Office of Enterprise Productivity & Security, South Central Region https://docs.microsoft.com/archive/blogs/scdsec/feed.xml Insights from the frontlines of real-world digital transformation Tue, 16 Apr 2019 06:16:19 GMT en-US hourly 1 Microsoft 365: Specifications for the Modern Enterprise https://docs.microsoft.com/archive/blogs/scdsec/secure-productive-enterprise-specifications-for-the-modern-enterprise Thu, 30 Nov 2017 10:43:26 GMT https://blogs.technet.microsoft.com/scdsec/?p=355 Introduction: Earlier this year, Microsoft introduced a new solution set: Microsoft 365 (or M365 for short). A combination of Windows 10, Office 365, and the Enterprise Mobility + Security platform, M365 represents a clear, simplified path for an enterprise to evaluate, purchase and deploy their foundational digital infrastructure. At face value, one might think that M365 is simply an "easy to use" bundle or a licensing vehicle. In fact, simplified licensing is part of the story, but it is not the story. Microsoft 365 represents much more. M365 is Microsoft’s prescriptive set of specifications and technologies for running any modern enterprise in a “cloud first, mobile first” world.

Specifications for Running a Modern Enterprise:

If you remember the days of packaged PC software, you might remember picking up a copy of Photoshop, Office, or a game like Halo. After perusing the back of the package, you may have glanced to the side of the box where you would have found two sets of specifications: Minimum System Requirements and Recommended System Requirements. Each of these spec sets included the OS versions, memory configurations, processor speeds and GPU types that would be needed to either 1) get the software to run or 2) get the software to run with the raw power needed to achieve maximum performance. The tradition of publishing system requirements for consumer and enterprise software is very much alive and well today per this recent listing for Halo 5: Forge: Those system requirements are an effective analogy to what Microsoft 365 really is. With 2 configurations -- M365 E3 and M365 E5 -- this represents Microsoft’s “must do” (i.e. minimum) and “should do” (i.e. “recommended”) specifications for running and securing a modern workplace. Microsoft 365 was designed from the ground-up to enable uncompromising productivity, collaboration, mobility, business insights and a secure experience, giving your company the foundation to compete, excel, and grow. Let’s take a look at the two sets of M365 specifications side-by-side:
Minimum and recommended specifications across 3 foundational enterprise platforms: Office 365, Enterprise Mobility + Security and Windows 10
A common question here is: why is there both a “minimum” and “recommended” set of specs? It’s a great question, with a relatively simple answer. Given that every customer and company is at a different point in their unique digital transformation journey, the two spec sets give companies choices. One size does not fit all. Some customers require a level of flexibility in answering critical questions such as:
  • What can we prioritize given our current budget?
  • What is the timing around our other vendor/system investments?
  • Have we invested in the right skillsets internally to maximize the solutions?
A fitting example of this flexibility within the M365 framework is around the security components of the solution – let’s pick on data protection for just a moment. In a mobile first, cloud first world, without exception security should be the #1 concern of the executive, LOB, IT and Infosec teams of a modern enterprise. However, there is a difference in the level-of-effort required for those teams between these two related data protection scenarios:
  1. Identify sensitive data stores (e.g. finance or HR file shares) and then apply encryption policies to the data coming onto or off of the share
  2. Implement an enterprise wide auto-classification system that labels and encrypts all sensitive data at the-point-of-creation without IT or employee interaction.
Scenario #1 requires a simple agreement that the finance and HR users do indeed create and access sensitive information and require the application of a blanket encryption policy for data. Scenario #2 requires extensive consideration regarding enterprise wide classification labels and the numerous, specific policies that must be built out to cover a number of unique situations ranging from code-named projects to M&A to unique PII and beyond. The project for Scenario #1 can be accomplished in a week and is easily executed in SPE E3. Scenario #2 may take 6 - 12 months and is easily executed in SPE E5. In either case, however, it is not the technology within M365 that is influencing those timelines; it is the enterprise’s readiness around the policy and nomenclature of, in this case, advanced security features like data classification. In this example, this company could immediately accomplish the minimum specs (“encrypt all sensitive data stores”) in E3 while then purchasing the recommended specs in E5 months later when the ground work for an enterprise data classification system has been vetted and approved.

Technology Platforms for Running a Modern Enterprise:

We’re not quiet done with that previous specifications chart just yet. If you look to the first column of the matrix, you’ll see the capabilities that Microsoft believes are required of the Modern Workplace, from authoring to compliance and everything in between. The dilemma companies face is advancing productivity while maintaining security and adhering to compliance and regulatory policies. This is a significant obstacle for companies struggling to stay competitive. For example, enabling a more mobile workforce can expose your corporate network(s) to increased risk of data leakage and historically requires the need to dictate security practices into the user’s daily activities. The purpose of addressing security in a productivity environment is to ensure the continued effective protection of sensitive information and processes. The difficulty comes in balancing how much security can be implemented without affecting an enterprise's productivity. With a centrally managed and unified set of security and productivity offerings, an enterprise can focus their time on managing business and not the enabling solutions. In a nutshell, every modern enterprise needs to get work done, collaborate on it, and protect the work and the people doing it. Pretty obvious, right? To accomplish that herculean goal (and the specifications that make it possible), there are 3 key technology platforms that come together to form Microsoft 365:
  • Office 365: Enables, manages, and protects how work gets done and shared
  • Enterprise Mobility + Security: Enables, manages, and protects who gets work done and where it gets done.
  • Windows 10: Enables, manages, and protects the work environment itself, including providing for diverse workstyles across voice, ink, touch, and new classes of devices.
Those platforms probably aren’t new to you. Office 365 is the world’s largest SaaS application. Enterprise Mobility + Security is among Microsoft’s fastest adopted enterprise solution in history. Similarly, Windows continues to be the primary computing client of choice for the vast majority of the world’s commercial entities. But what might not be so familiar is how those platforms now come together in surprising new ways. While valuable on their own and quite capable of operating in a silo, that’s no longer how these platforms are designed. Office, EM+S, and Windows are now built from the ground-up to bring critical new capabilities. Together they form the building blocks of digital transformation in the modern workplace in 4 key areas:

