Securing Azure Storage in an Era of AI‑Driven Threats

Welcome back to another episode of Azure Storage Talk. I am Demetrius. I sit on the Azure Storage team supporting our BCDR partner ecosystem and today we are going to talk about some exciting security details and information just around Azure Storage and I would like to bring on and introduce Priya Shetty who is a principal product manager here at Microsoft on the Azure Storage team. So, Priya, welcome on. Thank you, Demetrius. Thank you for having me today. So, tell us a little bit about yourself first, how long you've been at Microsoft and also what what you're most excited about now. So, I have been with Microsoft and Azure Storage for about 7 years now and in the past prior to that I spent about 15 years with big and native industries like health care and oil and gas looking primarily at things like data ingestion, cloud data architectures, AI/ML workloads and specially looking at hybrid clouds. In the past few years I've spent a great deal of time looking at security and thinking about the threat landscape and how to make our cloud systems not just scalable and performant to meet our hyperscale workload needs, but also make sure that they are cyber resilient and secure especially in this era era of AI. So, talk to us about some of the top threats and some of the trends today for security and also what should customers think about as they consider their cloud security posture, Priya? Yeah. So, that's a great question. Cloud data overall is poised to grow to about 200 zettabytes or more just by 2026-27, right? So, I would say along with this exponential growth the threat landscape is always evolving. And if you think about AI, it's frankly reshaping the security landscape more profoundly than any other technology has in the past decade. I would say AI has supercharged not just innovation, but also risk and it needs really strong guardrails especially with agentic AI. If you look at some of the common threats to cloud data, overall misconfigurations, human error, ransomware, things like credential leaks, over-permissioned access, they continue to be some of the top threats for cloud data and systems. But especially with AI, data oversharing, prompt injection, model poisoning, AI-driven access or lateral movement and regulatory challenges I think would be some of the top things customers need to think about when they're thinking about AI safety. Yeah, that that's that's a lot for the average the average team or SOC SOC analyst or, you know, anyone today has to kind of make sure that their systems are architected appropriately to keep their systems resilient from all of those different types of things, right? And so, I want to know a little more about, you know, some of these secure and more governed type controls for data access especially in Azure Storage and I'm sure that you know, some of our customers may have some some questions about, you know, what's the best way to leverage those security controls to keep, you know, my storage accounts, my environment super super secure. So, there are many different pillars to think about to to the points you mentioned, Demetrius. As customers are thinking about securing cloud data especially with Azure Storage, they need to think about how to secure and control data access. That's the first pillar. Basically making sure that whether it's end users or apps or agents, they should be given the least privilege access to the data that they're only meant to access or use. Second pivot is to think about how do you secure your data both in transit as well as at rest. And it's equally important to think about cyber resilience for your cloud data. What that means is if there is a ransomware attack, how do you quickly detect it? How do you prevent data loss? How do you recover from these situations, right? Vigilance is also equally important. How do you detect and address threats to your data as quickly as possible? And considering data sovereignty and residency requirements is also equally important when you're thinking about data privacy and compliance considerations. So, there are multiple pillars and happy to dive into some of those as we speak today. I don't know if you have a favorite. It's almost like asking a parent, you know, who's the favorite child if you have three children, right? What's the favorite, I guess, control security control that that you you want you would like to talk about a little more, maybe dive dive into a little deeper and that you think it's important for the the audience to to know about. I like the analogy you used how do you think about protecting your child? I think you'd want the best protections that's out there to make sure your things you know, things are secure around your children. So, when you think about cloud data and I think about cloud data with Azure Storage, I think when you you want to make sure as I was saying least privilege access, right? You access the data that you're meant to use. Which means you should be using Entra to and OAuth 2.0. So, with Entra it is like a central it's secure, it's centralized identity access base where identity-based access and to ensure least privilege access through Entra, you can either use role-based access which is more coarse-grained that is applicable at a subscription or account or resource level or containers or you could think about attribute-based access which is meant for more sensitive data scenarios that you only want