Swedish Windows Security User Group

Today marks a significant shift in endpoint management and security. We’re launching the Microsoft Intune Suite, which unifies mission-critical advanced endpoint management and security solutions into one simple bundle. The new Intune Suite can simplify our customers’ endpoint management experience, improve their security posture, and keep people at the center with exceptional user experiences. Microsoft Security and Microsoft 365 deeply integrated with the Intune Suite will empower IT and security teams with data science and AI to increase automation, helping them move simply and quickly from reactive to proactive in addressing endpoint management and other security challenges.

Microsoft Intune is an industry-leading, unified endpoint management solution that organizations depend on to ensure their devices, operating systems, and apps are up-to-date, protected, and performant. Yet evolving work habits and security threats, tougher economic climate, and growing diversity of devices mean that organizations need more help in reducing complexity. Consider this: in a recent survey, two-thirds of respondents were using more than ten tools to manage and protect their digital estate.¹ More individual tools mean more management overhead, more attack surface, and more licensing costs—all things organizations need to reduce.

In this blog, I want to share three reasons why the new Intune Suite will matter to you:

1. Even better security by reducing attack vectors.
2. Simplification through consolidation and automation of IT and security operations workflows.
3. Savings through lower management overhead and reduced support costs.

I’ll also share some results from our latest survey of nearly four hundred endpoint management and security professionals, which will provide additional context for this new offer.

What is the Microsoft Intune Suite?

First, let’s review what capabilities the Intune Suite offers. These important capabilities have been in development for a while, and you may recall we announced our plans at Microsoft Ignite 2022 to launch the Intune Suite in March 2023 with an initial set of advanced solutions:

• Remote Help is a tool that will assist helpdesks—especially important as workers are now working away from the office more often. Remote Help is already available for Windows users and will also come to Android and Mac endpoints in future releases. It enables IT helpdesk teams to remotely troubleshoot a user’s desktop and mobile devices based on a user’s existing company identity. The extra Android support will prove particularly useful for managing frontline workers’ devices. Learn more about recent Remote Help updates for Windows.
• Endpoint Privilege Management, in preview in March 2023 and generally available in April 2023, will enable the controlled elevation of Windows standard users so security controls don’t get in the way of productivity. The right users will have the right privileges at the right time, to reduce the security risk of overprivileged users and reduce the burden on the help desk by allowing greater self-serve for basic scenarios, like setting up a local printer. Learn more about Endpoint Privilege Management first release capabilities.
• The Intune Suite also offers advanced endpoint analytics features, data-driven insights that help IT administrators understand, anticipate, and improve the user experience for the staff in the organization.
• There is also Microsoft Tunnel for Mobile App Management, a micro-VPN that connects corporate resources from personal iOS/iPadOS and Android devices, so employees can have access to company resources from their personal mobile devices when duty calls.
• The Intune Suite improves the management of specialty devices, to give employees the flexibility to choose the device they need to get the job done without those devices becoming points of vulnerability. 
• Following the March 1, 2023, launch, another capability that will be added to the Intune Suite is advanced app management, offering an enterprise app catalog and controls for easy app discovery, deployment, and automatic updating to mitigate risks introduced by out-of-date apps. Later this year, we will also introduce a cloud certificate management solution to issue and manage VPN and Wi-Fi certificates from Intune to devices without on-premises infrastructure. We will continue to add additional advanced capabilities to the Intune Suite over time, providing more endpoint security, automation, and control of the user computing landscape and experience.

So, why is this important for you now? It goes back to better security, simplification, and savings.

1. Improve security and reduce attack vectors

Even if IT and security organizations are becoming accustomed to supporting and protecting remote and hybrid work, our surveys show there is still much work to be done to improve enterprise endpoint security. Only 43 percent of endpoint management and security professionals said that their organization actively manages more than three-quarters of their endpoints.¹ Put another way, 57 percent of organizations do not have visibility or control over a quarter of their endpoints or more. Further, only 37 percent of organizations use patch management, and only 39 percent use Endpoint Privilege Management. As such, there is clearly an opportunity to increase the breadth of devices organizations can manage to have a more complete view of the health and performance of their digital estate. There is also an opportunity to improve the depth of protection offered through more Endpoint Privilege Management and more regular patch updates. This basic “cyber hygiene” is core to the way the suite improves security and is foundational before any Zero Trust initiative can really gain traction.

Security professionals see tighter product integration as a key step. When asked in our survey how they could improve their organization’s endpoint security, “integration” was the top answer. The Intune Suite delivers integration on multiple levels: between the various Intune Suite components, with Microsoft 365, and with other Microsoft Security assets. Better integration means fewer vulnerable spots that could be attacked. Microsoft has learned to be intentional about creating integrated value across its portfolio and with the Intune Suite, we are committed to continue building end-to-end value for users, IT, and security operations.

