1 min read
AI Security: The Basics Everyone Misses
Most prompt injection attempts never get to your prompt if you filter input properly. Use managed identities. Always.
Security
127 articles
1 min read
Implementing Zero-Trust Security for AI Workloads on Azure
Zero-trust isn't optional for AI workloads handling sensitive data. Implement these patterns from day one to avoid costly retrofitting.
1 min read
Securing AI Applications: A Comprehensive 2025 Checklist
AI security is not optional. Implement these measures before going to production, and review them quarterly as threats evolve.
1 min read
Securing AI Applications: Authentication and Authorization Patterns
AI applications face unique security concerns: protecting training data, controlling model access, securing inference endpoints, and preventing prompt…
1 min read
Implementing Zero-Trust Security for AI Applications
Zero-Trust security ensures AI applications remain protected while enabling legitimate business use cases.
1 min read
AI Safety Guardrails: Implementing Content Filtering in Azure OpenAI
Maintain comprehensive logs of all content filtering decisions for compliance and incident investigation. Every blocked request should be logged with…
1 min read
Prompt Injection Defense: Securing LLM Applications
Prompt injection occurs when user input is interpreted as instructions rather than data. Attackers can attempt to override system prompts, extract…
1 min read
Enterprise AI: Building Secure API Gateways for LLM Access
A well-designed gateway enables enterprise-wide AI adoption while maintaining security, compliance, and cost control.
1 min read
Implementing Guardrails for Production AI Systems
Filter and sanitize user inputs before they reach the LLM. Verify AI responses before returning them to users.
1 min read
AI Security Best Practices: Protecting AI Systems
Comprehensive security protects AI systems from emerging threats.
1 min read
Prompt Injection Defense: Protecting AI Applications
Defense in depth with multiple layers provides the best protection against prompt injection.
1 min read
Guardrails for LLMs: Building Safe AI Applications
Comprehensive guardrails are essential for responsible AI deployment.
3 min read
Enterprise Agent Patterns: Security, Governance, and Scale
Enterprise agents require these patterns to ensure security, compliance, and reliable operation at scale. Implement them from the start rather than…
1 min read
Audit Logging for AI Agents: Complete Activity Tracking
Comprehensive audit logging is essential for AI agents in production. It enables debugging, ensures compliance, and provides the visibility needed to build…
1 min read
Permission Models for AI Agents: Fine-Grained Access Control
Permission models for AI agents must be flexible yet secure. Combine RBAC for broad access patterns with capabilities for fine-grained, time-limited access.
1 min read
Sandboxing AI Agents: Isolation and Containment Strategies
Sandboxing is your last line of defense. Even trusted agents can behave unexpectedly - proper isolation ensures that unexpected behavior doesn't become a…
1 min read
Agent Safety Patterns: Building Trustworthy AI Systems
Safety in AI agents is not optional - it's foundational. Build safety in from the start, and your agents will be both powerful and trustworthy.
1 min read
Network Security in Microsoft Fabric
Network security provides defense in depth for your data platform. Today I'm exploring network security options in Microsoft Fabric.
1 min read
Conditional Access Policies for Microsoft Fabric
Conditional Access enables Zero Trust security by controlling access based on conditions. Today I'm exploring how to implement Conditional Access for…
1 min read
Data Loss Prevention in Microsoft Fabric
Data Loss Prevention (DLP) helps prevent accidental data exposure and ensures compliance. Today I'm exploring DLP implementation in Microsoft Fabric.
1 min read
Security Fundamentals in Microsoft Fabric
Security is foundational to any data platform. Today I'm exploring the security architecture and best practices in Microsoft Fabric.
1 min read
Data Sharing Patterns in Microsoft Fabric
Data sharing enables collaboration while maintaining security. Today I'm exploring data sharing patterns in Microsoft Fabric.
1 min read
Tenant Settings in Microsoft Fabric
Tenant settings control what users can do in your Fabric environment. Today I'm covering the essential settings every admin should configure.
1 min read
Fabric Admin Updates: Governance and Management
Fabric administration has matured significantly. Today I'm covering the latest admin capabilities for managing your Fabric environment effectively.
2 min read
Code Execution in AI Agents: Safe and Effective Patterns
Code execution is one of the most powerful capabilities for AI agents - and one of the most dangerous. Today I'm exploring how to implement it safely.
