Security

AzureFunBytes Episode 64 – Building SOC Efficiency with @Azure Sentinel with @rodtrent

Jay Gordon January 12, 2022 Jan 12, 2022 01/12/22

This week we’ll investigate the use cases for implementing the first cloud-native Security and Event Management service (SIEM) Microsoft Sentinel.

Azure DevOps (and Azure DevOps Server) and the log4j vulnerability

Gloridel Morales December 14, 2021 Dec 14, 2021 12/14/21

For Azure DevOps, our analysis pointed towards the Search service not being vulnerable. Even so, we are following the guidance and upgrading to the latest Log4j version and reviewing our network security group rules for the Search service as part of a defense in depth strategy. We will continue posting updates to this blog post as we learn mor

Azure DevOps Response to GitKraken SSH Bug

Gloridel Morales October 11, 2021 Oct 11, 2021 10/11/21

Azure DevOps was recently informed by GitKraken's development team, Axosoft, of a security vulnerability in GitKarken's key generation algorithm. This vulnerability led to the generation of insecure SSH keys. We identified customers affected by this vulnerability and revoked their SSH keys. Check out the blog post for more details.

AzureFunBytes Episode 58 – Improve your Open Source Security with @WhiteSourceSoft

Jay Gordon October 5, 2021 Oct 5, 2021 10/5/21

As developers progress along the software delivery lifecycle there's a need to ensure that security scans can be automated. By implementing products like WhiteSource you can automatically detect, prioritize, and remediate your open source security vulnerabilities.

AzureFunBytes Episode 56 – Secretless Applications with @ChristosMatskas

Jay Gordon September 21, 2021 Sep 21, 2021 09/21/21

Secretless application development strives to solve some important problems, like preventing your credentials from being leaked. If you are seeing connection strings, usernames or passwords in log files, you're adding to your risk profile.

AzureFunBytes Episode 42 – Hybrid Cloud on Azure with @ThomasMaurer

Jay Gordon June 8, 2021 Jun 8, 2021 06/8/21

This week my guest was Senior Cloud Advocate Thomas Maurer . We dove into the world of hybrid cloud ! Not every application is born in the cloud, but they can certainly interact with it. A hybrid cloud is a type of cloud computing that combines on-premises infrastructure—or a private cloud—with a public cloud.

New policies to restrict personal access token scope and lifespan

pazand June 3, 2021 Jun 3, 2021 06/3/21

Azure DevOps Administrators can now define a maximum lifespan for personal access tokens (PATs) and restrict the creation of global and full-scoped personal access tokens (PATs). These policies will affect all users and Azure DevOps organizations linked to the Azure AD tenant.

AzureFunBytes – Microsoft Identity with Christos Matskas!

Jay Gordon May 11, 2021 May 11, 2021 05/11/21

This week I welcomed [Christos Matskas](https://twitter.com/ChristosMatskas), Program Manager at Microsoft, to the show. We have discussed Identity before, but we'll get a great look into [authentication, authorization](https://cda.ms/24G), and [Azure AD](https://cda.ms/24F). Christos helps us understand how we can bridge the gap between our

Intro to Service Principals with Peter De Tender

Jay Gordon March 29, 2021 Mar 29, 2021 03/29/21

AzureFunBytes is a weekly opportunity to learn more about the fundamentals and foundations that make up Azure. It's a chance for me to understand more about what people across the Azure organization do and how they do it. Every week we get together at 11AM Pacific on Microsoft LearnTV and learn more about Azure. This time Microsoft Technical ...

Demystifying Service Principals – Managed Identities

Peter De Tender January 28, 2021 Jan 28, 2021 01/28/21

This article will describe the use case and core differences between Service Principal and Managed Identities, using Key Vault and other Azure services as an example

Azure DevOps Blog

Security - Azure DevOps Blog