Name: Ransomware, Identity Threats, and the AI Boom: Resilience for M365
Uploaded: 2026-04-14T04:16:05.731Z
Duration: 30 min 8 s
Description: Ransomware, Identity Threats, and the AI Boom: Resilience for M365

Transcript for "Ransomware, Identity Threats, and the AI Boom: Resilience for M365": Hi. Welcome, everyone. My name is Eddie Waslowski, field CTO for Rubik, joined by, Andy Malone, Microsoft MVP and industry expert. And welcome to our session, where we're gonna be talking about ransomware, identity threats, and the AI boom, all around the resilience of, m three sixty five. Andy, thanks so much for, for joining us. Maybe we can start out. If you could just maybe tell us a little bit about yourself and, and and get right into it. Absolutely. Nice to meet you, Eddie. Andy Malone, Microsoft MVP, as Eddie said. I'm based in The UK, in Scotland. I've been an MVP now for twenty years and a Microsoft trainer for thirty years. I run a YouTube channel. I write novels and I speak a lot of conferences. And my MVP area of expertise is in identity and security, so great for this. Fantastic. Thanks so much. So we're gonna have some fun. We're gonna talk this isn't gonna be kind of a product pitch. Right? We're gonna get and talk a little bit about just kind of the reality of things that we're seeing at, at the Microsoft three sixty five level. For those of you who who don't know, Rubrik, has been supporting Microsoft three sixty five with our, technology stack for a number of years now, and I've seen a number of trends. And speaking with folks like Andy gives us a kind of a good reality check to kinda make sure, okay, you know, what what are we talking about? How relevant is that? And and what is Andy really seeing as it relates to the kind of the threat landscape as it relates to, to March? So, you know, Andy, I guess I'll start off, you know, we've got into Microsoft when when organizations initially kind of deployed Microsoft and not March. Right? SharePoint servers on prem and file share servers and exchange servers and all these kinds of things. What we saw in the on prem world was a lot of kind of a data encryption types of types of attacks and seeing ways in which they can hold organizations hostage. But it's just not the case anymore really for for March. We've seen this kind of massive increase in attacks as it relates to, identity based attacks and and organizations more going towards this identity weaponization. Maybe you could talk a little bit about what you're seeing because our end we see and and learn from Microsoft, these attacks are up 275 year over year, 600,000,000 identity based attacks per year. But, kind of, what are you seeing on on your end as it relates to the threat the threat landscape of March? Yeah. Absolutely. I totally agree with you. It it's very interesting because the big selling point of moving to the cloud was that you'd hey, we don't need to do backups. Your data's safe. Your data's secure. Your data's protected. And it's interesting how, time has evolved on. And but as you say, identity is the first port of call. And, Microsoft Identity Solutions, I think one of the weaknesses, is on premises. And the fact that we still have active directory on premises, and it's that link, if you will, that hackers are using. So if we can get on premises, find the weaknesses, and we can traverse that to the cloud. And, of course, the when you talk about ransomware, the cruel attack at the moment is not just simply, ransomware ing the the the, targets, active directory or their system, but also their backups as well. And that's particularly cool. But also with identity, one of the big things that we're seeing at the moment is, the token theft attacks. Yes? So token theft is becoming a real issue. And, you know, Microsoft did a pretty good job at, you know, showing that and demonstrating that. But with the the likes of phishing resistant credentials, they've just released, you know, token phishing resistant credentials for for mobile devices that will sync with, Apple. And we're hoping that that will hopefully improve security a little bit. So Yeah. I mean, identity is so interesting these days. Right? Because, you know, you talk about, you know, building taller walls and wider moats and and trying to figure out ways in which to keep the the bad guys out. But identity really is kind of the the new perimeter. Right? So if you've got this idea that that identity is collapsing or or the provider itself is compromised, you're kinda locked out of your own your own estate or your own your own house. Right? Totally. Totally. I mean, and and, you know, we've got, Microsoft are rolling out, you know, conditional access policies. Everyone has to use phishing resistant credentials. And of course, one of the issues that we have with that is that we need some kind of a get out of jail free card for admins. So bay basically, we have the idea is that you have these Fido keys and and it's a phishing resistant credential. So, if worst case scenario things go go horribly wrong, you can store one of these in a safe somewhere and at least you can get back into your system. But the big recommendation right now is, you know, don't do security for all users. Because if you do security for all users, it could encompass all admins and you could lock yourself out. So in that respect, what Microsoft suggest is, kiss. You know, keep it small, keep it simple, roll it out in waves, and that will give you more control. Yeah. You know, it's funny you talk about this whole idea of we're talking about, like, identity, and I think it's important to to provide a distinction between recovery and resilience. Right? Because recovering is just, hey, you