Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams

•Download as PPTX, PDF•

0 likes•209 views

Bring your applications data to life with Microsoft Power BI’s advanced data modeling and visualization capabilities. Learn how to load data and build business semantic data models which can scale massive size. Use those models to bring insights to your organization and the users of your application with interactive report and dashboard visualizations.

Technology

Secure the
environment
Secure
the code
Secure the
operations

YOU HAVE TO INCLUDE ALL PHASES TO BE SECURE
API AppWeb SQL

•
•
•
•
Azure Key Vault
Azure AD
Azure Storage
Web App

LOCAL
Team
CITY
Service
STATE
Offering
FEDERAL
CSEO

https://www.powershellgallery.com/packages/AzSK/
https://github.com/azsk/DevOpsKit-docs
https://github.com/azsk/DevOpsKit
https://marketplace.visualstudio.com/items?itemName=AzSDKTeam.SecurityIntelliSen
se-Preview
https://marketplace.visualstudio.com/items?itemName=azsdktm.AzSDK-task
https://www.microsoft.com/itshowcase/Article/Content/919/Building-
cloud-apps-using-the-Secure-DevOps-Kit-for-Azure
azsksup@microsoft.com

Tuesday
May 8
Sheraton
Willow AB
3:00PM –
4:15PM
Breakout
BRK2509
Technology, meet Strategy: The lessons from
Microsoft’s Digital Transformation with the Chief
Digital Officer
Every company is becoming a software company in some form –
what does this mean for your organization, your people, you!? This
session will tell the story of Microsoft’s internal digital
transformation through the eyes of the Chief Digital Officer, Kurt
DelBene. Kurt has been on the cutting edge of tech for the last 25
years. Joining Microsoft in 1992 as a leader in Windows, he went on
to help with the transformation of Office from a set of on-premises
tools to the vital Office 365 cloud service it is today and went on
after Microsoft to help former President Barack Obama save
Healthcare.gov! Now back at Microsoft, as Chief Digital Officer, Kurt
joins Julia White, CVP of Azure Marketing to discuss the nature of
digital transformation and what lessons can be learned from his and
Microsoft’s own digital transformation.
Kurt DelBene, Chief
Digital Officer, and
Julia White, CVP cloud
security

Day Time Code Topic Speakers
Monday
May 7
1:00PM –
2:15PM PT
Sheraton Grand
Ballroom A
BRK4001
Building secure cloud apps – lessons learned from
Microsoft’s internal security and software engineering
teams
Robert Venable and
Sudhindranath Byna
Monday
May 7
4:30PM –
5:45PM
WSCC:
Ballrooms 6C
BRK2110
Azure Messaging and event based architecture in the
real world: Lessons learned rebuilding Microsoft's
Supply chain on Azure Serverless
Hariharan Sundaram and
Lyle Dodge
Monday
May 7
6:00PM –
6:20PM
Expo Theater 1
THR3602
Operations at big scale: Inside the Microsoft
enterprise
Pete Apple
Tuesday
May 8
11:30AM –
11:50AM
Expo Theater 1
THR2508
Rebuilding for the cloud: Reinventing revenue
reporting at Microsoft
Robert Venable
Tuesday
May 8
3:00PM –
4:15PM
Sheraton Willow
AB
BRK2509
Technology, meet Strategy: The lessons from
Microsoft’s Digital Transformation with the Chief
Digital Officer
Kurt DelBene and Julia
White

IT Showcase
How Microsoft is digitally transforming its
enterprise
Visit the website
microsoft.com/itshowcase

Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams

Modern elastic cloud infrastructure is fundamentally breaking traditional security approaches. Public cloud has no natural perimeter and network segmentation leaving individual cloud servers exposed. In private cloud, malicious East-West traffic inside the network is a serious threat. As new workloads are added and retired dynamically, change control is difficult, and updating granular firewall rules and security policies becomes a risky, manual process. Join us and learn the 6 Critical Criteria to secure your public, private or hybrid cloud – on-demand, anywhere, at any scale.

