Compliance and Security Are a Mind-Set

Vigilant companies must protect their environment with methodical planning and security best practices. Security and compliance audits are simple to achieve and do not break the bank. How you service these compliance audits is simply planning for them. This is where Office 365 is a must-have tool. Office 365 makes compliance audits simple because the compliance tools are built into Office 365. When you look at compliance, Microsoft cloud products are far simpler to use and easier to deploy than other methods. For years, Microsoft has been under the scrutiny of the Department of Justice (DOJ) and Federal Trade Commission (FTC) for many of its business practices in early 2000. This oversight has driven Microsoft to develop a common set of software-as-a-service (SaaS) products that are focused on business security.

Microsoft has developed products to address a fundamental business need, that is, to address internal compliance requirements. Today, these products form the basis of the Microsoft threat detection road map (see Figure 1-1).

It is also ironic that the pressures that Microsoft faced in years past are now the pressures that we all face in our businesses. That is, how can we create full transparency and information controls in our business practices? As I said, to start we need to change our mind-set. It is all about security and the road map that we use to get to our destination.

The Microsoft cybersecurity road map shown in Figure 1-1 ties all the Microsoft cloud services together. Before you can truly understand this road map, you need to understand where the data comes from and how it is collected. This is where the Intelligent Security Graph shown in Figure 1-2 comes into play. The Intelligent Security Graph is the base information source for Microsoft Threat Detection.

All new security models for preventing attacks comes down to the analysis of information. Microsoft published the Intelligent Security Graph as the basis of its security backbone. It is the collection of information from billions of devices and data from endpoints around the world. This information is analyzed to look at the user usage of Microsoft programs and at different attacks by bad actors. The data shows trends of attacks, which provides Microsoft with the necessary responses. In other words, this data allows the analytic tools to detect a bad actor and take the appropriate actions to combat the threat. The different Microsoft technologies such as Windows 10 Defender and Windows 10 Advanced Threat Protection (WATP) deploy these defenses automatically to the connected devices. WATP uses new behavioral analysis to defend the desktop and is included in the office 365 subscriptions for Windows 10 E5.

The simplest example of the impact of information collected in the Intelligent Security Graph is to look at the Office 365 login process. You have probably run into the situation where you try to log in to Office 365 in your browser and get prompted to try again. You know that the password is correct and cannot understand why you can’t log into the service.

When you look under the hood and you review the data collected in the Intelligent Security Graph, you will begin to understand that Microsoft looks not only at the location where you are logging into the service but also at how you logged into the service. The way you type your password or login ID is an important action. The pause between letters and how long you wait before you press Enter are other forms of identification. If I look at myself, for instance, my right hand types faster than my left hand. This tracking maps to a unique behavior and a predictable pattern. This is one of my “digital characters.” In this AI-enabled world, everything is collected and analyzed to determine whether it’s really you or a bad actor. If the Office 365 security mechanism classifies you as a bad actor, you need to provide some additional level of authentication to ensure you are who you say you are. In Figure 1-3, the learner builds a pattern for your account. The patterns are unique (albeit not 100 percent trustworthy) and provide a level of guarantee that you are indeed the correct person for the account.

As another example, say you use Microsoft security services to manage your account. You can link additional information about you to your account such as cell phone, e-mail address, office phone number, and answers to those pesky security questions. Any information like this is linked into the multifactor authentication (MFA) service and is integrated with Azure Identity Protection (more about this in Chapter 4). Combine this new security information along with a customized Office 365 portal and compute devices that are “joined to Azure Active Directory” and you have a secure compute environment. The integrated security of Office 365 is further enhanced with your credentials and user identity protection.

