Latest / The Identity Blueprint / Every M&A Deal Carries Inherited Risk. Here's How Microsoft Entra Secures It.

Transcript

Every M&A Deal Carries Inherited Risk. Here's How Microsoft Entra Secures It. · The Identity Blueprint

• 0:00
  SPEAKER_00: Welcome back to the Identity Blueprint.
• 0:02
  SPEAKER_00: Beyond the Domain, I'm Ernie with Jose.
• 0:05
  SPEAKER_00: Last episode was the mechanics of getting day one right.
• 0:09
  SPEAKER_00: This one is what you inherit whether you're ready or not.
• 0:12
  SPEAKER_00: We trace the Marriott Starwood Breach, a state actor sitting inside the target's network for two years before the deal closed, and two more after, until it cost Marriott$170 million and a 20-year consent order from the Federal Trade Commission.
• 0:28
  SPEAKER_00: We also get mechanical, how a naming collision between two finance admins groups can hand junior accountants global admin rights overnight, and why the Oracle Cerner breach hit the migration servers, not either company's fortress.
• 0:44
  SPEAKER_00: If you're signing off on the integration timeline, this is required listening.
• 0:48
  SPEAKER_00: Let's get into it.
• 0:50
  SPEAKER_01: I mean, imagine buying a$50 million mansion, right?
• 0:53
  SPEAKER_01: You move your family in, you're arranging all your furniture, and then uh you discover a complete stranger has been living in the basement for two years.
• 1:02
  SPEAKER_00: Right.
• 1:02
  SPEAKER_00: And they still have the keys to your front door.
• 1:04
  SPEAKER_01: Exactly.
• 1:05
  SPEAKER_01: They have the keys, the foundation is actively crumbling, the wiring is just completely exposed, and uh you are now legally responsible for all of it.
• 1:14
  SPEAKER_01: Trevor Burrus, Jr.
• 1:14
  SPEAKER_00: Which is a terrifying thought.
• 1:16
  SPEAKER_01: It is.
• 1:16
  SPEAKER_01: But that is exactly what happens in the digital landscape during like over 40% of corporate mergers today.
• 1:24
  SPEAKER_01: So welcome to the deep dive.
• 1:26
  SPEAKER_00: Glad to be here.
• 1:26
  SPEAKER_01: Aaron Powell For you, the listener, our mission for this session is super clear.
• 1:30
  SPEAKER_01: We are delivering a mechanics and case study masterclass on uh the identity governance challenges and the inherited security risks that come with merging to previously independent organizations.
• 1:42
  SPEAKER_00: Aaron Powell Yeah, we are really dissecting an architectural reality that is, quite honestly, often completely ignored until it brings a multi-billion dollar business to its knees.
• 1:51
  SPEAKER_01: Aaron Powell Which happens more than people think.
• 1:52
  SPEAKER_00: Oh, absolutely.
• 1:53
  SPEAKER_00: So our roadmap for this exploration today is driven by real breach data and you know technical precision.
• 2:01
  SPEAKER_00: Right.
• 2:02
  SPEAKER_00: We'll map the broader MA identity risk landscape first.
• 2:05
  SPEAKER_01: Aaron Powell Right, lay the groundwork.
• 2:06
  SPEAKER_00: Aaron Powell Exactly.
• 2:07
  SPEAKER_00: Then we'll deconstruct the canonical Marriott Starwood case study.
• 2:11
  SPEAKER_00: After that, we're going to get our hands dirty in the actual engineering mechanics of group and application access migration.
• 2:18
  SPEAKER_01: That's the really heavy technical stuff.
• 2:20
  SPEAKER_00: Aaron Powell It is.
• 2:21
  SPEAKER_00: And from there, we are hunting down the lateral movement risks of shadow IT tenants.
• 2:25
  SPEAKER_00: And finally, we'll close by extracting the architectural lessons from the Oracle Center data breach.
• 2:30
  SPEAKER_01: Perfect, because you know the stakes here are fascinating.
• 2:33
  SPEAKER_01: There is such a massive disconnect between the boardroom and the server room.
• 2:37
  SPEAKER_01: Oh, massive.
• 2:38
  SPEAKER_01: Yeah.
• 2:38
  SPEAKER_01: You see the press release for a major acquisition, right?
• 2:41
  SPEAKER_01: The CEOs are shaking hands, the stock prices are jumping.
• 2:44
  SPEAKER_01: I mean, it looks like a perfectly engineered financial marriage.
• 2:46
  SPEAKER_01: On paper.
• 2:47
  SPEAKER_01: Right, on paper.
• 2:48
  SPEAKER_01: But before we get into the heavy mechanics of how you actually migrate users and integrate these massive directories, we really need to understand the underlying volatility.
• 2:57
  SPEAKER_00: Aaron Powell The inherited risk.
• 2:58
  SPEAKER_01: Yeah.
• 2:59
  SPEAKER_01: Because when two massive enterprises combine, I think the assumption is just that all the underlying gears click into place.
• 3:07
  SPEAKER_01: Why is that assumption so dangerous?
• 3:09
  SPEAKER_00: Aaron Ross Powell Because an acquisition is well, it's almost never just a financial transaction.
• 3:15
  SPEAKER_00: Underneath all the paperwork, it's the violent collision of two completely different IT and security postures.
• 3:22
  SPEAKER_01: Aaron Powell collision.
• 3:23
  SPEAKER_01: I like that.
• 3:24
  SPEAKER_00: Aaron Powell It's true.
• 3:24
  SPEAKER_00: You have two massive entities and they each have their own established directories, their own access policies, uh, their own legacy tech debt, and most importantly, their own undetected vulnerabilities.
• 3:36
  SPEAKER_00: Right.
• 3:36
  SPEAKER_00: When those two environments are linked, the acquiring company is literally buying the target company's entire historical cybersecurity posture, warts and all.
• 3:45
  SPEAKER_01: Trevor Burrus, So they inherit everything.
• 3:46
  SPEAKER_00: Trevor Burrus, Jr.: Everything.
• 3:47
  SPEAKER_00: And this is why identity integration failures are cited as the primary blame in more than 40% of all MA failures.
• 3:53
  SPEAKER_01: Trevor Burrus Okay, wait.
• 3:54
  SPEAKER_01: Over 40% of these massive billion-dollar corporate marriages fail, and the autopsy points directly at identity.
• 4:00
  SPEAKER_00: Aaron Powell Directly at it, yeah.
• 4:02
  SPEAKER_01: Let's unpack that specific metric, because that's huge.
• 4:05
  SPEAKER_01: Why identity?
• 4:06
  SPEAKER_01: I mean, if two companies merge, they're combining supply chains, right?
• 4:10
  SPEAKER_01: Manufacturing plants, HR, real estate portfolios.
• 4:14
  SPEAKER_01: Why is identity the specific failure point that tears the whole deal apart?
• 4:18
  SPEAKER_00: Aaron Powell Because identity is the perimeter of the modern enterprise.
• 4:20
  SPEAKER_00: I mean, historically the network was the perimeter, right?
• 4:23
  SPEAKER_01: Right.
• 4:23
  SPEAKER_01: The old Castle and Moat model.
• 4:24
  SPEAKER_00: Trevor Burrus, Jr.
• 4:24
  SPEAKER_00: Exactly.
• 4:25
  SPEAKER_00: You built a moat around your corporate headquarters, you put a firewall at the edge, and you assumed everything inside was safe.
• 4:31
  SPEAKER_00: But that model is completely dead.