One extra advantage of using a single vendor for more of your endpoint security needs is that there is one single dataset rather than multiple disparate streams of data. Uniform, consistent data means better security analytics and visibility to potential vulnerabilities and anomalies. You can’t mitigate what you can’t see. Bringing together the data and actionable insights in one place increases your ability to assess, manage, and act on potential risks across your device landscape.

“The Microsoft Intune Suite is going to help us consolidate our endpoint management solutions, saving costs, making our lives easier, and keeping the hospital data secure. I would highly recommend the Microsoft Intune Suite to any organization looking to enhance their security posture.”—Ibrar Mahmood, IT Cyber Security Manager, Milton Keynes University Hospital NHS Foundation Trust.

2. Simplify endpoint management

Many organizations have reported increased complexity within their IT environment over the past few years. This makes sense: smartphones, bring your own device (BYOD), hybrid work, and evolving security threats can all increase complexity. Yet, the response to the current complexity has been to add more point solutions, which is a step backward as more solutions mean more vendor integration requirements, possibly creating additional attack surfaces.

Given other top IT priorities—cloud migrations, lowering costs, AI, analytics, and staff retention—it is understandable why endpoint tools have not been consolidated yet. However, I believe that the simplification and consolidation of endpoint management tools is needed quickly. By choosing the Intune Suite, you can simplify your approach to advanced endpoint management, meaning more bandwidth to focus on other priorities in 2023 and beyond.

Simplification also enables the consolidation of your security vendors—A Gartner® survey reported in September 2022 that 75 percent of organizations are pursuing security vendor consolidation in 2022, up from 29 percent in 2020.² This not only presents the opportunity to reduce risk and direct licensing costs but saves time and mental overhead in not having to manage so many supplier relationships.

One example of reduced mental overhead: the Intune Suite also simplifies your IT and security operations. One unified admin console means unified workflows. You no longer need to hop from one admin console to the next or stitch together workflows.

We are dedicated to helping organizations use the power and data of the cloud to further automate and orchestrate IT workflows to cut complexity. As Omdia recently put it, when ranking Microsoft a leader, in the Digital Workplace Management/Unified Endpoint Management Platforms, 2023 assessment, “The sheer scale of signals Microsoft has visibility of enables more analytics, automation opportunities, and insights across the endpoint estate than any other UEM vendor.“³

3. Enable cost savings

Many C-suite executives are looking for cost savings in 2023—the Intune Suite delivers multiple ways to save.

First, the Intune Suite reduces the overhead of negotiating and overseeing separate contracts with multiple vendors. It means less integration of work between components and training on different tools. It also means fewer costs from employee downtime due to a security breach and lower IT helpdesk costs through fewer inbound calls and faster resolution of remaining tickets.

National Railway Company of Belgium (SNCB) easily manages more than 21,000 devices with Microsoft Intune. “Intune is a huge success story for SNCB,” says Bouke Stijns, Chief Information Security Manager, SNCB. His team fully containerizes SNCB applications on smartphones so that the company can’t access employees’ personal apps and data. He also appreciates that compliance with the General Data Protection Regulation (GDPR) is built into Microsoft solutions and the Microsoft licensing model, which optimizes the IT budget in an industry that allocates resources to passenger experience rather than IT expenditure. “Our Microsoft license offers an extensive set of security solutions that optimizes budget and reduces the number of vendors we need to coordinate with,” he explains. Read the full customer story.

Second, the Intune Suite bundled list price is lower than the sum of all the individual capabilities of the Intune Suite and delivers Microsoft integrated value greater than the cost and overhead of managing alternative vendor solutions.

The bundle is available as an add-on to any plan that includes Intune, which most customers get through the value of their Microsoft 365 subscription. For added flexibility, the individual solutions within the suite will also be available as standalone add-ons to Intune, so organizations can migrate to the Microsoft solution they prioritize based on their needs. 

Additionally, for advanced features that extend the value of Intune beyond core endpoint management functionality—for example, protecting and managing specialty devices or Tunnel for Mobile App Management for unenrolled devices—we are introducing a new plan, Microsoft Intune Plan 2, that you can buy for specific, targeted users. 

Learn more about the new Microsoft Intune plans and pricing.

“I’m eagerly awaiting the migration of all our mobile devices to the Microsoft Intune Suite as our core UEM System. Looking into the migration, we just know—due to the work the team and Microsoft put into Intune the last years—that we are making an exciting step forward to an even better reliable and integrated UEM platform for our mobile devices, better preparing us for the future and all challenges that lie ahead.”—Florian Weisenberger, Product Owner Mobile Workplace iOS, Audi.

The net effect of the new, comprehensive Intune Suite, Intune Plan 2, and the single solution add-ons to Intune offer organizations flexible options to plan their budgets, IT and security lifecycle, and vendor contracts in a deliberate and calculated way—with security, simplification, and savings in mind.

