Business Central Under the Hood episode 10: Hackers Are at the Gate! Business Central & Security.

Overview

The episode covers the current threat landscape, including credential stuffing, ransomware and the exposure of small businesses, and how Microsoft secures Business Central. Topics include the secure by default approach, threat intelligence that is cascaded across cloud customers, and code review through the security development lifecycle with static analysis and code scanning.

It also describes secure admin workstations, auditing and security logs sent to Microsoft Purview, the Dynamics 365 bounty program, and a 2019 red team exercise. The closing sections cover threat modeling, CISO workshops, fishing resistant MFA, phishing and social engineering, AI in security and incident response, and recommendations for partners and customers.

Key points

• Business Central ships auditing and security logs to Microsoft Purview, so customers can build their own alerts and detect anomalies. This is part of a joint responsibility model.
• Cloud customers benefit from threat intelligence sharing: when an attack is detected on one customer, such as malicious IP addresses, it can be cascaded to all customers immediately.
• All Business Central code goes through professional security team review, including threat modeling, risk assessment and mitigation tracking, plus static analysis and code scanning before release.
• Production access uses secure admin workstations that are separate from corporate systems and need a physical security dongle, a second factor and a specialist VPN.
• Do not use SMS as multifactor authentication. Microsoft uses fishing resistant MFA such as passkeys.
• Partners and developers are pointed to the security development lifecycle guidance, a threat modeling video, and CISO workshop videos with decks.
• Microsoft pays researchers through the Dynamics 365 bounty program to report vulnerabilities responsibly, and now reports cloud bugs even without a CVE.

Features

AL objects mentioned

As heard in the captions. A name that matches one object page by exact type and name links to it; the others stay as named.

• other “Cosmos database” at 41:13

Quotes

• 1:32 “I think we should be concerned. Uh, I think the hackers kind of are at the gates a little bit.”
• 2:29 “a a very special responsibility because we hold the keys of the kingdoms for so many businesses”
• 4:12 “right now we in Microsoft are experienced sometimes billions, if not trillions of attempts of people that are taking these rainbow tables”
• 9:41 “those businesses are probably the most vulnerable. They’re in the perfect sweet spot for ransomware attackers.”
• 10:57 “secure by default you know we’ve often you know since the 70s we’ve had all these security principles like”
• 11:53 “it’s secure by default when you switch it on it’s secure and you have to read the documents and to really strive to screw”
• 13:45 “we can cascade that to all of our customers immediately”
• 13:56 “a single customer is attacked or even compromised and then we can plug that into our systems to defend everybody else.”
• 14:52 “secure by default watched by network operations centers staffed by the best in the world using”
• 17:28 “all of these AI features need to go through the professional security teams like my own it was very hard work for us we”
• 21:04 “we essentially pay people to to report security bugs to us vulnerabilities”
• 21:55 “a zero day just means uh a vulnerability that is that the bad that the that the sort of attackers know about before the”
• 23:04 “most successful breaches have nothing to do with zero days”
• 25:14 “do not use SMS as a as a multiffactor thing because uh it’s it’s compromised”
• 26:39 “the I think that most people would be quite shocked and terrified to realize how many close calls every business has”
• 26:53 “a few months ago we started reporting all of our cloud bugs”
• 29:28 “In 2019 we we got the what was then the Azure uh red team”
• 32:45 “I think the simplest thing would be for them to to follow the security development life cycle that is a very mature, very complete”
• 34:25 “threat modeling is deceptively simple I mean we made a 5minute video for engineering resources here within Microsoft it really just involves this you”
• 35:41 “good security people are not security absolutists. Remember that they’re part of a business that has to ship value to customers”
• 36:52 “Definitely not SMS. Uh you know, we we actually use so-called fishing resistant MFA”
• 38:02 “if you get a call from somebody saying they’re from Microsoft and there’s some security issue on your computer this is not us. this”
• 39:45 “cyber security as a discipline is extremely broad. It’s not just a narrow technical thing. A lot of it’s psychology.”
• 40:57 “it’s hard for me to remember the 300 or so controls that are”
• 47:56 “The basics are the basics and the basics are basic get you an awful long way”

Disclaimers in the video

• 17:10 subject-to-change: we maintained that even in the age of AI where there’s enormous pressure to push out AI features
• 40:46 preview: I’ve now got a a co-pilot threat modeler with me that’s watching the transcript
• 43:57 other: MCP servers are all the rage and this is a new thing and everyone’s rushing into an area to ship it and we need to give centralized guidance
• 46:22 other: attackers have not really found a good use for AI yet but they’re trying to figure out how to weaponize these techniques

Presenters (as heard): Jonathan Davis, Vincent, Craig Nelson, Jonathan.