Trust: Protect your organization, data, and people

  • Integrated intelligent security
  • Transparency and control
  • Privacy by design
  • Compliance leadership

Collaboration: Create a productive workplace to embrace diverse workstyles

  • Email and schedule
  • Create, share, and find
  • Call and meet
  • Connect and engage

Mobility: Enable your people to get things done anywhere

  • Work from anywhere
  • Access from any device
  • Manage and secure identity
  • Always up to date

Intelligence: Provide insights to drive faster, better business decisions

  • Analytics for everyone
  • Discover relevant content and people
  • Improve personal effectiveness
  • Works for you
In the new world, if you are lacking in any one of these areas, you have an incomplete puzzle -- you are likely not competing at your full potential. The whole picture of a modern enterprise only really comes together when each of these areas are addressed in concert to serve the specific needs and goals of the business. There is a lot more to say on each of these "building blocks" of an enterprise digital transformation and we will be posting in-depth articles on each as part of our ongoing M365 series.

Summary:

At the end of the day, Microsoft 365 is not about the 2 “spec sets” or 3 “technology platforms” or even the 4 “building blocks of digital transformation.” M365 is about each company’s unique needs, customers and journey. M365 is simply a framework to help get from Point A (how do I enable greater productivity while protecting my users, data, and devices in a cloud first, mobile first world?) to Point B (how can I take these experiences to the next level to transform my business in a mobile first, cloud first world?). Our team looks forward to helping you understand and execute your own journey and digital transformation.    ]]> Stop Phishing Attacks with Mail Flow Rules in Exchange Online https://docs.microsoft.com/archive/blogs/scdsec/stop-phishing-attacks-with-mail-flow-rules-in-exchange-online Sat, 27 May 2017 11:42:58 GMT https://blogs.technet.microsoft.com/scdsec/?p=326 Spoof Intelligence is being enhanced but requires E5 licensing. Below is a quick mail flow rule I've shared with several customers to help combat phishing attacks. The rule is simple... if an email originates from outside the organization, but has a sender that inside the organization... do something.