• 4:33
  SPEAKER_01: Yeah, people are everywhere now.
• 4:34
  SPEAKER_00: Today, employees work from coffee shops, applications live in the cloud, data is accessed from personal devices.
• 4:41
  SPEAKER_00: The only constant like the only control plane that actually matters anymore is the identity of the user requesting access.
• 4:48
  SPEAKER_01: So if you can't figure out who is who, the business simply cannot function.
• 4:52
  SPEAKER_00: If you can't reconcile who has access to what, the acquiring company can't consolidate billing.
• 4:58
  SPEAKER_00: They can't merge their CRM platforms.
• 5:00
  SPEAKER_00: Oh wow.
• 5:01
  SPEAKER_00: They can't even give their new employees access to the corporate intranet.
• 5:05
  SPEAKER_00: The operational paralysis is immediate.
• 5:08
  SPEAKER_01: Aaron Powell So the business just grinds to a halt because literally nobody can log in.
• 5:11
  SPEAKER_01: Trevor Burrus, Jr.
• 5:12
  SPEAKER_00: That's the operational side, yeah.
• 5:13
  SPEAKER_00: But it goes much deeper than just operational downtime.
• 5:16
  SPEAKER_00: When we look at that 40% failure rate, we were looking at massive security compromises.
• 5:21
  SPEAKER_01: Aaron Powell The actual breaches.
• 5:23
  SPEAKER_01: Trevor Burrus, Right.
• 5:23
  SPEAKER_00: The scale of the inherited risks is really what drives those failures.
• 5:27
  SPEAKER_00: When you integrate a target company's identity framework, you face three primary existential dangers.
• 5:34
  SPEAKER_00: Aaron Powell Okay.
• 5:34
  SPEAKER_01: Lay them out for us.
• 5:35
  SPEAKER_00: First, you are potentially inheriting undetected pre-existing breaches from the target company.
• 5:41
  SPEAKER_01: Aaron Powell Meaning the attackers are already inside.
• 5:43
  SPEAKER_00: Aaron Powell Yes.
• 5:44
  SPEAKER_00: If threat actors are already inside their environment, just operating quietly in the background, the moment you connect your Active Directories or uh federate your cloud tenants, you have just built a bridge for those attackers directly into your primary pristine environment.
• 5:59
  SPEAKER_01: Aaron Powell Oh man.
• 6:00
  SPEAKER_01: So they just walk right across the bridge.
• 6:01
  SPEAKER_01: The enterprise architect spent six months building for them.
• 6:04
  SPEAKER_00: Aaron Powell Exactly.
• 6:05
  SPEAKER_00: The attackers don't even have to work for it.
• 6:07
  SPEAKER_00: You did the work for them.
• 6:08
  SPEAKER_01: Aaron Powell That's terrifying.
• 6:10
  SPEAKER_01: What's the second danger?
• 6:11
  SPEAKER_00: Aaron Powell Second, you face the creation of highly vulnerable data migration environments during the transition itself.
• 6:18
  SPEAKER_01: Aaron Powell The temporary infrastructure.
• 6:20
  SPEAKER_01: Trevor Burrus Yeah.
• 6:20
  SPEAKER_00: Temporary infrastructure used to move petabytes of data from the target to the acquirer is notoriously weak.
• 6:28
  SPEAKER_00: We'll get into that deeply with Oracle Cerner later.
• 6:30
  SPEAKER_01: Okay.
• 6:30
  SPEAKER_01: And the third The third is the anchor of regulatory liability.
• 6:34
  SPEAKER_01: Legal liability does not magically disappear when a company is bought.
• 6:38
  SPEAKER_01: It carries forward entirely intact to the acquiring company.
• 6:42
  SPEAKER_00: Aaron Powell Wait, let me push back on this because there is a glaring hole in that timeline, right?
• 6:46
  SPEAKER_00: If I am the CEO of a Fortune 500 company and I'm spending, let's say, five billion dollars to acquire a competitor, I'm not just taking their word for it.
• 6:56
  SPEAKER_00: I am hiring armies of corporate lawyers.
• 6:58
  SPEAKER_00: I'm getting top-tier IT auditors from the big four risk assessors.
• 7:02
  SPEAKER_00: I mean, they spend months combing through everything before the ink ever dries.
• 7:05
  SPEAKER_01: Aaron Powell The due diligence phase.
• 7:07
  SPEAKER_01: Exactly.
• 7:08
  SPEAKER_01: Due diligence.
• 7:09
  SPEAKER_01: How does an army of highly paid auditors completely miss a crumbling foundation or like an active state-sponsored breach?
• 7:16
  SPEAKER_00: Aaron Powell Because traditional compliance checklist due diligence completely fails to find active threats hiding in identity structures.
• 7:24
  SPEAKER_00: And the reason is simple.
• 7:26
  SPEAKER_00: Auditors look at paper, not packets.
• 7:28
  SPEAKER_01: Paper, not packets.
• 7:29
  SPEAKER_01: Okay, explain that.
• 7:30
  SPEAKER_00: Well, the lawyers and auditors are reviewing SOC2 reports, ISO certifications, and these self-addestation questionnaires.
• 7:37
  SPEAKER_00: A typical MA diligence checklist asks, Do you have an identity management policy?
• 7:42
  SPEAKER_01: And the target company obviously checks, yes.
• 7:44
  SPEAKER_00: Aaron Powell Right, because they do have a PDF document outlining a policy.
• 7:47
  SPEAKER_00: What the checklist does not reveal is that three of their legacy domain administrators haven't rotated their passwords in five years.
• 7:54
  SPEAKER_01: Oh, I see.
• 7:55
  SPEAKER_01: So the policy says they should, but the technical reality in the active directory is completely different.
• 8:00
  SPEAKER_00: Aaron Powell Exactly.
• 8:01
  SPEAKER_00: The paper is clean, but the network is dirty.
• 8:04
  SPEAKER_00: Furthermore, an auditor looking at an ISO certification will never spot that a state-sponsored threat actor has been sitting dormant in an unmanaged service account since last November.
• 8:13
  SPEAKER_01: Because that's not on the checklist.
• 8:15
  SPEAKER_00: It's impossible to find.
• 8:16
  SPEAKER_00: You cannot find an active cyber threat by reviewing legal disclosures in a data room.
• 8:21
  SPEAKER_00: If the target company doesn't know they are breached, they can't disclose it to the auditors.
• 8:26
  SPEAKER_01: And the auditors aren't running actual network scans.
• 8:29
  SPEAKER_00: No.
• 8:29
  SPEAKER_00: They don't have the technical mandate or the time to run an active compromise assessment across 50,000 endpoints before the deal closes.
• 8:36
  SPEAKER_01: Aaron Powell Man.
• 8:37
  SPEAKER_01: So if the paper diligence is really that blind to the technical reality, the legal protections built into the deal must be completely hollow.
• 8:46
  SPEAKER_00: Aaron Ross Powell They often are.
• 8:48
  SPEAKER_00: And the industry learned this the hard way.
• 8:50
  SPEAKER_00: The danger of relying on paper disclosures isn't just, you know, theoretical fear-mongering.
• 8:54
  SPEAKER_01: Aaron Powell, we have a massive real-world example.
• 8:57
  SPEAKER_00: The canonical failure.
• 8:58
  SPEAKER_00: The industry experienced a failure that fundamentally rewrote the rules on inherited MA cyber risk, proving definitively that checklist diligence is insufficient.
• 9:07
  SPEAKER_01: Let's set the background for that.
