Month: May 2020
Modern Workplace security: 5 steps to use Microsoft Teams in a safe way

Modern Workplace security: 5 steps to use Microsoft Teams in a safe way

By | | Comments 0 Comment

In this blog I will go through 5 basic security improvement for organization that are shifting to Microsoft Teams. Also read my previous article: The Value Of Microsoft 365 E3 and E5.

Security improvements are embedded in Teams, it just needs activation

I’ve met a lot of organizations over the last months implementing Microsoft Teams, and I really love to see the fast-deployments, the big-activation, simple communication, dedicated onboarding.

  • Did you know that Microsoft Teams is not an addition to Office 365, but an integration of multiple services?
  • Did you know you can integrate the product better in your current workplace than ‘we’ think?
  • And thousand other possibilities – now that’s the problem, right? We do not really knew, before..
  • I know I’ve used Microsoft 365 E5 licenses. You can figure something out without CASB and with Azure Premium P1 + EndPoint Manager.

Introduction: Microsoft Teams Architecture

Did you know that Microsoft Teams is part of Office 365 or Microsoft 365 and is using: Azure AD, OneDrive, SharePoint, Exchange Online, SharePoint, Yammer, Stream, etc all out of the box. I mean, I suppose your organization will use deep integration when shifting to Microsoft Teams. Let’s dig into solutions now!

1. Identity Protection: MFA + Azure AD Conditional Access Policies + Risk Policy

The first step is to have a security-identity. Everything comes to Identity security and authentication – access management in general.

  • It’s still a best practice to activate Multi-Factor Authentication. I’ve written a lot about this in my previous article.
  • Activate Conditional Access to not get craziness of pop-ups and deliver a productive workplace.
Azure AD Conditional Access
  • Force a password change when assuming breach, risk-policies to be sure you can harbor save identities.
User Risk Policy

2. Registration for Windows 10: Device Onboarding

Make your Windows 10 devices known in the organization. So you have them in control, and you can do smart things with knowing.

Register or enroll your devices into Azure AD to provide an identity-token to the device. This identity is used to authenticate the device when a user signs in and apply conditional access rules that require domain-joined or compliant PCs.

  • Hybrid Azure AD Join: Enables devices in Active Directory to register in Azure AD For Access Management.
  • Go through Autopilot and let new devices join in Cloud-Only modus. With an Hybrid Identity. I’m not fan of doing registration only. It has value, but you can give than only Access Management. I’ve seen companies being able to go direct with Autopilot and shift to only Cloud Modern Management and have the devices in Azure AD only. It’s not a requirement Cloud or Hybrid. But it can help with straight-forward implementations.
  • Later you can do EndPoint Manager. Deploy Microsoft Teams, and the Office 365 suite to all endpoints.

3. Block downloading of document on non-trusted devices

If your device is not trusted. Accessing corporates data should be possibly (sometimes not, I know) but different than a real trusted device.

  • Set simple and transparent conditional access policies. Don’t make it to complex.
  • You could use this App Control (preview) to easily block downloading of ANY Office 365 document on a ‘non-trusted’, ‘non-compliant’ device.
  • Keep in mind, when using this. If you only select Exchange, it still impacts Teams, SharePoint as stated in the tip in the first screenshot.

4. Intune App Protection policies for Mobile Devices

You’ve covered your identity, your Windows 10 devices. You’ve covered your non-trusted devices and now your mobile devices.

  • I like to get feedback on this one. I’ve done App Protection policies on multiple customers without changing any definition of the standard policy you can create from: https://admin.microsoft.com – there is nothing wrong with standards. Better a policy activated than no policies.