1 min read
AI Risk Management: Identifying and Mitigating AI Risks
AI introduces risks that cut across data, models, operations and people. Over the past year I've helped teams map those risks to concrete controls — from…
2 min read
Fabric Governance: Building a Secure Data Platform
Fabric governance is where the platform's SaaS architecture creates both an advantage and a complication for enterprise security teams. The advantage…
1 min read
PII Detection and Protection in AI Applications
Implementing comprehensive PII detection and protection strategies for AI applications.
1 min read
Input Validation for LLM Applications
Comprehensive input validation strategies for securing LLM applications against malicious inputs.
1 min read
Prompt Injection Defense: Protecting LLM Applications
Comprehensive strategies for defending against prompt injection attacks in LLM applications.
1 min read
AI Safety Fundamentals for LLM Applications
Essential AI safety concepts and practices for building responsible LLM applications.
1 min read
Row-Level Security in Fabric: Data Access at the Row Level
RLS provides essential data security for multi-tenant and sensitive data scenarios. Tomorrow, I will cover Azure OpenAI function calling patterns.
1 min read
Item Permissions in Fabric: Granular Access Control
Item permissions provide the flexibility to share specific artifacts securely. Tomorrow, I will cover Row-Level Security in Fabric.
1 min read
Fabric Workspace Roles: Managing Access and Collaboration
Proper role management is essential for secure and efficient collaboration. Tomorrow, I will cover Item Permissions in more detail.
1 min read
Microsoft Fabric Security: Protecting Your Data Platform
Security is an ongoing responsibility. Tomorrow, I will cover Workspace Roles in more detail.
1 min read
Microsoft Security Copilot: AI-Powered Threat Defense
Security Copilot addresses the security skills gap by augmenting analysts with AI-powered investigation and response capabilities.
1 min read
Azure Content Safety: Protecting AI Applications from Harmful Content
1. Set appropriate thresholds : Adjust based on your use case 2. Use blocklists : For domain specific terms 3. Check both input and output : For AI…
1 min read
Content Filtering in Azure OpenAI: Implementing Safety Guardrails
Each category has severity levels: safe, low, medium, high.
2 min read
Enterprise AI with Azure OpenAI: Security, Compliance, and Governance
The question I kept hearing from enterprise clients in January 2023 was some variation of: "We've seen what ChatGPT can do—how do we get that capability…
1 min read
Azure Security: A Year in Review
2022 brought significant security advancements in Azure, from Defender for Cloud improvements to enhanced Zero Trust capabilities. As we move into 2023,…
1 min read
Rate Limiting Middleware in ASP.NET Core 7
Rate limiting protects your application by: Preventing denial of service attacks Ensuring fair usage among clients Protecting downstream services Managing…
1 min read
Secure Files in Azure DevOps
Secure Files protect sensitive credentials while enabling automated pipelines.
1 min read
Service Connections in Azure DevOps
Service connections provide secure, manageable access to external resources.
1 min read
Advanced Checks in Azure DevOps Pipelines
Checks provide automated validation gates for enterprise deployments.
1 min read
OIDC Tokens in GitHub Actions
OIDC eliminates the need for long-lived cloud credentials, improving security posture.
1 min read
GitHub Required Workflows for Enterprise
Required workflows ensure consistent security and quality standards across the enterprise.
5 min read
Code Signing and Notarizing your MacOS Apps
Code Signing is verifying that you (or an entity) developed and owns the application. The way it works is by creating a “signature” on to the application to…
1 min read
Row-Level Security in Azure SQL Database
RLS uses security policies with predicate functions to filter rows transparently. Users see only the rows they're authorized to access without any…
1 min read
Dynamic Data Masking in Azure SQL Database
DDM is a policy-based security feature that hides sensitive data in query results. The data in the database is not modified, making it ideal for scenarios…
1 min read
Always Encrypted in Azure SQL Database
Always Encrypted uses column encryption keys (CEKs) protected by column master keys (CMKs) to encrypt sensitive columns. The database engine never has…
1 min read
Ledger Tables in Azure SQL Database
Ledger tables maintain a complete history of all changes with cryptographic hashes, making it possible to verify that data hasn't been tampered with.
1 min read
Azure IoT Security Best Practices
Implementing these security best practices creates a defense-in-depth approach for your IoT solutions.
1 min read
Azure IoT Hub Device Provisioning Service Deep Dive
DPS is essential for deploying and managing IoT devices at scale across multiple regions and IoT Hubs.
1 min read
Kubernetes Network Policies: Securing Pod Communication
Network Policies provide essential microsegmentation for Kubernetes clusters. Enable a CNI that supports policies (like Azure CNI or Calico) to enforce them.