Considerations

  • If you have 3rd parties who send on your behalf  (HR, Corp Comm, Surveys, etc.), you'll want to make exceptions accordingly.
  • Test the rule first. Either target the rule to a specific group of users or run it in test mode.
  • If you are concerned about users sending out sensitive information, consider a DLP policy that would look for SSN's leaving the company.
]]> Multi Factor Authentication in Challenging Environments (like no Internet access) https://docs.microsoft.com/archive/blogs/scdsec/implementing-multi-factor-authentication-in-challenging-environments Mon, 24 Apr 2017 09:40:31 GMT https://blogs.technet.microsoft.com/scdsec/?p=316 This article introduces 3 options for addressing this scenario. We can accommodate the isolated user with a “Time-Based One-Time Password” (TOTP) solution.  Codes are generated locally by combining a secret key with the current timestamp using a cryptographic hash function to generate a one-time password.  The user enters these codes as a second factor of authentication and life is good. The first (and easiest) solution for the isolated user is to deploy the Microsoft Authenticator application. The Microsoft Authenticator app can receive notifications both over cellular and Wi-Fi connections. In addition, the application can generate access codes locally. These codes don't require internet or data, so you don't have to worry about having phone service to sign in, or that the app will use up your data plan. When you close the app, it doesn't keep running in the background so it won't drain your battery. You can close the app and ignore it until the next time that you sign in. The Microsoft Authenticator app works across all platforms and accomplishes the goal of allowing the user to enter the current code into the verification window in an isolated environment. The second solution involves deploying an on-prem Azure Multi-Factor Authentication Server.  This solution ties into our Azure MFA service to provide MFA auth to a subset on-prem resources, specifically ADFS, RADIUS, and IIS.  This process involves importing third-party Open Authentication (OATH) time-based, one-time password (TOTP) tokens, and then using them for two-step verification. For example, a customer could utilize ActiveIdentity tokens  which are OATH TOTP tokens whose secret key was imported into the Azure Multi-Factor Authentication Server. OATH TOTP tokens support the following formats: Portable Symmetric Key Container (PSKC) CSV if the file contains a serial number, a secret key in Base 32 format, and a time interval The third and final solution employs third party MFA solutions and their various flavors of OTP could be leveraged from within ADFS.  Once installed and registered with ADFS, it is possible to enforce MFA as part of the global or per-relying-party authentication policy.  These solutions are all supported with ADFS.
Gemalto   Gemalto Identity & Security Services
inWebo Technologies   inWebo Enterprise Authentication service
Login People   Login People MFA API connector for AD FS 2012 R2 (public beta)
Microsoft Corp. Microsoft Azure MFA
RSA, The Security Division of EMC   RSA SecurID Authentication Agent for Microsoft Active Directory Federation Services
SafeNet, Inc.   SafeNet Authentication Service (SAS) Agent for AD FS
Swisscom   Mobile ID Authentication Service and Signature Services
]]> Secure Productive Enterprise: Thoughts on Modern Enterprise Security with Sachin Gupta, Principal Security Evangelist at Microsoft https://docs.microsoft.com/archive/blogs/scdsec/modern-enterprise-security-trends-an-interview-with-sachin-gupta-principal-security-evangelist-at-microsoft Thu, 02 Feb 2017 19:39:28 GMT https://blogs.technet.microsoft.com/scdsec/?p=285 Sachin: Absolutely. Excited to talk to you, John! John: We’ve let the cat out of the bag a little bit already regarding your background with RSA, but can you go into a little bit more about the how and why of your journey to Microsoft? Sachin: Sure, you know I spent about 10 years at EMC-RSA working with a variety of security technologies -identify and access management, data protection technologies, fraud detection and prevention, threat detection, security analytics, etc.. More importantly, I enjoyed helping my customers design security solutions to not only help protect the most critical assets, which, in my mind are your identity, data, device and apps, but also to detect and respond to malicious and fraudulent activities outside and inside the organization.  I remember when the opportunity at Microsoft first presented itself, I joked and said, "you got to be kidding me." I never imagined Microsoft and security would go hand in hand together. Jokes and old world bias aside, Microsoft was investing more than $1b in security R&D each year at the time – and  more now -- and has made “security first” a mandate in our cloud first, mobility first approach to enabling customers to take a secure journey to the cloud. So, back to your question John, what excited me most about Microsoft is the implementation of our built-in vs bolt-on approach to security that is going to be the much needed catalyst to help our customers optimize their investments with Microsoft and other technologies and securely transform their business in ways that were not possible before. John [Laughter]: Yep, you are spot on that not everyone automatically connected Microsoft to security. But times do change and I now see very different discussions between customers, partners and our teams. A lot of that is connected to the bolt-on vs. built notion that you refer to, but I am always amazed by the amount to telemetry that Microsoft has from the likes of AAD, O365, Windows Update, Xbox Live, Outlook.com, Bing and the like. We’ve become pretty good at discovering, tracking, reporting and helping to mitigate advanced threats, correct? Sachin: Absolutely! Microsoft security is literally night and day from just 4 or 5 years ago. In addition to all that, Microsoft is taking a holistic approach to security by leveraging the deep and broad threat intel as a fluid to connect and integrate the traditional security silos across all our platforms such as O365, Windows 10, Azure and our enterprise mobility plus security solutions to help better protect, detect and respond to advanced threats in a modern hybrid environment. I believe this is an exciting opportunity and challenge to help our customers leverage security as an enabler for their business organizations to achieve more and I am honored to be part of this journey and the enterprise cybersecurity team at Microsoft. John: Let’s get specific on the Enterprise Cybersecurity team here at Microsoft. What do you and the team do? Sachin: My team is a group of trusted advisors with deep cybersecurity expertise that work closely with enterprises and empower them to confidently and securely move to cloud, and modernize their  platforms by delivering the security solutions, expertise and services needed to keep their data safe. Mission statement stuff aside, we specifically partner and work closely with our customers in defining a security framework, approach, roadmap and architecture to not only enable a secure journey to cloud but also to optimize and maximize their return on investment with us. Everything we do is grounded in the “value” that security provides. And that “value” is unique from customer to customer. John: Of course. Every company is unique in their strategic initiatives and their security priorities, but, when you sit down with CIOs and CISOs and their teams, are you seeing some trending issues that are real “hot-buttons” across the board? The common denominators, if you will? Sachin: Great question. We all know that cybersecurity now is a board room topic and discussion. Even though the board is getting reports from the chief risk officer and external independent sources, boards are now taking time to meet with the CISO on at least a quarterly basis to get the current state of cybersecurity. Board members want to know what the key cyber security issues are, particularly from a business prospective – the key blockers identified, the security strategies and ongoing projects to address the issues, blockers etc. We also know that businesses are transforming themselves to be more agile, to help their employees be more productive, to engage with their customer in new ways and so on an so forth. This, at the same time, is expanding the attack surface and dissolving the traditional security perimeter making the traditional security approach ineffective. But, to your point, let’s get specific and expand on the broader security trends and challenges that majority of the organizations are go through by default. John: Love it. So, in your mind and experience, these are really the things that are non-negotiable. Is it fair to say that these things MUST be explored in the new cloud first, mobile first world? Sachin: Absolutely correct. If you, as a commercial entity, don’t look at the modernization of these specific things, you are likely not fully managing your risk and are certainly not fully realizing the value that you can bring to your own customers and stakeholders. So, let me start with a biggie… Identity is the new security perimeter. There are no “if, ands or buts” about it. Identities are becoming more and more mobile. It is not so much about protecting the identities inside the four walls of your organization but the new perimeter is wherever the identity is meeting with the data. Users and business want convenience of being able to access their data/app regardless of where the identity is and the type of device being used. It’s imperative that these identities are protected regardless of where they are in a consistent manner and more importantly should not impede on user experience. We simply can’t built brick walls anymore and this leads to the challenge of implementing compensating controls which not only provide the optimal security but also enhance the user experience. John: Exactly. Your identity, your credentials, whatever phrase you want to use are really the keys to the kingdom. No matter who you are in an org, you have an assigned identity. It’s like the keys to your house. You wouldn’t hand out a copy to the handyman, to all the neighbors on your street, to the postal carrier, etc, etc, but we often see corporate identity reused – to access a non-sanctioned SaaS app, to “register” for that cool new game from the app store on