Information Protection - Jasper Bernaers

Modern Workplace security: 5 steps to use Microsoft Teams in a safe way

By Jasper Bernaers | May 24, 2020 | Comments 0 Comment

In this blog I will go through 5 basic security improvement for organization that are shifting to Microsoft Teams. Also read my previous article: The Value Of Microsoft 365 E3 and E5.

Security improvements are embedded in Teams, it just needs activation

I’ve met a lot of organizations over the last months implementing Microsoft Teams, and I really love to see the fast-deployments, the big-activation, simple communication, dedicated onboarding.

Did you know that Microsoft Teams is not an addition to Office 365, but an integration of multiple services?
Did you know you can integrate the product better in your current workplace than ‘we’ think?
And thousand other possibilities – now that’s the problem, right? We do not really knew, before..
I know I’ve used Microsoft 365 E5 licenses. You can figure something out without CASB and with Azure Premium P1 + EndPoint Manager.

Introduction: Microsoft Teams Architecture

Did you know that Microsoft Teams is part of Office 365 or Microsoft 365 and is using: Azure AD, OneDrive, SharePoint, Exchange Online, SharePoint, Yammer, Stream, etc all out of the box. I mean, I suppose your organization will use deep integration when shifting to Microsoft Teams. Let’s dig into solutions now!

1. Identity Protection: MFA + Azure AD Conditional Access Policies + Risk Policy

The first step is to have a security-identity. Everything comes to Identity security and authentication – access management in general.

It’s still a best practice to activate Multi-Factor Authentication. I’ve written a lot about this in my previous article.
Activate Conditional Access to not get craziness of pop-ups and deliver a productive workplace.

Force a password change when assuming breach, risk-policies to be sure you can harbor save identities.

2. Registration for Windows 10: Device Onboarding

Make your Windows 10 devices known in the organization. So you have them in control, and you can do smart things with knowing.

Register or enroll your devices into Azure AD to provide an identity-token to the device. This identity is used to authenticate the device when a user signs in and apply conditional access rules that require domain-joined or compliant PCs.

Hybrid Azure AD Join: Enables devices in Active Directory to register in Azure AD For Access Management.

Go through Autopilot and let new devices join in Cloud-Only modus. With an Hybrid Identity. I’m not fan of doing registration only. It has value, but you can give than only Access Management. I’ve seen companies being able to go direct with Autopilot and shift to only Cloud Modern Management and have the devices in Azure AD only. It’s not a requirement Cloud or Hybrid. But it can help with straight-forward implementations.
Later you can do EndPoint Manager. Deploy Microsoft Teams, and the Office 365 suite to all endpoints.

3. Block downloading of document on non-trusted devices

If your device is not trusted. Accessing corporates data should be possibly (sometimes not, I know) but different than a real trusted device.

Set simple and transparent conditional access policies. Don’t make it to complex.
You could use this App Control (preview) to easily block downloading of ANY Office 365 document on a ‘non-trusted’, ‘non-compliant’ device.
Keep in mind, when using this. If you only select Exchange, it still impacts Teams, SharePoint as stated in the tip in the first screenshot.

4. Intune App Protection policies for Mobile Devices

You’ve covered your identity, your Windows 10 devices. You’ve covered your non-trusted devices and now your mobile devices.

I like to get feedback on this one. I’ve done App Protection policies on multiple customers without changing any definition of the standard policy you can create from: https://admin.microsoft.com – there is nothing wrong with standards. Better a policy activated than no policies.

Or you can use the App Protection Policy Data Protection Framework. It provides 3 levels op App data protection configuration. (github)

Level 1 enterprise basic data protection – Microsoft recommends this configuration as the minimum data protection configuration for an enterprise device.
Level 2 enterprise enhanced data protection – Microsoft recommends this configuration for devices where users access sensitive or confidential information. This configuration is applicable to most mobile users accessing work or school data. Some of the controls may impact user experience.
Level 3 enterprise high data protection – Microsoft recommends this configuration for devices run by an organization with a larger or more sophisticated security team, or for specific users or groups who are at uniquely high risk (as one example, one organization identified users who handle data whose theft would directly and seriously impact their stock price). An organization likely to be targeted by well-funded and sophisticated adversaries should aspire to this configuration.

Access requirements: You can find this in: EndPoint Manager

PIN for access: Require
PIN type: Numeric
Simple PIN Allow
Select minimum PIN length 4
Touch ID instead of PIN for access (iOS 8+/iPadOS): AllowOverride
More details in the 3 screenshots for iOS. I’ve also created a policy for Android.

