Category Archives: Programming

Related to some aspect of programming, software development, related tools, or supporting technologies, related standards, etc.

Talk: Running #Azure Securely and Compliantly – Granite State Code Camp #GSCC2021 – aka Compliance for Lazy People

Leave a reply

Today I had the opportunity to speak at the Granite State Code Camp (#GSCC2021) in Manchester, NH. This was the first time I’ve given an in-person talk since the start of COVID and it was great to see so many smiling facing (even when partially obscured by a mask!).

Last year my focus was a more in-the-weeds talk called Running Azure Securely – which of these Azure security features are for me?. This year I stepped back a level and focused on Compliance. In the session I discussed security vs. compliance, the shared responsibility model, and touched on a few other features, but spent a good bit of time focused on what I am thinking about as the “Policy stack” where one can gather lots of insight about your workload’s compliance with technology controls indicated by various compliance standards – based on the Azure Policy capabilities, a pillar of governance, and rolled up and available from Azure Security Center Microsoft Defender for Cloud.

Azure Security Center as a brand is no more – it is part of a rebranding to Microsoft Defender for Cloud. I assume this renaming, announced at Ignite, is because it is a feature set that can span beyond Azure – for example, keeping an on on-premises resources and resources in non-Azure clouds like AWS.

The session was interactive (as preferred!) and many thanks to Kevin and Vishwas and the nice lady whose name I didn’t catch who I think worked for the college for help in overcoming technical limitations in the room I was speaking from.

If you want to experience MORE AZURE please check out https://meetup.com/bostonazure (currently operating as part of “Virtual Boston Azure”).

If you are someone who would like to SPEAK at Virtual Boston Azure, please get in touch. (Twitter is a good way to reach me – I am @codingoutloud – or you can address it to @bostonazure.)

Slide deck is attached.

Advertisement

Talk: Running #Azure Securely – Granite State Code Camp #GSCC – Are all these security features for me?

1 Reply

Yesterday I had the opportunity to speak at the Granite State Code Camp (#gscc) in Burlington, MA. As part of my series of talks on Running Azure Securely, my talk today was around defense in depth and was called Running Azure Securely – which of these Azure security features are for me?. The session was interactive, engaging a third-of-a-dozen folks in the audience in a discussion of how to defend various workloads using the (fictitious) page of photos app as a foil.

Slide deck attached.

Also perhaps of interest – a similar talk from the other Burlington – at the recent VT Code Camp – which has a few add’l resources listed: https://blog.codingoutloud.com/2019/09/28/talk-running-azure-securely-are-all-these-security-features-for-me/

Talk: Running Azure DNS Securely

Leave a reply

On 22-Oct-2019 I spoke at Boston Azure about network security and focused on some of the edges of using Azure DNS, and included some DNS subdomain hijacking awareness.

The command

dig CNAME bostonazuredemo.azuresecurely.com +short

will check public DNS records for a CNAME, returning whatever it is mapped to, if anything.

digging-dns-hijacking

In the above screenshot:

  1. nothing returned from dig – this is before any DNS entry was created for the demo subdomain
  2. a cascade of CNAMES are returned from dig – this is after a DNS entry was created for the demo subdomain – and it pointed at an Azure Web App — the cascade here includes my subdomain => an azurewebsites.net subdomain (bostonazuredemo.azurewebsites.net) => a second azurewebsites.net subdomain (waws-prod-dm1-139.sip….) => a cloudapp.net domain => and finally an IP address
  3. a single CNAME is returned from dig – this is after the Azure Web App was deleted (), but the DNS subdomain entry (bostonazuredemo.azuresecurely.com) was left intact – creating a dangling subdomain at risk of being hijacked — anyone who registered bostonazuredemo.azurewebsites.net (and it was open for anyone) would automatically have bostonazuredemo.azuresecurely.com already wired up to it.
  4. a cascade of CNAMES are returned from dig – but different than the first – this is after bostonazuredemo.azurewebsites.net was registered again, by a hacker, and bostonazuredemo.azuresecurely.com was hijacked

 

Some other notes from the session:

Subdomain takeover examples:

 

Talk: Running SQL Azure Securely — SQL Saturday #877 — 14-Sep-2019

1 Reply

Today I had the opportunity to speak at SQL Saturday #877 in Burlington, MA. As part of my series of talks on Running Azure Securely, my talk today was Running Azure SQL Database Securely and applied to Azure SQL DB and Azure SQL DB Managed Instances.

Some Resources Mentioned

The deck

Running Azure SQL DBs Securely – Bill Wilder – SQL Saturday #877 – 14-Sep-2019

Talk description

If you know your way around SQL Server, then you will find Azure SQL Database to be familiar territory. But some aspects are more familiar than others, which is especially true for security-related differences.

In this session we review the key differences around identity management and authentication (including multi-factor authentication), managing server credentials (or, even better, not needing to in some cases), how to audit logins (probably not what you expect), an overview of encryption and data masking options, and the supporting role of Azure Key Vault. We will also touch on compliance and disaster recovery to give the complete picture of powerful features you’ll definitely want to know about to protect your data.

This talk will cover relevant capabilities for both traditional Azure SQL Databases and the newer Azure SQL Managed Instances.

This talk assumes you are already familiar with SQL Server or another enterprise database.

Action Photo

(Credit Taiob Ali @SqlWorldWide)

Event: Boston #Azure / MIT edition of Global Azure Bootcamp

Leave a reply

We had a great event at MIT on Saturday 27-April-2019 — the Boston Azure edition of the Global Azure Bootcamp hosted at MIT. There were lots of great session contributions – making this a true community effort.