your phone, etc. If any of those datastores are compromised, you have now unlocked the front door of your house to someone that you don’t necessarily want to be able to walk in unannounced. Sachin: Yes, that is a great analogy. And if you think about credentials as opening that front door, it’s really more than that. That key has now granted access to everything in your house, the media room, the food pantry, the cars inside your garage, etc. The same thought applies here. Your identity lights up your access to devices, apps and data. Which brings me to the next big security trend and rule… Data is the new currency. Data in traditional thinking used to be an asset that stays within the four walls of our organization. However, with mobility and the need for collaboration beyond the traditional perimeter, the lifecycle of data looks very different today. It may very well be created within your organization and cross boundaries to a partner organization, in the cloud, personal email accounts and so on and so forth. Data is obviously the most important asset for a given organization and it’s imperative that we not only protect it but also track it in highly digitized and mobile world. The silos that use to exist between discovery, classification, protection and tracking of data are collapsing and the CISOs want a more holistic and integrated solution to protect data. Which bring us to the 3rd big trend which is a new approach to overall Enterprise Detection and Response. Prevention will always be a viable strategy, but it can’t be the only one going forward. Something will get through. Now the question is how fast do you find it and how do you minimize the blast radius. John: You are really advocating an “assumed breach” posture here. Always assume that you are compromised in some way and invest in discovery and remediation as well as robust prevention. Sachin: Exactly. There is no doubt that significant cyber-attacks are not only occurring more frequently, but also exponentially increasing in technological sophistication. This makes every organization more susceptible to breach, and subsequently, the possibility of a significant financial and reputational damage. CISOs are recognizing the need to run their organization in an assume breach mode. This obviously translates into the ability to pro-actively detect threats much earlier in the kill chain to avoid a breach situation. Dissecting what happened with breaches at several large organization earlier last year shows that they had invested in a bunch of security solutions and yet they failed to detect and respond to threats early enough to avoid a breach situation. Clearly that's not ideal and a more holistic approach to threat detection combined with strategic threat intel is needed to enable this pro-active threat detection both on-premises and in the cloud. John: And to circle back to Microsoft’s cybersecurity DNA, how do you and the Microsoft Cybersecurity team help those CIO and CISO teams navigate the kinds of considerations and challenges that you just outlined? Sachin: Well, I don’t want to sound like a marketing brochure too much, but Microsoft really does have unique, industry leading cybersecurity capabilities that extend from the world’s most used client operating systems to the most trusted cloud in the world. The Enterprise Cybersecurity Group leverages deep security perspective, experience combined with our unique security capabilities to help our customers build a secure roadmap for their journey to the cloud. We break the traditional silos of securing identity, data, apps, etc. and take a more holistic and integrated approach to security. As an example – when we think about enabling identity for digital transformation, the identity to us is a combination of user, application data and device. You simply can’t secure these assets in silos to have a secure identity but rather you need a more connected, integrated and comprehensive approach. We also have unique built-in capabilities to help our customers monitor and detect advanced cyber threats in both on-premises and cloud environment. We work with enterprise customers to help connect these dots to provide for a single pane of glass not only from Microsoft product and technologies prospective but also leveraging integration capabilities with other security solutions that may exist in their environment. Look, we aspire to do some greats things in the security space. However we recognize that we are part of a larger ecosystem and we need to play well with other security providers. Additionally, we offer industry leading tactical and strategic incident response capabilities backed with unique access to product expertise. Bottom line, we help connect the security dots and breaks those traditional silos for our customers to achieve more and enable their business. John: You may actually have a future in marketing, Sachin! [Laughter] Anyway, certainly internally at the very least, it is clear that Microsoft has made “security first” a mandate in our “cloud first, mobile first” approach to the modern enterprise across all of our platforms and solutions. What makes this such a game-changer for both Microsoft and our customers and partners? Sachin: First of all, Security is not something new at Microsoft. Microsoft stands for trust. And more than ever, we are making investments to keep us all secure. 15 years ago, Bill Gates recognized this would be a challenge for the industry when he declared that making computing trustworthy was our top priority. Since then, we have made incredible strides but it continues to be a journey. Over these past 15 years, we have learned a lot – First, our ability to make threat go away entirely is limited. What we can control is our reediness and response in face of ongoing threat. Second - bolt on security will always keep us on the defense. The point/bolt-on security solutions are good at solving a specific problem. However for most part, they are disconnected, they don’t share intel and work with each other in real time and that does not help with reducing your median time to detection and recovery. The security first approach at Microsoft is about building the security controls into the platform itself so they can work in a more cohesive and integrated manner. We face the same adversaries as our customers do, but because of the scale of the technology we build and operate, we capture a massive amount of security related signals and that’s what provides us with glue to connect and integrate security dots together. This in turn provides you with the ability to not only provide for enhanced protection but also the ability to proactively monitor, detect and respond to cyber threats. This to me is a game changer which significantly enhances our ability to disrupt the adversary economic model and playbook. Let me illustrate this with an example. We all know Phishing is still the most common attack vector used by adversaries to infect end user devices by sending weaponized attachment via email.  Think about a scenario where windows defender detects the malicious payload on the end user machine and sends this intelligence to O365. O365 then automatically uses this intelligence to scan and remove emails with the same malicious attachment from the O365 mailboxes. This is truly a game change how the intel from one security capability is used by other in an automated and near real time fashion to help reduce the median time detection and response. Microsoft is committed to being a leader in the security space, but security is not a problem we can address alone. Doing so in the right way means working broadly with others. Our Digital Crimes Unit brings together partners with multiple areas of expertise to fight digital crime. Together, we are addressing broad threats like botnets and the online needs of vulnerable populations like children and senior citizens. We are also working with alliances like FIDO to help drive towards a world without passwords. We will continue to invest in security partnershipsand help drive the entire industry forward. John: And, finally, any words of advice for folks that that have been tasked with rapidly -- and perhaps even radically -- improving their organization’s own security posture? There are so many options and so much noise out there, where do they start? Sachin: First things first, I believe it is critical for companies to adopt a good security hygiene across things like monitoring, patch, operating systems, privileges access etc. This provides for a good security foundation to build upon and frankly speaking – Could help protect against a majority of threats and attack vectors. Cloud adoption and mobility is clearly expanding the traditional perimeter beyond the four walls of the organization. Clearly we need to acknowledge the reality that it is not a matter of if an organization will experience a breach but rather it is about “when” and organizations need to operating with an Assume Breach mindset. The traditional protect, detect and respond model is still applicable but organizations need to look at capabilities which extend beyond the traditional perimeter. I have said before that identity is the new security perimeter and clearly protecting this modern identity requires innovative capabilities combined with a mind shift. It is also important to understand that modern identity is not just about user but it also includes data, device and the application that the user is accessing. Organizations should also invest in technologies which could them reduce their mean time to detection. Traditional signature based approaches to threat detection should transition to capabilities that leverage machine learning, behavior analysis and big data analytics to proactively detect threats much earlier in the kill chain. Cloud promises agility, scalability and much more but it also promises security at scale and could help rapidly enhance the overall security posture. John: Thanks, Sachin! Appreciate the time. Now go out there and get some cyber bad guys. Sachin: [Laughter] Will do, John. Appreciate the partnership! And if folks want to chat, they can reach me at gupta.sachin AT microsoft.com  ]]> Implementing Conditional Access with Exchange Online (updated using Azure Portal) https://docs.microsoft.com/archive/blogs/scdsec/implementing-conditional-access-with-exchange-online-updated-using-azure-portal Mon, 09 Jan 2017 20:33:41 GMT https://blogs.technet.microsoft.com/scdsec/?p=275
 