5. Knowing the risks with Cloud App Security

You’ve covered your identity, your Windows 10 devices. You’ve covered your non-trusted devices and your mobile devices. If there is something slipping in between activation or something is missing. I suggest to use Cloud App Security to see data exfiltration, etc..

As you can see in your Cloud App Security portal the ‘possibility’ to understand the block download policy is there.

You can dig deeper to understand what happened. In the demo movie on the top I’ve showed left a trusted environment, on the right a non-trusted ‘personal computer’.

You can go further with automation from here. But I will not go deeper into this in this article. Because I believe that if you have these 5 steps you have already achieved somethings.

Next steps?

Identity protection(1) – automated remediation and creation of service-desk ticket to respond to your risky users.
Compliance policies(2) – to not let devices slip under the fingers of IT-departments. You need a process to be sure all devices are passing the same process. And are totally blocked if not.
Block downloads on non-trusted devices. (3) Go further, this implementation above is a great opportunity because of the easiness of implementation. Information protection is next. Because people can exfiltrate data when e-mailing, syncing, copying on their corp device, and their home device. And that’s a thing that should not be possible, anymore.
Automate actions with CASB. Label your exfiltration expert. And create processes IF there is something wrong. The right people in the chain of command are informed.

Next improvement is a future blog! Thanks for reading.

I hope you enjoyed reading. Please comment below!

When and why should you start with Microsoft 365 business Premium

By Jasper Bernaers | May 3, 2020 | Comments 0 Comment

Earlier I’ve brought the article: The value of Microsoft 365 E3 and E5. Due the request I’ve written this article about Business Premium. To respect the content of the previous article the creating the modern workplace is crucial to read before reading this one. Global value of the Microsoft 365 stack will be the same.

The value of Microsoft 365 Business Premium

1. High-level

Cloud strategy to become a modern organization that will tackle the on-premises complexity and grow to a modern cloud-first organization.
Some Microsoft 365 E3 or E5 features are included to enable and empower the people to reset their own password. Some are part of AD premium P1 features: Others are: Cloud App Discovery, Office 365 ATP, Application Proxy, Dynamic Groups, Passwordless authentication.
WHY? This product is made for companies under 300 people. And has more value because of this specific offering in the market. The price is lower. It has features of Microsoft 365 E3/E5, but there are constraints because the cloud-only focus. This will push the investment to consolidate on-premises workloads to M365 Business Premium. You will read the details below.

2. Defend against threats

Office 365 Advanced Threat protection to be protected with Safe Links, Safe Attachments, Anti-phishing intelligence.
Advanced multi-factor authentication. You can choose to bypass MFA from trusted locations.
You can enforce Microsoft Defender on your Windows 10 PCs with enhanced protection against ransomware and malware.

3. Protect business data

Data Loss Prevention: Microsoft 365 Business Premium can automatically detect when an email you’re about to send includes sensitive data like credit card info, social security numbers, and dozens of other confidential data types. If you’re just conducting normal business. But, if you’re about to do something dumb, it’s a welcome safety net. There are even templates that can conform to geographic or industry-specific regulatory requirements.
Encryption of email and documents: If you need to send sensitive data to a partner or customer outside your organization you can encrypt that email with just one click. This ensures that only the intended recipient with the right credentials can open the email.
Information protection: You can use this function to control who has access to company information. Whether it’s in an email or a document. By applying restriction that prevents people form forwarding, copying and printing.
Archiving: This is another function that’s been made simple for when you need to preserve email and documents for legal reasons, or if you need to access an employee’s email/files after they leave the company

4. Easily secure and manage your devices

MAM: Mobile Application Mangement is typically used for devices that aren’t owned by your employees, like personal phones or laptops. This type of management gives you control of company-owned email and files—but personal “data,” like pictures and texts, are not controlled with MAM. With MAM, your workers can use their personal devices to do their job without worrying that IT is controlling it. If a MAM device is ever lost or stolen, it’s simple to wipe all the corporate data from it.

MDM: Mobile Device Management: is the best option if your organization issues company-owned devices to your employees for work use. With MDM, you can centrally manage everything on the device, install apps on it, restrict the functions or usage, block recreational usage (kind of a buzzkill, but ok), just to name a few options. As with MAM, if an MDM device is ever stolen, wiping the corporate data or doing a full factory reset is easy.
You are able to set a minimum of security requirements needed for a modern midsize organisation.

The Microsoft 365 Business Premium strategy

Microsoft 365 business Premium is created to help midsize organization with their challenging ambition to be more productive and secure. It’s a known fact that not all small business have the possibly to provide a M365 E5 license for everyone.