Or you can use the App Protection Policy Data Protection Framework. It provides 3 levels op App data protection configuration. (github)

  • Level 1 enterprise basic data protection – Microsoft recommends this configuration as the minimum data protection configuration for an enterprise device.
  • Level 2 enterprise enhanced data protection – Microsoft recommends this configuration for devices where users access sensitive or confidential information. This configuration is applicable to most mobile users accessing work or school data. Some of the controls may impact user experience.
  • Level 3 enterprise high data protection – Microsoft recommends this configuration for devices run by an organization with a larger or more sophisticated security team, or for specific users or groups who are at uniquely high risk (as one example, one organization identified users who handle data whose theft would directly and seriously impact their stock price). An organization likely to be targeted by well-funded and sophisticated adversaries should aspire to this configuration.

Access requirements: You can find this in: EndPoint Manager

  • PIN for access: Require
  • PIN type: Numeric
  • Simple PIN Allow
  • Select minimum PIN length 4
  • Touch ID instead of PIN for access (iOS 8+/iPadOS): AllowOverride
  • More details in the 3 screenshots for iOS. I’ve also created a policy for Android.

5. Knowing the risks with Cloud App Security

You’ve covered your identity, your Windows 10 devices. You’ve covered your non-trusted devices and your mobile devices. If there is something slipping in between activation or something is missing. I suggest to use Cloud App Security to see data exfiltration, etc..

  • As you can see in your Cloud App Security portal the ‘possibility’ to understand the block download policy is there.
  • You can dig deeper to understand what happened. In the demo movie on the top I’ve showed left a trusted environment, on the right a non-trusted ‘personal computer’.
  • You can go further with automation from here. But I will not go deeper into this in this article. Because I believe that if you have these 5 steps you have already achieved somethings.

Next steps?

  • Identity protection(1) – automated remediation and creation of service-desk ticket to respond to your risky users.
  • Compliance policies(2) – to not let devices slip under the fingers of IT-departments. You need a process to be sure all devices are passing the same process. And are totally blocked if not.
  • Block downloads on non-trusted devices. (3) Go further, this implementation above is a great opportunity because of the easiness of implementation. Information protection is next. Because people can exfiltrate data when e-mailing, syncing, copying on their corp device, and their home device. And that’s a thing that should not be possible, anymore.
  • Automate actions with CASB. Label your exfiltration expert. And create processes IF there is something wrong. The right people in the chain of command are informed.
  • Next improvement is a future blog! Thanks for reading.

I hope you enjoyed reading. Please comment below!

Azure AD Conditional Access
The value of Multi-Factor Authentication – Get your story right!

The value of Multi-Factor Authentication – Get your story right!

By | | Comments 0 Comment

I’ve tried something different last night. To write the story of Multi-factor authentication and bring the relation in the eco-system of Microsoft. Everything is connected. I would love a comment, share or a reply to see if this content is valuable for you! Thanks, Jasper

Creating the modern workplace! – Vision

  • Increase mobility: People are working from home. From clients and during travel. In regard to collaboration, 98% of information workers collaborate or communicate with someone else at work on a weekly basis.
  • Improve security and compliance. Most of the time there is no control of data compliance in the current on-premise environment. Security systems are complex and static without growing or proven improvements. Start with a Zero Trust model. Start with protection of your people.
  • Find more topics I’ve written in my previous article.

What is Multi-Factor Authentication – To know

  • Something you know, typically a password or a pincode.
  • Something you have, such as a trusted device that is not easily duplicated, like a phone or hardware key/token.
  • Something you are – biometrics like a fingerprint or face scan.

Cybersecurity Reference Architecture – The Cybersecurity vision to integrate deeply in Microsoft tech

Whoooaww, that’s a extreme reflex for doing our MFA implementation!! IS IT? Dear customer, colleagues. is it? I don’t think so. We need to see and understand that the small parts (Micro) are connected to the big parts. (Macro) Identity & Access management in crucial. Identity is the first step, is the bases, the baseline. We need to invest in the whole Cybersecurity frame and we need to start with the basics.

Next to the macro view of this Cybersecurity Reference architecture we need to dare to question the identity providers we have integrated in our current environment.

Foundation Infrastructure – The not so interesting part

The only way is up. Starting with your foundation. 1. Networking
2. Identity is the first investment before you ‘grow‘ to workloads and scenario’s.