As a side note, look at your neighbors’ homes as you drive home from work. Do you see homes with alarm signs on them? Are the homes well-lit or dark? If you are a bad actor, which home would you pick to break into? Which home would give you the best opportunity as a thief? Would you pick the well-lit home with the alarm sign on it or the dark house with few lights on and no posted alarm sign? Your Office 365 organization is very much like your home. What are the tools that you need to look at to make it so the bad actors look somewhere else? What changes do you need to make in your business processes and basic configuration so that the environment is much more difficult to clone? Do you have a universal cloud-based signature (like Crossware, https://www.crossware.co.nz ) that signs all e-mail from all devices in the same way so you can easily tell whether your e-mail has been spoofed? You need to approach your SaaS security from this mind-set—assume that you could be breached and put tools in place to make it difficult for the bad actors to impersonate you.

You can add internal security controls with Azure privilege identity to control access to the Office 365 tenant by your administrators. Figure 1-4 shows my home page login for Office 365, and it is different from the generic home page login for Office 365. This difference is important for the simple reason that the bad actors do not expect it.

These items are simple to complete. These capabilities (and others) exist within the Office 365 security license. Once you add these capabilities, you have drastically improved the security of your Office 365 service, and in the process you have made your company less susceptible to attacks by bad actors. Remember, security is a mind-set. The way I approach security is to review weekly (and sometimes daily and hourly) the accounts that my organization manages for security. On these accounts we deploy the Microsoft 365 Enterprise E5 suite (a combination of Office E5, Enterprise Mobility Suite [EMS] E5, and Windows 10 E5 security software). This allows us to handle both proactive and reactive security. During my weekly review session, I look at the security of the Office 365 organization. I review a set of key reports that cover the health of the behavior of the employees. These behavior reports flag actions based on incorrect privacy data releases or bad actors impersonating users in the organization.

In Chapter 2, we will build the baseline reporting structure and detail of the reports that you need to review. After you set up and enable some basic Azure services, in Chapter 3 you will look at your Microsoft Secure Score for your cloud-based services and make changes to improve that score. You will use the Microsoft Secure Score for both Office 365 and Windows 10 E5 Advanced Threat Protection.

In another example, Figure 1-5 shows the Azure Advanced Threat Protection analytics (see https://portal.atp.azure.com ) to detect patterns of access. This is the new model for security. (The old model for security consisted of bloated data scanners looking at known bad program signatures.) The new model is an AI-based machine learning or deep learning model that looks at behaviors and characteristics. When you look at the data from the Microsoft Intelligent Threat Graph, the information that is detected across the user base is integrated into the different security tools. The new model incorporates behavior analysis of the data access and threat modeling of systems activities on desktop and mobile devices.

Detection today looks at how applications work and how users use the applications. This combination of data and usage collection develops an operational profile for the users. As an example, let’s look at Microsoft Word, which is a fancy text editor. It does not run administrator scripts or look at permissions (or change user permissions and access). You would not expect Word to invoke an administrator application that changes a user’s password or performs other administrative functions. The next-generation security software operates in this manner. It analyzes the applications (on a Mac or PC) and logs (or blocks) the nonstandard behavior when it is detected.

In addition, we are not faced with just security for the sake of security; we are also faced with new requirements on how governments expect us to manage our employees and customers’ information. Security is a broad topic, and Office 365 contains hundreds of product codes. This book is based on the configuration of a specific security suite called Microsoft 365 Enterprise E5.

To simplify the process, you will use the Microsoft 365 Enterprise E5 subscription as a base for all configurations. To continue on our security journey, you will need to deploy a Microsoft 365 E5 subscription and an Azure subscription. Azure Cloud Service Provider (CSP) subscriptions are nothing more than a payment commitment through a Microsoft cloud partner.

My goal in this chapter is to expose you to the different aspects of security in Office 365 and slowly help you configure your Office 365 and Azure security service. To get started on this journey, let’s look at the European regulation—the General Data Protection Regulation (GDPR)—that will have a major impact on how you manage personal information. Office 365 is designed around privacy. But for privacy to work, you need to conform to the new and upcoming regulations. The U.S. version of GDPR is coming. In fact, California has recently passed the California Consumer Privacy Act (CCPA), and many states are about to clone the same law. We all need to change our view about security and data privacy. Let’s take a quick look at the GDPR and then step through some Office 365 security features.

