All You Need is Guest

Security

Business users creating apps without security expertise leads to insecure applications. How can we ensure security in this new landscape and what vulnerabilities exist in Azure's ecosystem?

Key takeaways

Business users are creating apps without security expertise, leading to insecure applications.
The security of these applications depends on the security of the users who use them.
The shared responsibility model needs to be pushed, as the platforms can’t do everything.
Vendors need to onboard easily, and business users need to be guided to make better security decisions.
Business users can bypass security features by using guest tenants and unapproved connectors.
Guest users can access resources and data within an organization.
The Azure Active Directory (AAD) allows for unknown behavior, such as the ability for guest users to access resources.
Azure CLI can generate tokens on behalf of users.
Power Apps allows business users to create applications without security expertise.
Hackers can use Power Apps to get access to resources and data within an organization.
Business users need to be informed and guided to make better security decisions.
Easy onboarding for vendors is crucial.
Guiding business users to make better security decisions is important.
DLP is a great mechanism, but it’s limited.
The best framework we have today is the security mechanism for guiding business users.
AAD needs to be improved for better security.
The Azure File Storage is vulnerable.
Guest users can be invited to a tenant and access resources.
Business users need to be aware of what applications they are building.
The way to solve this is to hack own environment.
The tool PowerGuest can be used to check and understand the application.
The security of the applications is tied to the security of the users who use them.

All You Need is Guest

More talks