Implementing Conditional Access with Exchange Online (updated using Azure Portal) I am updating this blog post using the new Conditional Access features in the Azure Portal. The new portal is accessed from https://portal.azure.com. I will demo using Exchange Online; however, these same steps can be used with all other Software as a Service applications in Azure. Conditional Access will check the following:      User / Risk      Application      Location      Device / Device State After checking the appropriate conditions, a decision will be made to either Allow, Block or require Multi-factor Authentication (MFA).  If the User Account or a Risky Sign-On is detected, then we can force a password change or force Multi-factor Authentication. I will go through this process using my Windows 10 Virtual Machine.  However, this will apply to not only Windows, but iOS and Android.
The complete blog post can be found here: https://blogs.technet.microsoft.com/pauljones/2016/12/28/implementing-conditional-access-with-exchange-online-updated-using-azure-portal/]]> Secure Productive Enterprise: 9 Modern Security & Productivity Pitfalls https://docs.microsoft.com/archive/blogs/scdsec/modern-enterprise-security-9-things-you-cant-overlook Mon, 19 Dec 2016 08:00:59 GMT https://blogs.technet.microsoft.com/scdsec/?p=245

Introduction: A Critical Question, A Critical Reality

“Top news today, <insert company name here> announced that their systems were breached by hackers dating back to at least 6 months ago.  Details are currently limited on what information was taken and the full financial impact of the incursion.” It seems like every day we see another announcement of another security breach in another enterprise.  CIOs and CISOs are being asked by their CEOs and their Boards of Directors, “how do we ensure that we don’t end up as the next security breach headline?”  It’s a critical question (probably the most critical question facing IT today). And it’s being asked in the face of a critical reality: IT spending will only increase 0.6% in 2016[1].  The business, along with their partners in IT, have their work cut out for them! The focus of this whitepaper is to revisit some concepts that aren’t necessarily new but are sometimes discounted or misinterpreted.   Our hope is that the information in this whitepaper will spark new ideas and drive new actions as we collectively work to keep our companies and businesses one step ahead of the bad guys and the data breach media circus. These are the 9 things that cannot be overlooked in the new (and continuously evolving) era of enterprise security and productivity.    

#1: The keys to the kingdom

The new security perimeter is identity. It is the common denominator of corporate access and dictates a user’s access and permissions across networks, devices, apps and data. Regardless of if you’re a CEO or the dock foreman, you have a corporate identity. Identity, is literally and figuratively the key.  It’s important to call this out so that it’s not lost while companies spend cycles protecting their endpoints.  No matter how much you protect your endpoints with anti-malware, or your data from a Data Leakage Prevention (DLP) perspective, a stolen identity will get past all these countermeasures.  You can build bigger walls with more sophisticated firewalls and stack layers of Intrusion Prevention Systems (IPS) behind them, if I look like someone that’s been in the castle before, I’m getting in! Key take-away: Always assume that a set of your corporate identities have been reused, are for sale, are replicated in a 3rd party cloud or are still being used to access corporate data and assets even after separation/termination.    