TrendMicro - Security Designed for the Software-Defined Data Center

VMUG IT

Kevin Glavin - Continuous Integration, Continuous Delivery, and Deployment (C...

centralohioissa

Continuous Integration, Continuous Delivery, and Continuous Deployment can include security! We will explore functional examples of CI/CD^2 toolchains using only open source software (OSS): What are the components? What activities do they support? What works well? What works... not so well? What is the cost of freely available OSS? In this talk we will explore the activities that are involved with successful Continuous Integration, Continuous Delivery, and Continuous Deployment. We’ll do this by discussing how traditional software security activities like SAST, DAST, manual code reviews, and ethical hacking work together and independently to strengthen your program.

BlueHat v18 || Dep for the app layer - time for app sec to grow up

BlueHat Security Conference

Arshan Dabirsiaghi, Contrast Security Matt Austin, Contrast Security Nothing in the security industry has moved the needle like Data Execution Prevention and it's sister protections like ASLR. The availability of secure APIs, the training of developers around the world, and the efforts of security practitioners all produced practically nothing compared to the practical gains produced by DEP, ASLR and other "automatic" protections provided by the tool chain and OS itself. Where is the equivalent in the Application Layer? Can we use these same techniques and approaches to stop SQL Injection and Deserialization attacks? Can we give developers a "secure stack by default" for any application? In this talk we'll show you the promising results of our research into this space using binary instrumentation, including the release of free tools that developers can use to protect their applications today from several bug classes, instantly, and without any code changes.

Integrate Security into DevOps - SecDevOps

Ulf Mattsson

1.Security Controls Must Be Programmable and Automated Wherever Possible 2.Implement a Simple Risk and Threat Model for All Applications 3.Scan Custom Code, Applications and APIs 4.Scan for OSS Issues in Development 5.Treat Scripts/Recipes/Templates/Layers as Sensitive Code 6.Measure System Integrity and Ensure Correct Configuration at Load 7.Use Whitelisting on Production Systems, Including Container-Based Implementations 8.Assume Compromise; Monitor Everything; Architect for Rapid Detection and Response 9.Lock Down Production Infrastructure and Services 10.Tokenization and Payment Processing

by Twistlock With containers, teams worldwide are deploying faster than ever before. But traditional security practices are slow and manual - leaving many users a choice between strong security or DevOps speed. In this talk, we'll outline how adopting a new 'cloud native' approach to security lets you recognize all the benefits of containerized deployment - and enjoy stronger protection than ever before.

Security Challenges in Cloud

MarketingArrowECS_CZ

Timothy Wright & Stephen Halwes - Finding the Needle in the Hardware – Identi...

centralohioissa

During this talk we will be discussing hardware reverse engineering and why this is becoming a new way for attackers to compromise company networks. We will discuss how vendors are now leaving potentially malicious code within firmware and how some attackers could exploit these vulnerabilities. We will also discuss why it is important for companies to spend time reviewing hardware for vulnerabilities prior to deploying the systems within your company’s network and outlining a process on how to perform this work. The presenters will outline each phase of the hardware reverse engineering assessment, outlining how to exploit various vulnerabilities that you may discover and provide a list the software and tools that will be needed to support this work. Finally we will talk about how you should be documenting your findings for management and how to properly disclose the findings to the vendor once the test has been completed.

Msft cloud architecture_security_commonattacks

Akram Qureshi

2018 06 Presentation Cloudguard SaaS de Checkpoint

e-Xpert Solutions SA

2018 06 Presentation Cloudguard IaaS de Checkpoint

e-Xpert Solutions SA

A Stratagem on Strategy: Rolling Security Testing into Product Testing

Kevin Fealey

Commercial software products rely on formal test strategies to describe who will perform testing, when testing will occur, the process that will be followed, the depth of testing, and more. Test strategies are extended by test plans that detail specific tests that will be executed and how success will be measured. Test strategies and plans support objectively evaluating that software meets requirements and functions properly. Conversely, security teams think about where security gates should be in the SDLC and deploy SAST, DAST, IAST, manual testing, or a combination. Rarely is it considered what level of coverage these methods provide, and output from security testing is not mapped back to requirements. Compared to other teams involved in the SDLC, security seems to just be winging their test strategies and plans. Especially in a DevOps environment where silos are broken and responsibilities are shared across dev, ops, test, and security, use of common methodologies will help to reduce confusion and improve pipeline throughput. During this talk we will discuss: - What are test strategies and how are they used by product teams to provide consistency in testing (something security generally lacks)? - What are test plans and how are they used by product teams to enable visibly strong test coverage (something security also lacks)? - In a DevOps environment, what is security’s role in existing test strategies? - How can security teams leverage test plans to provide better visibility on test coverage and map findings back to requirements to reduce confusion and demonstrate security value to stakeholders throughout the value stream? - What other lessons can we learn from how dev, ops, and test support quality deliveries that can enable more effective and efficient security (e.g. security as code)?