1 min read
Pod Security Admission: Replacing Pod Security Policies
Three built in levels: Privileged : Unrestricted (equivalent to no PSP) Baseline : Prevents known privilege escalations Restricted : Heavily restricted,…
1 min read
Seccomp by Default: Kubernetes Container Security
Seccomp (Secure Computing Mode) limits which system calls a process can make, reducing the attack surface.
1 min read
Power BI Object-Level Security: Protecting Tables and Columns
Object Level Security provides an additional security layer: Protect sensitive columns from unauthorized access Hide entire tables from roles Complement RLS…
1 min read
Power BI Row-Level Security: Securing Data at the Row Level
Row Level Security is essential for: Multi tenant applications Regional data access Hierarchical visibility Regulatory compliance Combined with proper…
1 min read
Azure Private Link Service: Expose Your Services Privately
Private Endpoint : Consume services privately (you're the client) Private Link Service : Expose services privately (you're the provider) 1. SaaS providers :…
1 min read
Private Endpoints Everywhere: Securing Your Azure Data Platform
A private endpoint: Creates a network interface with a private IP in your VNet Maps to a specific Azure resource (or sub resource) Enables DNS resolution to…
2 min read
Azure Data Factory Managed Virtual Network: Secure Data Integration
Data Flows automatically use the managed VNet when connected to private endpoints.
1 min read
Data Governance in Azure Databricks: Policies, Practices, and Implementation
A complete governance framework addresses: Access Control : Who can access what data Data Quality : Ensuring data accuracy and completeness Data Lineage :…
1 min read
Windows Event Collection: Comprehensive Monitoring with AMA
Comprehensive Windows Event collection is essential for security monitoring and compliance.
1 min read
Azure Confidential Ledger: Tamper-Proof Record Keeping
Azure Confidential Ledger provides cryptographically verifiable, tamper-proof record keeping for compliance-critical scenarios.
1 min read
Secrets Management Patterns: Best Practices for Azure
Category Example Recommended Approach Azure Services Storage, SQL Managed Identity External APIs Third party APIs Key Vault Certificates TLS, Auth Key Vault…
1 min read
Certificate-Less Authentication: Simplifying Service Identity
Certificate-less authentication dramatically simplifies operations while improving security posture.
1 min read
Keyless Authentication: The Future of Cloud Security
Keyless Authentication: The Future of Cloud Security
1 min read
OIDC for GitHub Actions: Secure Azure Deployments
OIDC for GitHub Actions is the modern, secure approach to Azure authentication in CI/CD pipelines.
1 min read
Workload Identity Federation: Keyless Authentication from Anywhere
Instead of client secrets: 1. External identity provider issues a token 2. Token is exchanged for an Azure AD token 3. Application uses Azure AD token to…
1 min read
Managed Identities Everywhere: Eliminating Secrets in Azure
Managed identities are the foundation of a zero-secrets architecture in Azure.
1 min read
Dependabot: Automated Dependency Updates and Security
Dependabot is an essential tool for maintaining secure and up-to-date dependencies.
1 min read
GitHub Secret Scanning: Protecting Your Credentials
GitHub partners with service providers to detect over 100 types of secrets. When a secret is detected, both you and the provider are notified, allowing for…
1 min read
GitHub Code Scanning: Finding Vulnerabilities Before They Ship
Code scanning uses CodeQL, a semantic code analysis engine, to find security vulnerabilities, bugs, and other errors in your codebase.
1 min read
GitHub Advanced Security: Enterprise-Grade Security for Your Code
GitHub Advanced Security transforms security from a gate to a continuous process integrated into your development workflow.
1 min read
Differential Privacy in Machine Learning: Protecting Individual Data
Differential privacy ensures that the output of a computation doesn't reveal whether any individual's data was included. The key insight: add calibrated…
1 min read
Identity-First Security: The New Perimeter
Identity-first security in 2021 meant rethinking how we control access. The tools are mature; the challenge is implementation discipline.
1 min read
Zero Trust Security in Azure: Trust Nothing, Verify Everything
1. Verify Explicitly : Always authenticate and authorize based on all available data points 2. Least Privilege Access : Limit user access with just in time…
1 min read
Azure Service Connector: Simplified Service-to-Service Connections
Azure Service Connector eliminates the boilerplate of connecting services while implementing security best practices. It's a significant productivity boost…
2 min read
Azure AD Workload Identity for AKS: The Future of Pod Identity
Azure AD Workload Identity is the architecture-level improvement over AAD Pod Identity that removes the NMI DaemonSet and uses Kubernetes native service…
1 min read
Secure Azure Access with AKS Pod Identity
AAD Pod Identity was the original mechanism for giving Kubernetes pods an Azure AD identity so they could access Azure resources—Key Vault secrets, Storage…
1 min read
Content Protection and DRM with Azure Media Services
Content protection with DRM ensures your premium content remains secure while providing a seamless viewing experience across all platforms.