Join us at Microsoft Secure

In Omdia’s report, they wrote: “Microsoft’s focus is on bringing together this range of mission-critical endpoint and application management and security tools into a single cloud solution. In delivering this integrated set of capabilities, the vendor will help customers simplify how endpoints are managed, strengthen security postures, potentially reduce total cost of ownership, and improve employee experiences.”³

The Intune Suite represents shift change in endpoint security, simplification, and savings. I encourage you to learn more by watching the new Microsoft Mechanics video and visiting our Microsoft Intune Suite page to discover the expanding set of Intune products. Finally, please join us at Microsoft Secure on March 28, 2023, where our product leadership will add perspective about the Intune Suite and demonstrate the integrated innovation and value of the new bundled solution.

To learn more about Microsoft Security solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us on LinkedIn (Microsoft Security) and Twitter (@MSFTSecurity) for the latest news and updates on cybersecurity.

---

¹Endpoint Management Vulnerability Gap, Enterprise Strategy Group. Fieldwork was conducted in November 2022.

² Gartner Press Release, Gartner Survey Shows 75% of Organizations Are Pursuing Security Vendor Consolidation in 2022, Gartner. September 13, 2022. GARTNER is a registered trademark and service mark of Gartner, Inc., and/or its affiliates in the U.S. and internationally and is used herein with permission. All rights reserved.

³Omdia Universe: Digital Workspace Management/Unified Endpoint Management Platforms, 2023, Omdia. December 12, 2022.

The post The Microsoft Intune Suite fuels cyber safety and IT efficiency appeared first on Microsoft Security Blog.

The modern enterprise has an incredible diversity of endpoints accessing their data. This creates a massive attack surface, and as a result, endpoints can easily become the weakest link in your Zero Trust security strategy.

Whether a device is a personally owned BYOD device or a corporate-owned and fully managed device, we want to have visibility into the endpoints accessing our network, and ensure we’re only allowing healthy and compliant devices to access corporate resources. Likewise, we are concerned about the health and trustworthiness of mobile and desktop apps that run on those endpoints. We want to ensure those apps are also healthy and compliant and that they prevent corporate data from leaking to consumer apps or services through malicious intent or accidental means.

Get visibility into device health and compliance

Gaining visibility into the endpoints accessing your corporate resources is the first step in your Zero Trust device strategy. Typically, companies are proactive in protecting PCs from vulnerabilities and attacks, while mobile devices often go unmonitored and without protections. To help limit risk exposure, we need to monitor every endpoint to ensure it has a trusted identity, has security policies applied, and the risk level for things like malware or data exfiltration has been measured, remediated, or deemed acceptable. For example, if a personal device is jailbroken, we can block access to ensure that enterprise applications are not exposed to known vulnerabilities.

1. To ensure you have a trusted identity for an endpoint, register your devices with Azure Active Directory (Azure AD). Devices registered in Azure AD can be managed using tools like Microsoft Endpoint Manager, Microsoft Intune, System Center Configuration Manager, Group Policy (hybrid Azure AD join), or other supported third-party tools (using the Intune Compliance API + Intune license). Once you’ve configured your policy, share the following guidance to help users get their devices registered—new Windows 10 devices, existing Windows 10 devices, and personal devices.
2. Once we have identities for all the devices accessing corporate resources, we want to ensure that they meet the minimum security requirements set by your organization before access is granted. With Microsoft Intune, we can set compliance rules for devices before granting access to corporate resources. We also recommend setting remediation actions for noncompliant devices, such as blocking a noncompliant device or offering the user a grace period to get compliant.

Restricting access from vulnerable and compromised devices

Once we know the health and compliance status of an endpoint through Intune enrollment, we can use Azure AD Conditional Access to enforce more granular, risk-based access policies. For example, we can ensure that no vulnerable devices (like devices with malware) are allowed access until remediated, or ensure logins from unmanaged devices only receive limited access to corporate resources, and so on.

3. To get started, we recommend only allowing access to your cloud apps from Intune-managed, domain-joined, and/or compliant devices. These are baseline security requirements that every device will have to meet before access is granted.
4. Next, we can configure device-based Conditional Access policies in Intune to enforce restrictions based on device health and compliance. This will allow us to enforce more granular access decisions and fine-tune the Conditional Access policies based on your organization’s risk appetite. For example, we might want to exclude certain device platforms from accessing specific apps.
5. Finally, we want to ensure that your endpoints and apps are protected from malicious threats. This will help ensure your data is better-protected and users are at less risk of getting denied access due to device health and/or compliance issues. We can integrate data from Microsoft Defender Advanced Threat Protection (ATP), or other Mobile Threat Defense (MTD) vendors, as an information source for device compliance policies and device Conditional Access rules. Options below:
   • Enable Mobile Threat Defense connectors in Intune.
   • Configure Microsoft Defender ATP as part of your Intune compliance policy,
   • Configure third-party Mobile Threat Defense for mobile devices using Intune.
   • Configure third-party Mobile Thread Defense for mobile apps using Intune

Enforcing security policies on mobile devices and apps

We have two options for enforcing security policies on mobile devices: Intune Mobile Device Management (MDM) and Intune Mobile Application Management (MAM). In both cases, once data access is granted, we want to control what the user does with the data. For example, if a user accesses a document with a corporate identity, we want to prevent that document from being saved in an unprotected consumer storage location or from being shared with a consumer communication or chat app. With Intune MAM policies in place, they can only transfer or copy data within trusted apps such as Office 365 or Adobe Acrobat Reader, and only save it to trusted locations such as OneDrive or SharePoint.

