because we are passionate believers that everyone and anyone can be a defender if you want to be that. With the proper training programs, we can all work together to build a workforce of the future that reflects our planet, the beautiful diversity that it has, and we can build an inclusive environment. We can do our best work as we build these teams that reflect many viewpoints, including that of the demographics of attackers themselves. Because they come from diverse viewpoint. I think it will help us all stay ahead of this advanced threat landscape. And as I said, it's a cat and mouse game, so it helps us mitigate that. And with that I also wanted to share if you're searching for content and ways of skilling your team, there are plenty of tools out there. We also have put out our content. There's some rich content libraries, so please take a look. And we also have announced new certifications now. So if you're interested, shoot us a note and I'd be happy to share that with you. With that, if we can go to the next slide please. Leslie all right, so we covered a lot today. We went from threat landscape to zero trust to end to end security to skilling to cloud. And I'm sure that can be overwhelming. But remember, this is a journey one step at a time. What I want to leave you with is five things that you can do right now to begin putting these recommendations into action. The first one is widen your lens on assessing the risk. Remember, those attacks come from anyway and just by having an open mindset and widening lens to where the vulnerabilities can come from, whether it's outside in or inside out is going to be a massive step for strengthening cybersecurity. Second one is use the tools you already have. Many of our organizations have great tools in our treasure chest. A great example of this is Multi factor Authentication or mfa. In its short form when we passwords when password spraying, phishing, they're responsible for the vast majority of attacks. Today that is key. If you're using a commercial enterprise subscription, MFA may already be included. So just look at that and start using that. Our own data as alarming it is shows that customers don't take advantage of tools like MFA. In fact our customer orgs today there's only 18% of users MFA and while that is significantly up since before the pandemic, we still have a lot of room to enhance that. So that's the second one. The third one is keep your the third one is to keep your employee software current and your devices current. So batch, batch patch where you can connecting to your net. When these devices are connecting to your network, you need to understand the level of protection on each. We know that many nation state actors and criminal groups will move quickly to take advantage of any unpatched system. So promptly applying all the available patches or using automated tools that are out there is the best protection against any attack. Fourth we talked about this is the cloud. Embrace the cloud where you can and choose partners who can provide that scale and innovation for you. This can help you drive productivity and Be more resilient to cyber attacks and at a lower cost as well. And then lastly, it's about skilling. Let's help our defenders to really brush up on their skills. We are all in this together. The cyber landscape is changing fast and it's important for us to develop defenders and to ensure that our teams are keeping up with the new techniques, tactics and practices that today's employee, that today's attackers are employing. With that, Leslie, I think that's my last slide. Now, I thought I'll end with something which inspires me every day, is why am I here and doing that? And that's because if you look at Maslow's hierarchy, safety is at the very bottom is fundamental to humans. And today that safety is digital security. Security should be the freedom to imagine, to plan, to empower, to innovate, to inspire. We're emerging from a year that has altered us forever. It's altered the world forever. It changed the way we live, it changed the way we work. It brought new challenges in cyber security, and it reminded us all that there's no playbook for change. But where there's uncertainty, there's also the power to shape the world in positive and profound ways. As security professionals, as security leaders, as business leaders, as security communities, it is absolutely within our superpowers to help people feel safe and be safe. This ultimately is the heart of security. And so I'll end it again with this quote which I started with. It is the freedom to imagine, to empower, and to inspire. So let's inspire and let's be inspired. And with that, I'll take questions if there's any on chat. I know that Leslie is monitoring some of these or if you just want to ask me directly, that would be awesome as well.

Hey, Lisu, this is Carrie. Lou Dietrich.

Nice to see you. Hi, Kerry. Lou.

So I think the biggest challenge that I see is this, like conflict between convenience and security. So like you said, 18%, only 18%, I guess, of Microsoft customers or a survey are using multi factor authentication, maybe because they think it's inconvenient. How is Microsoft or how are you guys thinking about this conflict between convenience and security and how we make it more implicit so that it's not so much effort and you're building a culture of security while helping people do things easily?