know, Andy and Eddie are users, and we wanna be able to get those back up and running. If you think about, like, the resilience and, like, the trust fabric and all of the things that exist within something like Entra, and how that relates to active directory on prem, which most organizations have deployed some kind of hybrid type of scenario situation between the communication. But thinking about, like, all of those things of okay. I I've got conditional access policies. I have app registrations. I have enterprise applications. All of these things that are critical, not just restoring those, but understanding how they relate and being able to recover those in in minutes as opposed to, you know, hours and weeks where we've seen this kind of process within Microsoft, like a 150 serial steps. And we've seen organizations take, you know, several weeks to be able to to kind of recover these. So we see these kind of organizations that are kind of thinking about their their blast radius and kind of what's happening. And, you know, within March, it's it's this kind of hybrid idea. Even though things are it's a SaaS application, we still have this kind of, scenario of of being able to to kind of recover recover both. And I think that's a in a critical dis distinction when you talk about identity. It's not just recovery, but it's the resilience and all the critical applications and things that exist within identity. Oh, I so I mean, totally. Somebody was talking to me the other day, and they said to me, Andy, is there a way that I can back up my configuration, my enter ID structure, and things like that? And, you know, there isn't. There's there's no way that you can do it natively with Microsoft. There are third party products. But that's the problem. We're starting to see, you know, gaps, you know. Microsoft said you never needed to do backups. But now we do need to do backups. We need to backup our data. I mean, the the whole cloud flare, I was in The US just in November there. And we had a massive outage. There was a massive outage of so many different sites. And it's a little embarrassing when you're up on stage. And if that was a mission critical environment, you you're here you you are really in trouble. So you really do need a backup. A, because if you are hit with ransomware, I you would hope that an organization like Microsoft trust. Safeguards in place, because the cloud vendors are just don't have them. So things like, you know, extra backups or, some third party identity backup solution or third party tool is is gonna be more and more important, I think. Yeah. I mean, think about the concept of of, like, a minimally viable business and what do you need to to execute operations. It's not just, you know, within the Microsoft stack. All of the things that these apps are touching, the you have in terms of Entra. Right? How do you log in to specific applications? Right? How do you deal with, you know, time off request? How do you deal with accounting? I mean, all of the things that that touch Entra or just all of these these applications is is quite robust. And organizations, I think, need to be thinking about this broader approach and saying, well, I don't necessarily need to back up, you know, this three sixty five. I don't necessarily need to back up identity. Well, what's what's the strategy? Right? And we've seen organizations go through these attacks and and, unfortunately, have to figure out ways in which to communicate, collaborate, be pro productive without these, which is which is really, which is really crazy. Yeah. I mean, you're you're you're so so to interrupt you, you're talking about, you know, identity there. And, originally, of course, we had Microsoft Identra I sorry. Entra. And the big thing, of course, was, hey, let's, connect to a directory sync server on premises to active directory. And the the big selling feature in the early days was convenience. The fact that you could have single sign on, and that would give you single sign on not just to your on premises infrastructure, but all these other SaaS application, platforms that are out there. And now suddenly Microsoft and, many kind of third party watchers are looking at that going now, hold on a minute. Do you want convenience or do you want security? And we now realize that that, single sign on solution is potentially an Achilles heel. So, you know, it's not necessarily a recommendation anymore. So Well, Andy, you're making all of our product managers very happy hearing all of these things because it helps to validate what we're doing is actually is is relevant. It's it's helping customers from, from a broader perspective. So, so let's talk a little bit about kind of recovery. Right? And kind of the traditional backup strategies and and these kinds of things and, you know, if it these attacks happened, the the playbook has been kind of restore from from backup. And and I think we're kind of highlighting why that really doesn't that doesn't work. Because, you know, thinking about a recovery process, trying to, like, make the distinction of what to recover and how long it's gonna take, it's it's a it's a pretty big challenge these days. Wouldn't you agree? Totally. Totally. And one thing that has definitely emerged is the need for immutable backups, or air gapped backups as the the trendy name is now. So and, you know, just and in fact, I'm I'm here in Norway this week and we were talking about the the famous Maersk attack. You know, the ransomware that hit Maersk, one of the biggest companies in the world. And thank goodness, they had an off-site, active directory server on a boat somewhere in Africa, that they managed to restore their entire