Personal Privacy and Individual Rights

Personal privacy rights require you to implement Office 365 Advanced Data Governance (ADG). The ADG capabilities are part of the Microsoft 365 E5 license that we are using in this book. The new data protection laws are about how we managed personal privacy. To manage personal privacy, you need to also manage the different cloud-based apps that are installed in the environment using tools like Cloud App Security. Everything is about personal data protection and the services used to manage personal information (see Figure 1-8).

The new GDPR rules require that any “personal” information that you access needs to provide the end user with the ability to manage that information. The definition of personal information is broad. Personal information is any information that is identifiable to the individual. If you collect information on videos and share information with affiliates, all of that information needs to be fully disclosed, and the end user must be given the ability to access their personal information, correct any errors associated with that data, erase the personal information from your business records, and object to the processing of the information (if you are a processor under the EU regulations, you can be exempt from managing any information about individuals and export all information that you have collected on them).

As a business manager, you need to seriously look at how you manage personal data and what controls you have on that data. If you are a multinational company that does business in the European Union, you are subject to data regulations—even if you are based in the United States. The privacy laws (worldwide, not just in the United States) are changing, and the data breach laws and the penalties for noncompliance are significant. One of the new features that Google is providing in the European Union to comply with the GDPR is the ability to destroy all information collected in Gmail accounts and the Chrome browser. This capability is slowly being introduced in the United States.

Controls and Notifications

The management of personal information is only one aspect of the new privacy laws. Other requirements are based on the type of data maintained. There is a fine line between personal information and health-related information, for example. The fines for data breaches and security are significant, and you need to use different data storage and encryption methods for the data that you retain. There is a requirement to notify “supervisory” authorities (local, state, federal and international agencies) when a data breach occurs. You need to get permission to process personal data, and you need to keep detailed records (with no time limitations) on how you process the data. Figure 1-9 shows the data visibility that you need to have in your company to meet the GDPR requirements.

The GDPR requires different rules for data controllers and for data processors. As an IT manager, you are required to manage the audit logs and security associated with different data types. In some cases, you will be the data processor, and in other cases you will be the data controller. In either case, how you manage, supervise, and review access to information is critical. How you use the different tools to manage this service (such as Compliance Manager in the Microsoft Security and Trust center to managed GDPR compliance) reduces your business liability as well as your personal liability.

Transparent Privacy Policies with Data Management

The latest federal laws require notification of the usage of private information, but the laws are so broad that no one really understands what is going on. What the GDPR has done is simplify the requirements. The GDPR has defined organizations that process information and organizations that supply information. The California CCPA does something similar. Under the GDPR, all data controllers and data processors are required to provide a clear statement (which needs to be approved by regulators) about data collection and what type of data is collected. There are also requirements on data processing as well as a full audit process for the data (what has been done, what was changed) and the data retention policy associated with that information and audit logs. In other words, you need a 100 percent transparent policy in how data is used, who it is shared with, and why. Along with this is a new requirement that the personal data can be deleted at any time if requested by the individual. This is also part of the California CCPA. As IT managers and CISOs, we need to look to the future and expect that personal information (from consumers, business associates, employees) management regulation will be more stringent; therefore, we need to develop the processes and learn to use the tools with Microsoft Security and Compliance center to address these new requirements.

IT Training and Responsibilities

All types of security require training . You need to establish the necessary process rules and train the IT personnel to manage the information according to the regulations. It is imperative that information is managed properly. GDRP requires that every company have a data protection officer (DPO) who has the responsibility to manage the information. The regulation also provides methods of contact and requirements for the users who have access to personal information.

Organizations will need to train individual who have access to personal information under the new GDPR privacy requirements. There needs to be a full audit of information access. In addition, vendors that transact against data from a data collector must be fully complaint with the GDRP requirements.

GDPR Next Steps

As the Corporate Information Security Officer (CISO) , my role has just expanded to the DPO role in addition to my traditional compliance role. It is no longer acceptable to use older tools that no longer meet the new data regulations. As the CISO, I need to be proactive and look at how to minimize my organization’s risk. The GDPR is a wake-up call on data management. The call to action for all of us is to reduce the amount of personal information that we collect and to implement additional management tools to manage our employees’ and client information. Information management is the key to managing our business securely.