Modernizing Traditional Security - DEM13 - AWS re:Inforce 2019

Amazon Web Services

As containers become the commonplace method for delivering and deploying applications, we’ve seen more of our customers taking a “lift-and-shift” approach to migrating their existing applications. In this session, John Morello from Twistlock discusses a non-profit that provides environmental science and engineering oversight to some of the world’s largest civil waterworks projects. This organization relies on a critical 14-year-old app that models storm surge. The move to containers for this application delivered immediate benefits, making it easier to manage vulnerabilities, ensure regulatory compliance, and provide runtime defense. In this session, we break down the security advantages of containers relative to traditional architectures.

SACON - Devops-container (Richard Bussiere)

Priyanka Aash

Mobile Threat Protection: A Holistic Approach to Securing Mobile Data and Dev...

Skycure

Why cloud native envs deserve better security - Dima Stopel, Twistlock - Clou...

Cloud Native Day Tel Aviv

Traditionally, security teams have been accustomed to investigating incidents and falling back to previous code releases if they detect serious issues. With the rise of modern cloud-native applications and immutable infrastructure, however, security engineers have new solutions at their fingertips. Immutable infrastructure refers to infrastructure with components that are designed to be destroyed and replaced with new versions whenever a change is necessary. This makes immutable infrastructure different from conventional deployment technologies, in which components were typically updated while they were still running rather than being redeployed whenever a change takes place. In this session, Dima Stopel will discuss the changing security landscape and how immutable infrastructure and cloud-native technologies such as containers, can make tedious, risk-prone security workflows a thing of the past.

Mobile Security: 2016 Wrap-Up and 2017 Predictions

Skycure

SACON - Automating SecOps (Murray Goldschmidt)

Priyanka Aash

Supply Chain Threats to the US Energy Sector

Kaspersky

This presentation by Cynthia James discusses steps to take towards cyber-securing the supply chain of Energy sector organizations in the U.S. From the biggest challenges to a review of regulation and compliance guidelines, this deck covers three areas of Energy: nuclear, electric and "other". Cynthia James is a CISSP (Certified Information Systems Security Professional) and frequent presenter for the TABD group at Kaspersky Lab, global provider of cybersecurity solutions. With 9 years of experience in the cybersecurity space, Cynthia is a regular speaker on the subject and has authored a book on cybercrime: “Stop Cybercrime from Ruining Your Life".

Security in the Development Lifecycle - lessons learned

Boaz Shunami

In this presentation, I delivered in the OWASP IL conference on September 2012. I discuss the lessons learned from several years of Implementing Application Security into the development lifecycle on organizations in IL, EU and US. I cover some different approaches to the subject and also different types of organizations. Concluding with some recommendations. Feel free to contact me if you have any questions: boaz (at) komodosec.com check out our website and services on: www.komodosec.com

How to Predict, Detect and Protect Against Mobile Cyber Attacks

Skycure

Watch webinar recording: http://hubs.ly/H01l56L0 Join Brian Katz, director of mobile strategy at VMware, and Varun Kohli, vice president at Skycure, discuss how to: - Get visibility into ALL mobile threats, vulnerabilities and attacks impacting your organization today - Integrate Skycure with AirWatch to predict, detect, and protect against mobile cyber attacks - Stop attacks before they make it to the enterprise by profiling good and bad device, app and user behaviors by leveraging crowd wisdom

CLOUD SECURITY IN INSURANCE INDUSTRY WITH RESPECT TO INDIAN MARKET

Practical DevSecOps Using Security Instrumentation

VMware Tanzu

7 Experts on Implementing Azure Sentinel

Mighty Guides, Inc.