Intune ensures that the device configuration aspects of the endpoint are centrally managed and controlled. Device management through Intune enables endpoint provisioning, configuration, automatic updates, device wipe, or other remote actions. Device management requires the endpoint to be enrolled with an organizational account and allows for greater control over things like disk encryption, camera usage, network connectivity, certificate deployment, and so on.

6. First, using Intune, let’s apply Microsoft’s recommended security settings to Windows 10 devices to protect corporate data (Windows 10 1809 or later required).
7. Ensure your devices are patched and up to date using Intune—check out our guidance for Windows 10 and iOS.
8. Finally, we recommend ensuring your devices are encrypted to protect data at rest. Intune can manage a device’s built-in disk encryption across both macOS and Windows 10.

Meanwhile, Intune MAM is concerned with management of the mobile and desktop apps that run on endpoints. Where user privacy is a higher priority, or the device is not owned by the company, app management makes it possible to apply security controls (such as Intune app protection policies) at the app level on non-enrolled devices. The organization can ensure that only apps that comply with their security controls, and running on approved devices, can be used to access emails or files or browse the web.

With Intune, MAM is possible for both managed and unmanaged devices. For example, a user’s personal phone (which is not MDM-enrolled) may have apps that receive Intune app protection policies to contain and protect corporate data after it has been accessed. Those same app protection policies can be applied to apps on a corporate-owned and enrolled tablet. In that case, the app-level protections complement the device-level protections. If the device is also managed and enrolled with Intune MDM, you can choose not to require a separate app-level PIN if a device-level PIN is set, as part of the Intune MAM policy configuration.

9. To protect your corporate data at the application level, configure Intune MAM policies for corporate apps. MAM policies offer several ways to control access to your organizational data from within apps:
   • Configure data relocation policies like save-as restrictions for saving organization data or restrict actions like cut, copy, and paste outside of organizational apps.
   • Configure access policy settings like requiring simple PIN for access or blocking managed apps from running on jailbroken or rooted devices.
   • Configure automatic selective wipe of corporate data for noncompliant devices using MAM conditional launch actions.
   • If needed, create exceptions to the MAM data transfer policy to and from approved third-party apps.
10. Next, we want to set up app-based Conditional Access policies to ensure only approved corporate apps access corporate data.
11. Finally, using app configuration (appconfig) policies, Intune can help eliminate app setup complexity or issues, make it easier for end users to get going, and ensure better consistency in your security policies. Check out our guidance on assigning configuration settings.

Conclusion

We hope the above helps you deploy and successfully incorporate devices into your Zero Trust strategy. Make sure to check out the other deployment guides in the series by following the Microsoft Security blog. For more information on Microsoft Security Solutions visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

The post Zero Trust Deployment Guide for devices appeared first on Microsoft Security.

Off the top of your head, what percentage of endpoints in your organization are currently protected?

Something in the 98 percent+ range?

Most enterprises would say having fewer than 2 percent of endpoint devices lacking adequate security would be considered good given the various changes, updates, etc. However, enterprises have traditionally focused security and compliance efforts on traditional computing devices (for example, servers, desktops, and laptops), which represent just 40 percent of the relevant endpoints. The remaining 60 percent of endpoints are mobile devices and are woefully under-protected. That’s a problem.

Mobile security is more important than ever

Mobile devices, both corporate-owned and bring your own device (BYOD), are now the dominant productivity platform in any enterprise organization, with more than 80 percent of daily work performed on a mobile device. These devices operate extensively outside of corporate firewalls, in the hands of users who may not prioritize precautions like vetting Wi-Fi networks or keeping their devices patched and updated. Mobile often represents a wandering corporate data repository.

These factors combine to cause headaches for security teams because, in short, mobile security has a significant gap in most organizations’ endpoint protection strategies.

