Microtechx

Your organisation most likely has already been breached - you just don't know it yet

That's how Advanced Persistent Threats (APTs) work.
Unlike ransomware that announces itself, or phishing that trips an alert - APTs are long-term, targeted attacks designed to infiltrate an organisation and remain hidden for as long as possible. These campaigns often unfold over weeks, months, or even years.

And they're not random. Attackers choose their targets carefully, often focusing on high-value entities like government agencies, critical infrastructure, or large enterprises.

Here's what makes APTs uniquely dangerous:
Attackers use specialised tools and tactics designed to evade traditional security controls - such as zero-day vulnerabilities, custom malware, and multi-stage operations. APTs aren't one-time events; attackers work continuously to maintain access, using a range of techniques to avoid detection and reestablish control if disrupted.

Who's doing this?
APT28 (Fancy Bear), believed to be linked to Russian military intelligence, has targeted governmental and military organisations using spear-phishing and malware. APT29 (Cozy Bear), associated with Russian intelligence services, has focused on diplomatic and governmental entities. The Lazarus Group, attributed to North Korea, has conducted operations ranging from financial theft to disruptive attacks on media and entertainment sectors.

And the scale of damage is staggering. A February 2024 cyberattack on a major healthcare IT services unit disrupted patient care and led to the theft of protected health information, impacting an estimated 190 million people.

So what actually works against APTs?
Preventing APTs requires a multi-layered approach - closing gaps across people, processes, and technology. Best practices include regular patch management, employee training to combat phishing, network segmentation with least-privilege access, continuous monitoring, and a well-practised incident response plan.

No defence is perfect, but a layered approach can significantly reduce the likelihood and impact of an APT attack - and also increase the chances you catch them early.

What is your APT defense strategy?

Let's imagine you gave 5 teams access to your Azure OpenAI instance. If one of them would do something they shouldn't, how would you revoke only their access?

That is actually an important question when we talk about scaling Azure OpenAI internally, so what do we do?

Azure OpenAI gives you two keys - a primary and a secondary. The secondary key exists for rotation, not for isolating clients. So when you hand that same key to your data science team, your product team, your external vendor, and two internal apps, you've created a situation where access control is essentially all-or-nothing.
Want to cut off the vendor? You're rotating the key for everyone. Want to give the product team a higher rate limit than the data science team? Not possible at the key level. Want to figure out which team is burning through your token quota? Good luck - the logs won't tell you.

To fix the problem we need to stop treating Azure OpenAI as something clients connect to directly, and start treating it as an internal service behind a gateway.

Put Azure API Management in front. Issue each client their own subscription key through the gateway. The gateway authenticates to Azure OpenAI via managed identity - no keys floating around in client configs at all. From there you get what you actually need: per-client rate limits, independent key rotation, revocation without disruption, and logs that actually tell you who's doing what.

The gateway also lets you make routing decisions based on client identity. Different teams can hit different model deployments through the same endpoint without knowing anything about the backend topology.

That is not at all exotic architecture, it is something that you would be able to operate 6 months from now on!

How are your teams handling access isolation on shared Azure OpenAI instances right now? API Management, custom gateway, or still figuring it out?

People believe NIST compliance is about passing audits - when in reality it is about controlling the risk of access breaches

There was one detail about Microsoft's explanation of NIST that caught my eye: "...security frameworks spend a huge amount of time focusing on identity, permissions, and access control, because attackers constantly exploit overexposed systems."

And that is true, most environments are way messier than teams would like to admit.

Permissions get accumulated over time, old contractor accounts stay active, admins reuse elevated privileges for convenience... Cloud platforms inherit default settings nobody reviews...

A company can technically be “compliant” while still exposing sensitive data internally.
That’s why frameworks like NIST push principles like:
- Least privilege → users only get access they truly need
- Continuous monitoring → access is reviewed constantly, not once a year
- Identity verification → trust is earned repeatedly, not assumed after login
- Configuration management → defaults are treated as risks, not conveniences

That is important, because we know that most cybersecurity problems aren't about a Hollywood-style hacker breaking through six firewalls, but about one forgotten permission sitting quietly in the environment for 18 months...

I am curious, what’s the most overlooked access control issue you keep seeing inside organizations today?

Many organizations believe their cloud environments are compliant simply because security policies exist.

But in reality, it is hardly like that, as compliance gaps are often found each time these things happen:

• When a virtual machine is deployed outside the approved baseline;
• When some patches are missed;
• When configurations drift over time;
• When previously temporary environments become permanent;
• Or when teams lose centralized visibility across workloads;

With this, suddenly, what looked like compliance on paper becomes a real operational and security risk...

As cloud environments scale, manual compliance management no longer works - this is why modern organizations are adopting automated compliance strategies, like:

• Standardized VM configurations
• Policy-based governance
• Continuous monitoring
• Automated remediation
• Centralized security visibility

Compliance today is about maintaining security consistency across dynamic infrastructure.

Because in cloud security, even a single unmanaged virtual machine can become the weak point of the entire environment.