Office apps and services
Advanced security + management
for 1-300 employees! Hard requirement!

Which features of E5 are included in Microsoft 365 Business Premium

Shared Computer action – to active Microsoft 635 Apps when becoming active on a workstation.
Manual retention policies and sensitivity labels
Office 365 Data Loss Prevention (DLP) for emails and files
Email archiving
Basic Office Message Encryption
Company Branding
Self-Service Password Reset
Office 365 Advanced Threat Protection (ATP) Plan 1
Windows Defender Antivirus
Device Guard
Windows Information Protection
BitLocker and BitLocker To Go
Windows AutoPilot
Windows Hello for Business
Windows 10 Business Premium. Exact details here / FAQ
Cloud App Discovery as announced in this article
Dynamic groups as announced in this article
Application Proxy as announced in this article
Passwordless authentication as announced in this article
Service description: Microsoft-365-business-service-description

Don’t choose Microsoft 365 Business Premium if…

I’ve met a lot of people who don’t dare to advice Microsoft 365 Business Premium because for a long time there were less features than today. And they don’t follow the evolution.
It is still difficult to grow to cloud-only. so take a good look to the things below that are not included.
It is important to know that Microsoft 365 Business Premium is focusing on a cloud-strategy. When you have a mid-size organization who is willing to shift to modern cloud solutions they will be able to shift if they make the commitment to remove these integrations. This product is created to work for cloud scenario’s. Are you able to decommission all of these workloads?
It looks difficult but the most services are replaced in cloud variants today. So it’s outdated technology with a high TCO.
Exchange Server, SharePoint Server, and Skype for Business Server Client Access License (CAL) equivalency is not included/licensed.
Windows Server, RMS, and Microsoft Identity Management CAL equivalency is not included/licensed.
System Center Configuration Manager and System Center Endpoint Protection Management License (ML) equivalencyis is not included/licensed.
Full overview here.

Microsoft 365 Business will include Azure AD Premium P1

Brad Anderson, Microsoft 365 Vice-President is referring to this blog: aka.ms/aadp1smbblog

if you're a part of a small/medium business, take a second to check out this good news:
Microsoft 365 Business is about to get full Azure AD Premium P1.
this is a VERY powerful capability, and you can learn more about it here: https://t.co/1dFYHvRXGW pic.twitter.com/5BU9AlDot9
— Brad Anderson (@Anderson) April 10, 2020

High-level decisions to be made

Are you ready and able to stop investing heavily in your on-premises infrastructure?
Do you want to stop using, Exchange, SharePoint, Skype for business on premises?
Are you willing to shift your System center infrastructure to EndPoint Manager?
And at least, most important: Are you able to stop thinking Hybrid AND on-premises? Than GO, DO IT! Good luck! I’ve helped almost 5 customers to grow to full cloud. with no footprint in their local-AD. they are super exited and happy! Simplicity = key to grow.

New product names

The new product names go into effect on April 21, 2020. This is a change to the product name only, and there are no pricing or feature changes at this time. Maybe later.

Office 365 Business Essentials will become Microsoft 365 Business Basic.
Office 365 Business Premium will become Microsoft 365 Business Standard.
Microsoft 365 Business will become Microsoft 365 Business Premium.
Office 365 Business and Office 365 ProPlus will both become Microsoft 365 Apps. Where necessary we will use the “for business” and “for enterprise” labels to distinguish between the two.
Source: https://www.microsoft.com/en-us/microsoft-365/blog/2020/03/30/new-microsoft-365-offerings-small-and-medium-sized-businesses/

Enable Microsoft 365 Security – Example from Microsoft

Set up tenant:	Recommend settings – normal scenario	Recommended settings – high risk scenario
Decide between hybrid & cloud-only identity	Hybrid, Azure AD Connect	Hybrid, Azure AD Connect
Azure AD Connect – sign-in method	Password Hash Sync	Password Hash Sync
Azure AD Connect – single sign-on	Enabled	Enabled
Azure AD Connect – On-premises attribute for Azure AD username	userPrincipalName	userPrincipalName
Azure AD Connect – Password writeback	Enabled	Enabled
Decide on email migration strategy	Hybrid Agent	Hybrid Agent
Configure DNS domains	Situational	Situational

