I meant to post this earlier but got distracted by a few other things. Yay for busy life, right?

Earlier this month Microsoft concluded their investigation of the recent Storm-0558 email compromise/attack and the results are... fascinating. I highly recommend checking out the blog post when you get a chance. It's available here. . . .

Read More

OK, OK, so it may not necessarily be the most interesting topic...

Nevertheless, I think this article from Microsoft on Conditional Access framework and policies is an important one.

Of particular note, there's a section on naming conventions and how to develop/establish a system that scales well for designating . . .

Read More

Great read from Microsoft: The Seven Properties of Highly Secure Devices.

This doc delves into architectural considerations for designing IoT systems that have security baked in. Good stuff!

Read More

In case I'm not the only person who as a little unfamiliar with Microsoft's "Verified ID" feature, I came across a great video from Andy Malone that walks through a practical example of how it works.

Here's a high-level diagram as well:

Very interesting and compelling. I think remains to be . . .

Read More

I came across a nifty quote by Pete Zerger while watching one of his LinkedIn Learning courses. This one really resonated with me:

Focus on security and productivity. Ensure that security enables productivity as well as reducing risk. If it hampers productivity or increases risk, reconsider.

I know at first . . .

Read More

I'm digging this illustration of IoT security architecture zones, courtesy of Microsoft docs.

The beauty of it all is the simple (but effective) principles:

• Segment the solution
• Minimize the impact of lower-trust zones against higher-trust zones
• Assume that as data traverses zones, it could be . . .

Read More