Identity is a fundamental part of the workplace – The attack surface

As you can see in this figure all security mechanisms are built on the fundamentals of Identity Management. What can you protect IF you’re not able to enable MFA? It has his reasons. There are numbers out there to make you aware of this. We will come to that, later in this article.

Cloud Architecture Identity – MFA is part of something

Understanding identity management in the eco-system of Microsoft’s Identity management system is crucial to find the place where Multi-factor authentication (MFA) belongs. User Accounts – Identity management – Azure Active Directory – Azure/Microsoft365

Self-Service Password Reset – To help the people

Give people in your organization the ability to get some good because they ‘need’ to do MFA. This will ask people of your organization to change their password when there is a threshold higher or above the risk level. It will decrease the IT workload and more import it will make your customers happy. By the way, it’s very easy to configure go to Azure AD – Password Reset – Authentication Methods.

Force a password change when assuming breach – To prevent breaches AND decrease IT tickets

Go to Identity Protection in Microsoft Azure. Select your assignment. All users. Conditions. Select your requirement. And select Require Passwords Change. This will ask people of this organization to change their password when the threshold is at or above the risk level.

Did you know that: IT administrators can enable sign-in risk as a condition in multiple conditional access policies outside identity protection.
In case you don’t have MFA enrolled before this ‘risk policy’ – your account will be locked.

Azure AD Conditional Access – To make it easier

Conditional Access is a solution used by Azure Active Directory to bring signals together, to make decisions, and enforce organizational policies. Conditional Access is at the heart of the new identity driven control plane.

  • Keep user accounts safe by requiring strong authentication based on location and risks.
  • Keep data safe by only allowing managed devices.
  • Meet compliance requirements.
  • Create simple policies for everyone – not for groups, departments – make it simple!
  • Your modular dreams…

What if MFA fails like it did before? – Probably won’t

  • MFA failed 2 times? Less than 4 hours? Ever? Compared to your on-premise environment?
  • We like to kill MFA implementations because we don’t like it but we still want more security. DO IT. If security is a priority, you can fix this technically. What if that’s the real problem?
  • What if you did not have MFA and are breached? OR leave MFA enabled and still be in control of your data.
  • What if MFA failed and you had your devices and identities connected to your modern workplace because it was not a side-project and part of a strategic decision and were able to work when the service fails for some hours?
  • The reflex should to be prevent: Like a break glass account in case of a problematic situation.
  • Next to that write up a document that describes the action requires in case of MFA authentication problems. High risk user will get a unique passwords, low risk users may authenticate without password change. Risky users with medium risk and higher will get a password change.

The standard pitch doesn’t work – So stop telling this

  • 99,9% compromised accounts did not have MFA.
  • Next to this fact the 50 accounts on 10.000 people that will be breached according the numbers of Microsoft is more and more understandable.
  • Your Pa$$word doesn’t matter
  • You can do internal phishing attacks and see that people are entering their passwords. It’s a fact. What’s the point of knowing again if it’s already known? Any fool can know, the point is to understand. Albert E.

These stories are well-known but will not trigger changes. Do’s & don’ts are judging. Don’t work on the ‘facts’. Work on the value and support and simplicity of modern technology. GIVE to the people. Don’t take things away.

99,9% compromised accounts did not have MFA

MFA is included in all licenses – It has been changed since a long time

Basic MFA is included in all Office 365 and Microsoft 365 licenses. It does not mean conditional access or other related features are included. Reference.

Passwordless authentication – To give to the people

Enablement of Passwordless authentication will activate authentication without a password – isn’t this great? Enablement of password Authentication in Azure AD is easy. Go to Azure Active Directory – Security – Authentication methods | Authentication method policy (Preview) – Enable.

Passwordless authentication is a feature that let us rethink our current MFA solution IF it’s not running in the cloud or third-party. As you can see the integration is deeper and deeper here.