Configure identity protection – example from Microsoft

Configure identity protection:	Recommend settings – normal scenario	Recommended settings – high risk scenario
Plan for administrative access	Required	Required
Configure dedicated admin accounts	Recommended	Recommended
Multi-factor authentication (MFA) for admins	Security defaults	Required, Conditional Access
Multi-factor authentication (MFA) for users	Security defaults	Required, Conditional Access
Self-service password reset (SSPR)	Enabled-All	Enabled-All
Combined security information registration	Enabled-All	Enabled-All

Practical guide to securing remote work using Microsoft 365 Business Premium

This guide summarizes Microsoft’s recommendations for enabling employees at small and medium-sized businesses to securely work from home, using the features included in Microsoft 365 Business Premium is written above. Read the Microsoft Guide: Here with deep insights and knowledge of medium-sized business. Guide

Creating a security culture

Use the Chief Security Officer (CSO)

Succes Stories Microsoft 365 Business Premium

Something missing? Please leave a reply!

The value of Microsoft 365 E3 or E5

By Jasper Bernaers | April 15, 2020 | Comments 1 comment

Creating the modern workplace!

Digital business transformation. Every company has a digital transformation initiative. Microsoft 365 drives this digital transformation.
Increasing agility. The ability to respond to and drive market change quickly is the fundamental measure of business agility.
Empower information workers and firstline workers so they can collaborate and communicate better. Internally as with customers.
Support different working styles for millennial’s, Gen Z, Gen X, Baby boomers.
Generate better intelligence and analytics with a single view into your company information!
Increase mobility. people are working from home. From clients and during travel. In regard to collaboration, 98% of information workers collaborate or communicate with someone else at work on a weekly basis.
Improve security and compliance. Most of the time there is no control of data compliance in the current on-premise environment. Security systems are complex and static without growing or proven improvements. Start with a Zero Trust model.

Microsoft 365 E3 OR E5?

Decision making is crucial. Also simplicity. Make IT-system simple to move faster and support your business better. 2-3 Flavors of license scenario’s or strategies will be great. Don’t mess with addons id you will not use or active them..build trust, choose platform, choose Microsoft.
Start with activating basic security mechanisms. Start support of what you are using. grow. Don’t buy E5 when you are not mature enough, yet. Buy E5 and enable CASB to understand shadow IT or act when people extract crucial organization data… etc..
Don’t think it’s complex. Even when your company size is 50 people. You could start using Microsoft Business, full cloud. With real value and benefits as in Microsoft 365 E3. You could even use M365 E5 for small business when data control and cloud security is required.

Office 365 – standard set

Every company is using e-mail, calendar, contacts move to exchange Online. it’s a proven standard.
Voice, Video, Meetings. Microsoft Teams. It’s used by 500.000 organization and became a standard. Shift to Microsoft Teams for better collaboration.
Office ProPlus: Everyone is using rich office clients: Word, Excel, PowerPoint. It’s there for decades and became a standard.
Planner, Yammer, OneDrive, SharePoint,.. it isn’t always a standard but we currently have tools to Plan tasks, Share thoughts, Share Documents and colleborate in our organization. Proven standard

Office 365 – advanced

‘Built-in’ Analytics – did you know there are free/default/built-in dashboards for a lot of Microsoft 365 Services. I know. These are not organizational related. So they can give rich insights of usability of Office 365 tools.
Workplace Analytics for example: Measure progress toward transformation goals or Evaluate effectiveness of change efforts. Measure meeting hours, Discover inefficient processes, Identify hurdles to innovation, Gaps in learning, Identify Influencers,..

MyAnalytics: It’s not to control – it’s to to help to find out how work is done. People in your organization can find out their own habits because of their Analytic-insights.

The bigger picture – Why?

To bring value of Microsoft 365 E3 or E5 it’s important to understand the bigger picture. In the underlaying topics I’ve brought as much features in the eco-system of the E5 license. The main question is what are the benefits for a organization to shift to cloud solutions?

1. Protection across the attack kill chain

This slide shows the real value of Microsoft 365 E5. A lot of customers al laughing with MDATP because they think this is a isolated product. And are going deep in the license compare strategy of their current antivirus. Have a separated anti-spam solution, NO Azure AD Protection, NO cloud App Security..

2. Microsoft 365 E5 license includes

O365 ATP, Windows Defender ATP, Azure ATP + Cloud App Security. Detailed descriptions can be found on the website of Microsoft.

3. Cloud App Security

Cloud App Security shows you exactly whether data is passing on all endpoints. Document data, lateral movements, usage of applications, global traffic, count of applications in use in your organisation. Risk levels, GDPR proof applications. Bring network devices logging in CASB to have more insights.