• 9:08
  SPEAKER_01: The Marriott Starwood case study.
• 9:09
  SPEAKER_01: Yes.
• 9:10
  SPEAKER_01: So on September 23, 2016, Marriott officially closed its massive$13.6 billion acquisition of Starwood hotels and resorts.
• 9:19
  SPEAKER_00: Aaron Powell A monumental deal.
• 9:20
  SPEAKER_01: Trevor Burrus Yeah.
• 9:21
  SPEAKER_01: It created the largest hotel chain in the entire world.
• 9:24
  SPEAKER_01: They were integrating massive guest databases, global reservation systems, loyalty programs, just an insane amount of data.
• 9:31
  SPEAKER_00: Aaron Powell The scale of the integration was totally unprecedented.
• 9:35
  SPEAKER_00: But the timeline of the breach is really what makes this the foundational precedent for MA risk.
• 9:39
  SPEAKER_01: Aaron Powell Right.
• 9:40
  SPEAKER_01: Break down the timeline for us.
• 9:42
  SPEAKER_00: So forensic investigations later revealed that Chinese state-sponsored attackers had originally compromised Starwood's network in 2014.
• 9:51
  SPEAKER_01: Yes.
• 9:51
  SPEAKER_00: That means highly sophisticated adversaries had already been operating continuously inside Starwood's guest reservation database for two full years prior to the acquisition closing in 2016.
• 10:03
  SPEAKER_01: Two years of uninterrupted dwell time before Marriott even owned the company.
• 10:07
  SPEAKER_00: Exactly.
• 10:07
  SPEAKER_01: The attackers are literally sitting in the basement, mapping the house, stealing data while Marriott is outside on the lawn negotiating the purchase price.
• 10:15
  SPEAKER_00: It's wild, but it gets worse.
• 10:16
  SPEAKER_00: The situation deteriorated significantly post-acquisition.
• 10:20
  SPEAKER_00: After the deal closed on September 23, 2016, Starwoods Network was brought under Marriott's corporate umbrella.
• 10:27
  SPEAKER_00: Those same Chinese state-sponsored attackers remain completely undetected inside what was now Marriott's network for two additional years.
• 10:35
  SPEAKER_01: Wait, two more years?
• 10:36
  SPEAKER_00: The breach wasn't discovered until September 2018.
• 10:39
  SPEAKER_01: So that's a four-year dwell time, two years under Starwood's watch, and two years under Marriott's watch.
• 10:44
  SPEAKER_01: Right.
• 10:45
  SPEAKER_01: The financial and reputational impact of discovering a state actor has been strip mining your guest data for four years.
• 10:51
  SPEAKER_01: I mean, that's just mind-blowing.
• 10:52
  SPEAKER_00: Aaron Powell The numbers are staggering.
• 10:54
  SPEAKER_00: The combined cost of the breach exceeded$170 million across three separate but related breaches.
• 11:02
  SPEAKER_00: And it exposed the personal data of 344 million guests globally.
• 11:06
  SPEAKER_00: We're talking passport numbers, travel dates, credit card fragments.
• 11:10
  SPEAKER_01: Over 300 million people.
• 11:12
  SPEAKER_01: And the regulatory hammer came down hard on that, didn't it?
• 11:15
  SPEAKER_00: With historic force, it resulted in a massive 20-year FTC consent order that extends Marriott's strict compliance and auditing obligations all the way through 2044.
• 11:25
  SPEAKER_01: 2044?
• 11:27
  SPEAKER_01: A 20-year consent order.
• 11:29
  SPEAKER_01: I mean, that is an incredibly severe penalty.
• 11:31
  SPEAKER_00: It essentially means the federal government has a permanent seat in Marriott's boardroom for a generation.
• 11:36
  SPEAKER_00: Every major IT decision, every new architecture deployment has to be viewed through the lens of that FTC mandate.
• 11:43
  SPEAKER_01: That's a nightmare.
• 11:44
  SPEAKER_00: It is.
• 11:45
  SPEAKER_00: And when cybersecurity architects and legal teams analyzed this disaster, they extracted three core operating principles that now govern every subsequent private equity and corporate acquisition.
• 11:56
  SPEAKER_01: Okay, let's go through these.
• 11:57
  SPEAKER_01: Whether you're in tech, hospitality, healthcare.
• 12:00
  SPEAKER_01: These three principles dictate the reality of modern MA.
• 12:04
  SPEAKER_01: Principle number one changes the entire legal strategy, right?
• 12:07
  SPEAKER_00: Aaron Powell, it does.
• 12:08
  SPEAKER_00: Principle number one, target self-disclosure is insufficient.
• 12:10
  SPEAKER_01: Aaron Powell Okay.
• 12:11
  SPEAKER_01: So applying this to the standard MA playbook, what happens to the concept of reps and warranties?
• 12:16
  SPEAKER_00: Aaron Powell Well, the legal contracts can only protect the acquiring company up to the limit of the target's awareness.
• 12:22
  SPEAKER_00: Historically, acquirers relied heavily on those reps and warranties, meaning the target legally guarantees, in writing, that their network is secure, they have no known breaches, their IP is uncompromised.
• 12:34
  SPEAKER_00: Trevor Burrus, Jr.
• 12:35
  SPEAKER_01: And if that turns out to be false, the acquirer theoretically has legal recourse to claw back money or sue for damages.
• 12:42
  SPEAKER_00: Aaron Powell Theoretically, yes.
• 12:44
  SPEAKER_00: But pre-acquisition diligence based on self-disclosure is utterly useless if the target company is blind to their own vulnerabilities.
• 12:51
  SPEAKER_01: Right.
• 12:52
  SPEAKER_01: Because Starwood didn't know the Chinese state actors were in their reservation database back in 2014, they couldn't possibly disclose it to Marriott in 2016.
• 13:01
  SPEAKER_00: Aaron Powell Exactly.
• 13:02
  SPEAKER_00: You cannot disclose what you cannot see.
• 13:04
  SPEAKER_00: The legal mechanism of reps and warranties breaks down completely in cyberspace.
• 13:08
  SPEAKER_00: A breach is not like a broken roof, right?
• 13:10
  SPEAKER_00: You can't just visually inspect it during a walkthrough.
• 13:12
  SPEAKER_01: Yeah, there's no water leaking from the ceiling.
• 13:14
  SPEAKER_00: No.
• 13:14
  SPEAKER_00: So if the target's internal security tools are failing, their legal disclosures will be fundamentally flawed, no matter how honest their executives are trying to be.
• 13:23
  SPEAKER_01: That makes total sense.
• 13:24
  SPEAKER_01: So if self-disclosure is functionally meaningless, the burden has to move somewhere else.
• 13:30
  SPEAKER_01: Which brings us to principle number two.
• 13:32
  SPEAKER_00: Principle number two, detection responsibility shifts.
• 13:35
  SPEAKER_01: Shifts to the acquirer.
• 13:36
  SPEAKER_00: The moment the deal closes, the post-closing detection capability of the acquirer completely determines how long an inherited breach persists.
• 13:45
  SPEAKER_01: So Marriott owns it now.
• 13:46
  SPEAKER_00: Right.
• 13:47
  SPEAKER_00: Marriott could argue endlessly that Starwood let the hackers in back in 2014.
• 13:52
  SPEAKER_00: They could point fingers at Starwood's legacy IT team, their legacy firewalls, their legacy access policies.
• 13:58
  SPEAKER_01: But the FTC didn't care.
• 13:59
  SPEAKER_00: Nope.
