{"id":5502,"date":"2020-07-15T11:06:28","date_gmt":"2020-07-15T18:06:28","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=5502"},"modified":"2023-06-20T15:22:47","modified_gmt":"2023-06-20T22:22:47","slug":"protecting-microsofts-applications-and-services-using-a-zero-trust-security-model","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/","title":{"rendered":"Protecting Microsoft\u2019s applications and services using a Zero Trust security model"},"content":{"rendered":"
\n
\n
<\/div>\n

This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n

The most basic way to secure your home is to lock your front door and windows.<\/p>\n

But do you remember to lock all <\/em>your doors and windows?<\/p>\n

If you don\u2019t lock the door that connects your garage to your house, you\u2019re still vulnerable to intrusion. You can draw the same parallel between physical security at home and ensuring that applications and services are secure online.<\/p>\n

\"Carmichael
Carmichael Patton is a senior program manager in Microsoft’s internal digital security team.<\/figcaption><\/figure>\n

\u201cTo be safe, you need to lock all your doors, even the ones that aren\u2019t immediately obvious,\u201d says Carmichael Patton, a senior program manager in Microsoft’s internal digital security team<\/p>\n

Microsoft\u2019s digital security team proactively protects Microsoft from cyberattacks, including entry points that could easily be overlooked. Bad actors use a wide variety of tactics when trying to attack the company\u2019s data, including phishing and deploying malicious code on applications and services.<\/p>\n

With most of Microsoft\u2019s employees now working remotely during the COVID-19 crisis, the company is investing even more in developing and rolling out solutions that support an ecosystem of internal applications. This aligns with Microsoft\u2019s Zero Trust strategy<\/a>.<\/p>\n

\u201cWith so many employees accessing applications and services on the internet, it\u2019s necessary to evaluate and verify application health when employees access them,\u201d says Darshana Pandya, a senior program manager in Microsoft’s internal digital security team, who\u2019s leading the effort. \u201cService health is foundational in our organization, and we always ensure that Zero Trust controls are in place so our applications and services are accessed by the right people.\u201d<\/p>\n

[Learn how Microsoft implemented a Zero Trust security model.<\/a> Read about how Microsoft transitioned to a modern access architecture with Zero Trust.<\/a> Find out how Microsoft uses a Zero Trust security model to ensure that employees can securely work remotely.<\/a>]<\/em><\/p>\n

Proactively verifying security for applications and services<\/strong><\/p>\n

Before a Microsoft application is deployed internally, every application must follow the standard security development lifecycle<\/a> to meet security and compliance requirements. This process includes automated evaluations of the code and infrastructure to identify malware, vulnerabilities, and open-source components. However, these security controls require consistent work to ensure the health of the application stays current over time to prevent vulnerabilities. Microsoft\u2019s digital security team uses a variety of tools to identify threats, to prevent phishing and assess the health of its cloud apps.<\/p>\n

Despite these existing controls and checks, the internal security team identified an opportunity to develop an application verification system that aligns with Microsoft\u2019s Zero Trust security model. Pandya and Patton are actively exploring the concept of building a system that calculates a health score for every application that employees access. The application score is calculated on the security state of its code, configuration, infrastructure, and compliance with Microsoft\u2019s internal security requirements.<\/p>\n

The team is always exploring how the company can further enhance its efforts to ensure the health of line-of-business applications as part of Microsoft\u2019s Zero Trust security model. Currently, Microsoft\u2019s internal systems and applications require that strong identity and device health are verified as part of user authentication. This method is referred to as conditional access. The security team is exploring using this same conditional access system and extending it beyond device and identity verification to application health verification. Pandya and Patton are exploring how to calculate a health score for every application accessed by employees. The idea is that the conditional access system, based on Microsoft Azure Active Directory, can query application health score as another validation method as part of authentication requests. The application score could be calculated on the security state of its code, configuration, infrastructure, and compliance with Microsoft\u2019s internal compliance requirements. For example, an unregistered shadow IT application that is running on client device could be blocked.<\/p>\n

\u201cVerifying service health protects our employees from unintentionally accessing malicious applications or content,\u201d Pandya says. \u201cThis can be done on any set of applications, but we plan to start with a proof of concept for our line-of-business applications like HR or finance applications.\u201d<\/p>\n

Pandya believes that this system and the health score will support the security and productivity of Microsoft employees.<\/p>\n

\u201cWe want employees to create applications and automate tasks that help people be more productive and efficient, but we need to make sure they\u2019re compliant and meet security requirements,\u201d Pandya says. This approach would result in applications being verified to meet a minimum set of security criteria prior to access being permitted, which provides an additional level of protection for employees.<\/p>\n

Building an application and service health verification system is an iterative process, but Pandya and Patton believe the additional evaluations are a step in the right direction.<\/p>\n

\u201cNearly everything we build as part of our Zero Trust efforts internally transitions into our products,\u201d Patton says. \u201cWe meet regularly with product teams to discuss and refine Microsoft\u2019s internal security requirements, which also helps our enterprise customers.\u201d<\/p>\n

Learn how Microsoft implemented a Zero Trust security model.<\/a><\/p>\n

Read about how Microsoft transitioned to a modern access architecture with Zero Trust.<\/a><\/p>\n