Twistlock: 7 Experts on Cloud-Native Security

Mighty Guides, Inc.

Azure Messaging and event based architecture in the real world: Lessons learn...

Microsoft Tech Community

Rebuilding for the cloud: Reinventing revenue reporting at Microsoft

Microsoft Tech Community

Follow Microsoft’s journey to redesign its internal revenue tracking system—the beating heart of financial tracking and billing at Microsoft. Meet the team lead who is transforming an outdated app to a new, scalable, cloud-based solution that can handle billions of microtransactions from selling software as a service (SaaS)—billing pennies here and there for a Skype call or a few minutes of Azure server time.

What's hot

Security at the Speed of Software - Twistlock

Amazon Web Services

Security Challenges in Cloud

MarketingArrowECS_CZ

Timothy Wright & Stephen Halwes - Finding the Needle in the Hardware – Identi...

centralohioissa

Msft cloud architecture_security_commonattacks

Akram Qureshi

2018 06 Presentation Cloudguard SaaS de Checkpoint

e-Xpert Solutions SA

2018 06 Presentation Cloudguard IaaS de Checkpoint

e-Xpert Solutions SA

A Stratagem on Strategy: Rolling Security Testing into Product Testing

Kevin Fealey

Modernizing Traditional Security - DEM13 - AWS re:Inforce 2019

Amazon Web Services

SACON - Devops-container (Richard Bussiere)

Priyanka Aash

Mobile Threat Protection: A Holistic Approach to Securing Mobile Data and Dev...

Skycure

Why cloud native envs deserve better security - Dima Stopel, Twistlock - Clou...

Cloud Native Day Tel Aviv

Mobile Security: 2016 Wrap-Up and 2017 Predictions

Skycure

SACON - Automating SecOps (Murray Goldschmidt)

Priyanka Aash

Supply Chain Threats to the US Energy Sector

Kaspersky

Security in the Development Lifecycle - lessons learned

Boaz Shunami

How to Predict, Detect and Protect Against Mobile Cyber Attacks

Skycure

CLOUD SECURITY IN INSURANCE INDUSTRY WITH RESPECT TO INDIAN MARKET

Practical DevSecOps Using Security Instrumentation

VMware Tanzu

7 Experts on Implementing Azure Sentinel

Mighty Guides, Inc.

Twistlock: 7 Experts on Cloud-Native Security

Mighty Guides, Inc.

What's hot (20)

Security at the Speed of Software - Twistlock

Security Challenges in Cloud

Timothy Wright & Stephen Halwes - Finding the Needle in the Hardware – Identi...

Msft cloud architecture_security_commonattacks

2018 06 Presentation Cloudguard SaaS de Checkpoint

2018 06 Presentation Cloudguard IaaS de Checkpoint

A Stratagem on Strategy: Rolling Security Testing into Product Testing

Modernizing Traditional Security - DEM13 - AWS re:Inforce 2019

SACON - Devops-container (Richard Bussiere)

Mobile Threat Protection: A Holistic Approach to Securing Mobile Data and Dev...

Why cloud native envs deserve better security - Dima Stopel, Twistlock - Clou...

Mobile Security: 2016 Wrap-Up and 2017 Predictions

SACON - Automating SecOps (Murray Goldschmidt)

Supply Chain Threats to the US Energy Sector

Security in the Development Lifecycle - lessons learned

How to Predict, Detect and Protect Against Mobile Cyber Attacks

CLOUD SECURITY IN INSURANCE INDUSTRY WITH RESPECT TO INDIAN MARKET

Practical DevSecOps Using Security Instrumentation

7 Experts on Implementing Azure Sentinel

Twistlock: 7 Experts on Cloud-Native Security

Similar to Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams

Azure Messaging and event based architecture in the real world: Lessons learn...

Microsoft Tech Community

Rebuilding for the cloud: Reinventing revenue reporting at Microsoft

Microsoft Tech Community

December 2022 Microsoft 365 Need to Know Webinar

Robert Crane

PaaS and Container Innovation – What’s new with App Service

Microsoft Tech Community

Azure Certification AZ-300 | Edureka

Edureka!