• 14:00
  SPEAKER_00: Marriott's failure to detect those attackers for two years post-close was entirely their own liability.
• 14:06
  SPEAKER_00: Once you buy the network, it is your network.
• 14:08
  SPEAKER_01: Your house, your problem.
• 14:09
  SPEAKER_00: Exactly.
• 14:10
  SPEAKER_00: Your security tools, your SOC analysts, and your identity governance frameworks are now responsible for finding the threats.
• 14:16
  SPEAKER_01: Which flows perfectly into principle number three.
• 14:18
  SPEAKER_01: Liability inherits forward.
• 14:21
  SPEAKER_00: Yes.
• 14:21
  SPEAKER_00: The regulatory bodies do not care about the timeline of the initial intrusion.
• 14:26
  SPEAKER_00: Regulatory consent orders and liabilities transfer forward through change of control transactions, regardless of who originally caused the breach.
• 14:34
  SPEAKER_01: So even if the breach started a decade ago.
• 14:52
  SPEAKER_01: And Marriott operates under the FTC consent order until 2044.
• 14:56
  SPEAKER_01: Trevor Burrus, Jr.
• 14:56
  SPEAKER_00: Precisely.
• 14:57
  SPEAKER_00: Liability is attached to the data and the infrastructure, not the previous corporate owners.
• 15:02
  SPEAKER_01: Okay, so if Marriott proved that leaving the old network untouched is basically a ticking time bomb, the natural impulse for an acquiring company is to just rip the band-aid off.
• 15:11
  SPEAKER_00: That's usually the instinct.
• 15:12
  SPEAKER_01: You buy the company, you immediately force all their users into your secure directory on day one, and you just decommission their legacy environment before the ink dries.
• 15:20
  SPEAKER_01: But what actually happens when you force two massive historically independent directories into a single pipeline like that?
• 15:28
  SPEAKER_00: The architecture buckles under the strain.
• 15:31
  SPEAKER_00: It just breaks.
• 15:32
  SPEAKER_00: Integrating identities is arguably the most complex phase of MA.
• 15:37
  SPEAKER_01: Why is it so hard to just combine them?
• 15:40
  SPEAKER_00: From a mechanical standpoint, you are attempting to reconcile disparate IAM frameworks, entirely conflicting security policies, and deep data silos.
• 15:50
  SPEAKER_00: You can't simply plug the two networks together.
• 15:52
  SPEAKER_01: Let's talk about the integration timeline then, because you know the board always wants it done in 30 days.
• 15:57
  SPEAKER_01: The CEO already promised Wall Street that synergies would be realized in Q1.
• 16:01
  SPEAKER_00: They always do.
• 16:02
  SPEAKER_01: How does an architect actually pace this integration without breaking the business?
• 16:05
  SPEAKER_00: Well, the integration timeline requires extensive early assessment before a single user object is migrated.
• 16:11
  SPEAKER_00: The architect has to identify overlapping access rights across two massive disparate user populations.
• 16:17
  SPEAKER_01: Which takes time.
• 16:18
  SPEAKER_00: It takes a lot of time.
• 16:19
  SPEAKER_00: They must develop a unified access policy to ensure business continuity.
• 16:24
  SPEAKER_00: Because if you move too fast and blindly merge the directories, you break core applications.
• 16:29
  SPEAKER_01: Like what?
• 16:29
  SPEAKER_01: What happens?
• 16:30
  SPEAKER_00: A legacy user suddenly loses access to their HR portal or their financial reporting tools and the business halts.
• 16:38
  SPEAKER_00: But on the flip side, if you move too slow, you maintain duplicate systems, which doubles your licensing costs and massively increases your attack surface.
• 16:46
  SPEAKER_01: Aaron Powell So you're stuck between a rock and a hard place.
• 16:49
  SPEAKER_01: To manage this phase transition without breaking the legacy environment immediately, administrators rely on specific bridging mechanisms, don't they?
• 16:57
  SPEAKER_00: Aaron Powell Yeah, they do.
• 16:58
  SPEAKER_00: Administrators will often use group SOA or source of authority switching.
• 17:02
  SPEAKER_00: Right.
• 17:02
  SPEAKER_00: This allows them to transfer Active Directory group management authority up to entra ID.
• 17:08
  SPEAKER_00: So by shifting the source of authority to the cloud, the acquiring organization can manage the life cycle of the target's groups from a centralized control plane.
• 17:15
  SPEAKER_01: Aaron Powell So it bridges the gap for a phased migration.
• 17:18
  SPEAKER_00: Aaron Powell Exactly.
• 17:19
  SPEAKER_00: They do not have to immediately collapse the legacy on-premises infrastructure of the acquired company, which gives them breathing room to untangle the mess.
• 17:27
  SPEAKER_01: Aaron Powell Okay, so that handles the location of the authority.
• 17:30
  SPEAKER_01: But it doesn't solve the logical conflicts of the data itself.
• 17:33
  SPEAKER_01: When you're syncing two massive databases, you inevitably run into collisions, right?
• 17:38
  SPEAKER_00: Aaron Powell Oh, constant collisions.
• 17:39
  SPEAKER_01: Aaron Powell How does the architecture handle something like timestamp resolution?
• 17:43
  SPEAKER_01: Like if both the legacy system and the new system update a user's attribute at the exact same time, how does the sync engine avoid an infinite loop of overriding?
• 17:52
  SPEAKER_00: Well, the synchronization engine relies on highly specific metadata rules.
• 17:57
  SPEAKER_00: When two directories collide and a user object is updated in both places, the architecture uses last write wins logic.
• 18:04
  SPEAKER_01: Last write wins.
• 18:05
  SPEAKER_00: Yeah.
• 18:05
  SPEAKER_00: The synchronization engine compares the timestamp of the modification on the on-premises object with the timestamp in the cloud metaverse.
• 18:12
  SPEAKER_00: Whichever system recorded the most recent write operation becomes the ultimate source of truth.
• 18:16
  SPEAKER_01: And then that value gets replicated across the boundary.
• 18:19
  SPEAKER_00: Exactly.
• 18:19
  SPEAKER_00: But honestly, timestamp resolution is the easy part.
• 18:22
  SPEAKER_01: Really?
• 18:23
  SPEAKER_01: What's the hard part?
• 18:24
  SPEAKER_00: The true nightmare is application-specific merge logic for group memberships.
• 18:29
  SPEAKER_01: Okay.
• 18:30
  SPEAKER_01: This is where we need to dive into a concrete edge case.
• 18:33
  SPEAKER_01: Let's look at a naming conflict, because I feel like this is where the theory of MA integration hits the brutal reality of human behavior.
• 18:40
  SPEAKER_00: Oh, absolutely.
• 18:41
  SPEAKER_01: Imagine both the acquiring company, let's call them company A and the target company, Company B, they both have an active directory group called Finance Admins.
• 18:51
  SPEAKER_00: A very common name.
• 18:52
  SPEAKER_01: Right.
• 18:52
  SPEAKER_01: In Company A, the acquirer, Finance Admins, is just a low-privileged group.
• 18:57
  SPEAKER_01: It grants 50 junior accountants read-only access to a set of quarterly reporting dashboards.
• 19:03
  SPEAKER_01: It is entirely benign.
• 19:04
  SPEAKER_01: Okay.
• 19:04
  SPEAKER_01: But in company B, the target company, their finance admins group is highly privileged.
• 19:09
  SPEAKER_01: It's restricted to three senior executives, and it grants full global administrator rights to the corporate billing infrastructure and the outbound wire transfer systems.