Exchange E-mail Gateway/Advanced Threat Protection

Office 365 Advanced Threat Protection protects users from unsafe e-mail attachments and message URLs. The service can work in Office 365, work stand-alone, or in a hybrid environment when the e-mail services are routed through Office 365. ATP processes all URLs and e-mails that are sent to the user’s mailbox. These URLs are examined in real time and blocks access to bad sites and code. ATP also deals with dynamic threats. Dynamic threats are when the links in the e-mail are valid when initially processed by the service and later turn bad because of delayed execution payload. Figure 1-11 is an example of the ATP service executing on a delayed payload link.

Office 365 ATP also validates attachments. Office 365 ATP not only looks for unsafe links but also looks for unsafe attachments and will block them from the user’s mailbox. The user can still override the unsafe attachments, so no data is lost in the case of mischaracterization.

The Office 365 ATP service is included as part of the Microsoft 365 E5 license and is optional with all other 365 services. As a matter of recourse, I recommend that all clients include this license with their Office 365 service. In fact, my organization requires that any customer that we provide security support must purchase this license.

Windows 10 Defender Advanced Threat Protection

Windows 10 Defender Advanced Threat Protection ( https://securitycenter.windows.com ) is the next generation of behavioral threat and deep learning tool. This tool is included in the Microsoft 365 E5 security suite and is an optional tool of other Office 365 subscriptions (such as Windows 10 E5 subscription). Windows Defender Advance Threat Protection not only blocks malicious activity but also provides postbreach detection, investigation, and response to ongoing attempts.

Figure 1-12 shows a trigger on one of the alerts from Windows 10 Defender Advanced Threat Protection. In this example, a malicious activity was detected in a Word application. The Windows 10 Defender Advanced Threat Protection monitoring service detected and blocked the malicious activity. In this case, this attack was a kernel attack. Traditional antivirus software would not have caught this activity because traditional antivirus is signiture based. This attack was detected by the Windows Defender Advance Threat Protection AI behavioral change monitoring.

Another feature of Windows Defender Advanced Threat Protection is the historical analysis of various attacks on the user (see Figure 1-13). In this case, you can see a complete history of the users, the machines for which a user has logged in to the Office 365 and other services, and what type of behavioral problems were detected.

Windows Defender is built into the core of Windows 10 operating systems. In other words, it is not a third-party add-on, and it is integrated with the Microsoft intelligent security graph. Simply, this means that when a breach is detected in the various endpoints, Windows Defender ATP (the Windows 10 that includes the Windows E5 with Advance Threat Protection extensions) begins to monitor and block malicious activity in all connected endpoints.

As you deploy Windows Advanced Threat Protection in this book, you will also collect Windows Telemetry data. Windows Telemetry, when used with Windows Advanced Threat Protection, will give you the ability to identity lateral attacks that the bad actors use to penetrate your environment.

A lateral attack is an attack used to breach the defenses in a company. The bad actor looks for a weak entry point (such as a Mac with an out-of-date version of OS X or a 3-year-old BIOS). The bad actor breaches the system, and the help-desk folks try to remotely address the problem. The bad actors use the information from the help-desk access to attack other systems in the network. Windows 10 Defender ATP and Azure ATP help protect and identify this threat.

Cloud App Security

Cloud App Security (CAS) is a key component in the ongoing identification of security breaches. There are new apps released daily with new features and exploits, and users do not know whether an app is valid when they install it. They just download the cloud application and try the service and then uninstall the application. This is where malicious services will creep into the enterprise environment and exploit the user credentials and supply personal data to third-party services. Under the new data privacy laws, this is a data breach.

What Cloud App Security does is to detect the activity of users either from agents running on the local machine (agent-based) or via access to the firewall and other security appliances (agent-less) in the environment. Cloud App Security provides visibility into the user desktop activities, controls for sanctioned apps, deep integration with Office 365, integration with Microsoft intelligent graph to improve detection, remediation, and proactive management (see Figure 1-14).