1 min read
Implementing Speaker Recognition with Azure Cognitive Services
Speaker Recognition enables secure, frictionless authentication and personalized experiences based on voice identity.
1 min read
Azure Update Management for Patch Compliance
Set up Update Management for your VMs: Onboard VMs to Update Management: Schedule update deployments: Create maintenance scripts: Query update compliance…
1 min read
Working with Azure Activity Logs for Audit and Compliance
Activity Logs include several categories: Administrative : Resource management operations (create, update, delete) Security : Security Center alerts and…
1 min read
Application Security Groups for Simplified Network Security
Traditional NSG rules use IP addresses, which creates challenges: IP addresses change when VMs are recreated Rules become hard to read with many IP ranges…
1 min read
Network Security Groups - Microsegmentation in Azure
NSG rules are evaluated by priority (100 4096, lower = higher priority): Direction : Inbound or Outbound Priority : 100 4096 (lower numbers processed first)…
2 min read
Configuring Azure Firewall Rules for Enterprise Security
Azure Firewall rules are the configuration work that determines whether your network security posture is genuinely restrictive or accidentally permissive.…
1 min read
Simplified Outbound Connectivity with Azure NAT Gateway
NAT Gateway solves several problems: SNAT Port Exhaustion : Each NAT Gateway supports up to 64,000 concurrent connections per public IP Simplified…
1 min read
Azure Application Gateway v2: Regional Load Balancing Deep Dive
Application Gateway v2 is where the regional Layer 7 load balancer story became production-serious for enterprise workloads. Autoscaling means you don't…
1 min read
Azure Web Application Firewall: Custom Rules and Policies
Platform Use Case Global/Regional Application Gateway Regional apps, traditional Regional Front Door Global apps, edge protection Global CDN Static content…
1 min read
Azure DDoS Protection: Defending Against Volumetric Attacks
Basic (Free) Always on traffic monitoring Automatic mitigation Protection for Azure infrastructure No SLA or customization Standard (Paid) All Basic…
1 min read
Azure Managed HSM: FIPS 140-2 Level 3 Key Management
Feature Key Vault Premium Managed HSM HSM Type Multi tenant Single tenant FIPS Level 140 2 Level 2 140 2 Level 3 Admin Control Azure managed Customer…
1 min read
Azure Key Vault Certificates: Complete Lifecycle Management
Key Vault stores certificates as: Certificate : The X.509 certificate (public) Key : The private key (protected) Secret : The combined certificate + private…
1 min read
OAuth 2.0 Flows with Azure AD: Choosing the Right Flow
Flow Use Case User Interaction Authorization Code Web apps, mobile Yes Authorization Code + PKCE SPAs, mobile, desktop Yes Client Credentials Daemon/service…
1 min read
Azure AD B2C Custom Policies: Advanced Identity Flows
User Flows: Pre-built, configurable through portal Custom Policies: XML-based, fully customizable
2 min read
Azure AD Conditional Access: Zero Trust Authentication Policies
Conditional Access is where the "never trust, always verify" principle of Zero Trust actually gets operationalised. Every sign-in to every app goes through…
1 min read
Microsoft Defender for Identity: Protecting Your Active Directory
The service identifies: Reconnaissance : Attackers gathering information about your environment Compromised credentials : Pass the hash, pass the ticket,…
1 min read
Azure Security Center and Microsoft Defender: Unified Cloud Security
Microsoft Defender for Cloud includes: CSPM (Cloud Security Posture Management): Free tier with security recommendations CWP (Cloud Workload Protection):…
1 min read
Azure Sentinel SOAR: Automating Security Response
In Sentinel, SOAR is implemented through Playbooks (Logic Apps) and Automation Rules.
2 min read
Azure Dedicated Host - Running VMs on Isolated Physical Servers
Azure Dedicated Host is the offering I typically reach for when a client's security or compliance team says "I can't be on shared hardware." The use cases…
2 min read
Azure Confidential Computing - Protecting Data in Use
Confidential Computing addresses the attack surface that most cloud encryption doesn't touch: data while it's actively being processed in memory. Encryption…
2 min read
ADLS Gen2 Access Control with ACLs - Fine-Grained Security
Both work together - a user needs both RBAC permission to access the storage account AND appropriate ACL permissions on the specific path.