#2: With friends like these…

When we talk with customers about various security concepts and countermeasures, it’s common to hear, “Our trust model is simple: trusted devices are inside our network, any device external to our network is untrusted.”  So, if a device inside your network becomes infected with malware, is it still trusted?  Of course it shouldn’t be, so the model does not hold up in practical execution.  We must always operate under the assumption that there are devices and servers on our network that are already compromised at any given time.  The goal then becomes identifying these compromised assets and quarantine them as quickly as possible.  The tricky part here is that there is no single sure-fire way to insure against compromise and it is also becoming increasingly difficult to detect compromised hosts, which leads to our next two concepts. Key take-away: You must adopt an assumed breach posture. You’ve already been compromised -- the goal is to contain it.    

#3: Silver bullets are for werewolves

Another concept we hear often is “Isn’t two factor authentication good enough?” or “we already have the #1 rated prevent-the-breach solution available.”  In reality there is no one single silver bullet process, procedure, or product that will provide complete defense against attackers.  Instead, by constantly asking the question “If the attacker gets past this, what’s our next line of defense/offense?”  We’re not building a better mouse trap; we’re building a maze full of mousetraps!  Using MFA as an example, the specific question becomes: “If the attacker is able to steal the user’s token/phone used for the second factor and is able to get into our network, how will we find them?”  That kind of question will lead to the right kind of answers. In the MFA scenario, one such answer would be to employ user logon behavioral analytics solution.  The attacker may have the credentials and second factor but they don’t have the user’s system use pattern, allowing a behavioral analytics platform to alert the suspicious activity for containment.  This type of “what if” thinking will drive a continuous cycle of security posture improvement. Key take-away: You must take a layered approach to all security initiatives/solutions, where the next layer is always challenging the previous one.    

#4: Hiding in plain sight

Signature based malware detection is still important but we can no longer rely on this technology solely to detect compromised systems.  To illustrate this point, let’s use the DLL injection method as an example scenario.  The more sophisticated attackers are using advanced techniques such as hot-patching as a means to silently inject malicious DLLs into running processes.  Antimalware products typically don’t catch these because they are looking at non-system processes for DLL injection methods.[2]  So what are we to do?  What if there was a way that we could evaluate a large number of hosts and see that an increasing number of them have begun to act out of character but in a common way among each other.  This is where cloud powered machine learning coupled with telemetry from a very large sample size of hosts (think hundreds of millions) can help identify these unknown malware specimens and thwart an attack before it grows out of control. Key take-away: When it comes to sophisticated attacks, it increasingly “takes a village” to identify them. The new cloud security model requires putting very large telemetry sets and computational power to work on your behalf.    

#5: Humans take the path of least resistance (usually)

Security awareness and education programs can make a big difference in improving overall security risk (anti-phishing email training is a great example where there is always a return on investment). But when awareness programs morph into new policies where the burden of execution is put on the end-users, new risks are introduced. Here is a common example:“If passwords are the weakest link, we’ll just force our users to have better passwords.”  While this may sound like a good idea, what usually ends up happening is that a user will be so proud of that secure password you made them create at your company, they’ll use it outside of work too.  The danger here is that through some simple social engineering or if one of those external systems (that use that fantastic password) gets compromised, the attacker has a password to the user’s credentials on your company network!  Let’s face it, every online storefront that we use doesn’t have the luxury or the bank roll to have state-of-the-art security countermeasures.  Instead of leaning on password complexity in this scenario, look to other measures to protect credentials such as multi-factor authentication, conditional access and compromised credential threat reporting tools to solve this issue. Key take-away: Doubling down on end-user security policy and relying on end-user compliance will often result in bad end-user habits, workarounds and a compromised security posture.    

#6: If it ain’t broke, don’t change it?

Speaking of end-users, believe it or not, they absolutely hate VPN.  Having to use a VPN is an unnatural motion for a user that is just trying to get something done at work.  And VPN solutions are not exactly known for being user friendly and can be frustrating when you are in a hurry (which is always).  The truth is, VPNs are good for some things but shouldn’t be the standard for remote access.  Instead, the recommended alternative is to publish an internal site externally using a reverse proxy.  This is a solution that can yield quizzical looks by some companies as the “gut reaction” can be to infer that this is not a secure alternative.  Let’s evaluate that. When a user VPNs into the company network, their computer essentially creates a secure session back into the corporate network.  Once VPN’d in, the user and their machine, which are typically outside the safety of the key card locked corporate walls and controlled/monitored networks, are now sitting on the corporate network.  The user can get to file servers and other resources that are probably unnecessary for them to access just to get the task done that they VPN’d in for in the first place.  Reflecting on the fact that 63% of confirmed data breaches involve weak, default, or stolen passwords[3], VPN becomes a popular conduit for attackers. Now consider publishing an internal web site for use externally via a reverse proxy.  While it is still possible for an attacker to compromise the system hosting the Web site through a code vulnerability in the site (not a dig against developers, just a possibility), you are not relying on passwords as the primary method of protection before granting gaping access to the corporate network!  If you do use VPN, please make sure you are requiring 2FA/MFA to help protect against weak, default, or stolen passwords. Key take-away: Yes, it is possible for security solutions to delight users, improve productivity, and save money while improving your posture.    