4. Security & Compliance

I’ve seen that there a not enough organizations aware of the richness of the Security & Compliance possibilities in Microsoft 365. Because of shifting to Microsoft 365 the compliance will be in control of your organization. Even if you leave some file-servers and SharePoint services on-premise.

5. Identity & Access management

Because of simplified Identity management organizations are able to work with Security perimeters to protect their users and organization. Because of these simplified configuration users will be able to reset their own password, control their own devices, or configure additional security components. (ZERO-IT)

6. Self-Service Password Reset (SSPR)

The SSPR possibility Is an Azure Active Directory (AD) feature that enables users to reset their passwords without contacting IT staff for help. People can unblock themselves and continue working no matter where they are.

7. Managed Mobile Device

Cloud intelligence drives management. Use Autopilot to roll-out new devices and Increase productivity, reduce help-desk costs and Provide the best employee experience. Manage you Windows 10 devices and your mobile devices. Stop allowing personal devices without taking control of organization data. Use MAM and be diplomatic for end-users.

8. Microsoft Defender Security Center Security operations dashboard

The Security operations dashboard is where the endpoint detection and response capabilities are surfaced. It provides a high level overview of where detections were seen and highlights where response actions are needed. USE your built-in possibility for SECOPS reporting. You HAVE IT.

9. Identity driven Security

Because of the use of a single identity in Azure. Or hybrid synced from your local Active Directory services organizations will be able to protect and automatically act when necessary. request for update your password if breached. Ask MFA when your device is not trusted. etc.. let your users update their password from home. Increase productivity.

10. Risky Sign-ins

This great feature will bring based on cloud intelligence insights to understand the RISK of a user. for example unfamiliar location, anonymous IP addresses, leaked credentials.. (more info here)

11. Information Protection

To start with classification and labeling of document choose your battles. Define 1-2-3 labels for example: “High-Confidential Internal Only”, “Public” and “Internal Only”. It’s a good start without auto-labeling documents so people can learn how to protect their confidential data. In a later phase you can enable auto-labeling when a document is highly confidential because of there are credit-card numbers, personal information etc in this document. The activation of Information Protection could come from the fact that 1 million files are shared with external people. Or that you want to stop third-party applications so company data stays safe in the environment.

12. Advanced Threat Protection

Work with Microsoft Defender Security Center (previous WDATP) it will give you insights for Applications, OS, Network, Accounts, Security Controls + Give insights for Software patching, Top vulnerable software, Top exposed machines. Most reports are built-in and seamless integration is done in the Eco-system of Microsoft 365 E5.

Threat & Vulnerability management dashboard

13. Windows 10 Enterprise with modern approach

Windows 10: My personal favorite. I really love customers which did their homework and started using Windows 10 without policies, governance, Intune (for example), management solutions and now they are stuck in the patching & management of these systems. This is wrong!

Microsoft Windows 10: Windows 10 has been released to insiders in 2015. version. 1507 afterwards 1511, 1607, 1703,1709, 1803,1809,1903,1909. Microsoft did understand the pain of shifting from Windows XP to Windows 7, Windows 8 to 8.1 and Windows 10. And now they want you to work on this NEW versions in a different way.

Microsoft’s Windows 10 Enterprise: comes in the flavor of continues improvement. And needs to be implemented in a service-model with automatic updates, roll-outs, deployment, patching, updating, software requests (self-service) and even more!

Set compliance policies: Because of deep integrations you will be able to work on the compliance of the devices and grow to a recurrent update-model.

14. Desktop Analytics

Thanks to desktop analytics you will be able to evaluate the changes during updates as software distribution and compatibility issues. You can bring your organization to a next level. In case you were afraid that automation took your job, think again. These things need huge attention!

15. Native PowerBI Integration

Because of the rich Eco-system within Microsoft 365 everything can be measured. This report is default/standard without any manipulation of Power-bi. I know it sounds stupid, but without insights that can grow fast. You have nothing. Features/services are changing every year. Be prepared. Start consolidation and start using standards to built on.

