RunAs Radio

How do you test your database? While at NDC Porto, Richard chatted with Dan Mallott about building unit tests for transactional databases like SQL Server. Dan talks about using testing frameworks constructed for the purpose, like TSQL-T, to make it easier to test individual database elements, from stored procedures to column constraints. The conversation digs into the challenges around testing, tolerating the changes to the database, and tweaking how you write your T-SQL code to be more testable. But the power of getting database tests into your CI/CD pipeline is enormous - catch more problems in testing before they become problems in production!LinkstsqltDbFitRecorded October 17, 2024

What's happening with SQL Server Management Studio? Richard chats with Erin Stellato, now at Microsoft, about the big jump coming for SSMS. Erin talks about how folks felt SSMS was a bit neglected when the reality is that there was a push to catch up with its parent codebase in Visual Studio. However, the next version of SSMS makes that jump, which opens the door to some excellent extension models. The conversation dives into the role of the Copilots in SQL Server through SSMS - helping you understand databases, write queries, and diagnose problems - eventually!LinksSQL Server Management StudioAzure SQL DatabaseSQL Server Integration ServicesSQL Server Data ToolsSQL FormatterRecorded September 26, 2024

How does Software-Defined Networking in Azure work? Richard chats with Aidan Finn about his experiences working with the suite of Azure networking products, including Firewall and Route Server. Aidan talks about the training available on Microsoft Learn to get up to speed with the power of Azure Firewall, including building policy rule sets. The conversation also explores the power of defining how traffic can move within your network to clarify when potentially malicious software is active. LinksAzure FirewallSecure Networks with Zero TrustAzure Route ServerAzure Firewall TrainingAzure Firewall Policy Rule SetsRecorded September 24, 2024

ARM for Windows is here in the form of the Snapdragon Copilot+ PCs - how do you update them? Richard talks with Aria Hanson about how Windows Updates treat ARM like just another Windows device - all the updates! Aria talks about the transition time with Windows 24H2 update, which has some specific Copilot+ PC features. But when looking at ARM-based Windows devices, don't just focus on the Copilot part; check out the great battery life and the simpler architecture that should lead to long-life machines. The conversation also digs into the Windows Insider program, which now has four channels for updates, in order of likelihood to blue screen: Canary, Dev, Beta, and Release Preview.LinksWindows InsidersCopilot+ PCsWindows Insider BlogWindows AutopatchWindows AutopilotPlutonRecorded September 18, 2024

How can you secure your company information with Azure Virtual Desktop? Richard talks to Jim Duffy about his work helping companies comply with NIST SP 800-171 security standards. These are the new standards required for Department of Defense contracting - including all subcontractors and suppliers. The security standard is thorough, with over 100 requirements. And you have to be audited to show that you comply! Even if you don't work with the government, the NIST security standard is excellent, and Jim talks about how you can use AVD to create a secure enclave for protecting data. And if you need help complying with NIST 800-171, Island Systems can help!LinksAzure Virtual DesktopNIST SP 800-171 Rev 3Secure Future InitiativeIsland SystemsRecorded August 12, 2024

Can you pen test yourself? Paula Januszkiewicz says yes! Richard talks to Paula about taking an active role in understanding your organization's security vulnerabilities. Paula talks about the low-hanging fruit she often finds as a professional penetration tester - typically on poorly maintained infrastructure like PKI servers. The conversation digs into tooling you can use to find vulnerabilities - just make sure you trust the source of those tools. Not everyone is a good guy in open source! And, of course, there's always a time to bring in professionals to do a deeper level of testing. Don't wait until the breach happens to take some action!LinksCqurePenetration TestingGitHub Secrets ScanningHaveIBeenPwnedRecorded August 22, 2024

How can OpenAI help you with PowerShell? Richard talks to Doug Finke about his experiences with ChatGPT and GitHub Copilot to help him write PowerShell and how he incorporated the OpenAI API into a PowerShell library to create a conversational interface in his PowerShell scripts! Doug talks about his productivity gains using OpenAI to write better quality PowerShell faster - helping him understand the code, automate test writing, and explore aspects of PowerShell he had never dug into. But beyond writing code for him, adding the conversational interface to a PowerShell script opens a whole new interactive opportunity to make it easier for folks to use scripts and do more with them!LinksGitHub CopilotPSAIGPT-4oDoug's BlogDoug's YouTube ChannelRecorded August 7, 2024

