eSign PPT for Administrative Secure

Department e sign administrative ppt secure

a very good afternoon and thank you so much for having taken the time to have joined our webinar today my name is J and I am an identity and access management expert here at managed engine so before we get started with today's presentation I would like to take the help of you early-bird to you know quickly check the audio and video a quick audio/video check before we get started if you can hear me loud and clear I'm going to say one two three if you can say one two three on chat for confirmation that would be wonderful I'm saying one two three check please type one two three on chat and I would take that as confirmation oh lovely thank you so much for the confirmation guys thank you Steve Andrew and Jake thank you you guys are lovely so the next quick verification is on the video if you can see my screen that has the title for today's webinar please give me a thumbs up or a good to go sign awesome thank you again for the confirmation yes we are all set and good to go so it's always a wonderful sight to have you guys over for our management webinars this is a part of the global webinar series that we are conducting here at management so today's topic is going to be around IT security and identity access management so one important aspect of identity and access management that many a-times left unanswered is the IT security aspect of it so we treat I am an IT security as two separate entities of IT is that how it's supposed to be handled that is the million-dollar question so when we're talking about the office 365 as an identity and access management solution we will have to acknowledge and understand the fact that the migration towards office 365 has been phenomenal Microsoft in fact claims that the micros the Microsoft 365 office 365 migration has doubled in the last one year so as organizations are asked the number of organizations that are migrating their email services to office 365 and other cloud services increases it becomes almost impossible to do all of this all by yourself given the quantum of data that gets migrated during this process from your existing on-prem infrastructure to that on the cloud it is very obvious that organizations take the help of a third party vendor when that happens many times these third party vendors are very much equipped to do the migration but aren't security experts or aren't really equipped to also handle the challenges that come along with this migration what am I talking about right here so when this specific migration happens a quick audio check I've got a message from SIA that saying that my voice is not clear a quick audio check thank you Jake and Prashant for confirming perfect so yeah we were talking about office 365 migration so when you're talking about the security posture it becomes all the more difficult for an administrator to keep a complete tab on what is going to happen or what are the new variables that are in the picture right now so we would need to understand that when this migration happens the number of parameters or the risk score for your organization is eventually going to take a dip so you would need to embrace yourself or brace yourself with a tool or a solution that could essentially get you do this migration without a big challenge so what the US government did was they put together a best practice or or a guidelines essentially to cater to this specific problem so they saw huge transition happening towards the cloud huge transition happening towards office 365 so that being the case almost around October of last year the cybersecurity and the infrastructure security agency which is the C is a in shot they conducted several engagements with office 365 customers around the world they understood what was going wrong so much to the organization's shock most important factors of security were very much ignored there was tremendous oversight that was happening so this led to a huge series of mailbox compromises and account takeovers in the last one year we've got statistics that I'd be walking you through through today's session you would understand the intensity of what I'm talking about in a while so what do we have right here it seems like a perfectly happy organization all the employees look absolutely happy I'm pretty sure the administrator has done a great job in keeping them you know to date giving them all the resources that they need they seem to be an absolutely fine organization posing happily for the picture this is what you and I see but when it comes to an attacker that is least of his concern or least of her concern so what is the differentiator right here an attacker very much identifies a user based on their behavior they try to check how the user behaves on a day to day basis they try and draw profiles for each of these users so for an attacker all that matters is that one vulnerable user to get inside all that matters is that so in fact the attackers go to the extent of stalking the users for months together they understand their behavior they go to the extents of figuring out when does that user have their coffee when does that user take a break all just so that they can that right spot to get into your organization or breach your security so one thing that we need to understand is the security of your organization is only as strong as the weakest link and in this case the weakest link is going to be your users because I'm pretty sure you're all of you who joined me today are going to have a huge smile on your face when I say we still have users in our organizations who write their passwords on a piece of paper and have it stuck right on top of their desktop isn't that true I'm pretty sure you're nodding your head what are we going to do when we have such users though you try to improve your security Porsha there are always going to be a user who's who got sloppy at some point in time