YouTube Link: https://youtu.be/RIVDgSGcLRY (** Microsoft Azure Certification Training: https://www.edureka.co/microsoft-azure-developer-associate-certification-training-course **) This Edureka "Azure Certification - AZ - 300” PPT will give you a thorough and insightful overview of a new set of Microsoft Azure Certifications and Azure AZ-100 certification in particular. Following are the offering of this PPT: 1. Why This Transition? 2. What Does It Cover? 3. Pre-requisites 4. Exam Basics 5. How to Prepare? 6. Frequently Asked Questions Check out our Playlists: https://goo.gl/A1CJjM Blog Series: https://goo.gl/KvjU4h Follow us to never miss an update in the future. YouTube: https://www.youtube.com/user/edurekaIN Instagram: https://www.instagram.com/edureka_learning/ Facebook: https://www.facebook.com/edurekaIN/ Twitter: https://twitter.com/edurekain LinkedIn: https://www.linkedin.com/company/edureka

What's new for Serverless Computing in Azure

Microsoft Tech Community

SharePoint Saturday Ottawa 2014 - Microsoft Azure : Central component of your...

PimpMySharePoint

The Cloud can help you and your organization to maximize your investments and to simplify your business processes for all your SharePoint activities. Microsoft Azure can offer you a lot of services that can allow you to transform your infrastructures, your development paradigm and your IT teams to start thinking in terms of DevOps. In this session, our goal will be to show you how to use the Azure platform in an enterprise where SharePoint is used as an application platform. Subjects covered will be : - Microsoft Azure as IaaS - Microsoft Azure as CDN - Microsoft Azure as hub for all your ALM with Visual Studio Online - Microsoft Azure as an application layer for all your SharePoint Apps - Microsoft Azure as a complex integration environment - Microsoft Azure as a deployment framework The cloud and Microsoft Azure to help the SharePoint platform, it's possible! By Sebastien Levert and Julien Stroheker - Twitter: @sebastienlevert and @Ju_Stroh

Operations at big scale inside the microsoft enterprise

Microsoft Tech Community

Microsoft Azure and Microsoft 365 - How Will They Help You

Suhail Jamaldeen

Are you ready? Introduction to Cloud Computing and Windows Azure

Thomas Robbins

Windows Azure is an internet scale cloud computing and services platform hosted in Microsoft data centers, which provides an operating system and a set of developer services which can be used individually or together. It gives developers the choice to build web application; applications running on connected devices, PCs or servers; or hybrid solutions offering the best of both worlds. Don’t miss this session to learn what cloud computing is and what Windows Azure provides. Speaker: Vince Mayfield, CEO Bit-Wizards

Transform your organization with cisco cloud

solarisyougood

週刊Azureなう Igniteキャッチアップ編

Naoki (Neo) SATO

Interesting EMS Sessions for Ignite 2018

JoshuaLanier5

Land your data safely and accurately with Power Platform and Azure.pdf

George Grammatikos

The Trinity in Exponential Technologies: Open Source, Blockchain and Microsof...

Juarez Junior

DEVNET-1147 Energizing Your Career with Cloud Technologies

Cisco DevNet

How do you protect a hybrid PaaS-IaaS solution, built entirely in the cloud?

Lorenzo Barbieri

SQLArgentina - Data Platform Summit BA - Keynote

Mariano Kovo

Supercharge Your Spring Boot Apps!

VMware Tanzu

LinuxONE InterConnect2017 slideshare_ppt

Arun M

Similar to Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams (20)

Azure Messaging and event based architecture in the real world: Lessons learn...

Rebuilding for the cloud: Reinventing revenue reporting at Microsoft

December 2022 Microsoft 365 Need to Know Webinar

PaaS and Container Innovation – What’s new with App Service

Azure Certification AZ-300 | Edureka

What's new for Serverless Computing in Azure

SharePoint Saturday Ottawa 2014 - Microsoft Azure : Central component of your...

Operations at big scale inside the microsoft enterprise

Microsoft Azure and Microsoft 365 - How Will They Help You

Are you ready? Introduction to Cloud Computing and Windows Azure

Transform your organization with cisco cloud

週刊Azureなう Igniteキャッチアップ編

Interesting EMS Sessions for Ignite 2018

Land your data safely and accurately with Power Platform and Azure.pdf

The Trinity in Exponential Technologies: Open Source, Blockchain and Microsof...