Action Plan

Create a STRATEGY to bring value for Microsoft 365 E3 or E5. Do you want to: increase agility, empower information workers create intelligence increase mobility short: Drive transformation. AND invest in your SECURITY MATURITY -> than you should start with a STRATEGY. Non of all these things are technical. Even if we think it’s technical. DECIDE.
PLAN: Everything starts with a plan. PLAN to start a Microsoft Teams pilot, to evaluate, to pick-up the finding. and plan to go further. Most important PLAN to write a ROADMAP which describes the road ahead.
READINESS CHECK: Are you technically READY to start with a Microsoft Teams Roll-out? Is your company READY to start? Are the people READY to start? Is everyone involved? Are you READY?
IMPLEMENTATION: This is the easy part. Implement Microsoft Teams. Enable the features, check the boxes. Activate the subscriptions, copy the templates. Start the Pilot. Ask experts to deliver the technical requirements.
NEW WAY OF WORK: Microsoft Teams as used in this example as ‘new tech’, think about the groups we had in the top of the article. millennial’s, Gen Z, Gen X, Baby boomers. Do you think you should make some scenario’s? training and standard adoption programs to help them work as they never did before? YES!
TRANSFORM(ATION): Real transformation is successful when you KNOW/MEASURE it went well. Wen you see the activation/usage ratio in numbers. When you know the people are confident and happy to use new technology. When nobody is complaining and the organization has grown to a higher level of collaboration. And even when it fails or needs more improvements start over with this S-P-R-I-N-T.

Thank you for reading!

Jasper

The top 10 security recommendations to consider while working from home!

By Jasper Bernaers | April 12, 2020 | Comments 0 Comment

Mobile working is a standard, today.
Companies are not longer protected by their infrastructure in their corp-environment.
Crucial document data is moving away from centralized systems because it’s easier to work on them on our own document systems.
The irrelevance of bombastic systems in corporate environment is holding collaboration down.
Does it sounds familiar?

the 10 security recommendations we should consider while working from home!

Identity Security / MFA
Install the latest patches and updates
Passwords and management
Build real-time reports of security risks
Create automated and intelligent alerts
Install antivirus on all endpoints
Secure devices and corporate devices (+ personal phones)
Evaluate regularly which users have access to data, devices and networks
Track, change and block access for temporary projects and when employees are leaving your company
Use information protection solutions to protect your data everywhere.

1. Identity protection

Some facts: 1.2 million of all Office 365 or Microsoft 365 accounts (each month) are compromised. This represents 0.5% of all accounts in your environment. Source: theregister-co-uk

Multi-factor authentication prevents 99.9% of all attacks.

Activate MFA, It’s easy.
Run a Microsoft Attack Simulator. It cost 2 hours. And will show the potential risk.
See which account has most likely been compromised through risky sign-ins.
IMAP, POP3 disablement and implementation of MFA in 1 click? Enable Azure AD Security Defaults

99,9% compromised accounts did not have MFA

2. Patching & updates

Take control of all devices in your organisation with Microsoft EndPoint Manager.
Take control of Mobile Devices, or at least use Mobile Aplication Management and protect your corporate data. (iOS, Android, W10, MacOSX,..)

3. Passwords and management of authentication

Create a password policy. Check if 100% is during renewals. Enable MFA for everyone. In case you don’t do it create policy for example: IF not with MFA than set password +100 characters. (for applications, not users) etc..
Microsoft has advised to disable password renewals in this article. I think it’s possible IF you are doing multiple other steps of this article.
Start using Windows Hello For Business
Start using Passwordless Authentication
Start using Self-Service Password Management

4. Create real-time reporting of security vulnerabilities

Identity risks are in every organisation. Don’t think that your changes are low. Check the facts.
It is very easy to use ‘risky users‘, ‘risky-sign’ ins and ‘risk detection’ to find out real risks.
Integrate with Microsoft Defender ATP and ATP Sensors to have all intelligence in the Microsoft cloud.

5. Create automated and intelligent alerts

There is only 1 answer. Microsoft Cloud App Security.
Create alerts when 100 files are deleted. Copied to Dropbox for example.

6. Install antivirus on ALL endpoints + go beyond antivirus

Microsoft Defender ATP, sentinel-one, Norton, McAfee, it doesn’t really matter. As long as you are able to protect all endpoints.
The second factor is to make sure that your antivirus is enabled. Use a single console. OR use MDATP. Set security alerts so you know when you are at risk.
Use EDR monitors to detect and respond to advanced attacks in real time.

7. Secure private(personal) devices and corporate devices

workstations and portables (With W10 for example) are in control in most of the companies. Mobile devices are left unmanaged because we don’t know the options.
With Intune (EndPoint Manager) you can isolate and segment applications without having to manage the device. The corp. applications is under control. The organization’s data is protected. The most important thing is done!
Choose a fingerprint, faceID worst-case pincode in app protection.
Below you may find an example of the Outlook application which is protected by Mobile Application Management. In case organisations are not the owner of these devices this is a great option. And simple to implement.

8) Evaluate regularly which users have access to data, devices and physical network

Cloud App Security shows you exactly whether data is passing on all endpoints.
Document data, lateral movements, usage of applications, global traffic, count of applications in use in your organisation. Risk levels, GDPR proof applications..
Bring network devices logging in CASB to have more insights.