#7: It’s all about the data, and the bass, not treble

Another area of potential end-user delight can come from the usage of SaaS applications. However, cloud based apps and file storage and can scare IT organizations (regardless of which company hosts the cloud).  The unfortunate thing about that possibility is that IT governed cloud based file storage can help your users be much more productive and give them less reason to store company data in a non-IT governed cloud.  There, we said it.  When you look at studies that show that 8 out of 10 employees admit to using non-IT approved SaaS apps [4], it would be foolish to think that there isn’t some type of company data in those apps.  So what do we do?  First, we should look at why IT groups don’t want to approve a cloud based file storage solution.  The most common reason we hear is “how do I know a user won’t upload some document to the cloud storage and share it out to the world?”  This is very controllable in enterprise class cloud file storage providers.  In additional, with the emergence of Cloud Access Security Broker (CASB) technology, this is 100% manageable.  Pile on information rights management which is also integrated into many CASBs and you have a solid solution to provide to your users.  Give your users a solution or they’ll find one for you (and you might not like it)! Key Take-away: IT can absolutely regain full control and security over SaaS apps and cloud storage with the correct solution.    

#8: False sense of security

Sometimes the solutions you put in place to detect advanced threats won’t actually help you detect them.  Let’s take SIEM (Security Information and Event Management) solutions for example.  These systems essentially pull in mass amounts of log data from pretty much any type of system you run in your company.  One example of data that SIEM’s collect are Windows logon security events that detail information about users logging into Windows systems.  With techniques such as Pass the Ticket (PtT) used in many advanced persistent threat examples, these attacks can only be detected at the network packet level making them invisible to SIEMs that rely solely on Windows event data alone.  Typically, when discussing this topic with companies, this information comes as a surprise to them.  To detect a technique such as PtT, you have to dig into the network packet level and have an advanced rule engine that can look for telltale signs of the attack.  There are products on the security market today that can analyze network traffic to find these types of attacks and are worth investing in.  SIEMs are still worth the investment, especially when you have an auditor ask you to provide every place XYZ user has logged in for the last 90 days!  Just don’t believe they will tell you everything about what’s going on in your computing fabric. Two-Factor or Multi-Factor Authentication (2FA/MFA) are additional examples of solutions that companies sometimes believe will provide them protection from techniques such as Pass the Ticket (PtT).  2FA/MFA is a fantastic (and required) security solution in the new world, but, unfortunately, due to the nature of how PtT works, 2FA/MFA is not effective to protect against this increasingly common technique.  However, in this example, other practices and technologies are effective, such as Privileged Access Workstations[5] and Credential Guard in Windows 10 Enterprise Edition. Key Take-away: Marketing and sales hype don’t always live up to practical execution. Ensure you understand the practical limitations, gaps and overlaps of all of your security components.    

#9: Head in the sand

Let’s talk about penetration testing for a moment.  This is another area where we see companies need to be a bit more aggressive.  The days of pen testing on your network and against your external facing entry points is just not enough anymore, it’s time to think more aggressively.  For example, if you are a retailer, do you run pen tests starting inside a store as the entry point?  If not, it’s something to consider.  For all businesses, consider performing phishing campaigns against your own email users.  Plug a Raspberry Pi based sniffer into a network port in a conference room, what were you able to harvest?  These are just some examples, for a look at what modern pen testers are doing these days, take a look at this article featuring a company named RedTeam Security.  The infrared and RFID concepts are very interesting, entertaining, and scary all at the same time. Key Take-away: Continuous testing of your security layers and vectors of entry is a key component of any long-term posture improvement strategy. Human error, corporate crisis and new, advanced threats can compromise the best security plans.     