and given the fact that office 365 unlike your on-prem infrastructures isn't absolutely under your control why am I saying that because when it comes to your on-prem structure there are instances where you would have a complete see-through into every aspect of your system when it comes to a cloud infrastructure it is bound to have touch points that are beyond your control and also that now your users are not anymore working out of your office or probably working out of a coffee shop probably in a different geographical location in a different time zone that makes it all the more difficult for you to ensure that you have a security policy that caters to all these variables at the same time so what we need to understand is the attack that happens many a time goes absolutely unnoticed because the attacker takes considerable amount of time in preparing in researching in finding out that one vulnerable user and right after they get hold of that user the user need not even be an administrator does not even require enough credentials all that the user all that the attacker needs is one account and later after getting inside can request for privileges and somehow get hold of administrative privileges or somehow literally move as they call it you know it's a huge trend right now island hopping that's what they do they don't stick to one account they keep migrating between accounts or they keep literally moving between accounts so that they spread their line of control they do not just take hold of administrative accounts even the normal users some executive Wow if that is the case you know what's going to follow next an email from the executives account to the administrator asking for a privilege what is the administrator going to do so we are talking about compromised organizations that have lost millions of dollars because they were necessarily not able to contain the attack or not necessarily be able to discover that the attack had happened before it had cost tremendous damage so 68 percentage of these Brisas breaches take more than a month to discover what are you going to do right there and in fact the worst part is the management and the organization's together agree that they are undergoing attacks as old as phishing attacks and the worst part is one of every three organization out there in the last one year using office 365 had either at least at least one phishing attack of one event of that sort either noticed or unnoticed these are statistics that we were able to draw based on the survey that we've conducted so what does an attacker essentially try to do they try to get access to your system by taking over an account so all that they need is one account so they can impersonate a user when it comes to ATO as they call it or the account takeover as they call it the attacker looks for the weakest spot or the weakest user or the most vulnerable user whose actions can very much go under the radar they try to become you or that specific account got hat you know they could initiate lots of attacks afterwards they could try and bring in malware into your system so all this essentially happens because your users are not educated well enough so when we are talking about a phishing attack an age-old way of an email phishing attack nothing more complicated it is quite simple the email says it's from the Nigerian King the email says they're going to offer you a million dollars and all you had to do was just click on one link and probably fill up a detail your users are going to be tempted to do that and eventually end up not just compromising their security but compromising the security of your entire organization so what do you do at this point in time you would need to essentially try and have a holistic picture of your security landscape and how does that happen so to start off you will need to understand the types of attacks that your organization can necessarily undergo that starts with something as archaic or age-old as a phishing attack but then trust me the numbers right here are quite surprising users still fall prey for a phishing attack what are you going to what do you have to say about that ransom when they are on a rice they are higher than they were ever before what are we going to do about that and since office 365 being an application that involves called a collaboration and requires to be mobile your users are obviously going to step out of your office promise access critical resources in the organization from probably a public Wi-Fi probably from the train station or probably from a coffee shop essentially exposing your IT infrastructure for attack what are you going to do about that so what do we need essentially is nothing but an understanding of what goes behind so if you want to understand an attackers mindset this is going to be tremendously helpful when you want to counter the attackers initiative so we're trying to understand how does this attacker go initiating an attack taking over an account establishing control and then causing damage so you would very much be in a position to reverse this because you know how the attacker works so we're talking about a business email compromise we are talking about cases of account takeovers and what you essentially need to do is to equip yourself to understand and have triggers or have alert mechanisms that tell you when one of these five things happen so how are you going to get notified when something goes wrong that is essentially the idea behind today's session so you would need to understand what an attacker does the attacker essentially starts off impersonating to be someone else tries to establish a relationship with an employee in the organization and trust me the attackers are absolutely well room they know what to talk how to talk how to get your employees you know earn your employees trust the conversations happen over months together finally before they actually initiate the attack so