The lack of protection for (and visibility into) these endpoints introduces significant risk and compliance concerns that show no sign of slowing down. Here are some statistics from Zimperium’s State of Enterprise Mobile Security Report, 2019, which contains data from more than 45 million anonymized endpoints from enterprises in a variety of industries and both local and national government agencies from around the world:

• Mobile OS vendors created patches for 1,161 security vulnerabilities in 2019.
• At the end of 2019, 48 percent of iOS devices were more than four versions behind the latest OS version and 58 percent of Android devices were more than two versions behind.
• Twenty-four percent of enterprise mobile endpoints were exposed to device threats, not including outdated operating systems.
• Nineteen percent of enterprise mobile endpoints experienced network-based attacks.
• Sixty-eight percent of malicious profiles were considered “high-risk,” meaning they had elevated access that could lead to data exfiltration or full compromise.

Microsoft and Zimperium deliver comprehensive mobile security

The combination of Microsoft’s management and security solutions and Zimperium’s unique on-device mobile device security delivers unequaled protection for managed and unmanaged BYOD devices. Together, Microsoft and Zimperium have delivered numerous innovations for customers in areas such as:

• Integrating with Microsoft Endpoint Manager (formerly Microsoft Intune)
  Zimperium’s mobile threat defense (MTD) integrates with Microsoft Endpoint Manager to offer customers a jointly developed the solution that provides device-risk based app protection for unenrolled BYOD devices.
• Enhancing Microsoft Defender Advanced Threat Protection (ATP)
  Zimperium offers advanced integration with Microsoft Defender ATP for forensic-level threat visibility and hunting.
• Integrating Mobile Threat Defense (MTD) with Microsoft Azure Sentinel SIEM Solution
  With this MTD solution integrated with Azure Sentinel, security analysts are now able to include mobile threat data in their advanced threat hunting and threat correlation analysis.
• Residing on Microsoft Azure
  Zimperium is capable of running natively on Microsoft Azure.

An endpoint is an endpoint is an endpoint, and they all must be protected

Organizations now realize mobile devices are an unprotected endpoint with possible access to or containing the information of a traditional endpoint. And while there are some overlaps in what you protect—email, calendars, etc.—the way you solve the traditional endpoint security problem is completely different than how you solve the mobile security problem.

So, what does all this really mean for an enterprise?

For a joint Microsoft and Zimperium international banking customer with employees in nine countries using 17,000 corporate and BYOD mobile devices, it means knowing that you are protected with Microsoft Endpoint Manager on Azure. It means knowing how many of your employees are putting your enterprise at risk with outdated iOS versions and high-risk profiles. It means having the ability to remediate and monitor your endpoints with one console. Our customer is in control of its infrastructure choices versus having the vendor forcing a solution. In addition, both iOS and Android platforms are supported and protected. If a user were to switch from one device to another that runs a different OS, the person would simply re-download the Zimperium app and activate.

Once deployed, the solution is capable of simultaneously integrating with unified endpoint solutions (UEM) solutions from multiple vendors. In other words, part of the organization, or specified users, can be managed with one UEM solution, and part of it by another. For joint Zimperium and Microsoft customers, this capability simplifies the migration from a third-party UEM to Microsoft Endpoint Manager while maintaining security during the migration. Zimperium provides visibility and security across the mobile infrastructure for customers who may have multiple UEM solutions deployed.

About Zimperium

Zimperium, the global leader in mobile device and app security, offers real-time, on-device protection against Android and iOS threats. The Zimperium platform leverages our award-winning machine-learning-based engine—z9—to protect mobile data, apps, and sessions against device compromises, network attacks, phishing attempts, and malicious apps.

To date, z9 has detected 100 percent of zero-day device exploits without requiring an update or suffering from the delays and limitations of cloud-based detection—something no other mobile security provider can claim.

Get a free enterprise trial

Interested in trying Zimperium in your Microsoft security environment? Contact us today for mobile device security with protection against network, device, phishing, and malicious app attacks.

The post Mobile security—the 60 percent problem appeared first on Microsoft Security.

Since I published my last blog, Five identity priorities for 2020, COVID-19 has upended the way we work and socialize. Now that physical distancing has become essential to protect everyone’s health, more people than ever are going online to connect and get things done. As we all adjust to a new daily routine, the organizations we work for are turning to technology to help us collaborate and stay productive. In these challenging times, identity can make life simpler, both for people working from home and for IT administrators charged with keeping their environments secure.

In my previous blog, I advised connecting all applications and cloud resources to Azure Active Directory (Azure AD). If you’re like most organizations, your employees use a lot of apps, from popular software-as-a-service (SaaS) apps—including collaboration services like Zoom, Cisco Webex, Workplace from Facebook, or Box—to legacy web and on-premises applications. Making Azure AD the control plane across all your apps helps ensure your employees working from home have secure, seamless access to the tools and resources they need, while protecting those tools and resources from unauthorized access.

Making it easy for remote workers to access the apps they need

When you connect your apps to Azure AD, your employees only need to sign in once to access them, and they only need one set of credentials. To make on-premises web apps available without a cumbersome VPN, you can use Azure AD Application Proxy, while tools from our secure hybrid access partners like can provide access to. To get productive from wherever they are, your employees simply go to the My App Portal, where they can find all the apps they have your permission to use.