9. Track and block access for temporary projects or employees leave the company

governance without enforcement is just good advice.
Create simple written policies, enforce policies.
Create retention policies for example in a Microsoft Team that removes the team after 180 days.

10. Use information protection to protect your data everywhere

Use Information protection to protect document data. Even if you lose the document “physically”. There are still options to block this from opening and keep in secure from distribution, opening, editing,..
Create document data insights from on-premises and cloud solutions with Microsoft Information Protection Policies.

Conclusions

Security priorities are difficult. However, I would always start with MFA becasue this is fundamental identity security. Afterwards document and device security. Because companies are moving to Teams during Covid-19. And you don’t want data leakage during this time.
If your identity is not secure, and compromised, there is no point in doing information protection. Because a ‘hacker’ will use your accounts to access your corporate data.
Use Microsoft Securescore.microsoft.com as a guidance. Extract your priorities.
Let’s do it!

Secure your corporate information, not your devices!

By Jasper Bernaers | February 1, 2020 | Comments 0 Comment

Introduction

I’ve seen multiple customers struggling with their corporate information. Most of the time this data is secured in a traditional way without flexibility to collaborate.

Result: People find other way to collaborate: Dropbox, OneDrive, Box, Mails, Private-mails, whatsapp,..

You don’t want your personal data published on the web. Why do we allow organizations to be less secure with OUR information?

Goal: If you are curious about your data at this moment, setup a fast pilot traject. In 24 hours you will have real insights in your organization.

Environment: Office 365, Fileservers :-), Box, Dropbox. Connect!

What’s your strategy for protecting and governing sensitive and business critical data?

Please comment if you managed to protect your data with a control mechanism. You have great insights and known your possible leakage.

Why should you work to protect information within corporate environments

Users are accidentally sharing information
Users copying sensitive data for future use
Organizations not knowing what they have and what’s exposed at this moment
Users negligently sharing improperly with internal or external people
Sensitive data has being accessed or stolen by unauthorized persons
…

Use Microsoft native solution to discover your crucial data!

Start with labeling of your information cross-platform to get actual insights!
Labeling doesn’t mean it should be actionable – it’s just a state of reporting!
later: classify, protect and monitor your sensitive data everywhere – cross platform.

See your actual data in compliance center

Create some retention labels at your: Compliance Center
How to create labels: Microsoft Docs

Pilot project – High-level startup

Deploy AIP Scanner in discovery mode and start with analysing your data
Configure MCAS & AIP scanner
Define and publish some labels and policies
Create DLP and pop-up rules based on specific labels
And now start!

Pilot project – results

Discovery of sensitive info in endpoints and servers and services
Let people start with manual Labeling of documents and emails. (with default, simple, understandable labels!)

More information?

Did you know Microsoft is leading in “Enterprise Information Archiving”?
Find more Information on: Protection voor Office 365
Microsoft Information Protection – Ignite 2019 recap
Also see my article about the Value of Microsoft 365 E3 and E5.

Modern Desktop implementation – Behind the scenes

By Jasper Bernaers | January 25, 2020 | Comments 0 Comment

Introduction & Vision

At Synergics we truly believe the mission of Microsoft to empower every person and every organization on the planet to achieve more. Every great implemented project start with a vision and with goals/milestones.

In the first project we delivered workshops to understand the transformation needs of the organization. we identified these digital outcomes below. (the description is basic, I know. But it’s another side-traject of this implementation)

Empower information workers and firstline workers so they can collaborate and communicate.
Simplified communication – Communicate through the full organization.
Increase agility for the IT-Organization – adaptability.
Futureproof design – Technical design, cloud first strategy.

You can read the reference-case in NL or FR! Microsoft Surface with Windows Autopilot ensure efficiency gains and easier IT management for the city of Lokeren. Reference Case.

Evolution to modern management – 100% CLOUD!

Less complexity
built-in automation
brand-new configuration & policies
higher security standards
self-service possibilities
100% CLOUD!

To achieve more it’s important to give control to the people (empower), update your platform, easier roll-out’s of new devices etc.. (Scenario on the right, 100%…)

New device setup experience with Autopilot

Imaging/cloning/etc of devices is taking a lot of crucial time – compared to Autopilot. This isn’t the easiest enabler because there are policies, GPO’s, in place. With Autopilot we deliver the roll-out of the Windows 10 Devices and sync back the Device-Object so on-premise resources can still be accessed in transition for future plans.