DEVNET-1147 Energizing Your Career with Cloud Technologies

How do you protect a hybrid PaaS-IaaS solution, built entirely in the cloud?

SQLArgentina - Data Platform Summit BA - Keynote

Supercharge Your Spring Boot Apps!

LinuxONE InterConnect2017 slideshare_ppt

More from Microsoft Tech Community

100 ways to use Yammer

Microsoft Tech Community

10 Yammer Group Suggestions

Microsoft Tech Community

Removing Security Roadblocks to IoT Deployment Success

Microsoft Tech Community

Building mobile apps with Visual Studio and Xamarin

Microsoft Tech Community

Best practices with Microsoft Graph: Making your applications more performant...

Microsoft Tech Community

Interactive emails in Outlook with Adaptive Cards

Microsoft Tech Community

Unlocking security insights with Microsoft Graph API

Microsoft Tech Community

As organizations deploy additional security controls to combat today’s evolving threats, integration challenges often limit the return of investment. The new security API in the Microsoft Graph makes it easier for enterprise developers and ISVs to unlock insights from these solutions by unifying and standardizing alerts for easier integration and correlation, bringing together contextual data to inform investigations, and enabling automation for greater SecOps efficiency. We will walk through real world examples of applications that leverage the security API to help customers realize the full value of their security investments.

Break through the serverless barriers with Durable Functions

Microsoft Tech Community

Multiplayer Server Scaling with Azure Container Instances

Microsoft Tech Community

Explore Azure Cosmos DB

Microsoft Tech Community

Media Streaming Apps with Azure and Xamarin

Microsoft Tech Community

DevOps for Data Science

Microsoft Tech Community

Real-World Solutions with PowerApps: Tips & tricks to manage your app complexity

Microsoft Tech Community

Azure Functions and Microsoft Graph

Microsoft Tech Community

Ingestion in data pipelines with Managed Kafka Clusters in Azure HDInsight

Microsoft Tech Community

Getting Started with Visual Studio Tools for AI

Microsoft Tech Community

Using AML Python SDK

Microsoft Tech Community

Mobile Workforce Location Tracking with Bing Maps

Microsoft Tech Community

Cognitive Services Labs in action Anomaly detection

Microsoft Tech Community

Speech Devices SDK

Microsoft Tech Community

More from Microsoft Tech Community (20)

100 ways to use Yammer

10 Yammer Group Suggestions

Removing Security Roadblocks to IoT Deployment Success

Building mobile apps with Visual Studio and Xamarin

Best practices with Microsoft Graph: Making your applications more performant...

Interactive emails in Outlook with Adaptive Cards

Unlocking security insights with Microsoft Graph API

Break through the serverless barriers with Durable Functions

Multiplayer Server Scaling with Azure Container Instances

Explore Azure Cosmos DB

Media Streaming Apps with Azure and Xamarin

DevOps for Data Science

Real-World Solutions with PowerApps: Tips & tricks to manage your app complexity

Azure Functions and Microsoft Graph

Ingestion in data pipelines with Managed Kafka Clusters in Azure HDInsight

Getting Started with Visual Studio Tools for AI

Using AML Python SDK

Mobile Workforce Location Tracking with Bing Maps

Cognitive Services Labs in action Anomaly detection

Speech Devices SDK

Recently uploaded

FIDO Alliance Osaka Seminar: Overview.pdf

FIDO Alliance

Mission to Decommission: Importance of Decommissioning Products to Increase E...

Product School

From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...

Product School

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...

Product School

When stars align: studies in data quality, knowledge graphs, and machine lear...

Elena Simperl

How world-class product teams are winning in the AI era by CEO and Founder, P...