The MFA Experience – It isn’t bad at all

The mobile experience shows 3 sign-in code’s to validate the sign-in. Your code needs to be validated. and you don’t need to enter the password.

approve sign in passwordless
PasswordLess Authentication example

Combined MFA and password reset registration – To make the onboarding smooth

Microsoft has announced that the combined security information registration is now generally available (GA). This new experience makes it easy for users to register for Multi-Factor Authentication (MFA) and Self-Service Password Reset (SSPR) in a simple step-by-step process.

Adoption and change management – To make everyone happy except the sponsor 😉

Make standards that are understandable for everyone, not only of the IT organization. Communicate MFA announcement and changes before the change – not after. Keep track of the change record. Explain very well how you’re using ‘standards’ in your organization. Put the guidelines on a place where all procedures are located. Communicate over multiple platforms. Make it about the end-user. Help end-users. It’s all about experience! And you are in control!

Published on the #WorldPasswordDay – Stay Save!

What are your thoughts after reading this article? Comment below! In case you were inspired by this article please share!

Microsoft 365 Business Premium
When and why should you start with Microsoft 365 business Premium

When and why should you start with Microsoft 365 business Premium

By | | Comments 0 Comment

Earlier I’ve brought the article: The value of Microsoft 365 E3 and E5. Due the request I’ve written this article about Business Premium. To respect the content of the previous article the creating the modern workplace is crucial to read before reading this one. Global value of the Microsoft 365 stack will be the same.

The value of Microsoft 365 Business Premium

1. High-level

  • Cloud strategy to become a modern organization that will tackle the on-premises complexity and grow to a modern cloud-first organization.
  • Some Microsoft 365 E3 or E5 features are included to enable and empower the people to reset their own password. Some are part of AD premium P1 features: Others are: Cloud App Discovery, Office 365 ATP, Application Proxy, Dynamic Groups, Passwordless authentication.
  • WHY? This product is made for companies under 300 people. And has more value because of this specific offering in the market. The price is lower. It has features of Microsoft 365 E3/E5, but there are constraints because the cloud-only focus. This will push the investment to consolidate on-premises workloads to M365 Business Premium. You will read the details below.

2. Defend against threats

  • Office 365 Advanced Threat protection to be protected with Safe Links, Safe Attachments, Anti-phishing intelligence.
  • Advanced multi-factor authentication. You can choose to bypass MFA from trusted locations.
  • You can enforce Microsoft Defender on your Windows 10 PCs with enhanced protection against ransomware and malware.

3. Protect business data

  • Data Loss Prevention: Microsoft 365 Business Premium can automatically detect when an email you’re about to send includes sensitive data like credit card info, social security numbers, and dozens of other confidential data types. If you’re just conducting normal business. But, if you’re about to do something dumb, it’s a welcome safety net. There are even templates that can conform to geographic or industry-specific regulatory requirements.
  • Encryption of email and documents: If you need to send sensitive data to a partner or customer outside your organization you can encrypt that email with just one click. This ensures that only the intended recipient with the right credentials can open the email.
  • Information protection: You can use this function to control who has access to company information. Whether it’s in an email or a document. By applying restriction that prevents people form forwarding, copying and printing.
  • Archiving: This is another function that’s been made simple for when you need to preserve email and documents for legal reasons, or if you need to access an employee’s email/files after they leave the company

4. Easily secure and manage your devices

  • MAM: Mobile Application Mangement is typically used for devices that aren’t owned by your employees, like personal phones or laptops. This type of management gives you control of company-owned email and files—but personal “data,” like pictures and texts, are not controlled with MAM. With MAM, your workers can use their personal devices to do their job without worrying that IT is controlling it. If a MAM device is ever lost or stolen, it’s simple to wipe all the corporate data from it.
  • MDM: Mobile Device Management: is the best option if your organization issues company-owned devices to your employees for work use. With MDM, you can centrally manage everything on the device, install apps on it, restrict the functions or usage, block recreational usage (kind of a buzzkill, but ok), just to name a few options. As with MAM, if an MDM device is ever stolen, wiping the corporate data or doing a full factory reset is easy.
  • You are able to set a minimum of security requirements needed for a modern midsize organisation.