Microsoft 365 Data Governance has always been critical - but it's only getting more important! Richard talks to Nikki Chapple about her experiences working with companies trying to get their "data estate in order." That phrase is what Microsoft recommends before turning on tools like Copilot for M365. Nikki talks about how hard the goal of data security is - that it is just as tricky as any other security goal. Data security is an endless process that needs refining and work on routinely as new data and classes of data arrive in the organization. In the meantime, users are taking advantage of LLMs like ChatGPT for their work whether we want them to or not - so there is a need to act quickly to provide secure capabilities!LinksData. Privacy, and Security for Microsoft Copilot for M365Exabeam Business Rewards vs Security Risks ReportMicrosoft 2024 Work Trend Index ReportMicrosoft Purview Data Security and Compliance Protections for Generative AI AppsMicrosoft Copilot Studio for M365Entra Entitlement ManagementShareable Links in OneDrive and SharePoint in M365Nikki's M365 Governance BlogAll Things M365 Governance on YouTubeRecorded August 16, 2024

What does Windows Server 2025 bring to Active Directory? Richard chats with Orin Thomas about the new version of Windows Server coming and what to expect around Active Directory. Orin talks about how mature the Windows Server space is, so only incremental improvements are warranted, but they are important ones - like retiring NTLM once and for all. And when it comes to Active Directory, there are new secure features you're going to want, but you do need to up your functional level to get them, and that means getting to at least Server 2016 functional level first... then moving everything else. When was the last time you transferred a FSMO role? Orin also digs into the new certification practice options available, where instead of answering questions, you do the work and get evaluated - cool!LinksWhat's New in Server 2025SandwormActive Directory FSMO Roles in WindowsWindows Server Hybrid Administrator AssociateWindows LAPSRecorded August 6, 2024

Do you know how asymmetric encryption works? While at the Kansas City Developers Conference, Richard sat down with Eli Holderness to discuss many of the encryption technologies being used today—and the new options coming in the future! Eli talks about how symmetrical encryption and public key encryption have been the focus of modern encryption, especially on the web. But the ongoing security arms race means we have to keep tweaking encryption—what if we made a bigger leap? Asymmetric encryption offers huge potential - but there's still a long way to go!LinksPasswordless Identity with Eli HoldernessElliptic-Curve CryptographyShor's AlgorithmIsogeny Key ExchangeLearning with ErrorsChrome and Hybrid Kyber KEMliboqsLets EncryptRecorded June 27, 2024

What can you do to Microsoft 365 with PowerShell? Turns out - almost anything! Richard talks to Tony Redmond about his ongoing efforts to educate sysadmins about the vast array of capabilities in M365, including all the PowerShell cmdlets that can let you retrieve and control everything in M365. There's now so much information that Tony and his team have created a separate book explicitly focused on automating M365 with PowerShell. The conversation also turns to the role of Copilot - GitHub Copilot- in helping you write better PowerShell and the challenges around M365 Copilot. The goal is to take advantage of the Microsoft Graph - all that information about your M365 Tenant and what is happening inside it.LinksOffice 365 for IT ProsPractical 365 BlogAutomating Microsoft 365 with PowerShellMicrosoft Graph SDKCopilot for Microsoft 365Microsoft Entra PowerShellGitHub CopilotOverview of Microsoft GraphRecorded August 8, 2024

How is generative AI evolving, and what can we do about it? While at NDC in Oslo, Richard chatted with Alison Cossette about her work as a data scientist before the ChatGPT explosion in November 2022 and what life has been like since the LLM came to town. Alison talks about the rigor of building AI models using generative AI before ChatGPT and how many of those efforts have diminished when confronted with a friendly, confident language model. Eventually, this rigor will be needed - as the dangers of not managing language models cause problems, and the need for rigor will re-appear. Alison describes steps you can take today to understand how the LLMs you are using are trained and how they are tested. Generative AI is evolving, and you can be part of making it better!LinksGitHub CopilotFairly TrainedRecorded June 12, 2024

Leadership wants to get on the AI bandwagon - what are the security risks? While at the Kansas City Developers Conference, Richard sat down with Steve Poole to talk about his experiences helping companies manage the risk of bringing AI into the company. Steve talks about the impact of introducing a new development stack, especially open-source stacks where you aren't sure of the providence of the code - sometimes there's malware in there! The conversation also moves to the various sources of language models and the potential risks. There's an urgency to move quickly on this technology, but don't allow that urgency to shortcut the safety your company will need - you can do this properly!LinksHugging FaceRecorded June 27, 2024

What are the threats your cloud application and infrastructure are facing? While at NDC Oslo, Richard chatted with Daniela Cruzes and Romina Druta about their work building threat models for cloud-based applications. Daniela discusses how modeling helps to understand security concerns before applications are deployed and attacked - often, security retrofits are time-consuming and expensive, so thinking them through beforehand has enormous benefits. Romina dives into the supply chain side of threats - open-source libraries with backdoors, even down to development tools with malware. There are a lot of threats - but when you look, there are often great solutions as well. You'll need to collaborate with development to secure things, but security isn't optional and is worth fighting for.LinksCloud-Native Application Protection PlatformArgoVSCode Malicious Extention ThreatsRecorded June 12, 2024

