Can We Automate Security? SASHA ROSENBAUM

### Overview Sasha Rosenbaum, a program manager on the Azure DevOps team (formerly TFS) at Microsoft, explores the practical reality behind the question: "Can we automate security?" Her answer is that while parts of security can and should be automated, automation alone is far from sufficient. Grounded in her experience assisting a major US city recover from a devastating ransomware incident, Rosenbaum argues that modern security requires an "assumed breach" mindset. Rather than solely attempting to keep attackers out, organizations must focus on rapid detection, containment, and remediation, paired with deep cultural changes across engineering teams.

### Key Topics - **The Reality of Breaches & Assumed Breach**: Rosenbaum shares her deployment to assist a major US city hit by ransomware via brute-forced weak passwords. The attack compromised 95% of city infrastructure—including courts and police databases—largely because 2,000 known security warnings had been ignored due to organizational fatigue, and no working recovery procedures or backups existed. Quoting former NSA/CIA director Michael Hayden, she stresses that determined attackers will inevitably penetrate systems; security teams must assume they are already breached. - **Culture Change via Red Teaming & Gamification**: Developers frequently view security as an obstacle to shipping features. Microsoft addressed this by running internal Red Team exercises and capture the flag (CTF) events, demonstrating tangible proof of vulnerabilities (e.g., exploiting a cross-site scripting flaw to automatically upvote an internal bug ticket 280 times). Red Team operations operate under strict rules: do no harm, avoid impacting customer systems or availability, do not harass humans, and report findings responsibly. Microsoft eventually retired dedicated Blue Teams, embracing the model that every engineer must be a protector. - **Protecting Credentials and Phishing Defense**: The two largest entry points for attackers are credential theft and known vulnerabilities. Internal phishing tests showed that 44% of employees clicked simulated promotional links, and spear-phishing disguised as manager requests remains highly successful. To mitigate this, Rosenbaum emphasizes mandatory multi-factor authentication (MFA) and link-wrapping in Office 365, which inspects targets at click time. - **Open-Source Vulnerabilities & Supply Chain Security**: With ubiquitous adoption of open-source software, unpatched components pose severe risks, as seen in the Equifax breach involving an unpatched Apache Struts flaw. Defenses include automated dependency scanners (such as WhiteSource and GitHub's Dependabot), as well as routing external packages through scanned internal package repositories. - **Preventing Lateral Movement**: Attackers think in graphs, hopping through exposed credentials in file shares or test environments to escalate privileges. Rosenbaum advises against treating dev or test environments as throwaways, avoiding default configurations on POCs (especially Kubernetes clusters), and enforcing zero standing admin privileges through Just-in-Time (JIT) access and secure admin workstations. - **Automating Pipelines**: CI/CD pipelines can enforce automated secret scanning (such as CredScan) on pull requests to block secrets before merging into master. Furthermore, organizations should rotate secrets on every deployment using key vaults and adopt cloud infrastructure-as-code to prevent long-standing servers.

### Technical Details - **Secret Scanning**: Implementing automated pull request build triggers using CredScan and similar repository tools to detect hardcoded secrets and block merges into trunk/master. - **Access Control Architecture**: Implementing Just-in-Time (JIT) privilege elevation via temporary passwords or certificates, eliminating standing administrative permissions to production. - **Pipeline Secret Management**: Storing all operational credentials in key vaults and rotating them automatically during every release to prevent breakage from stale secrets. - **Threat Modeling Limitations**: Automated threat modeling tools tested by Microsoft generated high noise and false positives; threat modeling remains an effective human-driven whiteboard process for new feature designs, though it cannot cover every single code commit. - **Bug Bounty**: Microsoft established an Azure bounty program offering up to $20,000 for documented, reproducible vulnerabilities.

### Takeaways Automating security in CI/CD pipelines—especially secret detection, open-source dependency scanning, and automated credential rotation—is critical for modern engineering. However, automation cannot replace human vigilance and threat modeling. Organizations must eliminate standing privileges, deploy MFA, isolate environments, and use gamified exercises like Red Teaming to build a culture of security empathy among developers.