your end users or agents or apps to access specific files or folders. So, you can specify conditions for your role assignments. In addition to making sure you have least privilege access, you should also have Microsoft Entra Identity Protection or conditional access policies. So, what these allow is you can look at risk-based policies for access and this helps you investigate and remediate these risks really quickly. And we were talking about AI and the fact that agentic AI needs additional guardrails. So, last year we launched Microsoft Entra Agent ID as well. We wanted to make sure the same protections that are there for usual workforce identities are now extended to agentic AI as well. So, those are the things that you really need to think about. I would say Entra RBAC and ABAC is the way to go when you're thinking about securing the data access pillar. Yeah, and what are some of the things you you've mentioned least privilege a few times here. So, what what are some of the things that can happen if they are not utilizing least privilege and privileges and may have more privileges than than they need in the environment? Well, remember we talked about data oversharing, over-permissioned access. So, if you're not putting tighter controls on who's accessing your data and making sure they're only accessing the data they're intended to use, there is a risk of data exfiltration. Data might be shared with more folks than is expected. There could be security, compliance risks, financial liabilities, a whole suite of problems, right? And if it gets into the hands of unauthorized personnel, you are also leaving your systems vulnerable to cyberattacks and ransomware postures or things like that. So, those are the kinds of risks you're really looking at which is why securing it with Entra RBAC and ABAC is equally important. But there are other pivots as well like I we can dive into how do you think about securing your network context and things like that for example and I'm happy to dive into those if you'd like to learn more about those. Yeah, you you mentioned about keeping data safe in transit, right? Let's let's dive into that and why that's important especially from a network perspective. Yeah. So, there are two angles when you're thinking about data in transit. So, first of all when you're thinking about the network security context, frankly with Azure Storage you have a range of options, right? Depends on the customer use case. It ranges all the way from controlling access based on network context to all the way to prevent data infiltration and exfiltration for heightened security. You mentioned how do you protect data from getting out, what are the controls to put in. This is one of the ways we can do that in addition to Entra for greater security. So, the choice really depends on your use case. If it's an on-premise client where IP address is known and it is less likely to change, you use IP-based restrictions. If you have clients within Azure, then virtual network rules are a good network restriction to put for your storage account. If your scenario demands more strict inbound controls, then we have private endpoints that offer a secure dedicated endpoint for your storage account. So, that offers greater security from that pivot. And one of the newest offerings we have here which was launched uh last year, it is uh network security perimeter. Think of it as a fence or a logical boundary in which you have placed different types of Azure resources including storage. So, network security perimeter gives you the tightest controls on ingress and egress. So, by default everything is denied and you have to explicitly allow rules so that the resources can talk to each other and other applications can talk to it. So, that's gives you the best protections today and it also the other benefit with network security perimeter is you have different Azure types. You don't have to go and then configure your network protections one Azure resource type at a time. You can do it in a centralized pane, have common monitoring and things like that. So, that's one angle for data and for securing data in transit. The second angle is from the encryption perspective. So, there TLS 1.3 offers the most secure cryptographic capabilities today, right? So, it helps secure the data in transit. It has faster handshakes and it also has stronger cipher suites. So, where it helps you is it prevents this man-in-the-middle attack sort of scenarios. In the past we had incidents like poodle and raccoon which were possible with older protocols, but with TLS 1.3 you have stronger crypto cipher capabilities. So, you basically have greater security assurances with it. Yeah, and I've seen that it it sometimes take customers a while to upgrade TLS. No, I've seen people running 1.2 for a very long time. Yes. >> And that's one thing that they a little hesitant to to make sure they have all all of their ducks in a row to okay, if we're going to upgrade to 1.3 then we need to make sure that we you go through the proper change management channels that we you know, plan appropriately for that. Have you seen any similarities just around from version 1.2 to 1.3 and kind of a slow adoption? So, that's a very good point that you raised. Uh things things around security are always slow moving changes especially on the platform side such as the one we mentioned TLS 1.2 to 1.3 is not a small change to go through. It all depends on your ecosystem, how