Mike

I Build-Break-Repeat, AWS, Azure, MS, Cisco, InfoSec

[Mike @MySnozzberries]

@awakecoding At an individual level, yes.

At an organizational level, it sucks.

The gap in experience between those two is how I know the SaaSpocalypse isn't what it is cracked up to be.

[Mike @MySnozzberries]

@awakecoding Ahhh, that is interesting. I have had my agents include part of that content when drafting PRs and compare links or spin up gists with like e2e test results, but I could see the benefit of more content.

[Mike @MySnozzberries]

@merill @PrzemyslawKlys It's X.500 the whole way down, you can't convince me otherwise.

[Mike @MySnozzberries]

@IAMERICAbooted @PyroTek3 1) T2 never needs access to the DB if you aren't using impersonation
2) Application data plane groups > Tier groups > Authenticated Users
3) Auth silos
4) Network controls further restrict silos
5) App hardening is discrete from tiering, create SQL roles

Go as far as you need

[Mike @MySnozzberries]

@IAMERICAbooted @PyroTek3 The CIS Benchmarks will always have some controls that are conflicting, as they are designed to turn off uncommon services. This is a common use case where you wouldn't want to follow them. If CIS is your internal policy, then you'd want to document the exception.

[Mike @MySnozzberries]

@IAMERICAbooted @PyroTek3 You can also have T2 SQL servers.

A user at a tier and an admin at a tier are still separate, and you would use the planes to segment authZ.

Cross tier authN can only occur to more restrictive tiers, not to less restrictive.

[Mike @MySnozzberries]

@IAMERICAbooted @PyroTek3 These are all very different scenarios. Depending on your tier definitions and controls internally these can each be data plane, management plane, or control plane considerations regardless of the asset tier or data classification.

[Mike @MySnozzberries]

@IAMERICAbooted @PyroTek3 The protocols and data flow let you determine if you need additional controls.

Front end IIS doing impersonation with Kerberos, T2 user running SSMS, Fabric data gateway allowing access by cloud users.

[Mike @MySnozzberries]

@kainzjoh @AdamGell +1 RANCID

[Mike @MySnozzberries]

@NathanMcNulty And their own tools to deploy a policy, once you've figured it out, barely work. The half dozen options in Intune have rough edges so half the time end up needing to patch together detection and remediation scripts.

[Mike @MySnozzberries]

@rucam365 App Reg with Cert, store the cert in Key Vault, let the agent use the cert with the CLI tools, APIs, and what else it needs, assuming appropriate authZ.

Can get more nuanced, but that is the general authN flow. Then authZ stays pretty consistent.

[Mike @MySnozzberries]

@NathanMcNulty Group Policy was always the least mature option for configuration management. At its best it is a necessary evil. At its worst it is just adding in risk to an environment.

[Mike @MySnozzberries]

@awakecoding @merill Authoring, testing, validating, and improving

But you can also have your harness test inside the devcontainer instead of local tools, which is arguably worth the setup token cost

[Mike @MySnozzberries]

@merill @awakecoding I have had some luck, you will definitely burn through tokens though. Currently I align devcontainers with VS Code Tasks as a quick start for repos with a lot of dependencies. Never done work with Nuget though.

[Mike @MySnozzberries]

@SamErde I do a check in my profile to determine that the font is enabled.

https://t.co/92gaxRBXAb

[Mike @MySnozzberries]

@awakecoding Depends on who I want to use it. I test with VSCode+GH, but deploy in different ways like even Copilot Studio.