• 19:18
  SPEAKER_00: A massive difference in scope.
• 19:20
  SPEAKER_01: Huge.
• 19:20
  SPEAKER_01: So you are the lead architect in charge of this merger.
• 19:24
  SPEAKER_01: The synchronization engine sees two groups with the exact same string name, finance admins.
• 19:30
  SPEAKER_01: How do you actually resolve this?
• 19:32
  SPEAKER_00: Well, the most critical action the architect takes right off the bat is preventing the automated sync engine from doing its job.
• 19:37
  SPEAKER_01: Wait, you turn off the sync.
• 19:39
  SPEAKER_00: You have to.
• 19:40
  SPEAKER_00: If you allow an automated synchronization tool to blindly map groups based solely on string matching, the junior accountants from Company A will suddenly inherit the legacy privileges of Company B.
• 19:52
  SPEAKER_01: Oh wow.
• 19:52
  SPEAKER_01: So you'd have 50 entry-level employees who suddenly possess global admin rights to Company B's wire transfer systems.
• 19:59
  SPEAKER_00: Exactly.
• 20:00
  SPEAKER_00: The blast radius of that mistake is catastrophic.
• 20:03
  SPEAKER_00: It is an immediate compliance violation, a massive insider threat, and honestly, a potential financial disaster.
• 20:09
  SPEAKER_01: But the board says we need this integration finished in 30 days, turn on the sink.
• 20:13
  SPEAKER_01: You are telling me I have to manually audit hundreds, maybe thousands of these legacy groups.
• 20:19
  SPEAKER_01: Nobody has the time or the budget for that level of meticulous mapping during a fast-paced MA sprint.
• 20:25
  SPEAKER_01: What happens if they just push it through and try to clean it up later?
• 20:28
  SPEAKER_00: If you push it through, the environment falls into a state of inherited diagnostic muddy waters that literally cannot be untangled.
• 20:37
  SPEAKER_00: You lose the lineage of why someone has access.
• 20:39
  SPEAKER_01: Because it's all blended together.
• 20:41
  SPEAKER_00: Exactly.
• 20:42
  SPEAKER_00: The architectural resolution to a naming conflict like finance admins requires precision engineering, regardless of the board's timeline.
• 20:50
  SPEAKER_00: So first, the architect must immediately halt any automated synchronization that relies on simple string matching.
• 20:56
  SPEAKER_01: Okay, so you stop the sync.
• 20:57
  SPEAKER_00: The sync rules must be rewritten to exclude high-risk organizational units from the target environment.
• 21:03
  SPEAKER_01: So you basically put up a firewall between the two directories.
• 21:06
  SPEAKER_01: What is the actual mechanical step to untangle the names once you've stopped it?
• 21:11
  SPEAKER_00: The architect must physically separate the objects in the directory so they do not collide in the metaverse.
• 21:16
  SPEAKER_00: Mechanically, they will scope the legacy groups to specific isolated boundaries.
• 21:21
  SPEAKER_01: How do they do that?
• 21:22
  SPEAKER_00: They'll execute a mass renaming operation via PowerShell, prefixing the incoming groups at the directory level.
• 21:30
  SPEAKER_00: So Company B's group is renamed to Target Finance Admins Legacy.
• 21:34
  SPEAKER_01: Oh, I see.
• 21:35
  SPEAKER_01: So the synchronization engine now sees two distinct objects Finance Admins and Target Finance Admins Legacy.
• 21:43
  SPEAKER_01: The collision is totally averted.
• 21:45
  SPEAKER_01: Exactly.
• 21:45
  SPEAKER_01: Okay, you averted the collision.
• 21:46
  SPEAKER_01: But the target company's CFO is probably furious because his wire transfer system is locked down and the integration is stalling.
• 21:55
  SPEAKER_01: Prefixing the name doesn't actually integrate the companies, it just builds two separate houses.
• 22:00
  SPEAKER_01: On the same lot, right?
• 22:01
  SPEAKER_00: Right.
• 22:01
  SPEAKER_00: It's just a temporary containment.
• 22:02
  SPEAKER_01: So how do you map them together securely?
• 22:05
  SPEAKER_00: The resolution involves fundamentally redefining the entitlement structures.
• 22:09
  SPEAKER_00: You never merge legacy privileges, you map legacy users to new, tightly governed privileges.
• 22:14
  SPEAKER_01: Aaron Powell Okay, walk me through that.
• 22:15
  SPEAKER_00: The architect creates a brand new, unified, role-based access control model in the parent tenant.
• 22:21
  SPEAKER_00: They create a new group, say enterprise financial controllers.
• 22:25
  SPEAKER_01: A completely fresh group.
• 22:26
  SPEAKER_00: Yes.
• 22:27
  SPEAKER_00: Built from scratch with strict conditional access policies, requiring MFA, requiring a compliant device, and logging every single action.
• 22:36
  SPEAKER_01: So you have this secure, empty vessel waiting in the new environment.
• 22:40
  SPEAKER_00: Exactly.
• 22:41
  SPEAKER_00: Then comes the highly scrutinized mapping process.
• 22:44
  SPEAKER_00: The architect audits the membership of the Legacy Target Finance Admins Legacy Group.
• 22:49
  SPEAKER_00: They strip out any service accounts, any inactive users, and any accounts that shouldn't have global wire transfer rights.
• 22:55
  SPEAKER_01: They clean house.
• 22:56
  SPEAKER_00: They do.
• 22:57
  SPEAKER_00: Only the strictly validated users, the three senior executives from Company B, are mapped into the new Enterprise Financial Controllers Group.
• 23:05
  SPEAKER_00: Only then is full synchronization to the cloud applications permitted.
• 23:09
  SPEAKER_01: That's incredibly strict.
• 23:10
  SPEAKER_00: It forces the business to justify the access rather than just grandfathering in a decade of technical debt.
• 23:15
  SPEAKER_01: Man, I can hear the political friction from here.
• 23:18
  SPEAKER_01: The acquired company's executives are being told their access is revoked until they can justify it to the new parent company's IT team.
• 23:24
  SPEAKER_00: It's politically painful but architecturally necessary.
• 23:28
  SPEAKER_01: But as painful as that mapping process is, it implies that you actually know what groups and what tenants you are dealing with.
• 23:35
  SPEAKER_01: Right.
• 23:35
  SPEAKER_01: Merging the groups you know about is hard enough.
• 23:37
  SPEAKER_01: But what happens when the target company's IT team hands you a map of their network and you discover the map is missing half the territory?
• 23:44
  SPEAKER_00: Aaron Powell You are entering the blind spot of MA integration.
• 23:48
  SPEAKER_00: Everything we just discussed relies on centralized visibility.
• 23:52
  SPEAKER_00: If you can see the group, you can prefix it, you can map it, and you can secure it.
• 23:56
  SPEAKER_00: But the modern digital footprint of an acquired company extends far beyond what their central IT team actually controls.
• 24:03
  SPEAKER_01: Aaron Powell Which introduces our fourth major topic: shadow IT tenant risk.
• 24:08
  SPEAKER_01: We always think of shadow IT as like an employee using a personal Dropbox account to share a large PDF.
• 24:15
  SPEAKER_01: Annoying but relatively contained.
• 24:16
  SPEAKER_00: Aaron Powell That's the old definition.
• 24:18
  SPEAKER_01: Aaron Powell Right.
• 24:18
  SPEAKER_01: But in the context of an acquisition, shadow IT takes on an entirely different scale.