modernized your infrastructure stack is, what is the factor ecosystem look like, that that do they support TLS 1.3 or not? So, there's like a all a lot of moving parts that customers need to think about. Now, we totally understand that customers are coming from different levels of maturity for their ecosystems. So, they as they are thinking about their security journey, there there's a lot of variety out there. So, we have published some detailed migration guidance for different kinds of scenarios as they're thinking about this posture. But we are strongly advocating that customers move to 1.3 for the stronger cipher suites. We talked about our threat landscape evolving. We talked talked about AI threats making things even more difficult. I think it is in the customer's interest to modernize their infrastructure and move towards this path. But definitely Demetrius as you mentioned, change management is an important piece. It is not trivial. Customers do have to plan and we we've we've been on this journey with them for about 2 3 years now to you know, and we officially actually to your point announced the retirement of older protocols 1.2 and 1.1 in this journey to move people over to 1.3. NIST also recommends standards body for crypto also recommends that you move to 1.3 as soon as possible. So, we're in this with the in this journey with the customers and there for them to you know, transition to this new protocol and help them understand if they have issues with upgrading because of certain infra constraints and all that we are working with them to do that as well. Okay. And let's talk about protection, right? As far as how would or how should customers be more resilient especially with ransomware attacks are are out there and I I read a stat this morning where it said that less customers are or less people are recovering or paying the ransom now. Mhm. I think it was down to 28% people are now paying cuz it used to be a really high number of people paying the ransom. So, I guess we're we're making some headway with the way the technology is advancing keeping systems resilient, but how can they recover data and I guess talk about some of the features and capabilities within Azure storage that help around that aspect? Right. But before I dive into what I'm with ransomware we're thinking about really a lot of pivots. We are thinking about prevention, we are thinking about detection and mitigation. Those are the three pivots that customers need to think deeply about, right? Now, we I just want to double click a bit on encryption before we dive deeper into these data protection mechanisms because it's important to think about that from the ransomware angle as well. Now, when we are think we talked about data in transit, right? The data at rest today table stakes with Azure storage. You have all data all Azure storage data at rest is encrypted with AS256. And we now actually have GCM authenticated encryption that is about to go GA. We are about to make that announcement. That offers a lot of strong cryptographic protections. So, we talked about ransomware attacks and you know, cyber attacks. Basically, this authenticated encryption will make sure that whatever decrypted data is there that is actually what was exactly written because there's built-in authentication now in this encryption mechanism. And this will prevent any kind of cipher text tampering and give you greater protections from data corruption as well. So, the other advantage for GCM is it's got parallel light so it has low latency encryption. And we also have flexibility in key management, right? So, as we are thinking about these pivots and we move towards how can I better protect my data beyond these controls like you know, intra back a back network security and the encryption pivots. You brought up a very important point. How do you react to situations with data deletion or loss? Like how should a customer think about it? So, first we think about prevention as I said and that you can today do with arm resource locks or immutable storage. So, that's more suitable for use cases where customers are writing once but reading multiple times. So, you can actually prevent data deletion by either applying a time-based retention policy or a legal hold policies. Usually these are used for compliance reasons and sensitive data access kind of scenarios. So, immutable storage is a good fit there. But you might have cases where you are obviously have multiple write transactions as well. There may be use cases where you are not you are reading writing more than once and pretty frequently. So, in such cases if you want to protect your data from data deletion or overwrites then capabilities like soft delete and versioning are a better fit. Now, all of these capabilities immutable storage, soft delete and versioning are recovering data from your the data recovery storage from your main storage account. But with ransomware attacks you could have a situation where you you're locked out of the main one. Then what do you do then? How do you recover your data? So, if you want more comprehensive protection and we really advise very strongly that for your business critical data you should leverage mechanisms like vaulted backup or object replication. So, we have integration with Azure backup today and we also have object replication available natively with storage. With this you can create a secondary copy of your data. So, you isolate a copy of your data in a