that being the case you would need to inform your employees that if there are any malicious emails if there are any suspicious emails or someone's absolutely being unnecessarily or friendly trying to offer some gifts or whatever be it they need to be really really alert about that situation and also try and notify the administrator that something's not right so it starts off by ensuring that your users know what sort of attacks can they fall prey for so if it's a B EC that we are talking about a business email compromise that we are talking about it all starts with something as simple as a bogus invoice kiemce most of us would have already known the criminal takes hold of an employee's email address the account is used to send notifications to customers they in turn try and get wire transfers to their personal accounts the next one is the CEO of fraud Wow this has been quiet rampant in the recent times given the fact that getting hold of a domain name that similar to your domain name is not so difficult they try and you know come up with creative names that are very close to your domain name impersonate to be the CEO of a said company and then demand for payments so that is one another instance when you're talking about account compromise right after an account gets compromised like I already mentioned they try to island hawk they try to receive payments into their personal accounts impersonating to be an executive in the organization reaching out to the finance team in the organization and things like that and the worst of all these let alone the money that gets lost in the situation the worst of all these is data exfiltration how would you be in a position to get notified when data gets copied data gets transferred get a data gets deleted and essentially if it's proprietary data an intellectual property it's still okay and the organization is going to face a huge loss that's okay but when we are talking about personally identifiable information things like your user data things like your users personal information their social security number or something of that sort you are not just losing data but also essentially making yourself open to a huge lawsuit given the fact that there is gdpr in plays and lots of other compliance regulations that demand your user data is absolutely secure you wouldn't really want to take this risk it's when we are trying to essentially get your organization to be more mobile get your users to be octa productivity we would also want to consider the cons of such an event so here the simple agenda for this event is going to be like this so we want this to the security landscape so far we've been talking about what an attacker would essentially do how does an attacker understand the users profile how do they initiate an attack what is an account takeover and things like that so the rest of the session is going to be understanding cases of configuration vulnerabilities so where did I go wrong where did the organization make a mistake what vulnerabilities am i exposing myself to so we're going to be talking about that and then I'm going to be giving you the best practices as given by C is AR the homeland security and then finally I'm gonna give you one cool action item that you can go back and implement right away and email me back please do email me back after 24 hours and tell me how did your security posture improve so that is pretty much going to be the agenda for the rest of the 20 minutes so we'll start off by what C is a recommended so C is a went on to understand that the migration is inevitable and enterprises are moving to the cloud and in the last one year like I pointed out the attack the number of instances have been on the rise so they stepped in to understand what was going along and when they had engagements with these customers or enterprises they were able to find that there were a few loopholes there were a few points that the organization or the vendor who is doing the migration is dot the first and foremost thing is the multi-factor authentication so this is as basic as it could get a single factor of authentication is definitely not going to be enough these days passwords are bad as they are easy to guess and because basically who is configuring them your employees it's quite understandable that passwords aren't is necessarily any longer the most secure way of doing doing things so we would need to understand that passwords are vulnerable to a variety of attacks it could be a phishing attack t could be a brute force attack or it could be even a password spray attack and one of the easiest things that you can do to protect against password threats is to just implement multi-factor authentication with MFA even if an attacker gets hold of a user's password the password alone is definitely not going to be sufficient to authenticate or provide the attacker access to data so multi-factor authentication for users is okay if you've not enabled it it's still okay so if you are in the process of migrating to cloud I solutely understand it's a tedious effect altogether so I get that but when you're talking about not implementing mfa for administrators that is a criminal mistake because as your Active Directory has global administrators in office 365 they are the ones that have the highest level of administration privileges and is at a tenant level it is equivalent to your domain administrator on trim so what are we talking about so we are talking about someone who's got the keys to your kingdom and if multi-factor authentication is not enabled by default to these accounts there are high chances that everything about your security can go wrong because these accounts are exposed to the Internet the applications are cloud-based if not immediately secure everything about your organization security can go wrong so the first thing that you'll have to do is get back implement em FAS as easy as just a checkbox our way configuring