Product School

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

Product School

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

FIDO Alliance

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

FIDO Alliance

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

To Graph or Not to Graph Knowledge Graph Architectures and LLMs

Paul Groth

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

Prayukth K V

The IoT and OT threat landscape report has been prepared by the Threat Research Team at Sectrio using data from Sectrio, cyber threat intelligence farming facilities spread across over 85 cities around the world. In addition, Sectrio also runs AI-based advanced threat and payload engagement facilities that serve as sinks to attract and engage sophisticated threat actors, and newer malware including new variants and latent threats that are at an earlier stage of development. The latest edition of the OT/ICS and IoT security Threat Landscape Report 2024 also covers: State of global ICS asset and network exposure Sectoral targets and attacks as well as the cost of ransom Global APT activity, AI usage, actor and tactic profiles, and implications Rise in volumes of AI-powered cyberattacks Major cyber events in 2024 Malware and malicious payload trends Cyberattack types and targets Vulnerability exploit attempts on CVEs Attacks on counties – USA Expansion of bot farms – how, where, and why In-depth analysis of the cyber threat landscape across North America, South America, Europe, APAC, and the Middle East Why are attacks on smart factories rising? Cyber risk predictions Axis of attacks – Europe Systemic attacks in the Middle East Download the full report from here: https://sectrio.com/resources/ot-threat-landscape-reports/sectrio-releases-ot-ics-and-iot-security-threat-landscape-report-2024/

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...

Product School

Leading Change strategies and insights for effective change management pdf 1.pdf

OnBoard

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

Inflectra

In this insightful webinar, Inflectra explores how artificial intelligence (AI) is transforming software development and testing. Discover how AI-powered tools are revolutionizing every stage of the software development lifecycle (SDLC), from design and prototyping to testing, deployment, and monitoring. Learn about: • The Future of Testing: How AI is shifting testing towards verification, analysis, and higher-level skills, while reducing repetitive tasks. • Test Automation: How AI-powered test case generation, optimization, and self-healing tests are making testing more efficient and effective. • Visual Testing: Explore the emerging capabilities of AI in visual testing and how it's set to revolutionize UI verification. • Inflectra's AI Solutions: See demonstrations of Inflectra's cutting-edge AI tools like the ChatGPT plugin and Azure Open AI platform, designed to streamline your testing process. Whether you're a developer, tester, or QA professional, this webinar will give you valuable insights into how AI is shaping the future of software delivery.

Neuro-symbolic is not enough, we need neuro-*semantic*

Frank van Harmelen

Neuro-symbolic (NeSy) AI is on the rise. However, simply machine learning on just any symbolic structure is not sufficient to really harvest the gains of NeSy. These will only be gained when the symbolic structures have an actual semantics. I give an operational definition of semantics as “predictable inference”. All of this illustrated with link prediction over knowledge graphs, but the argument is general.

Essentials of Automations: Optimizing FME Workflows with Parameters

Safe Software

Are you looking to streamline your workflows and boost your projects’ efficiency? Do you find yourself searching for ways to add flexibility and control over your FME workflows? If so, you’re in the right place. Join us for an insightful dive into the world of FME parameters, a critical element in optimizing workflow efficiency. This webinar marks the beginning of our three-part “Essentials of Automation” series. This first webinar is designed to equip you with the knowledge and skills to utilize parameters effectively: enhancing the flexibility, maintainability, and user control of your FME projects. Here’s what you’ll gain: - Essentials of FME Parameters: Understand the pivotal role of parameters, including Reader/Writer, Transformer, User, and FME Flow categories. Discover how they are the key to unlocking automation and optimization within your workflows. - Practical Applications in FME Form: Delve into key user parameter types including choice, connections, and file URLs. Allow users to control how a workflow runs, making your workflows more reusable. Learn to import values and deliver the best user experience for your workflows while enhancing accuracy. - Optimization Strategies in FME Flow: Explore the creation and strategic deployment of parameters in FME Flow, including the use of deployment and geometry parameters, to maximize workflow efficiency. - Pro Tips for Success: Gain insights on parameterizing connections and leveraging new features like Conditional Visibility for clarity and simplicity. We’ll wrap up with a glimpse into future webinars, followed by a Q&A session to address your specific questions surrounding this topic. Don’t miss this opportunity to elevate your FME expertise and drive your projects to new heights of efficiency.

Accelerate your Kubernetes clusters with Varnish Caching

Thijs Feryn

Recently uploaded (20)

FIDO Alliance Osaka Seminar: Overview.pdf

Mission to Decommission: Importance of Decommissioning Products to Increase E...

From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...

Unsubscribed: Combat Subscription Fatigue With a Membership Mentality by Head...