When Cloud App Security (CAS) is deployed, you have access to analytics on user behavior. You have the tools to block activities and remediate problems. CAS supports detections for ransomware, access to subscriptions, and access to unauthorized data. This is a key tool that is used for compliance and data governance and is included as part of the Microsoft 365 E5 subscription.

There have been numerous situations where I had to review the logs of different activities to understand potential threats in SaaS-based environments. Cloud App Security is a must-have tool for security analysis .

Azure Identity Protection

Cloud App Security provides the tools to better understand the behavioral side of the user and provides the tools for remediation. There is another side of security management, and this is the Azure Identity Protection management. Azure Identity Protection allows you to detect potential vulnerabilities affecting your organization’s identities, configure automated responses to detected suspicious actions, and investigate suspicious incidents and take appropriate action to resolve them. The vast number of security breaches take effect when a user identity is stolen. The issue is knowing what to do to identify risk-based activities so you can track the activity and take appropriate action—leveraging the different ways to authenticate a person who is accessing your systems.

The approach that Azure Identity Protection uses is to classify users into three different risk categories: high, medium, and low. The AIP configuration allows you to take specific action based on the risk. As an example, a high-risk user could have their password automatically reset at the next login or be forced to use multifactor authentication) to log in. Azure Identity Protection uses two types of security (something you have and something you know). The Azure Identity Protection dashboard shows the users and how they access different activities (see Figure 1-15).

Figure 1-15 shows users who are at high risk. In this case, you have policies in place to act on when users are flagged for risk events and vulnerabilities. These are reports such as “Users flagged for risk,” “Risk events,” and “Vulnerabilities.” Risk events could include logging in from multiple addresses, logging in from nontrusted locations, or logging in from devices that are not registered with the Azure identity suite. These policy settings can enable multifactor authentication, password reset, and a reduction in access to different areas of Office 365. The goal of the Azure Identity Protection service is to mitigate risk while managing a user’s credentials. Integrate into this the Azure threat protection’s DNS detection services and you have significantly strengthened the security capability of your deployment.

Azure Security Center

Azure Security Center is an Azure service that assists you in monitoring and analyzing threats against your Azure and Office 365 infrastructure. In the Security Center, you can see a signal dashboard showing all your integrated services and the status of these services (Figure 1-16). You can also see the threats and the responses that you set up to counter the threats. The policies that you put in place are integrated into a single management policy.

When you think about security, you need to think of incident response and the processes that you have in place to address an incident. Typically, there are five phases with an incident: detect, assess, diagnose, stabilize, and close. The Azure Security Center has been designed around these five basic steps. The Security Center assists you in the management of the incident by giving you the necessary information to address the event .

Cloud based Advanced Threat Protection for endpoints

Advanced Threat Protection (previously called Advanced Threat Analytics) is about detecting threats using behavior analytics in your enterprise. What is unique about Azure ATP is it uses self-learning to build a behavior profile that represents your organization. Azure ATP is deployed on your domain controller and integrates into the Windows Security Center. The detection tool supports Windows desktops, Windows servers, Linux servers. The simplest example is to look at how your organization uses multiple devices to access information. When you access information from multiple sources, using multiple tools, this creates a blind spot in the organization on data management and user behavior. What happens is that you leave backdoors open for bad actors to gain access to your credentials. This opens the door for data breaches. Keep in mind that in this post-GDPR world, those breaches will need to be reported within 72 hours of the event.

This self-learning approach is used to dynamically create a threat profile in your organization while reducing the noise of the information collected. The Azure ATP tool is different than the Office 365/Azure privileged identity feature. Azure ATP is a self-learning tool that looks at the behavior of entities in your organization and helps you make decisions on the best way to handle security management in a deterministic fashion. Figure 1-17 shows the typical deployment for this tool on Azure or on-site servers.