Yeah, it's a great question, Gary. Lou. And you know, I'm a big believer that security should not be in the way of experience or innovation. In fact, it's fundamental to experience and innovation. So it's not an or, it's an and. And one of the, one of the greatest examples I have is passwordless protection because that's a big investment that we have made as part of our cloud identity and as we move towards that, in fact, Microsoft is 100% passwordless. Now what we hear from organizations routinely is that that enables them to have a better experience because they don't have to remember the passwords. But it's also so much better from a security standpoint. And so that's an example where security can help you strengthen your defenses and provide an exceptional experience. The second thing is as we talked about, mfa, but even other of the tools that we have, the security, there's a massive focus on simplifying these tools. There's a massive focus on just making them easy to use, easy to drive we that consumer led thinking and modernization to that. So it's a joy to work with these tools and you can have these unified panes of glasses where you need them. But also you get to be that, you know, cyber geek working on innovation. So I think there's a lot of work which is being done right now to make security the really the imperative for innovation and the underlying foundation for innovation and not get in the way.

Vesu, we had a couple questions that came in on private chat. The first one is we talk about Zero Trust for security, but how does it compare or how does it apply to compliance?

Yeah, it's a great question, Leslie. And when you think of Zero Trust, it started with identity because identity is very much the battleground of security and we have to start there. However, if you look at Zero trust and its evolution, the idea is you've got to assume breach, no matter where the breach is coming from. And as part of that you have to have inside out thinking and that release compliance. With compliance, it crosses the spectrum from insider risk to data governance to data protection to data loss prevention and managing all these regulations. And the smarter that we can get across this, the more automated that we can get across this and really changing our thinking from that inside out perspective. That's the key element of Zero trust today. And I think that helps us fortify across our entire digital estate.

Excellent. And then another one. So as we look to the future, what do you think are some of the things that companies will need to do or think differently about in order to be resilient in this environment?

Yeah, it's a great question. You know, this is a journey. So I would say there are multiple aspects to this journey. I would start with where We a couple of the things we talked about. So first start with the tool set that you have many times you will have the tools to start giving you that first layer of defense. Secondly, you know, we talked about zero trust ad nauseam. So do, do start with that posture. Map it out, break it down. There's a lot of organizations who are on this journey, you can learn from those organizations. There's a lot of recipes that are posted on the, on the Internet, you can learn from them. And I think there's a community discussions having. So start with zero trust and map it out. If you're wondering where to start with zero trust. I know it feels like we've been talking a lot about identity, but device management, healthy device management, healthy identity, these are all good places to start. The third one I would say is we talked about cloud security and if you can get on the cloud journey, do try to do that. There's inherent advantages there. And then lastly, you know, make sure you're taking care of your people. The other thing I will share, which we didn't talk a lot about, is digital empathy thing. We have a lot of really exhausted people right now, overworked people right now. And when people are exhausted, you know, we make mistakes. And so thinking about how can we make that failure safe, how do we help our teams with digital empathy, with giving them the space and time for creativity, but also the tools that are going to help them enhance their security posture. So those are some of the things, Lesley, that I would think think about.

And then maybe there's one last question here. And that is as we think about boards of directors and boards of advisors, how do you think cybersecurity is sort of changing the role of their involvement?

Yeah, you know, it's a great question. I'm on the board of a company as well and security is a constant and continuous discussion. And the role definitely has evolved. Security used to be a backroom conversation. At one point, it used to be a government to government conversation. But today it's no longer that the board, it's a conversation from the board to the C suite to security leadership to IT leadership to the practitioner. And some of the ways in which the boards can really help from a security posture. And the role of the board has changing is asking questions like what is our playbook or what have we done to secure and strengthen our own security posture? What does that look like? What is our security transformation? If a company is embarking on new digital transformation initiative, which a lot of companies are, how is security transformation being handled? As part of that because they go hand in hand. Really understanding your data strategy. Data is the currency of the modern world. Your data side, how is it being transferred? How are you protecting that across the data lifecycle thing? These are a couple of things like really understanding that security posture. How are we protected when a new attack comes in? Like what's our playbook for that? Everything from communications to our technologies. And then thirdly, like really understanding that data life cycle. I think we're at the top of the hour so we may be, may have completed our time here. Again Leslie, thank you for all the questions and Sterling, thank you for the opportunity. It has been lovely to be here with you all and I look forward to staying engaged and connected with our community here. If you have any questions, please send them to us and we will get back on that. So thank you again and have a great day.

Bye bye. Thank you everyone. We have a lot more great content today.