Figure 1: Users can sign in once and access all the apps they need in a central place, the My Apps portal.

Enabling consistent, strong security across all your apps

With Azure AD, enabling productivity doesn’t shortchange security. Once you’ve connected your apps to Azure AD, you can apply custom security policies across your entire digital estate. Since even complex passwords get stolen, we recommend enforcing multi-factor authentication (MFA) for all accounts and applying Conditional Access policies for adaptive granular access controls. For example, when a user signs in, policies can determine whether to allow, limit, or block access based on their location, whether their device is compliant, and which app they’re trying to access.

Additionally, Microsoft Intune App Protection Policies can provide application-level controls and compliance, while maintaining a great user experience on any device. Intune app configuration policies can help keep work data safe by controlling or stopping people from sharing work data outside of trusted apps assigned to them.

Increasing IT efficiency with self-service and automation​

To reduce the burden on IT, Azure AD offers several tools to simplify management. Self-Service Password Reset lets users manage passwords on their own. Pre-integrated applications make it easy to enable single sign-on (SSO) with just a few clicks (Figure 2). Some companies, to help serve their communities. Automated provisioning of user accounts and apps makes onboarding significantly faster, so those new workers can get productive right away. For one customer, Mattress Firm, adding a new employee to their HR system automatically provisions their Azure AD user account and assigns them access to the appropriate applications within four hours.

Figure 2: Configure your apps for secure, seamless access with just a couple clicks.

Get free assistance connecting your apps to Azure AD

Many of our customers are moving rapidly to enable secure remote work during this current crisis, and we want to make sure you have everything you need. If you have subscriptions to Office 365 or Azure, you can use Azure AD to configure secure SSO for your 10 most critical apps for free. A license for Microsoft 365 gives you full access to Azure AD. For all our customers, we also offer complimentary deployment assistance through our FastTrack program.

As unprecedented numbers of people work remotely, the right tools, including Azure AD, can help keep them both protected and productive. Whatever your circumstances, we’re here to help. You can reach us via Twitter: @AzureAD.

Learn more

Learn how to use Azure AD to connect your workforce to all the apps they need from anywhere.

 

*This offer includes MFA via the Microsoft Authenticator app only.

The post Making it easier for your remote workforce to securely access all the apps they need, from anywhere appeared first on Microsoft Security.

With many employees suddenly working from home, there are things an organization and employees can do to help remain productive without increasing cybersecurity risk.

While employees in this new remote work situation will be thinking about how to stay in touch with colleagues and coworkers using chat applications, shared documents, and replacing planned meetings with conference calls, they may not be thinking about cyberattacks. CISOs and admins need to look urgently at new scenarios and new threat vectors as their organizations become a distributed organization overnight, with less time to make detailed plans or run pilots.

Based on our experiences working with customers who have had to pivot to new working environments quickly, I want to share some of those best practices that help ensure the best protection.

What to do in the short—and longer—term

Enabling official chat tools helps employees know where to congregate for work. If you’re taking advantage of the six months of free premium Microsoft Teams or the removed limits on how many users can join a team or schedule video calls using the “freemium” version, follow these steps for supporting remote work with Teams. The Open for Business Hub lists tools from various vendors that are free to small businesses during the outbreak. Whichever software you pick, provision it to users with Azure Active Directory (Azure AD) and set up single-sign-on, and you won’t have to worry about download links getting emailed around, which could lead to users falling for phishing emails.

You can secure access to cloud applications with Azure AD Conditional Access, protecting those sign-ins with security defaults. Remember to look at any policies you have set already, to make sure they don’t block access for users working from home. For secure collaboration with partners and suppliers, look at Azure AD B2B.

Azure AD Application Proxy publishes on-premises apps for remote availability, and if you use a managed gateway, today we support several partner solutions with secure hybrid access for Azure AD.

While many employees have work laptops they use at home, it’s likely organizations will see an increase in the use of personal devices accessing company data. Using Azure AD Conditional Access and Microsoft Intune app protection policies together helps manage and secure corporate data in approved apps on these personal devices, so employees can remain productive.

Intune automatically discovers new devices as users connect with them, prompting them to register the device and sign in with their company credentials. You could manage more device options, like turning on BitLocker or enforcing password length, without interfering with users’ personal data, like family photos; but be sensitive about these changes and make sure there’s a real risk you’re addressing rather than setting policies just because they’re available.

Read more in Tech Community on ways Azure AD can enable remote work.

You’ve heard me say it time and again when it comes to multi-factor authentication (MFA): 100 percent of your employees, 100 percent of the time. The single best thing you can do to improve security for employees working from home is to turn on MFA. If you don’t already have processes in place, treat this as an emergency pilot and make sure you have support folks ready to help employees who get stuck. As you probably can’t distribute hardware security devices, use Windows Hello biometrics and smartphone authentication apps like Microsoft Authenticator.