a few questions and getting over with it would take less than 30 minutes for you to get the whole thing configured please implement multi-factor authentication at least for the accounts that have domain privileges or your global administrators do that the next one is going to be auditing turning on auditing many-a-times can be you know a thing that you would want to overlook how is it going to be of any importance unless it's the auditing season that if that is your mindset then I think we'll have to fundamentally reject this because when it comes to auditing your mail boxes trust me when you're doing a root cause analysis for a security problem you would find tons and tons of clues or you would actually even be able to find what went wrong from a mailbox audit report and many a times the biggest challenge for administrators is the audit logs so I'm gonna ask you a quick question and let's see who gets the answer right when it comes to auditing in office 365 for how many days thus office 365 let you save or archive the log data by default you are given a provision to archive log data how long do they let you archive that let's see who gets the answer right okay I've got Jake who says 60 days I've got Mogens who says 30 days let's see if you've got more answer Steve says 120 and Luke says 90 all right okay and mushy low says it's 90 we've got two people who have got the answer right today Marshall oh and Luke have got the answer right the answer is 90 days now I'm gonna follow up with follow that up with another question three months of audit log data is that going to be good enough when you're trying to do a root cause analysis for a problem that had happened five months ago because the first thing that we understood was the attacker stays in your organization for a considerably long time before they actually exfiltrate any data they take their time to reconcile understand your entire infrastructure and then do it one fine day even before you know or they've been exfiltrated data all along so it takes months together to discover that something had gone wrong so three months of audit data is necessarily not going to serve the purpose and that is where you would need a tool like 8360 the one in view today that would essentially remove the upper cap you could save your audit data however long you choose to save and all of it can be archived and password protected and encrypted and compressed and all of that making it really simple and at the same time giving you access to a unified dashboard that gives not just access to one particular type of auditing but then the entire realm of a talk about auditing administrator activity talk about auditing mailbox activity talk about auditing user logon log of activity the whole deal gets audited stored and it's available for however long you want from one single dashboard so that's what we would need so this is again a recommendation for which by default office 365 does not give you a great solution so that's where 8360 steps in when we're talking about the next point which is possible synchronization so now if you are that just moved into a short and you've been on premise all along so you have users to manage at both these places and you have enabled a li connect or you've enabled synchronization so this turns out to be a very big problem because if you've not configured it right or to be precise if you haven't configured it right for the right set of users that could be detrimental so here what we need to understand is once the security of your Active Directory is compromised let's say okay it essentially means that the security of your as your also is compromised because in my organization there are probably a hundred users on as you're all right and 150 users on Active Directory so the set necessarily need not overlap there could be users on Azure were absolutely not present on Active Directory you're compromising the security of those users as well and essentially when it comes to synchronizing passwords for administrators deal that with a grain of salt would you really want to enable synchronization for those accounts think twice before you've enabled synchronization for admin accounts so this is again a best practice not just password but generally synchronization between administrator accounts on Active Directory and on reserve think twice before you enable it and if you are doing it keep a tab on the admin activity have an alert set for activity by the administrators the tool that we are talking about lets you do that the last bit is about the authentication protocols that are in place so what we need to understand is when we're talking about something like multi-factor authentication it necessarily does not go great with the existing legacy systems the existing legacy systems do not care with MFA to be precise to office 365 lets you use your legacy systems come on now now when you're talking about security you still let users use legacy systems I understand they're doing it from a usability standpoint just to ensure that your users have easy access but if you are enrollment is not to block these authentications then you're very much exposing yourself to having a system that does not have a second factor of authentication so how are you going to prevent applications from not being able to access your tenants resources when there is no MFA in place again you're exposing it completely so we what we need is a conditional access policy a conditional access policy that very much understands our users access draws a risk profile for that user checks if the users accessing from a known environment checks the sign-in risk level and then lets the user access through a legacy authentication if there is a deviation if there is any malicious behavior if for all of a sudden there's an access in the middle of the night or from a different geographical location the conditional access policy that comes along with your