– Old GPO’s can stay for some time.
– New possibilities of modern management becomes active.

Microsoft Windows update in waves & delivery optimization

It looks like a easy job but most of the time it’s a non-controlled mechanisms.

Windows 10 started in 2015 with builds as: 1511, 1607, 1703,1709, 1803,1809,1903,1909. As you see can in the screenshot, now we are transforming to 1903! and 1909 starting soon.

Delivery optimization
Updates in collections – pilot/key users
Peer-to-peer distribution

Hybrid Identity – and password write-back

I was hoping to write cloud-identity but we still live in a world of on-premise infrastructure waiting to move to the cloud. For now we are creating and maintaining identities on-premise. We enable password-write-back so users are able to change their password.

No Servicedesk calls anymore for password resets
Multi Factor Implementation, check!
Self-Service Password Writeback!
Hybrid-Identity

Intune mobile device management authority

Intune is the entry-point! Cloud!

Office 365 ProPlus distribution based on dynamic collections

It sounds very easy but I’ve seen a lot of customers fighting with licenses and automated processes.

When a user is in a M365 E3 dynamic collection because of the parameters Office ProPlus is automatically distributed.
When a user has no ProPlus acces, like a O365 F1 user, office 365 ProPlus will be removed.

Onedrive Known Folder Move (KFM)

There are two primary advantages of moving or redirecting Windows known folders (Desktop, Documents, Pictures, Screenshots, and Camera Roll) to OneDrive for Business for the users in your domain:

Your users can continue using the folders they’re familiar with. They don’t have to change their daily work habits to save files to OneDrive.
Saving files to OneDrive backs up your users’ data in the cloud and gives them access to their files from any device.
This has value, value, value. Users can find their documents on their phones because of the automated move. When there workstations crashes, the data is still there..

Microsoft Defender Advanced threat protection

All devices are fully managed under the greatest MDATP. (also see the quadrant)

Multi-layered protection: Microsoft Defender ATP provides multi-layered protection (built into the endpoint and cloud-powered) from file-based malware, malicious scripts, memory-based attacks, and other advanced threats
Threat Analytics: Contextual threat reports provide SecOps with near real-time visibility on how threats impact their organizations
A new approach to Threat and Vulnerability Management: Real-time discovery, prioritization based-on business context and dynamic threat landscape, and built-in remediation process speed up mitigation of vulnerabilities and misconfiguration
Built-in, cloud-powered protections: Real-time threat detection and protection with built-in advanced capabilities protect against broad-scale and targeted attacks like phishing and malware campaigns
Automated security, SecureScore and +10 more features!

Enterprise state roaming (ESR)

With Windows 10, Azure AD users gain the ability to securely synchronize their user settings and application settings data to the cloud. Enterprise State Roaming provides users with a unified experience across their Windows devices and reduces the time needed for configuring a new device. Enterprise State Roaming operates similar to the standard consumer settings sync that was first introduced in Windows 8. Additionally, Enterprise State Roaming offers:

Separation of corporate and consumer data – Organizations are in control of their data, and there is no mixing of corporate data in a consumer cloud account or consumer data in an enterprise cloud account.
Enhanced security – Data is automatically encrypted before leaving the user’s Windows 10 device by using Azure Rights Management (Azure RMS), and data stays encrypted at rest in the cloud. All content stays encrypted at rest in the cloud, except for the namespaces, like settings names and Windows app names.
Better management and monitoring – Provides control and visibility over who syncs settings in your organization and on which devices through the Azure AD portal integration.
Even next to KFM! Even more great for data loss etc..

Future achievements..

Everything starts with the value of Microsoft 365 E3 of E5.
Analytics and data. My-analytics, Workplace Analytics?
Security Operations – Advanced hunting?
Proactive services – thousand scenario’s possible..
Automation in processes with Power Automate?
Deep integration with third-party applications?
…

Exchange Online Conditional Access App Control

Protect apps with Microsoft Cloud App Security Conditional Access App Control

By Jasper Bernaers | January 5, 2020 | Comments 0 Comment

A lot of companies are struggling with data leakage when it comes to their exchange online environment. Easy fix! Enable: Microsoft Cloud App Security Conditional Access App Control! First, check the 7 seconds demo. It explains the unnecessary words!

Scenario:

You have all your devices enabled in Microsoft’s endpoint manager aka Intune
You are able to have an inventory and control of your hardware assets (CIS Control 1)
You are using Office 365 or Microsoft 365.
You don’t want users to download their e-mail attachments on a non-company owned device. (other scenario’s possible!)