Microsoft and Zero Trust

In the concluding section of this first chapter, I want to tackle the elephant in the room and a question I help my customers with constantly: can Microsoft be taken seriously as a cybersecurity company?

We will answer this question by also exploring Microsoft’s guiding principle to security in the cloud age: Zero Trust. The Zero Trust model will supplement the frameworks you learned about in the last section to round off your understanding of Microsoft and the industry’s language and terminology.

In this section, we will separate the marketing and jargon from reality, review Microsoft’s credibility as a cyber security provider, and explain precisely what Zero Trust means.

Microsoft as a security company

Let’s start with some numbers. Following a number of tech industry titans meeting with the White House regarding securing American cyberinfrastructure in 2021, Microsoft pledged investment efforts of $20 billion over the next 5 years. That’s a lot of money and, for some context, is double the investment that Google announced for the same purpose.

One of the ways Microsoft improves its security offerings is by acquiring promising companies that can integrate with Microsoft platforms such as Azure and Microsoft 365. This is how we start to see the origins of Microsoft 365 Defender.

Microsoft Defender Antivirus’s roots can be traced back to the mid-2003 acquisition of Gecad’s RAV and the 2004 acquisition of GIANT Company Software. Although Windows Defender would then start as an optional anti-spyware tool, it would go on to also provide built-in anti-malware and more (as you’ll learn).

The 2014 acquisition of Aorato led to Advanced Threat Analytics for on-premises Active Directory security, which was later superseded by Defender for Identity. This was followed by 2015’s Adallom purchase, which introduced the concept of a cloud access security broker (CASB), named today as Defender for Cloud Apps. We also see Secure Islands join Microsoft that same year, laying the foundations of Azure Information Protection. One of the most powerful features of Microsoft 365 Defender, automated investigation and response, originates from Microsoft’s 2017 purchase of Hexadite. The list continues, with the most recent examples including CyberX (becoming Defender for IoT), RiskIQ, and CloudKnox.

When we consider the sheer scale at which Microsoft operates, we can see some of the unique advantages they have. Windows and Active Directory – and, increasingly, Azure and Microsoft 365 – are omnipresent in enterprise IT. Windows itself goes beyond just enterprise IT and is used by millions for their home PCs, too. For example, Azure AD reportedly handles over 18 billion login sign-in transactions each day, and Windows 10 is used on over 1.3 billion devices. Using this vast dataset, the Microsoft Intelligence Security Graph becomes enriched with contextual telemetry, feeding the cloud-delivered protective capabilities of Microsoft’s security products.

Microsoft does have some reputational problems to overcome as a business that takes security seriously. Earlier versions of Windows, which really had no significant security measures, tarnished the image of the OS and, therefore, business. The perception became that only third-party vendors could be trusted with securing Microsoft environments.

However, times have changed, and not just recently. Each iteration of Windows sees significant security improvements. For example, Windows Vista introduced User Account Control (UAC) to remove a convention of elevated rights for standard user activities. In the server world, Windows Server 2016 introduced Windows Defender built-in, and services such as (Remote) Credential Guard and Device Guard to protect against identity and untrusted code attacks.

The security investments Microsoft continues to make, as described earlier, represent why many organizations are now fully investing in Microsoft services for security. As we proceed through this book, you’ll start to see some of the real benefits of this in the form of unified response capabilities due to shared platforms and access to that massive dataset for a rapidly evolving security context.

Zero Trust

It is impossible to avoid the term Zero Trust when discussing Microsoft security solutions. Although not an original creation of Microsoft, the model is at the front and center of its marketing and technical messaging. Unfortunately, as with many well-intentioned security principles, you will see Zero Trust being misunderstood or, at worst, hijacked. In this section, the buzz will be separated from the reality, so you will be able to understand exactly how Zero Trust should be approached and used to secure your environment.

The term was first coined by John Kindervag (Forrester, 2010) from an idea that can be traced back to the 2004 Jericho Forum, which looked at the issue of the perimeter as security becoming insufficient. By this, we mean that you cannot simply approach the idea of a castle and moat (network and firewall) and believe everything within the boundaries of the moat (firewall) is trusted or safe. Instead, we need to go as far down the layers as possible, analyzing as many signals as possible, at as lowest level as possible, before any trust can be applied.

The increase in big data, cloud services, and processing power makes Zero Trust possible. You need a well-resourced system capable of analyzing vast signal data and applying machine learning (ML) to create context and, therefore, identify threats and risks.

Microsoft distills Zero Trust down to three guiding principles:

• Verify explicitly: Make decisions about allowing access based on all data you have available. Effectively, default to denying access and leverage multiple layers of policy and data to allow access. No matter the source, authenticate and authorize all types of actions.
• Use least privileged access: Minimize access and administrator rights. Effectively, default to as few permissions and little time to them as possible to get the job done.
• Assume breach: Attackers will get in somewhere at some point, so have layered defenses to stop them moving. Effectively, leverage defense-in-depth and detection strategies so that unauthorized access to one resource doesn’t open access to all resources.

As we progress through this book, you will learn how Microsoft 365 Defender and its integrations with other security services serve these principles. For example, by onboarding devices to Microsoft Defender for Endpoint, risk scores can be attached that can be included when assessing access to Azure AD resources. This example’s additional layer of protection means that a username and password, or even a username, password, and multi-factor authentication, are not enough: you must also be on a device that is not compromised.

Now that you’re aware of what Zero Trust is, what isn’t Zero Trust?

Earlier, Zero Trust was explained as a response to the increasing difficulty and complexity of parameterization in cybersecurity. This has become particularly important in the world of remote and hybrid work, including on non-organizational, unmanaged devices. This does not translate to no need for perimeters. Keep in mind the saying don’t throw the baby out with the bathwater, and don’t start decommissioning your existing network segmentation capabilities. Instead, look at where you can add additional signals for decisions to authorize access.

Additionally, you cannot implement security software that contributes to Zero Trust and label the tool itself Zero Trust. Microsoft Defender for Endpoint, Azure AD Conditional Access, and other Microsoft security services are not Zero Trust, but their combined and well-architected implementation will put you on the path to Zero Trust.