office 365 stops and access alerts the administrator and then lets you go forward you know taking in the decision whether you want to let the user have access or not so it starts with one simple step I would strongly recommend do this right away after the webinar gets over it's not going to take a lot of time just enable multi-factor authentication I would say do it for all your users and it's become easier than ever before please look up for the mobile Authenticator that is out there it's from Microsoft it's easy to install easy to use let me try and quickly look up if I can get you the link for the mobile Authenticator from Microsoft just a quick second I'm looking that up rarely to check if I can give you access to the link and there you go I found it so in three two one and on your chat so go for the mobile authenticator install get your users to install it it is quite simple it's not anything that's rocket science your users can very much have it implemented right away and in fact the best part is it supports fingerprint it supports twin it supports all your traditional authentication that you do it for your Google or for your Facebook or the second level of authentication that you have for all the apps as simple as that but can make a world of difference so please do enable that so when you're talking about managing it from multiple tenants there comes the problem 8360 will let you manage multiple tenants which is the case and most of the time and also help you enforce MSA if need be not just give them an option but enforce MFA need be you can find specific users all across tenants and enable MFA for them that is going to be possible with 8360 the next aspect that I'd want you to remember go and implement is turning on audit logging so like eyerly a pointed out the tool has no limitation with respect to how long you want to audit data or save that audit data that is one good thing and number two since it has this unified dashboard that gives you an overview or an overall picture for all these auditing data please do enable the reports that are available turn those reports on it is as simple as a check box just get started enable auditing and go forward using the functionality to the fullest so you would get access to users activity all through you would be able to monitor mailbox activities you would be able to monitor admins activities and all of that so all you have to do is just enable auditing so if you do that you are going to get two things one and overview as to what's happening and number two I'm gonna break the suspense in some time it is called the secure score I'll tell you what's secure score and how is it essentially going to help you tackle your office 365 problems so turn on auditing data turn on mailbox auditing that is going give you access to all of that so if you want a unified dashboard that reports and also alerts if there is a deviation from usual behavior then you can very much turn that on in the 8360 alerts module so we've been talking about quite a few best practices given by C is a and in fact I would say in my personal opinion they've just covered the basics there is a lot more that can be done when it comes to enforcing security and doing it the easy way so just a few things that you could start off with is enable your spam and malware detection again a checkbox away they give it for you right away it's available in the security and compliance center please go to your security and compliance center and enable the malware detection as simple as that stop mail forwarding to external email address as a best practice I would suggest you can ask your email users to never at all forward emails to external domains many times insiders in the organization with malicious intent or someone who wants to you know take a dig at your organization after they leave your organization essentially try and leave backdoor access points into your infrastructure it starts with something as simple as a mail forwarding most of the times it gets overlooked what if I tell you you can have an out-of-the-box report that tells you who are the users in your organization's who've set mail forwarding to external email ID so you would not just be able to see those email IDs but instantly disable or perform an action right on top of those emails have them disabled at any capacity so we're talking about removing suspicious mail forwarding this is exactly what an attacker does as well not just your insiders attackers do the same thing they try and literally move and get hold of ask any number of accounts as possible and then go on setting touch points for them to get access back into the organization the next one is the mobile devices so when we are talking office 365 we are talking mobile we are talking mobility so what essentially happens right here is the compromise on security for usability and abilities so you would need to understand that and take a proactive step right here get hold of all the devices that are there new organization and if you're an organization that favors bring your own device policy please do get a list of all your user devices it could be the order for cell phones it could be their tablets it could be the smart laptops or whatever be it get hold of all those device details and have it uploaded into the solution when there is a deviation when there is a new device that is connecting for the first time accessing an application say for example logging into one way of trying to copy some data trying to do something malicious trying to forward an email or do any activity that they were not supposed to do because they are a new device you would get a notification so this is something that you could do track mobile devices that are connected to your office 365 and trust me you're going to save a lot of trouble the next one is tracking sensitive information on emails again this is a best practice that I'd want you to implement so