Security & Compliance: Core Concepts Explained
- 1. Security & Compliance: Core Concepts Explained Azure Thames Valley User Group Alan Eardley • @al_eardley 16 March 2021
- 2. Al Eardley @al_eardley blog.eardley.org.uk Head of Modern Workplace www.cps.co.uk greyhatbeard.com @greyhatbeard PowerPlatform.London/Home @LondonPPUG M365SandCUG.tech/Home @M365SandCUG
- 3. What will I cover? The problem The solution The benefits Next steps
- 4. The problem
- 5. Terminology • The experts talk about technology using words no-one understands • The differences between features are not always obvious • Microsoft have used words interchangeably over the years • … and they change the names of products 🤨
- 6. Definitions • The protection of computer systems and networks from the theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide Security • Conforming to a rule, such as a specification, policy, standard or law Compliance • The system by which the current and future use of ICT is directed and controlled Governance
- 7. The solution
- 8. Stories, metaphors and pictures BORDER CONTROL FAIRGROUNDS LIBRARIES
- 9. Who are you?
- 11. And who are you again? Allowed? User Device Location Content Who are you? Are you who you say you are? How do we know?
- 12. Authentication • Who are you? • How do you prove it? • Do I trust your proof? This Photo by Unknown Author is licensed under CC BY-SA-NC
- 14. Single-Sign On • If you pay at the entrance can you go on any ride? • Do you have to pay for each ride? This Photo by Unknown Author is licensed under CC BY-NC-ND
- 15. Are you allowed? Allowed? User Device Location Content What device are you using? Is it secure? Have you lent it to a child or friend?
- 16. Microsoft Intune
- 17. Are you allowed? Allowed? User Device Behaviour Content Where are you? Our network? Coffee shop? North Korea? Is that normal?
- 18. Microsoft Defender for Identity
- 19. Are you allowed? Allowed? User Device Location Content What are you accessing? Finance data? HR data? Secret sauce recipes?
- 21. Are you allowed? Allowed? User Device Location Content What are you accessing? Finance data? HR data? Secret sauce recipes? Where are you? Our network? Coffee shop? North Korea? What device are you using? Is it secure? Have you lent it to a child or friend? Who are you? Are you who you say you are? How do we know?
- 22. Where do you want to go?
- 23. Permissions
- 24. Entitlements • Request keys • Approve the request • Track who has the keys • Get the keys back when they are no longer needed
- 26. What do you want to look at?
- 28. What do you want to do with it?
- 31. Microsoft Defender for Office 365
- 32. How must we manage it?
- 33. Content Lifecycle Create Retain Dispose
- 34. Retention
- 35. Disposition
- 36. eDiscovery
- 37. Monitoring
- 38. Microsoft Cloud App Security
- 39. Microsoft Defender for Office 365
- 40. Azure Sentinel
- 41. Manage and Train
- 42. Secure Score and Compliance Score
- 44. Summary
- 45. Definitions • The protection of computer systems and networks from the theft of or damage to their hardware, software, or electronic data, as well as from the disruption or misdirection of the services they provide Security • Conforming to a rule, such as a specification, policy, standard or law Compliance • The system by which the current and future use of ICT is directed and controlled Governance
- 46. Are you allowed? Allowed? User Device Location Content What are you accessing? Finance data? HR data? Secret sauce recipes? Where are you? Our network? Coffee shop? North Korea? What device are you using? Is it secure? Have you lent it to a child or friend? Who are you? Are you who you say you are? How do we know?
- 47. Permissions Request Grant Review Revoke/Renew
- 48. Content Lifecycle Create Retain Dispose
- 50. Questions?
Editor's Notes
- #4: Problem – Why is it so hard to explain security and compliance? In fact what is the difference, and where does governance come in to it? Solution – Use images and stories to explain the features Benefits – hopefully much easier to remember Next steps – what should you do if you need to assess and implement changes to your tenant
- #5: Why is it so hard to explain security and compliance? In fact what is the difference, and where does governance come in to it?
- #13: Do I have data to compare your answers to? Password only
- #14: Please provide two forms of identification As well as seeing your passport, I want to check that you are the same person so I will check that your physical attributes match those stored on the passport I will check that you have another device that you can use to enter the right information - I trust you if you have two devices that are both aligned to your identity
- #15: Imagine a fairground with many rides. Single sign-on would be paying to get in at the entrance to the fair ground and then being able to go on every ride without having to pay any more The alternative is not paying at the front gate and then paying for every ride individually
- #17: If the device you are using doesn’t have a PIN, it may not be secure, it may not be you If the Apps are not allowed by the organisation Even apps need to have security so that in a restaurant when your child is playing they can’t accidentally send your boss or a client an email
- #19: When you suddenly turn up in a Ferrari rather than the Ford you usually drive, that will trigger a warning If your credentials have been found on the dark web You may be asked to go through a higher level of authentication, or have your access blocked Security Posture assessments – check for known vulnerabilities Alerts aligned to industry standard events and monitoring tools Monitor and profile user behaviour and activities Protect user identities and reduce the attack surface What is Microsoft Defender for Identity? | Microsoft Docs
- #21: I choose the level of authentication based different factors: Where have you authenticated What device are you using Where you are coming from Where you want to go - Are you passing through or staying for a while Is your identity safe? What application are you logging in to? Terms of Use Different level of authentication
- #24: Some doors are open Some doors are locked You have a bunch of keys that you have been given that allow you in to certain rooms You can ask for other keys
- #26: Complex set of controls Invite a user into our environment Send a link to a specific item and change the permissions on that item What application? What location Sensitivity classification of location
- #28: Each room contains content Documents, data To be created and edited
- #30: Marking – make sure people know that the document is important Secure documents by forcing people to have a key to open If you borrow a book We may want you to use the key every time to open the book - encrypted You might be able to use the book for a while without a key – time between auth
- #31: Warnings Set off an alarm if a book or document passes out of the organisation Prevention Slam the shutters down to prevent the book leaving
- #32: Check for malicious content in emails arriving Check that links are to safe locations – Email and Teams Anti-virus Anti-phising policies Attack simulation
- #35: Keep content for a period of time Tax records Guarantees Design documents
- #36: When should content be removed? Should it be deleted Should it be reviewed
- #37: When you need to find information from the whole library
- #39: Monitor activity React to activity Notifications Rules based on frequency or quantity Pro-actively add sensitivity to content What is Cloud App Security? | Microsoft Docs
- #40: Microsoft 365 Defender - Microsoft 365 security | Microsoft Docs Unified management of For EndPoint For Office 365 For Identity MCAS Manage incidents and see timeline of attack Manage investigations
- #41: Listening not just to Microsoft 365 but any system Azure Firewalls Custom solutions Complex rules on how to identify anomalous behaviour Sophisticated responses What is Azure Sentinel? | Microsoft Docs
- #43: Compare your configuration to required legislation Get recommendations on how to improve the scores Manage tasks to improve your score
- #44: Send an emails to test how well staff respond to threats Identify where more awareness and training is needed