Are you ready for passkeys? Richard talks to Tarek Dawoud from Microsoft about the evolution of passwordless access with passkeys. Tarek talks about the FIDO alliance and the ongoing effort to create authentication strategies that are mathematically impossible to phish - no password stuffing under the covers that might get exploited by a man-in-the-middle attack. The conversation also dives into the passkeys name and how it's a rebranding of passwordless authentication to make it easier for everyone to understand that you'd rather have a passkey than a password. The products involved are still evolving, but there's plenty you can take advantage of today and make your organization more phishing-resistant than ever!LinksFido AllianceYubicoWindows Hello for BusinessMicrosoft Digital Defense Report 2023Accenture Passwordless JourneyConditional AccessTemporary Access PassEnable Passkeys For Your OrganizationWeb AuthenCTAPMicrosoft Password GuidanceRecorded June 3, 2024

What does it cost to recover from a disaster? While at NDC Oslo, Richard chatted with Natalie Serebryakova about her work helping companies understand their disaster recovery costs and what that process can teach you about your infrastructure. Natalie talks about different types of disasters, from the deletion of a production server to a major outage caused by a fire at a data center - and the power of working through the scenario to determine what needs to be backed up and what it takes to recover. The conversation also dives into the scrutiny of implementation - often, decisions are made that are no longer understood, or systems have changed enough that they could be improved. The result can be lowering DR costs, improving performance, and reducing operating overhead! LinksSOC2DataDogRecorded June 12, 2024

Ready to move your device certificate authority to the cloud? Richard chats with Richard Hicks about Microsoft Cloud PKI - certificate management for devices and people as part of the Intune Suite. Richard talks about it being early days for Cloud PKI, so not everything you want is there yet. The only way to get a certificate onto a device is through Intune, so some devices, like servers, don't have a way to play yet. However, there is a bridge between Active Directory certificates and Cloud PKI, so you can bring your new devices in through Intune and ultimately unload a lot of your on-premises certificate infrastructure. And that will make everyone's lives easier and more secure!LinksConditional AccessActive Directory Certificate ServicesMicrosoft Cloud PKIMicrosoft IntuneIntune and SCEPCertificate Connector for Microsoft IntuneBring Your Own CA in Cloud PKISCEPmanKeytosMicrosoft Entra Certificate-Based AuthenticationPKINIT in KerberosminikatzNetwork Policy ServerRecorded June 3, 2024

How are you protecting your organization's data? Richard chats with Joanne Klein about her work with Microsoft Purview to help with data protection, management, and governance. Joanne talks about a spike in data protection concerns from Microsoft Copilot - if you have been securing data through obscurity, you're in for a nasty surprise! Copilot has a knack for finding every nook and cranny of data. Proper data protection also means effective archiving - getting rid of out-of-date or irrelevant data. And then there are the security concerns around data retention - how do you need to keep, and for how long? Microsoft Purview can help with all these problems, but you must work with leadership to get things right!LinksMicrosoft PurviewAdaptive Prevention in PurviewRecorded June 10, 2024

How has the cloud transformed the way we work with data? While at Build in Seattle, Richard sat down with Arun Ulag, Microsoft CVP of Azure Data, to discuss how the cloud has transformed how we work with data. The pre-cloud practice of extract-transform-and-load into OLAP cubes has given way to the data lake - you don't need to pre-process data if you have all the compute you need on demand. Arun goes further into empowering analysts using tools like PowerBI - but the key is access to data. With Microsoft Fabric, data lives in OneLake - or anywhere through links! Today, the data analytics landscape spans different product stacks and clouds - but all are available to learn more about your business!Links:PowerBIPivot Tables in ExcelOne LakeApache IcebergSnowflakeDatabricksRecorded May 22, 2024

What hardware runs Azure today and into the future? While at Build in Seattle, Richard sat down with Rani Borkar to discuss the hardware that makes up Azure Compute, including examples of the new Cobalt and Maia processors! Rani talks about Cobalt first, Microsoft's ARM processor designed for workloads in the cloud. Then, a look at the Maia processor, which focuses on neural net workloads like large language models. As Rani explains, the scale of the work coming to the cloud today allows for specialized hardware - you would likely not want to buy a machine this specialized for yourself, but you can rent it by the minute in Azure!Links:Azure Cobalt ProcessorAzure MaiaRecorded May 22, 2024