network. So you need to have some kind of off-site air gap backup. It's an absolute necessity these days. Yeah. And you think about, you know, you want you want things to live outside of the trust boundary. Right? Because if you have these kinds of attacks where social engineering is working and you're and you're gaining access at a at a credential level, you know, there's just there's no way to really prevent that. So we have to do that in order to to kinda bring these these things back. The thing is, hackers are really super smart. You know, they're you know, when you look at the actual technology, the technology's sound. And the whole the whole thing about social engineering is that the bad guys lure you away from it or, you know, pull you aside from it so that their attack can go through. You know, things like token based attacks and, you know, SSL stripping attacks and things like that. The whole point is to divert you away, make a noise over here while you do the damage over here. It's a classic attack, you know. I often talk about in my sessions with with customers. I talk about how 365 is kind of this virtual attic or or virtual basement. Because you you have an aggregation of data that has been accumulated over decades. Right? And when you think about undergoing a task or or a process where you're saying, okay, I wanna back up all of this data, is great. But then you think about, like, a recovery process and kind of what is the the minimally viable company, it's very difficult to make the distinction of what is the most critical thing from a a, a business level process that we need to be up and running. Right? So this game now that we play is, well, how fast, how long does it take, how quickly can you get up and running. Right? And if you think about going from an attic that you've got all this stuff up there, I have to use attic because I'm in Texas. We don't get we unfortunately don't get basements. But, you know, think about this this kind of strategy where okay. Well, I've gotta be able to bring the the data back and we can't wait so long. So, you know, without this kind of without utilizing things like AI or other data classification technologies, figuring out a way in which to prioritize recovery becomes quite a big challenge too as well. Oh, totally. I think and this is where, you know, companies need to do a risk analysis of what data they've got, where is it stored, what compliance requirements are required for that data as well. Things like, you know, retention policies, absolutely critical. How long do they have to keep it? You know, that's all gotta come into it as well as, you know, into that or interwoven into that backup strategy as well. Yeah. I mean, you think about if you if you have something where you have a an outage or an instance of, you know, compromising event, I think probably the I don't know what you see from from your perspective, but a lot of what I see is trying to figure out what what what it was impacted. Do we do we need to recover? How quickly is that gonna take? Do we need to consider a ransomware payment? Or do we have information that can help us prevent us from having to do that that we have enough information around what was what was been impacted. I think a lot of what we're seeing is that the time that it takes to discover. Sure. Sure. Oh, yeah. I mean, you you definitely need, I mean, you definitely need some kind of EDR solution. You know, I mean, the world has evolved, and we've moved on so much that traditional security just doesn't cut it anymore. And this is what worries me about the kind of hybrid solutions. If you're still on premises, you know, your data some of your data is still on premises, which is great, and you've got backup solutions there. But again, you need the off-site backup. You need that air gapped backup. And to be honest, this is one of the benefits of the cloud. You know, the you know, having a a a provider that you can work with, I think, is a is a real win win. And, you know, so you you you see it in one side as being a potential nightmare. But again, on the on the flip side, if it's done right, it can be a great solution. Yeah. Alright. Let's pivot to the thing that everybody wants to talk about. AI AI co pilot this. We wanna be able to leverage leverage the technology, which is which is great. I know you've got a significant amount of expertise in the in the co pilot arena and and AI. So let's talk a little bit about that. We're seeing a lot of organizations that are are rushing to do this. And we wanna we wanna get to to, you know, to this point. But where we're seeing this kind of issue with, at least on our side, from a a copilot deployment in in mass at an enterprise level is we see we got overexposed data. We've got permissions that are are broken. We don't necessarily know what data lives or what what the classification is of that data. So, like, what do you see around kind of the biggest risk of of an organization turning on Copilot very broadly within a within a Microsoft three sixty five environment? Well, I think I mean, it's huge. I mean, Microsoft really pushed Copilot. I mean, they spent $13,000,000,000 on it. So they obviously, they want a return on it. And, you know, many companies came in with Copilot, and there was a few test cases. And it was, yeah, this is great. Let's go and switch it on. And then as you said, as soon as you switch it on, you realize, woah, hold on a minute. Copilot Copilot agents, they can literally see everything and anything. So, you know, for so many companies that didn't have data loss, prevention policies, information protection, classification, labeling, all of all of that kind of stuff. It was just a complete