Longer term, I recommend security admins consider a program to find and label the most critical data, like Azure Information Protection, so you can track and audit usage when employees work from home. We must not assume that all networks are secure, or that all employees are in fact working from home when working remotely.

Track your Microsoft Secure Score to see how remote working affects your compliance and risk surface. Use Microsoft Defender Advanced Threat Protection (ATP) to look for attackers masquerading as employees working from home, but be aware that access policies looking for changes in user routines may flag legitimate logons from home and coffee shops.

How to help employees

As more organizations adapt to remote work options, supporting employees will require more than just providing tools and enforcing policies. It will be a combination of tools, transparency, and timeliness.

Remote workers have access to data, information, and your network. This increases the temptation for bad actors. Warn your employees to expect more phishing attempts, including targeted spear phishing aimed at high profile credentials. Now is a good time to be diligent, so watch out for urgent requests that break company policy, use emotive language and have details that are slightly wrong—and provide guidance on where to report those suspicious messages.

Establishing a clear communications policy helps employees recognize official messages. For example, video is harder to spoof than email: an official channel like Microsoft Stream could reduce the chance of phishing while making people feel connected. Streaming videos they can view at a convenient time will also help employees juggling personal responsibilities, like school closures or travel schedule changes.

Transparency is key. Some of our most successful customers are also some of our most transparent ones. Employee trust is built on transparency. By providing clear and basic information, including how to protect their devices, will help you and employees stay ahead of threats.

For example, help employees understand why downloading and using consumer or free VPNs is a bad idea. These connections can extract sensitive information from your network without employees realizing. Instead, offer guidance on how to leverage your VPN and how it’s routed through a secure VPN connection.

Employees need a basic understanding of conditional access policies and what their devices need to connect to the corporate network, like up-to-date anti-malware protection. This way employees understand if their access is blocked and how to get the support they need.

Working from home doesn’t mean being isolated. Reassure employees they can be social, stay in touch with colleagues, and still help keep the business secure. Read more about staying productive while working remotely on the Microsoft 365 blog.

The post Work remotely, stay secure—guidance for CISOs appeared first on Microsoft Security.

In Gartner’s third annual Magic Quadrant for Cloud Access Security Brokers (CASB), Microsoft was named a Leader based on its completeness of vision and ability to execute in the CASB market. Microsoft was also identified as strongest in execution.

Gartner led the industry when they defined the term CASB in 2012. We believe their report points out a key fact for the market, that Microsoft currently has the largest customer base of all participating vendors. We believe that this, along with being ranked as a Leader, reflects our continued commitment to building the best possible solution for our customers and our goal to find innovative ways of helping them better protect their Microsoft and third-party cloud apps and platforms.

This recognition comes at a great point in our evolution journey. We’re guided by a strong vision to provide a customer-centric, best-in-class CASB solution that easily integrates with our customers’ existing environment, simplifies deployment, and optimizes the experience for admins, SecOps, and end users alike.

In customer conversations, many of them embrace a similar set of key product differentiators, some of which are also referred to in the Gartner report including:

• The ability to monitor and control any app across cloud, on-premises, and custom apps.
• Extensive integration across products, while also offering the ability to integrate with third-party solutions.
• Extensive set of built-in threat-protection policies and a user and entity behavior analytics (UEBA) interface that provides a consolidated risk timeline and score for each user to help prioritize investigations across hybrid identities.

As we continue to build powerful, new capabilities for our CASB offering, we’re leveraging the unique ability to natively integrate with other best-in-class solutions from Microsoft’s Security and Identity portfolio including Azure Active Directory, Microsoft Defender Advanced Threat Protection, Microsoft Intune, and more. This allows us to deliver unique CASB capabilities, provide customers with fully integrated solutions across their portfolio, and achieve single-click deployments.

CASBs are essential to any modern Cloud Security strategy to provide a central point of monitoring and control. It enables IT departments to ensure secure access and protect the flow of critical data with a consistent set of controls across the increasing number of apps and cloud workloads.

With Microsoft Ignite around the corner, we look forward to more exciting announcements in November. As you continue to plan for the needs of your organization, please let us know how we can support the work you’re doing with Microsoft 365 by reaching out to your account team.

Learn more

Read the complimentary report for the analysis behind Microsoft’s position as a Leader.

For more information about our CASB solution, visit our website and stay up to date with our blog. Want to see our CASB in action? Start a free trial today.

Gartner Magic Quadrant for Cloud Access Security Brokers, Steve Riley, Craig Lawson, 22 October 2019.

The post Gartner names Microsoft a Leader in the 2019 Cloud Access Security Broker (CASB) Magic Quadrant appeared first on Microsoft Security.