The Microsoft 365 Business Premium strategy

Microsoft 365 business Premium is created to help midsize organization with their challenging ambition to be more productive and secure. It’s a known fact that not all small business have the possibly to provide a M365 E5 license for everyone.

  • Office apps and services
  • Advanced security + management
  • for 1-300 employees! Hard requirement!
Microsoft 365 Business Premium

Which features of E5 are included in Microsoft 365 Business Premium

Don’t choose Microsoft 365 Business Premium if…

  • I’ve met a lot of people who don’t dare to advice Microsoft 365 Business Premium because for a long time there were less features than today. And they don’t follow the evolution.
  • It is still difficult to grow to cloud-only. so take a good look to the things below that are not included.
  • It is important to know that Microsoft 365 Business Premium is focusing on a cloud-strategy. When you have a mid-size organization who is willing to shift to modern cloud solutions they will be able to shift if they make the commitment to remove these integrations. This product is created to work for cloud scenario’s. Are you able to decommission all of these workloads?
  • It looks difficult but the most services are replaced in cloud variants today. So it’s outdated technology with a high TCO.
  • Exchange Server, SharePoint Server, and Skype for Business Server Client Access License (CAL) equivalency is not included/licensed.
  • Windows Server, RMS, and Microsoft Identity Management CAL equivalency is not included/licensed.
  • System Center Configuration Manager and System Center Endpoint Protection Management License (ML) equivalencyis is not included/licensed.
  • Full overview here.

Microsoft 365 Business will include Azure AD Premium P1

Brad Anderson, Microsoft 365 Vice-President is referring to this blog: aka.ms/aadp1smbblog

High-level decisions to be made

  • Are you ready and able to stop investing heavily in your on-premises infrastructure?
  • Do you want to stop using, Exchange, SharePoint, Skype for business on premises?
  • Are you willing to shift your System center infrastructure to EndPoint Manager?
  • And at least, most important: Are you able to stop thinking Hybrid AND on-premises? Than GO, DO IT! Good luck! I’ve helped almost 5 customers to grow to full cloud. with no footprint in their local-AD. they are super exited and happy! Simplicity = key to grow.

New product names

The new product names go into effect on April 21, 2020. This is a change to the product name only, and there are no pricing or feature changes at this time. Maybe later.

Enable Microsoft 365 Security – Example from Microsoft

Set up tenant:Recommend settings – normal scenarioRecommended settings – high risk scenario
Decide between hybrid & cloud-only identityHybrid, Azure AD ConnectHybrid, Azure AD Connect
Azure AD Connect – sign-in methodPassword Hash SyncPassword Hash Sync
Azure AD Connect – single sign-onEnabledEnabled
Azure AD Connect – On-premises attribute for Azure AD usernameuserPrincipalNameuserPrincipalName
Azure AD Connect – Password writebackEnabledEnabled
Decide on email migration strategyHybrid AgentHybrid Agent
Configure DNS domainsSituationalSituational

Configure identity protection – example from Microsoft

Configure identity protection:Recommend settings – normal scenarioRecommended settings – high risk scenario
Plan for administrative accessRequiredRequired
Configure dedicated admin accountsRecommendedRecommended
Multi-factor authentication (MFA) for adminsSecurity defaultsRequired, Conditional Access
Multi-factor authentication (MFA) for usersSecurity defaultsRequired, Conditional Access
Self-service password reset (SSPR)Enabled-AllEnabled-All
Combined security information registrationEnabled-AllEnabled-All

Practical guide to securing remote work using Microsoft 365 Business Premium

This guide summarizes Microsoft’s recommendations for enabling employees at small and medium-sized businesses to securely work from home, using the features included in Microsoft 365 Business Premium is written above. Read the Microsoft Guide: Here with deep insights and knowledge of medium-sized business. Guide

Creating a security culture

Use the Chief Security Officer (CSO)

Succes Stories Microsoft 365 Business Premium

Something missing? Please leave a reply!

Search

Categories