organizations have intellectual property at multiple levels you can have those keywords in enter into the search query and you can save an alert and start checking if anybody is sending out emails with those keywords or what you could do is you could get to the office 365 manager module of 8360 and enable a condition based search based on the inputs that you give based on the way you train the system if a data of particular saut be it credit card information be it personally identifiable information be it some social security number something of that string type something of that pattern gets shared or copied or moved or sent across you would get notified and in fact we are working on a proactive way to implement a solution that can stop such data being transferred or stop that from being deleted or destroyed based on the content or the condition that you've said the next one is the pattern based search like in the previous case you can have an automatic configuration that searches for specific patterns across your organization and checks if there is any being transferred maliciously you could very much do that as well and on top of it I would strongly recommend have a policy that audits your one-room have a policy that audits your SharePoint if you see malicious copy-pasting activity deletion activity you would need to be in a provision even if not able to stop it but at least in a position to immediately get an alert that you can curtail the damage or minimize the damage so you would need an automation search engine that lets you do that so all of this boils down to one simple step which is the Microsoft secure school and this is the most important piece for the day they take away for the day that I'd want you to go back and implement right away the secure score dashboard is available for free please go back enable the secure score - both start using it I'm going to drop the link to the secure score right now and I want you to tell me what is your secure score I'm gonna quickly pull up my secure school and show you how much I've got so let's see what is my secure score just a quick second ok here you go you've got my secure score dashboard and it says ninety three out of five or seven let's see who's got a better secure score than I have okay I have Andrew who's got almost twice as much as I got he's got 195 I've got Christina who's got a 226 Wow that is really cool at what Mogens who's got 275 that's the highest so far great going that's the highest so far all right so we've got Mobius who stands out to be the clear winner he almost three times more than my secure score my score is pathetic guys trust me so it all boils down to just starting off an enabling of you functionality so it very clearly tells you what you are lacking so when I want to understand how can I improve it gives me access to improvement actions as well so these are essentially the list of things that I will need to do to enhance my secure score and it is going to reflect i less than 24 hours it starts off with something as simple as turning on multi-factor authentication that was the first point that we discussed today didn't we so term multi-factor authentication on and that's going to give you a score of 50 and instant boosts to your secure score and trust me when you do this over time repeatedly I will suggest you do it once in a month you are going to get a list of new options that you can work on and consistently prove your organization you're working towards improving the secure score and it gives you a very beautiful report at the end of it it analyzes your secure score in the past it analyzes your secure school now and it also analyzes the secure school when you alter it and it gives you a consolidated time-based report that tells you how have you graduated your organization security turning on mailbox auditing I told you right so you get gives you ten more points simple but you know useful actionable items right here enabling password self-service for users that is an kick-ass way to do it enabling malware detection like I told you enabling mailbox auditing in enabling mail forwarding rules all of that just those tasks that I told you turn them on and I'm pretty sure you're gonna get a hundred extra on your secure score dashboard so please go back turn them on tell me how much did you get what did your secure score improved to and I would love to hear what you have to say or how much did you get just a quick second while I toggle back to my presentation so there you go so we've got the Microsoft secure dashboard right there to help you tell where exactly you stand and how exactly can you improve as simple as that just one action item for the day please do that get back improve your secure score just enable a few things and tell me how exactly it changed your score at the end of the day so you would also get access to details as to what are you preventing your organization or securing your organization against things like ransomware things like password cracking all of that are going to no longer be a problem so what I'm going to do is I'm going to share a link to downloading the office 365 security guide that we have jointly written I would want you to send me a quick email on JY at manage engine comm for you to get access to this interesting ebook that we have written the one that is going to be changing the way you operate office 365 recommendations that are going to make your office 365 exponentially secure all you have to do is write to GA y at management comm which is my email address I'm gonna write back with the link to the e-book with the link to the best practices with the link to downloading today's presentation and the video if you want you guys have been lovely I hope you found this session to be useful and interesting and informative thank you so much for being such a wonderful audience my name is Jay your presenter for the day you all have a great day bye-bye