different environment. Now, you could do this in a separate storage account, in a separate subscription, separate region. So, it really gives you that level of added protection for your business critical data. This is really important for ransomware especially from the recovery perspective. If if if the worst case you have an attack you also want to control and block lateral movement and other things, but make sure that you can recover from a secondary copy if your primary account is compromised. So, vaulted backup is really good lever there. But we talked about vigilance which is the detection and the mitigation part. What's the worst case scenario? How do you do that? And that's where Defender for storage really helps. It helps you assess these risks and these anomalies and all these patterns much sooner and you can detect these threats and mitigate this before that it even causes problems for you. So, you also have other mechanisms like monitor and Azure monitor and the storage discovery, but we'd strongly recommend using Defender for storage for more comprehensive threat detection and mitigation. Yeah, it seems like there's a there's a lot of different comprehensive type of functionality here that the listeners can can utilize to keep their environments more resilient, more safe and you know, I know we could keep but we're we're we're running out of time here a little bit and maybe one more question though, just to wrap um especially in the geopolitical landscape that we're in right now. Uh things like data residency and you know, data sovereignty. What are you seeing or hearing or what do you recommend as far as some of the the best ways to achieve that on the Azure storage platform? Do you have any recommendations there? So, Azure storage today is available in 70 regions, right? So, you choose where your data lives and that is a strong ask in terms of data privacy and regulations. Even more so in this era of AI. I would say uh region of choice is something that is very top of mind when customers are thinking about data resiliency path and we do offer that with overall vaulted backup. But if you're looking at outage scenarios or disaster recovery or redundancy, then you can choose where your data lives and you can have options like zone and redundancy, ZRS or GZRS to recover from these kinds of outages. But mainly because we have such a large global footprint, you can choose which which region your data lives in for to account for some of those regional boundaries and those privacy considerations that you called out. I think like I know we unpacked a lot of capabilities today, but if we had to kind of quickly summarize what are some of the top things to think about for customers as they're handling exabytes of data in this global footprint, we have a range of capabilities with its security, protection or resilience. And top of mind, I would say is Entra RBACK and ABACK for lease privilege access, making sure that you secure your data in transit with TLS 1.3 and apply network protections like private end point or network security perimeter for greater security. Leverage encryption with AES 256 GCM authenticated encryption that's table stakes. No no additional configuration needed there. And then making sure your data is protected from ransomware. So, basically preventing it with immutable storage or using vaulted backup for more comprehensive data protection and then really choosing your region, choosing where it lives so that you can make sure you have full geo control for data boundaries for greater privacy and compliance. I think that would be those would be the top things to think about and to bring it all together, apply defender, include defender for storage in your posture to make sure you have like visibility to any threats that are out there. And Priya, this this was such a very helpful conversation for myself. I have learned a lot and I hope that the audience has learned as much as I have because security is just is one of those topics that continually change, right? You have threats out there, you have human error and deletion. You have to protect yourself from yourself. Um AI is out there, of course we had to mention that in this episode because you can't get enough of, you know, those two letters. Everyone's talking about it. Uh but before I let you go, I'll also share in the in the show notes in the description if there's any documentation or websites or papers, blog posts, anything that you would like to recommend for the audience to go a little deeper on, we'll we'll post that as well and if you want to say something else. Um I frankly I've I've really enjoyed this conversation, Demetrius. Thank you for having me here today and uh I'm looking forward to sharing as you said, we will share these additional links so that customers can go look at uh some of these details we talked about. We unpacked a lot in this conversation today, but I wanted to thank you for the opportunity and it was I had a great time having a chat with you about some of the top of mind we have with security for Azure storage. Thank you again, Priya and for those that are listening out there, please hit that subscribe button. A lot of you are just listening. We would really love to have you subscribe. That's the best way to to be alerted on the next episode that's coming out. So, thank you so much. It's been another great conversation and insightful conversation here on Azure storage talk. Thank you, Priya.