nightmare. And the problem is once you switch this stuff on, you've switched it on. You've opened Pandora's box. So you really need to do a full risk assessment. And to be honest, I I just don't feel that some of the tools that come with Microsoft are great. You need to be able to scan. You need to to deploy this quickly. And it's, the the problem with it is we we're treating this technology as if it was an on premises, tool. And in that respect, we're rolling it out like an on premises technology. You know, we're going really, really slow department by and it's taking such a long time where we need a solution that we can roll this out fast. Because because it's urgent. I think it's really urgent before AI does potential damage or you have the loss of, critical information. Well, it's funny. This isn't the first time that Microsoft has talked about this or deployed this. Right? You and I have been around long enough to remember Delve. Right? The strategy that Microsoft had around around Delve, which is a similar kind of thing based on who you are, the information that you have access to, their Delve would, excuse me, surface to you information that is relevant to you and your role. Yeah. But if you didn't have all of this figured out, organizations failed with Dell because they didn't have proper data governance set up and didn't have these kind of, you know, classifications. So, you know, we talked about AI being able to Copilot being able to access everything. Right? So are there compliance regulation challenges that you're seeing if if AI is accidentally modifying or moving sensitive data, financial records, and those kinds of things to actually, you know, in inhibit, or or do damage to organizations from kind of an over permissive AI model? Oh, I mean, totally. I mean, I've I've heard, in fact, I was in Denmark just recently and I heard of a customer in Denmark, a medical provider. And, you know, people were just querying, doing Copilot queries, and they were basically pulling up records information that you really shouldn't be able to see at that particular, level, you know. So that was a bit concerning. So, the the problem was that there was no information protection in place. Now what is that a technical problem or is that a a procedural problem? So, again, you need to get your have a good security policy, good procedures, and the technical stuff will hopefully come and get it get it right later on. But it just goes to show that it it can cause definite issues, you know. Yeah. It's one of the reasons we kinda looked at it from a product perspective to say, okay. We need some AI resilience. We need to understand we need to have a better strategy around how do we classify data within the platform. Right? So how can I accelerate something like Purview to be able to not only tag the data, but be able to check against what users are doing? Because oftentimes, we see organizations are, you know, enabling some manual or user based data classification that needs kind of a check and balance as well as trying to extend this throughout the entire platform. Again, the attic analogy, you've got so much data. How do we go through this? But then also thinking about it from, like, an AI resilience perspective, if if agents are doing something based on their access, have they done something that is not sanctioned by the organization? Is there a way kind of undo it? And have a way in which to to, you know, we have the the term rewind. But I think all organizations would be thinking about this kind of undo button that exists within within AI. I mean, the problem with a I mean, agents, don't get me wrong, fantastic. But agents have just suddenly appeared from nowhere, and it's the buzzword of the week. And you we have to kind of step back and look at these, you know. They're in enter ID. So now not only do admins have to manage users, you now have to manage agents, and I need to know exactly what these agents are actually doing. And that is just, there's nowhere in Microsoft three sixty five where you can get a definite report on that. Mhmm. Other things, you were talking about, you know, user. Just, like, just simple things like permissions. You know, just there's there's real weaknesses where as a user, I can't just go in and see a list of my files and get a list of who's accessed this file. Who who's this file shared with. There's no tool like that, natively. And it's just it it's a weakness. And it needs a it's a weakness that needs to be addressed. Yeah. Yeah. I mean, that's, you know, again, that's why kind of our unified approach of how we're we're thinking about things at at an organizational level. Right? So cyber resilience is identity, it's data, it's AI, it's all of the things that are that are within this this ecosystem as and as a a technology vendor. Right? We have to be able to think about, you know, all of these trends and how organizations are deploying these because they're often relying on organizations like Rubrik and folks like yourself to be able to say, how how do I do this in a way that is responsible, that is scalable, and then I can actually realize, the the benefits of the of the technology. So it's it's definitely something that is more and more prevalent within our within our day to day. Okay. I think I've covered on a a bunch of stuff. We've gone through and and covered a lot of topics. Andy, I greatly appreciate your time, your perspective, your information. It helps validate things on our side that that we know that we're we're doing right, and and we enjoy partnering with folks like yourself to be able to help, kinda keep us keep us in line. So, Andy, I greatly appreciate, your time. Thanks so much.