Azure Updates: Open source; Variant hunting; DDoS attacks

Microsoft director of product marketing David Dennis encouraged customers to take part in Azure Open Source Day on March 7. The event highlights Microsoft’s role in open source projects. At the event, Microsoft plans to demo scalability with containers using Azure AI, AKS, and managed databases. Partners will explain more details about their open source projects and large open source companies like GitHub, Redis, Nvidia, and HashiCorp will share updates. Microsoft also plans to teach customers about scalability with Dapr, support for Web3 scenarios, and open source security and compliance.

Shawn Herman, partner group engineering manager at Microsoft, highlighted Azure Security’s growing threat hunting capabilities. Microsoft implemented Security Development Lifecycle over 20 years ago and has 8500 security professionals, as well as its bug bounty program. Most recently, it has expanded into variant hunting and securing multitenancy. Herman wrote:

Variant hunting is an inductive learning technique, going from the specific to the general. Using newly discovered vulnerabilities as a jumping-off point, skilled security researchers look for additional and similar vulnerabilities, generalize the learnings into patterns, and then partner with engineering, governance, and policy teams to develop holistic and sustainable defenses. Variant hunting also looks at positive patterns, trying to learn from success as well as failure, but through the lens of real vulnerabilities and attacks, asking the question, “why did this attack fail here, when it succeeded there?”

To learn more about why some attacks succeed, Microsoft has employed red teams, penetration tests, and MSRC reports to carry out vertical and horizontal variant hunts. The ...