Find out how Microsoft uses a Zero Trust security model to ensure that employees can securely work remotely.<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft. The most basic way to secure your home is to lock your front door and windows. But do you remember to lock all your doors and windows? If […]<\/p>\n","protected":false},"author":146,"featured_media":5505,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":true,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[],"coauthors":[674],"class_list":["post-5502","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","m-blog-post"],"jetpack_publicize_connections":[],"yoast_head":"\nProtecting Microsoft\u2019s applications and services using a Zero Trust security model - Inside Track Blog<\/title>\n<meta name=\"description\" content=\"Microsoft is planning to build a new tool that verifies the health and security of internal applications and services.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Protecting Microsoft\u2019s applications and services using a Zero Trust security model - Inside Track Blog\" \/>\n<meta property=\"og:description\" content=\"Microsoft is planning to build a new tool that verifies the health and security of internal applications and services.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/\" \/>\n<meta property=\"og:site_name\" content=\"Inside Track Blog\" \/>\n<meta property=\"article:published_time\" content=\"2020-07-15T18:06:28+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-06-20T22:22:47+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2200\" \/>\n\t<meta property=\"og:image:height\" content=\"1467\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Inside Track \u2013 retired stories\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Inside Track \u2013 retired stories\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/\",\"name\":\"Protecting Microsoft\u2019s applications and services using a Zero Trust security model - Inside Track Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg\",\"datePublished\":\"2020-07-15T18:06:28+00:00\",\"dateModified\":\"2023-06-20T22:22:47+00:00\",\"author\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575\"},\"description\":\"Microsoft is planning to build a new tool that verifies the health and security of internal applications and services.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg\",\"width\":2200,\"height\":1467,\"caption\":\"Darshana Pandya, a senior program manager in Digital Security and Risk Engineering, is managing Zero Trust initiatives, which includes an effort to verify the health and security of internal applications and services at Microsoft.\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Protecting Microsoft\u2019s applications and services using a Zero Trust security model\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/\",\"name\":\"Inside Track Blog\",\"description\":\"How Microsoft does IT\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575\",\"name\":\"Inside Track \u2013 retired stories\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/ee0de87c339052d5d84852473bd7f213\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g\",\"caption\":\"Inside Track \u2013 retired stories\"},\"description\":\"The content on this page was crafted to highlight a specific moment in time or the solutions that have led us to where we are today. It offers valuable insights into our journey and the progress made over the years. Check out the Inside Track blog page for our up-to-date stories around Microsoft.\",\"url\":\"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/insidetrackarchive\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protecting Microsoft\u2019s applications and services using a Zero Trust security model - Inside Track Blog","description":"Microsoft is planning to build a new tool that verifies the health and security of internal applications and services.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/","og_locale":"en_US","og_type":"article","og_title":"Protecting Microsoft\u2019s applications and services using a Zero Trust security model - Inside Track Blog","og_description":"Microsoft is planning to build a new tool that verifies the health and security of internal applications and services.","og_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/","og_site_name":"Inside Track Blog","article_published_time":"2020-07-15T18:06:28+00:00","article_modified_time":"2023-06-20T22:22:47+00:00","og_image":[{"width":2200,"height":1467,"url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg","type":"image\/jpeg"}],"author":"Inside Track \u2013 retired stories","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Inside Track \u2013 retired stories","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/","name":"Protecting Microsoft\u2019s applications and services using a Zero Trust security model - Inside Track Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg","datePublished":"2020-07-15T18:06:28+00:00","dateModified":"2023-06-20T22:22:47+00:00","author":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575"},"description":"Microsoft is planning to build a new tool that verifies the health and security of internal applications and services.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#primaryimage","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg","contentUrl":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg","width":2200,"height":1467,"caption":"Darshana Pandya, a senior program manager in Digital Security and Risk Engineering, is managing Zero Trust initiatives, which includes an effort to verify the health and security of internal applications and services at Microsoft."},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/protecting-microsofts-applications-and-services-using-a-zero-trust-security-model\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/insidetrack\/blog\/"},{"@type":"ListItem","position":2,"name":"Protecting Microsoft\u2019s applications and services using a Zero Trust security model"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#website","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/","name":"Inside Track Blog","description":"How Microsoft does IT","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/59e5f7b07dae629412c990cc1a63b575","name":"Inside Track \u2013 retired stories","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/insidetrack\/blog\/#\/schema\/person\/image\/ee0de87c339052d5d84852473bd7f213","url":"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/24a8c329ab32afd1bc23fd1658d1acc2?s=96&d=mm&r=g","caption":"Inside Track \u2013 retired stories"},"description":"The content on this page was crafted to highlight a specific moment in time or the solutions that have led us to where we are today. It offers valuable insights into our journey and the progress made over the years. Check out the Inside Track blog page for our up-to-date stories around Microsoft.","url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/author\/insidetrackarchive\/"}]}},"jetpack_featured_media_url":"https:\/\/www.microsoft.com\/insidetrack\/blog\/uploads\/prod\/2020\/07\/10066_wordpress-hero.jpg","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p9hcZA-1qK","_links":{"self":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/5502"}],"collection":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/users\/146"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/comments?post=5502"}],"version-history":[{"count":8,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/5502\/revisions"}],"predecessor-version":[{"id":11540,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/posts\/5502\/revisions\/11540"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media\/5505"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/media?parent=5502"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/categories?post=5502"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/tags?post=5502"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/insidetrack\/blog\/wp-json\/wp\/v2\/coauthors?post=5502"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}