• 24:23
  SPEAKER_01: We aren't talking about rogue apps.
• 24:24
  SPEAKER_01: We're talking about rogue infrastructure.
• 24:26
  SPEAKER_00: Aaron Powell Exactly.
• 24:27
  SPEAKER_00: We are talking about unmanaged cloud instances, entire ultra-ID tenants, AWS organizations or Google Cloud environments that were spun up by a specific department completely outside the purview of the central IT department.
• 24:43
  SPEAKER_01: Aaron Powell Give me an example of how that even happens.
• 24:45
  SPEAKER_00: Aaron Powell Sure.
• 24:46
  SPEAKER_00: Let's say the marketing team needed a new SaaS platform to run a global campaign.
• 24:50
  SPEAKER_00: And IT told them the security review would take six months.
• 24:53
  SPEAKER_01: And marketing doesn't want to wait six months.
• 24:55
  SPEAKER_00: Never.
• 24:56
  SPEAKER_00: So the VP of marketing just swiped a corporate credit card, spun up a new tenant, and provisioned access for their entire team themselves.
• 25:03
  SPEAKER_01: They completely bypassed the bureaucracy to get the work done.
• 25:06
  SPEAKER_01: The intent was business velocity, but the result is a massive security vacuum.
• 25:11
  SPEAKER_00: A massive vacuum.
• 25:12
  SPEAKER_00: The danger of the unmanaged tenant is extreme because it bypasses the organization's centralized security controls by default.
• 25:19
  SPEAKER_01: Because central IT doesn't even know it's there.
• 25:22
  SPEAKER_00: Right.
• 25:22
  SPEAKER_00: The central IT team cannot enforce policies on an environment they do not know exists.
• 25:29
  SPEAKER_00: These shadow tenants specifically bypass multifactor authentication requirements.
• 25:34
  SPEAKER_00: They bypass conditional access policies that would normally restrict access from unmanaged devices or risky IP addresses.
• 25:42
  SPEAKER_01: And logging.
• 25:43
  SPEAKER_00: Completely lack centralized audit logging.
• 25:45
  SPEAKER_00: If something happens in there, IT has no record of it.
• 25:48
  SPEAKER_01: Okay, so if the marketing team's shadow tenant is unmanaged, it's essentially a dark room attached to the side of the house.
• 25:55
  SPEAKER_01: But if I am the enterprise architect for the acquiring company, my primary concern is the main corporate network.
• 26:01
  SPEAKER_00: Of course.
• 26:02
  SPEAKER_01: So if this shadow tenant was spun up outside of central IT, isn't it disconnected?
• 26:06
  SPEAKER_01: And if it's disconnected, isn't the blast radius contained purely to whatever marketing data they uploaded there?
• 26:11
  SPEAKER_00: Assuming a shadow tenant is completely isolated is the fatal assumption that leads to lateral movement breaches.
• 26:16
  SPEAKER_01: It's not isolated.
• 26:17
  SPEAKER_00: Rarely.
• 26:18
  SPEAKER_00: The mechanics of the threat rely on the fact that shadow tenants are almost never entirely isolated from the mothership.
• 26:23
  SPEAKER_00: Employees still need to share data.
• 26:26
  SPEAKER_01: Ah.
• 26:26
  SPEAKER_00: If a shadow tenant is compromised by an attacker, which is trivial, by the way, because there is no MFA enforced.
• 26:33
  SPEAKER_01: Right, they just brute force a password.
• 26:35
  SPEAKER_00: Exactly.
• 26:36
  SPEAKER_00: If that shadow tenant is compromised and it is connected to the primary enterprise environment through B2B collaboration activity, it becomes a direct lateral movement backdoor into the main network.
• 26:48
  SPEAKER_01: Okay, let's trace the exact packet flow of that lateral movement.
• 26:52
  SPEAKER_01: How does an attacker leverage a compromised marketing tenant to pivot into the highly secure primary corporate network?
• 27:00
  SPEAKER_00: The pivot relies on the trust relationships that were established for convenience.
• 27:04
  SPEAKER_00: Let's say the marketing team, working in their shadow tenant, needs to pull quarterly revenue figures from the main corporate SharePoint drive.
• 27:12
  SPEAKER_00: To facilitate this, a central IT administrator provisions a guest account in the main corporate tenant for the marketing director's shadow identity.
• 27:20
  SPEAKER_01: So they set up a B2B trust relationship.
• 27:23
  SPEAKER_00: Yes.
• 27:23
  SPEAKER_01: The main network now inherently trusts the authentication token provided by the shadow tenant.
• 27:28
  SPEAKER_00: Exactly.
• 27:29
  SPEAKER_00: So the attacker targets the shadow marketing tenant first.
• 27:33
  SPEAKER_00: Because there is no MFA, they brute force the marketing director's password or steal a session cookie.
• 27:40
  SPEAKER_00: The attacker is now fully authenticated inside the shadow tenant.
• 27:44
  SPEAKER_00: Okay.
• 27:45
  SPEAKER_00: The attacker then requests access to the main corporate SharePoint drive.
• 27:49
  SPEAKER_00: The shadow tenant issues an authentication token claiming this is the marketing director they have authenticated successfully.
• 27:55
  SPEAKER_01: And the main corporate network, respecting that B2B trust relationship, just accepts the token.
• 28:01
  SPEAKER_00: It accepts it without question.
• 28:03
  SPEAKER_01: Oh my God.
• 28:03
  SPEAKER_01: The attacker just walks seamlessly into the main corporate network, completely bypassing the primary perimeter defenses, all because the main network trusted a token from an unmanaged, highly insecure environment.
• 28:15
  SPEAKER_00: Yep.
• 28:16
  SPEAKER_00: The attacker inherits the access rights of the guest account without ever having to attack the main network's hardened perimeter.
• 28:22
  SPEAKER_01: Aaron Powell That's wild.
• 28:23
  SPEAKER_01: Are there other ways they pivot?
• 28:25
  SPEAKER_00: Yes.
• 28:25
  SPEAKER_00: Alternatively, the pivot can happen at the billing layer.
• 28:27
  SPEAKER_01: The billing layer.
• 28:28
  SPEAKER_00: If the shadow tenant shares billing infrastructure with the primary tenant, for example, if the marketing team link their Rogue Azure subscription to the main corporate Azure Enterprise Agreement to simplify the accounting.
• 28:41
  SPEAKER_01: Because finance wanted everything on one bill.
• 28:43
  SPEAKER_00: Right.
• 28:43
  SPEAKER_00: Well, an attacker who gains administrative rights in the shadow tenant might be able to pivot through that billing plane.
• 28:50
  SPEAKER_00: They can use the shared enterprise agreement to view, manipulate, or even delete resources in connected subscriptions that actually belong to the primary network.
• 29:01
  SPEAKER_01: So the attacker compromises the billing portal and suddenly has visibility into the entire corporate cloud architecture.
• 29:07
  SPEAKER_00: Exactly.
• 29:08
  SPEAKER_01: This is a terrifying vector, but it begs the ultimate operational question, which is really our edge case masterclass for this section.
• 29:15
  SPEAKER_01: You cannot secure what you cannot see.
• 29:17
  SPEAKER_00: Very true.
• 29:18
  SPEAKER_01: If the acquired company's IT team doesn't know the marketing tenant exists, how does the acquiring security team actually discover a shadow tenant during an integration sprint?
• 29:27
  SPEAKER_00: Forensic discovery of shadow infrastructure requires the architect to think like a threat hunter.