1 min read
Azure Sphere for Secured IoT Device Development
1. Azure Sphere MCU : Secured silicon with hardware based security 2. Azure Sphere OS : Linux based secured operating system 3. Azure Sphere Security…
2 min read
Azure Databricks Workspace Management and Data Governance Best Practices
Databricks workspace governance was the problem nobody thought about until there were thirty workspaces, fifteen clusters running overnight, and six teams…
1 min read
Centralized Security Management with Azure Firewall Manager
Azure Firewall Manager provides: Hierarchical policy management Parent and child policies for inheritance Global deployment Manage firewalls across regions…
2 min read
Secure VM Access with Azure Bastion
I keep writing about Bastion because I keep finding jump boxes I have to replace. VM with a public IP, port 3389 open, "admin" password in a sticky note in…
2 min read
Securing Azure Services with Private Link
Private Link provides several key benefits: Private connectivity Access services over private IP addresses Data exfiltration protection Service endpoints…
1 min read
Securing Your Cloud Infrastructure with Azure Defender for Cloud
Azure Defender extends the capabilities of Azure Security Center by adding: Advanced threat detection using machine learning and behavioral analytics…
1 min read
Advanced Azure Key Vault Patterns
"Put it in Key Vault" is the easy advice. The advanced game is rotation, lifecycle, and access patterns that don't break under pressure. Managed identity…
1 min read
Advanced Azure API Management Policies
I revisit APIM policies on this blog roughly every six months because the patterns are how the service earns its keep. Rate limiting per subscription, JWT…
1 min read
Azure SQL Database Ledger: Tamper-Proof Data
SQL Ledger: trust through cryptographic verification.
1 min read
Azure Storage Account Security Best Practices
Storage accounts are deceptively easy to deploy and easy to misconfigure into a leak. Public blob containers are still the most common "how did this get…
1 min read
Azure DDoS Protection: Defend Against Attacks
DDoS Protection Standard provides cost credits for attack-related scaling. Azure DDoS Protection: resilience against the largest attacks.
1 min read
Azure Bastion: Secure VM Access Without Public IPs
Jump boxes are one of those legacy patterns I keep finding in environments I inherit. A Windows VM with RDP open to the internet, "for admin access only,"…
1 min read
Azure Firewall: Network Security Fundamentals
Azure Firewall: cloud-native network security without the complexity.
1 min read
Azure Confidential Computing: Encrypt Data in Use
"It can't be processed if it can't be decrypted, but you can't process encrypted data." That truism quietly stopped being true. Confidential Computing uses…
1 min read
Azure Front Door WAF: Web Application Firewall
A WAF in front of every public app is no longer a nice-to-have. Bots scan you within minutes of going live, and "we'll add WAF later" is how breaches…
1 min read
Azure Sentinel: Cloud-Native SIEM
SIEM used to mean a rack of appliances, a forwarder per data source, and a six-figure annual licence. Sentinel rewrites that economics. It's a SIEM that…
1 min read
Azure API Management: Policy Deep Dive
API Management is one of those services I underestimated for years. "It's a proxy, right?" The penny drops when you realise policies are the product. Rate…
1 min read
Azure Defender: Cloud Security Posture Management
Azure Defender: security visibility across your entire estate.
1 min read
Azure SQL Security Features: Protect Your Data
Encrypt sensitive columns—keys never exposed to SQL Server. Azure SQL security is comprehensive—use all layers for maximum protection.
1 min read
Power BI Row-Level Security: Data Access Control
In Desktop: Modeling → View as Roles → Select role → Enter email to test RLS enables true multi-tenancy in Power BI, where one dataset serves many users…
1 min read
Azure Bastion: Secure VM Access Without Public IPs
The extra cost of Bastion is worth the security posture improvement.
1 min read
Azure Private Link: Secure Access to PaaS Services
By default, Azure PaaS services (Storage, SQL, Cosmos DB) have public endpoints. Even with firewall rules, data transits the public internet.
1 min read
Azure API Management: API Gateway Patterns
Three years ago a client asked me to "put a gateway in front of my APIs." It turned into a six-month conversation about rate limiting, OAuth, partner…
2 min read
Secure Secret Management with Azure Key Vault in .NET
A confession to start: I've shipped connection strings in appsettings.json more times than I'm proud of. The reasons are always the same — "it's only dev"…