ORGANIZERS

Big thank you to local organizers Olimpia (@olimpiaestela), Veronika (@breakpointv16), Gladis, and Maura (@squdgy). We all worked closely with Jason (@haleyjason) who ran the Burlington MA event. And don’t forget those folks at the Global Azure Bootcamp level providing a platform making this possible for a coordinated day of #Global Azure cloudiness (https://global.azurebootcamp.net/).

SPONSORS

The thanks continue with sponsors: MIT Women in Technology, Insight (formerly Blue Metal – https://www.insight.com/en_US/solve/digital-innovation.html), Finomial, and the Global Sponsors (https://global.azurebootcamp.net/sponsors/).

SPEAKERS

And a big thank you to the speakers – all who gave up a chunk of weekend to join us on a Saturday to share their knowledge (in order of appearance):

Attached are my slides:

The above graphic is from here: https://docs.microsoft.com/en-us/azure/event-grid/overview#event-sources

Here are some more links of interest:

  1. Some collected links (some repeated below): https://github.com/codingoutloud/bostonazurebootcamp2019/blob/master/README.md
  2. C# Script is real – not a hoax! 🙂 – https://msdn.microsoft.com/en-us/magazine/mt614271.aspx
  3. Azure Functions support C# Script (.csx files) – but also regular compiled C# (.cs on .NET Core)
  4. Example Azure Function written in regular compiled C#: https://github.com/codingoutloud/opstoolbox (especially https://github.com/codingoutloud/opstoolbox/blob/master/SslCertificateExpirationChecker.cs)
  5. Here are some example uses of the above:
  6. Event Grid:
    1. https://docs.microsoft.com/en-us/azure/event-grid/event-sources
    2. https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-event-grid
    3. https://madeofstrings.com/2018/06/29/azure-event-grid-filters-with-logic-apps/
    4. “Slide” I showed is below – it is from here: https://docs.microsoft.com/en-us/azure/event-grid/media/overview/functional-model.png
  7. Combine Azure Logic Apps with Azure Functions – https://docs.microsoft.com/en-us/azure/logic-apps/logic-apps-azure-functions#add-function-logic-app
  8. Similar to “follow-along lab” that tied together Subscription changes to an Azure Function using EventGrid
  9. Azure Function in JavaScript that fails 75% of the time. Useful for testing retries and seeing how errors are handled: https://gist.github.com/codingoutloud/151976063b1e9367369f1505f6cca66e
  10. Azure Blockchain Workbench:
    1. https://azure.microsoft.com/en-us/features/blockchain-workbench/
    2. https://docs.microsoft.com/en-us/azure/blockchain/workbench/
    3. https://docs.microsoft.com/en-us/azure/blockchain/workbench/architecture
    4. https://docs.microsoft.com/en-us/azure/blockchain/workbench/use

 

Talk: Running Securely On Azure

1 Reply

On Tuesday evening 27-Mar-2018 I had the pleasure of speaking to the Nashville Azure group about keeping workloads safe in the Azure cloud. Was a great group with a lot of interesting questions and dialog. They even helped to answer each others’ questions when I didn’t have answers, which is the best outcome of all.

For those interested in the deck I used, please find it below.

NashvilleAzure-RunningAzureSecurely-BillWilder-2018-Mar-27-Published

Talk: SQL Saturday 694 – Azure SQL Database – not just a cloud version of SQL Server

1 Reply

Spoke today to a small crowd of hardy soles who braved the snow to make it to SQL Saturday 694 – Providence – held at nearby Bryant University in Smithfield.

My slides are included below.

Azure SQL DB – Not Just A Cloud Version of SQL Server – SQL Saturday RI – 09-Dec-2017

Talk: SharePoint Saturday Burlington – Gentle Introduction to Azure

1 Reply

We first looked at how we might solve a random StackOverflow question using Azure Logic Apps, Azure Function Apps, the nifty PhantomJsCloud.com service, and a look at how a little Cognitive Service action could be woven in. A random walk around other Azure features followed. Some reactions were memorable – my favorite, because I completely agree: Why would I ever want to run my own SharePoint instance when the Office 365 service is available? And a bunch of other good questions.

Slides:

Talk: A Gentle Intro to Serverless Azure

1 Reply

Tonight I spoke at the North Boston Azure group and covering serverless concepts by looking at Logic Apps, Function Apps, and a couple of powerful/easy features of Web Apps (authentication via AAD/Twitter & CD via Github).

Before I posted the slides (see below), I needed to clean up the 1000+ emails I spammed myself with from my Logic App demo. (Doh!)

spammed-myself-with-more-than-1000-emails-from-logic-app-demo

The slides are available for review here:

bill-talking-at-nba

 

Talk: Logic Apps & Functions at Granite State SharePoint Users Group

1 Reply

Tonight I was pleased to have the opportunity to demystify Azure Logic Apps & Functions for the Granite State SharePoint Users Group. Here is the slide deck I used to present:

djj-k-rwsauqecu

Speaking at the “stimulation rich” Microsoft Store — photo credit: @jfj1997 Julie Turner

By the time I turned off the Twitter => Slack Logic App, a lot of messages were posted (in the #demo channel within Boston Azure slack account – which is open – join here):

slack

I will be giving a longer and more general version of this talk at the SharePoint Saturday New England 2017 event on Sat Oct 28 in Burlington MA.

Also planning other variants of this talk in the coming weeks:

  1. Azure Functions at Boston Azure – Thu Sep 14 in Cambridge MA (NERD)
  2. Serverless Azure at VT Code Camp – Sat Sep 16 in Burlington Vermont
  3. Serverless Azure at North Boston Azure – Tue Sep 26 in Burlington MA
  4. Logic Apps Thu Oct 5 at NE Microsoft Dev Group
  5. Serverless Azure at SharePoint Saturday NE event mentioned above Sat Oct 28 in Burlington MA