When stars align: studies in data quality, knowledge graphs, and machine lear...

How world-class product teams are winning in the AI era by CEO and Founder, P...

AI for Every Business: Unlocking Your Product's Universal Potential by VP of ...

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

FIDO Alliance Osaka Seminar: The WebAuthn API and Discoverable Credentials.pdf

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

GraphRAG is All You need? LLM & Knowledge Graph

To Graph or Not to Graph Knowledge Graph Architectures and LLMs

State of ICS and IoT Cyber Threat Landscape Report 2024 preview

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

De-mystifying Zero to One: Design Informed Techniques for Greenfield Innovati...

Leading Change strategies and insights for effective change management pdf 1.pdf

Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality

Neuro-symbolic is not enough, we need neuro-*semantic*

Essentials of Automations: Optimizing FME Workflows with Parameters

Accelerate your Kubernetes clusters with Varnish Caching

Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams

5. Secure the environment Secure the code Secure the operations

6. YOU HAVE TO INCLUDE ALL PHASES TO BE SECURE API AppWeb SQL

8. • • • • • • • • • • •

10.

11.

12. • • • • Azure Key Vault Azure AD Azure Storage Web App

13.

14.

15.

16.

17.

18.

19.

20.

21.

22.

23. LOCAL Team CITY Service STATE Offering FEDERAL CSEO

24.

25. https://www.powershellgallery.com/packages/AzSK/ https://github.com/azsk/DevOpsKit-docs https://github.com/azsk/DevOpsKit https://marketplace.visualstudio.com/items?itemName=AzSDKTeam.SecurityIntelliSen se-Preview https://marketplace.visualstudio.com/items?itemName=azsdktm.AzSDK-task https://www.microsoft.com/itshowcase/Article/Content/919/Building- cloud-apps-using-the-Secure-DevOps-Kit-for-Azure azsksup@microsoft.com

26. Tuesday May 8 Sheraton Willow AB 3:00PM – 4:15PM Breakout BRK2509 Technology, meet Strategy: The lessons from Microsoft’s Digital Transformation with the Chief Digital Officer Every company is becoming a software company in some form – what does this mean for your organization, your people, you!? This session will tell the story of Microsoft’s internal digital transformation through the eyes of the Chief Digital Officer, Kurt DelBene. Kurt has been on the cutting edge of tech for the last 25 years. Joining Microsoft in 1992 as a leader in Windows, he went on to help with the transformation of Office from a set of on-premises tools to the vital Office 365 cloud service it is today and went on after Microsoft to help former President Barack Obama save Healthcare.gov! Now back at Microsoft, as Chief Digital Officer, Kurt joins Julia White, CVP of Azure Marketing to discuss the nature of digital transformation and what lessons can be learned from his and Microsoft’s own digital transformation. Kurt DelBene, Chief Digital Officer, and Julia White, CVP cloud security

27. Day Time Code Topic Speakers Monday May 7 1:00PM – 2:15PM PT Sheraton Grand Ballroom A BRK4001 Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams Robert Venable and Sudhindranath Byna Monday May 7 4:30PM – 5:45PM WSCC: Ballrooms 6C BRK2110 Azure Messaging and event based architecture in the real world: Lessons learned rebuilding Microsoft's Supply chain on Azure Serverless Hariharan Sundaram and Lyle Dodge Monday May 7 6:00PM – 6:20PM Expo Theater 1 THR3602 Operations at big scale: Inside the Microsoft enterprise Pete Apple Tuesday May 8 11:30AM – 11:50AM Expo Theater 1 THR2508 Rebuilding for the cloud: Reinventing revenue reporting at Microsoft Robert Venable Tuesday May 8 3:00PM – 4:15PM Sheraton Willow AB BRK2509 Technology, meet Strategy: The lessons from Microsoft’s Digital Transformation with the Chief Digital Officer Kurt DelBene and Julia White

28. IT Showcase How Microsoft is digitally transforming its enterprise Visit the website microsoft.com/itshowcase

Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams

Similar to Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams (20)

More from Microsoft Tech Community

More from Microsoft Tech Community (20)

Recently uploaded

Recently uploaded (20)

Building secure cloud apps – lessons learned from Microsoft’s internal security and software engineering teams

Editor's Notes