• 29:33
  SPEAKER_00: You cannot rely on the legacy IT team's documentation.
• 29:37
  SPEAKER_00: It's guaranteed to be incomplete.
• 29:39
  SPEAKER_01: So what do they look at?
• 29:40
  SPEAKER_00: Administrators must attack the problem from multiple angles, analyzing data streams that the shadow users cannot hide.
• 29:47
  SPEAKER_00: First, they can leverage recent enter-ID tenant governance updates.
• 29:51
  SPEAKER_01: Okay.
• 29:52
  SPEAKER_00: Microsoft has released capabilities that allow administrators to discover reloaded tenants that are connected to their own environment via shared B2B activity or shared billing information.
• 30:02
  SPEAKER_01: So you can query the API and essentially ask the primary tenant, who have you been talking to that isn't on my approved list?
• 30:09
  SPEAKER_00: Precisely.
• 30:10
  SPEAKER_00: By querying the cross tenant access settings and the B2B collaboration logs, the security team can instantly generate a map of all undocumented tenants interacting with the primary directory.
• 30:20
  SPEAKER_01: And that highlights the risks right there.
• 30:21
  SPEAKER_00: Aaron Powell It highlights every guest account, every outbound trust, and every shared application.
• 30:26
  SPEAKER_00: This illuminates the immediate lateral movement risks.
• 30:28
  SPEAKER_01: Aaron Powell That's great, but that only covers the shadow tenants that have actively touched your network.
• 30:33
  SPEAKER_01: What about the ones that are totally isolated?
• 30:36
  SPEAKER_01: Oh.
• 30:37
  SPEAKER_01: Like the RD team spins up an AWS environment for a top secret project.
• 30:42
  SPEAKER_01: They never connect it to the main network via B2B.
• 30:45
  SPEAKER_01: They never share a billing plane, but they are storing highly sensitive intellectual property in an environment with no MFA.
• 30:53
  SPEAKER_01: How do you find a shadow tenant that leaves literally no footprint in your directory?
• 30:58
  SPEAKER_00: You follow the money.
• 30:59
  SPEAKER_01: Follow the money.
• 30:59
  SPEAKER_00: Security peans must aggregate expense and procurement data from the acquired company's finance department.
• 31:05
  SPEAKER_00: The Threat Hunters cross-reference the IT department's official ledger of approved software with the raw general ledger from finance.
• 31:13
  SPEAKER_01: Oh, I see.
• 31:13
  SPEAKER_01: They are specifically looking for corporate credit cards paying for rogue cloud services.
• 31:18
  SPEAKER_00: Exactly.
• 31:19
  SPEAKER_00: You are looking for the VP of marketing's$500 monthly expense for cloud hosting that has never been vetted by security.
• 31:27
  SPEAKER_01: The finance department always knows where the money is going, even if IT doesn't know what the money is actually buying.
• 31:32
  SPEAKER_00: Exactly.
• 31:33
  SPEAKER_00: When you find undocumented AWS bills, Azure subscriptions, or SAS application licenses on expense reports, you have found your isolated shadow tenants.
• 31:43
  SPEAKER_01: That's brilliant.
• 31:44
  SPEAKER_01: So you have directory logs and you have expense reports.
• 31:47
  SPEAKER_01: But what happens when the RD team uses a free tier of a Sauce application?
• 31:51
  SPEAKER_00: Aaron Powell The Free Tier problem.
• 31:53
  SPEAKER_01: Yeah.
• 31:53
  SPEAKER_01: There's no billing footprint and there's no B2B connection.
• 31:56
  SPEAKER_01: They just sign up with their corporate emails.
• 31:58
  SPEAKER_00: Aaron Powell That is where network telemetry becomes the final layer of discovery.
• 32:02
  SPEAKER_00: Security teams must analyze the target company's network traffic from the ground up.
• 32:07
  SPEAKER_00: Specifically, they use TLS fingerprinting, DNS query logs, and secure web gateways to spot high volume connections to unseen endpoints.
• 32:16
  SPEAKER_01: Let's break down the mechanics of that telemetry.
• 32:18
  SPEAKER_01: How does a DNS log expose a shadow tenant?
• 32:21
  SPEAKER_00: A DNS log records every time an employee's machine asks to resolve a domain name into an IP address.
• 32:27
  SPEAKER_00: Right.
• 32:27
  SPEAKER_00: If the security analyst aggregates the DNS logs for the entire required company and filters out all known approved corporate traffic, they are left with anomalies.
• 32:36
  SPEAKER_00: So if you analyze the logs and see that 50 employees in the RD department are simultaneously resolving login queries to a specific, undocumented SAS application domain every morning at 9.0 a.m.
• 32:49
  SPEAKER_01: You have just discovered a massive shadow deployment.
• 32:52
  SPEAKER_00: A traffic pattern itself is the footprint.
• 32:55
  SPEAKER_01: Wow.
• 32:55
  SPEAKER_01: And what about TLS fingerprinting?
• 32:57
  SPEAKER_01: How does that work?
• 32:58
  SPEAKER_00: During the initial TLS handshake, before the encrypted tunnel is fully established, the client sends a server name indication or SNI header in plaintext.
• 33:07
  SPEAKER_01: In plaintext?
• 33:07
  SPEAKER_00: Yes.
• 33:08
  SPEAKER_00: This tells the server which website the client is trying to reach.
• 33:11
  SPEAKER_00: By inspecting the SI headers at the secure web gateway, the architect can see exactly which cloud services the legacy employees are authenticating against.
• 33:21
  SPEAKER_01: Regardless of whether the subsequent data payload is encrypted.
• 33:24
  SPEAKER_00: Exactly.
• 33:24
  SPEAKER_00: So by triangulating BDB graph data, expense reports, and DNS telemetry, an architect can illuminate the shadow IT landscape and lock it down before it becomes a backdoor.
• 33:34
  SPEAKER_01: Okay.
• 33:34
  SPEAKER_01: So we have meticulously mapped the overlapping groups.
• 33:37
  SPEAKER_01: We have halted the automated sync to avoid the finance admins naming collision.
• 33:41
  SPEAKER_01: We have mapped the legacy users into a unified RBAC model, and we have forensically hunted down the shadow tenants using expense reports and TLS fingerprinting.
• 33:52
  SPEAKER_01: The entire landscape is mapped secure and visible.
• 33:55
  SPEAKER_00: Sounds like you're ready.
• 33:56
  SPEAKER_01: Right.
• 33:57
  SPEAKER_01: The logical conclusion is that we are finally safe to actually flip the switch and move the massive volumes of data from the target network to the acquiring network.
• 34:06
  SPEAKER_00: The assumption that the preparation phase guarantees a secure execution is one of the most dangerous fallacies in enterprise architecture.
• 34:14
  SPEAKER_01: Wait, really?
• 34:15
  SPEAKER_01: After all that?
• 34:15
  SPEAKER_00: After all that, the migration phase itself is often the deadliest trap in the entire MA lifecycle.
• 34:21
  SPEAKER_01: Why?
• 34:22
  SPEAKER_00: The sheer mechanical force required to move petabytes of data breaks the very security controls you just spent months designing.
• 34:29
  SPEAKER_01: Which brings us to our final topic and our second major case study, which illustrates exactly how the migration bridge itself becomes the vulnerability.
• 34:37
  SPEAKER_01: Let's lay out the background for the Oracle Cerner case study.
• 34:40
  SPEAKER_00: Yes, let's look at that.