Azure Log Analytics Suite

These are the basic configuration blades that are set up to add to Log Analytics. However, there are additional services that can easily be configured (see Figure 1-18). Typically, I recommend configuring the Office 365 services, the health agents, and the Windows telemetry devices. Depending on your infrastructure , you can deploy the data collection agents on your on-premises services or add them to different environments, such as your Windows servers hosted in a private data center. Accessing many of the new features for Azure security and monitoring is simple; just add an Azure CSP subscription to the environment. Once you have added the subscription, the Azure interface is enabled for the optional services.

Mobile Device Management and the Enterprise Mobility + Security Suite

Mobile Device Management (MDM) , Mobile Application Management, Windows Information Protection and the Enterprise Mobile + Security (EMS) suite are core components of the Microsoft security strategy. The main component of the EMS strategy is the Azure identity feature and how this relates to mobile device deployment. I have dedicated Chapter 5 to Mobile Application Management(MAM), Windows Information Protection (WIP) and Mobile Device Management (MDM). There are simple deployments (MAM/WIP) and compliance deployments (full MDM). In Chapter 5, I will go through the details of how to deploy this in your organization. MDM is managed from the intune dashboard Azure.

This security combination comprises the core offering with Office 365, and Microsoft offers different suites that are composed of a mix of these products (see Figure 1-19). Depending on the base product you are using, you can easily add different products to your Office 365 subscription. Figure 1-20 shows a good representation of the offerings. The prices listed are subject to change.

The subscription that I am using in this book is the Microsoft 365 E5 suite. This subscription is composed of the following components: Windows 10 E5, Office 365 E5, and EMS E5. These three components will give you the maximum configuration of Office 365 for your environment. As you read this chapter and deploy some of the advanced security features, you will deploy a Microsoft 365 E5 security suite. This will give you the capabilities that are needed to manage access and information .

Shield: Basic Monitoring

The Shield class of products is designed to provide basic monitoring services to any client. Companies that have a process-oriented infrastructure will use these packages to augment additional security service offerings. Companies that use MobileIron, a third-party antivirus package, will use this product. Most vendors will have an offering that looks like this. This basic package offers enough security products to provide basic monitoring, but if you are being targeted or are in a high-risk industry, you need to look at a higher-end offering.

Armor: Predictive Security Class

The Armor class will typically include predictive monitoring. In this case, I am referring to the configuration of services that can show you trends and analysis on your infrastructure. Data is collected from different endpoints (including Microsoft’s intelligent cloud) and presented in a series of dashboards that the IT manager/CISO can review to make business decisions. Data is collected and analyzed, and reports are generated. Companies that use this class of product have an existing IT staff that has experience in remediation and analysis of the company’s data. Basically, you have data being presented in a logical fashion where knowledgeable individuals can decide on the appropriate changes to the infrastructure.

Fortress: Proactive Security Class

The third class of products you typically see are the proactive security products. In this case, the example is the Fortress class. This is the high-end product with different types of security offerings targeted at high-risk industries. High-risk industries are defense contractors, financial businesses with compliance requirements, and any organization that manages large amounts of personal data. Products in this class include two distinct offerings: predictive analysis and proactive management. In this case, you need to have the skills to read the reports and make decisions on the different data that is being collected. The vendor that provides this service will proactively make changes in your security infrastructure to keep the bad actors out of the organization and protect the organization data.

As you look at different security products, you need to look at the offerings in respect to Office 365 because you want to use an integrated service offering. Table 1-1 shows the different options of the security products and how they overlap with Microsoft’s threat detection road map discussed earlier.

Table 1-1. Office 365 Security Product Feature Comparison (Courtesy of KAMIND IT)

It is important to look at product positioning and at what you are doing internally to make sure that you are aligned with the business. As you look at different product offerings, you need to step back and look at the services that are available in Office 365 and Azure. My goal in this book is to provide you with a good introduction to the various elements of Office 365—from a security perspective—and allow you to use those services as it makes sense for your business. There are two key security dashboards in Office 365 that you need to manage. These are the Security & Compliance Center dashboard and the Azure Advanced Threat Protection dashboard.