That’s all folks

While the information in this whitepaper is probably not Earth shattering, we wanted to review some security topics that we see come up time and time again when talking with businesses both large and small.  The only way we’re going to keep the bad guys and gals out is by working together, sharing what works and what doesn’t.  Our hope is that this whitepaper is provokes some new thoughts and will encourage more collaboration between businesses to keep our systems safe and secure.   [1] http://www.gartner.com/newsroom/id/3186517 [2] https://blogs.technet.microsoft.com/mmpc/2016/04/26/digging-deep-for-platinum/ [3] Verizon 2016 Data Breach Report [4] http://www.mcafee.com/us/resources/reports/rp-six-trends-security.pdf [5] https://technet.microsoft.com/en-us/windows-server-docs/security/securing-privileged-access/privileged-access-workstations  ]]> Implementing Conditional Access with Exchange Online https://docs.microsoft.com/archive/blogs/scdsec/implementing-conditional-access-with-exchange-online Tue, 13 Dec 2016 10:46:16 GMT https://blogs.technet.microsoft.com/scdsec/?p=255      User / Risk      Application      Location      Device / Device State After checking the appropriate conditions, a decision will be made to either Allow, Block or require Multi-factor Authentication (MFA). I will go through this process using my Windows 10 Virtual Machine.  However, this will apply to not only Windows, but iOS and Android. The complete blog post can be read at https://blogs.technet.microsoft.com/pauljones/2016/11/29/implementing-conditional-access-with-exchange-online/]]> Mobile Devices and Modern Threats https://docs.microsoft.com/archive/blogs/scdsec/mobile-devices-and-modern-threats Tue, 18 Oct 2016 09:46:19 GMT https://blogs.technet.microsoft.com/scdsec/?p=225 all mobile platforms are under attack.  These attackers commonly have a persona as an evil person living in their Mom’s basement with a sinister laugh as they take control of another unpatched machine for bitcoin mining.  While these folks undoubtedly exist, you must also remember there are actual companies creating software that is designed to infiltrate and steal data from mobile devices.  Even more alarming is the fact that these same companies create software solutions for profit, selling them by the seat count to whoever is willing to buy it (and there are all types that will pay for this).  For an eye opening read, I encourage you to visit Brad Anderson’s blog post here: https://blogs.technet.microsoft.com/enterprisemobility/2016/10/13/what-we-can-learn-from-the-tridentpegasus-ios-vulnerability/ I was driving to the office the other day when an epiphany hit me.  Maybe it should have hit me a long time ago.  I came to the realization that advanced anti-malware on mobile devices is no longer an overkill measure, it is a necessity.  I thought back to my days of using BBS’ and seeing antivirus products for download thinking AV is for “paranoid people”.  I think about those days and where we are now with PCs and how AV is not even enough anymore to thwart the sophistication of modern threats.  I was in a retail electronics store over the weekend and I witnessed a sales associate handing an AV software box to an elderly gentleman explaining he would be “good to go” if he installed it.  I went over to the gentleman and talked to him about Windows Update and shared some other best practices about protecting his PC, as much as I could share in about 2 minutes anyway.  In retrospect I probably overstepped my bounds a bit and came off creepy due to my stylish, power beard, but oh well :).  The last thing I asked him was if he had a mobile device.   He pulled out his iPhone and told me how great it was and that he was using email on it and wanted to look into Apple Pay.  I showed him an app called Lookout in the App Store and explained to him that he needs to protect his phone just as much as his computer.  He then stated he saw something on the news about hack on Apple phones, the conversation went on from there. I am very excited about the Lookout and Microsoft partnership and the work we are doing together to keep mobile devices safe and secure.  If you aren’t familiar with our partnership, check out Brad Anderson’s blog here for more information: https://blogs.technet.microsoft.com/enterprisemobility/2016/10/04/announcement-microsoft-lookout-partner-to-provide-expansive-mobile-security/ The point of all this rambling is to ensure you are thinking about enterprise mobile management more than just cut/copy/paste/save as protection.  Plan (and budget) for a security solution that will protect your mobile device infrastructure (phones and tablets) from the modern threats that are getting increasingly sophisticated every day. Jake Mowrer  ]]> Microsoft Cloud App Security - Part 2: Threat Protection https://docs.microsoft.com/archive/blogs/scdsec/cloud-app-security-threat-protection Tue, 13 Sep 2016 15:17:03 GMT https://blogs.technet.microsoft.com/scdsec/?p=175 From the Activity Log, you can set a filter to narrow your results.  In this example, I set the following filters:  

Activity Type = Log On

Location <> United States

IP Address Category = Risky

From the Activity Log, I then create a policy based on my search. Click the button New Policy from Search

CASB2

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

From the Create Activity Policy, enter a Policy Name, Description Severity and Category - see screenshot.

Then configure the following:

  • Activity Filters
  • Policy Match Parameters
  • Alerts
  • Governance
CASB3 CASB4                                                                                                   ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Activity Filters, this will be your search from the Activity Log.

Policy Match Parameters, select Single or Repeated Activity.

Alerts, select Create Alert and choose the different types: Email, Text Messages or both.

Finally, under Governance, choose which actions to automatically take: Notify User, CC User Manager, CC Additional Users (Security Team?), Suspend User, Require user to change password.

Now when a Log on is detected from a Risky IP Address outside of the US, Cloud App Security will automatically report, notify and take proper action.

  Thank You, Paul Jones    ]]> Microsoft Cloud App Security - Part 1: Credit Card Numbers https://docs.microsoft.com/archive/blogs/scdsec/microsoft-cloud-app-security-part-1-credit-card-numbers Mon, 22 Aug 2016 09:55:49 GMT https://blogs.technet.microsoft.com/scdsec/?p=65 Cloud App Security (CAS) - https://www.microsoft.com/en-us/cloud-platform/cloud-app-security In this blog post, I am going to cover how to setup alerts and enforce Data Loss Prevention when a file containing credit card number is detected in a sanctioned cloud app.  A sanctioned app is a cloud application that has been approved in the Cloud App Security console. From the Cloud App Security Console, click on Control - then Choose Templates: CAS1 Scroll down and find File containing PCI detected in the cloud (built-in DLP engine).  Click on the Plus to create a Policy from the Template. CAS2   In this example, I changed the Policy name to File containing Credit Card Numbers in the cloud (built-in DLP engine) to reflect that I am only looking for Credit Card numbers in this policy. In the Content inspection check Enabled and select All: Finance Credit card number. In the Alerts section:
  • Select Create an alert for each matching file
  • Select Send an alert as email (optional)
  • Select Send alert as text message (optional)
CAS3   Under the Governance section, I selected Microsoft SharePoint Online and Box and enabled the following:
  • Send policy match digest to file owner
    • CC additional users
  • Put in user quarantine
  • Enter a custom notification message: "Please do not put credit card information in files on SharePoint Online."
  cas5 After the policy is created from a template, I created a Word and an Excel document with Credit Card numbers in SharePoint and Box.  The policy looks for and only detects actual credit card numbers, don't just put random numbers. The policy detected the Word and Excel file in both SharePoint Online and Box and quarantine the file. I also got a text message and email notification.   CAS6 CAS7 Now I have the following remediation options in Box and SharePoint Online:
  • Open in Box
  • Open via public link
  • Refresh file
  • Search in parent folder
  • View Hierarchy
  • View related activity
  • View related governance
  • Restore from User Quarantine
  • Remove direct shared link
  • Restrict to collaborators only
This concludes my brief Blog Post on how to detect Credit Card Numbers in a Sanctioned Cloud App using Microsoft Cloud App Security. Thank You, Paul Jones Enterprise Mobility + Security Technology Solutions Professional South Central District]]>