• 34:41
  SPEAKER_01: Oracle formed Oracle Health through its massive$28 billion acquisition of Cerner, the healthcare information technology giant.
• 34:50
  SPEAKER_01: This was a colossal merger, integrating an incredibly complex, highly regulated repository of sensitive patient health data.
• 34:59
  SPEAKER_00: The stakes could not be higher when you're dealing with global healthcare infrastructure.
• 35:03
  SPEAKER_00: Trevor Burrus, Jr.
• 35:03
  SPEAKER_01: Absolutely.
• 35:04
  SPEAKER_01: And in early 2025, Oracle Health had to formally disclose a data breach.
• 35:10
  SPEAKER_01: But the specific location of the breach is where the architectural reality of MA rears its head.
• 35:16
  SPEAKER_00: Right.
• 35:16
  SPEAKER_00: It wasn't where you'd expect.
• 35:17
  SPEAKER_01: The attackers did not breach Oracle's main production systems, which are heavily fortified, monitored continuously, built on zero trust principles, and they did not breach Cerner's main pre-acquisition systems, which had their own established defensive perimeter.
• 35:31
  SPEAKER_00: So where did they go?
• 35:31
  SPEAKER_01: The attackers found the scene between the two fortresses.
• 35:34
  SPEAKER_01: The breach occurred on the legacy Cerner data migration servers.
• 35:38
  SPEAKER_00: The migration server.
• 35:39
  SPEAKER_01: Yeah.
• 35:39
  SPEAKER_01: These were temporary servers stood up specifically to facilitate the integration of Cerner's data into Oracle's infrastructure, and their compromise exposed the patient health data from dozens of U.S.
• 35:50
  SPEAKER_01: hospital systems.
• 35:55
  SPEAKER_00: Well, it's frequently overlooked by integration teams.
• 35:59
  SPEAKER_01: What's the lesson?
• 35:59
  SPEAKER_00: The legacy data migration servers, used strictly for the integration process, had a significantly weaker security posture than either organization's main production environment.
• 36:10
  SPEAKER_01: Let's drill into the mechanics of this specific underappreciated MA risk.
• 36:15
  SPEAKER_01: Why are the migration servers so vulnerable?
• 36:17
  SPEAKER_01: If you are moving the most sensitive data in the world patient health records, why wouldn't the migration servers have the highest level of security available?
• 36:25
  SPEAKER_00: Because the primary mandate during the migration phase is speed and business continuity, not security.
• 36:30
  SPEAKER_01: Speed over security.
• 36:31
  SPEAKER_00: Always.
• 36:32
  SPEAKER_00: When IT teams are tasked with moving petabytes of data, reconciling millions of database rows, and ensuring the hospital systems do not experience downtime, strict security controls are viewed as friction.
• 36:43
  SPEAKER_01: So what do they do?
• 36:44
  SPEAKER_00: To make the massive data transfer work seamlessly across two fundamentally different network architectures, architects will often temporarily disable strict security controls.
• 36:56
  SPEAKER_01: They open the floodgates to get the data through before like the weekend maintenance window closes.
• 37:00
  SPEAKER_00: Exactly.
• 37:01
  SPEAKER_00: The temporary infrastructure stood up to facilitate a merger is frequently under-secured by design.
• 37:07
  SPEAKER_00: It often lacks robust multi-factor authentication because service accounts are running automated scripts that cannot easily handle interactive MFA prompts.
• 37:17
  SPEAKER_01: Oh, because a script can't click approve on an authenticator app.
• 37:21
  SPEAKER_00: Right.
• 37:22
  SPEAKER_00: And it lacks continuous audit logging because the sheer volume of data being moved would instantly overwhelm the CM platform, creating millions of false positive alerts.
• 37:31
  SPEAKER_01: The alarms would just be ringing nonstop.
• 37:33
  SPEAKER_00: And it bypasses strict conditional access policies to ensure the data pipelines do not time out during massive batch transfers.
• 37:40
  SPEAKER_01: So in the rush to build the bridge between the two castles and to move the treasure across as fast as possible, they intentionally remove the guards on the bridge itself.
• 37:48
  SPEAKER_00: They do.
• 37:48
  SPEAKER_01: The assumption is it's only temporary.
• 37:50
  SPEAKER_01: We will shut the servers down on Monday morning once the sink is complete.
• 37:54
  SPEAKER_00: But attackers understand the psychology and the technical limitations of an MA integration perfectly.
• 38:00
  SPEAKER_00: The migration servers become an incredibly soft target.
• 38:04
  SPEAKER_00: Furthermore, the migration phase provides the perfect smoke screen.
• 38:08
  SPEAKER_01: A smokescreen?
• 38:10
  SPEAKER_01: How?
• 38:10
  SPEAKER_00: During an MA event, there are massive, legitimate data flows happening between the two companies.
• 38:16
  SPEAKER_00: Terabytes of data are moving across the wire in highly irregular patterns as teams test backups and replicate databases.
• 38:24
  SPEAKER_01: Oh, so it's just chaotic.
• 38:26
  SPEAKER_00: Exactly.
• 38:27
  SPEAKER_00: If an attacker is exfiltrating data from a migration server, their malicious traffic is completely camouflaged by the legitimate chaos of the integration.
• 38:35
  SPEAKER_01: The SOC analysts are ignoring the alerts because they were told expect massive data anomalies this weekend.
• 38:40
  SPEAKER_01: We are migrating the Cerner databases.
• 38:42
  SPEAKER_01: The anomaly literally becomes the baseline.
• 38:44
  SPEAKER_00: Exactly.
• 38:45
  SPEAKER_00: They target the temporary migration infrastructure precisely because it lacks visibility and enforcement, and because the defenders are overwhelmed by the noise of the merger.
• 38:54
  SPEAKER_01: That's incredibly smart on their part.
• 38:55
  SPEAKER_00: It illustrates perfectly that the migration phase itself is often the most vulnerable point in the entire MA lifecycle.
• 39:03
  SPEAKER_00: The very act of combining two highly secure, well-defended entities creates a temporary, highly insecure bridge that attackers actively hunt for.
• 39:12
  SPEAKER_01: So you don't have to attack the fortresses.
• 39:14
  SPEAKER_00: They do not need to break into Oracle, and they do not need to break into Cerner.
• 39:18
  SPEAKER_00: They just need to wait for the migration servers to spin up, bypass the disabled conditional access policies, and harvest the data as it flows across the unsecured bridge.
• 39:26
  SPEAKER_01: This deep dive covered the identity governance challenges of MA, specifically focusing on group and application access migration, the lateral movement risks of shadow IT tenants, the broader MA identity risk landscape, and the distinct architectural lessons from the Marriott Starwood and Oracle Cerner data breaches.
• 39:44
  SPEAKER_00: That's a wrap on every MA deal carries inherited risk.
• 39:48
  SPEAKER_00: Here's how Microsoft Entras secures it.
• 39:51
  SPEAKER_00: We closed on the sharpest lesson.
• 39:53
  SPEAKER_00: The migration servers, not either company's hardened perimeter, are usually where the breach happens.
• 39:59
  SPEAKER_00: Because speed always beats security when the board wants synergies by the first quarter.
• 40:05
  SPEAKER_00: Next episode, we run this same day one gauntlet through Okta and Ping, day one of the MA, and how they solve day one access differently.
• 40:15
  SPEAKER_00: Find the show notes and connect with Ernie on LinkedIn, link in the description.
• 40:19
  SPEAKER_00: Subscribe if you're staring down an integration of your own.
• 40:22
  SPEAKER_00: Until next time.