The traditional perimeter-based network defense is obsolete. Perimeter-based networks operate on the assumption that all systems within a network can be trusted. However, todays increasingly mobile workforce, the migration towards public cloud services, and the adoption of Bring Your Own Device (BYOD) model make perimeter security controls irrelevant. Networks that fail to evolve from traditional defenses are vulnerable to breaches: an attacker can compromise a single endpoint within the trusted boundary and then quickly expand foothold across the entire network.

In 2013, a massive credit card data breach hit Target and exposed the credit card information of over 40 million customers. Attackers used malware-laced emails to steal credentials from contractors that had remote access to Targets network. They then used the stolen credentials to gain access to the network, effectively evading the perimeter defense mechanisms that Target had in place. Once inside the network, the attackers installed malware on payment systems used in Target stores across the US and stole customer credit card information.

Zero Trust networks eliminate the concept of trust based on network location within a perimeter. Instead, Zero Trust architectures leverage device and user trust claims to gate access to organizational data and resources. A general Zero Trust network model (Figure 1) typically comprises the following:

• Identity provider to keep track of users and user-related information
• Device directory to maintain a list of devices that have access to corporate resources, along with their corresponding device information (e.g., type of device, integrity etc.)
• Policy evaluation service to determine if a user or device conforms to the policy set forth by security admins
• Access proxy that utilizes the above signals to grant or deny access to an organizational resource

Figure 1. Basic components of a general Zero Trust network model

Gating access to resources using dynamic trust decisions allows an enterprise to enable access to certain assets from any device while restricting access to high-value assets on enterprise-managed and compliant devices. In targeted and data breach attacks, attackers can compromise a single device within an organization, and then use the “hopping” method to move laterally across the network using stolen credentials. A solution based on Zero Trust network, configured with the right policies around user and device trust, can help prevent stolen network credentials from being used to gain access to a network.

Zero Trust is the next evolution in network security. The state of cyberattacks drives organizations to take the assume breach mindset, but this approach should not be limiting. Zero Trust networks protect corporate data and resources while ensuring that organizations can build a modern workplace using technologies that empower employees to be productive anytime, anywhere, any which way.

Zero Trust networking based on Azure AD conditional access

Today, employees access their organization’s resources from anywhere using a variety of devices and apps. Access control policies that focus only on who can access a resource is not sufficient. To master the balance between security and productivity, security admins also need to factor in how a resource is being accessed.

Microsoft has a story and strategy around Zero Trust networking. Azure Active Directory conditional access is the foundational building block of how customers can implement a Zero Trust network approach. Conditional access and Azure Active Directory Identity Protection make dynamic access control decisions based on user, device, location, and session risk for every resource request. They combine (1) attested runtime signals about the security state of a Windows device and (2) the trustworthiness of the user session and identity to arrive at the strongest possible security posture.

Conditional access provides a set of policies that can be configured to control the circumstances in which users can access corporate resources. Considerations for access include user role, group membership, device health and compliance, mobile applications, location, and sign-in risk. These considerations are used to decide whether to (1) allow access, (2) deny access, or (3) control access with additional authentication challenges (e.g., multi-factor authentication), Terms of Use, or access restrictions. Conditional access works robustly with any application configured for access with Azure Active Directory.

Figure 2. Microsofts high-level approach to realizing Zero Trust networks using conditional access.

To accomplish the Zero Trust model, Microsoft integrates several components and capabilities in Microsoft 365: Windows Defender Advanced Threat Protection, Azure Active Directory, Windows Defender System Guard, and Microsoft Intune.

Windows Defender Advanced Threat Protection

Windows Defender Advanced Threat Protection (ATP) is an endpoint protection platform (EPP) and endpoint detection response (EDR) technology that provides intelligence-driven protection, post-breach detection, investigation, and automatic response capabilities. It combines built-in behavioral sensors, machine learning, and security analytics to continuously monitor the state of devices and take remedial actions if necessary. One of the unique ways Windows Defender ATP mitigates breaches is by automatically isolating compromised machines and users from further cloud resource access.

For example, attackers use the Pass-the-Hash (PtH) and the Pass the ticket for Kerberos techniques to directly extract hashed user credentials from a compromised device. The hashed credentials can then be used to make lateral movement, allowing attackers to leapfrog from one system to another, or even escalate privileges. While Windows Defender Credential Guard prevents these attacks by protecting NTLM hashes and domain credentials, security admins still want to know that such an attack occurred.

Windows Defender ATP exposes attacks like these and generates a risk level for compromised devices. In the context of conditional access, Windows Defender ATP assigns a machine risk level, which is later used to determine whether the client device should get a token required to access corporate resources. Windows Defender ATP uses a broad range of security capabilities and signals, including:

• Rich machine learning and behavioral detection library
• Exploit protection
• Credential protection
• Application isolation
• Antivirus
• Network protection
• Web protection

Windows Defender System Guard runtime attestation

Windows Defender System Guard protects and maintains the integrity of a system as it boots up and continues running. In the assume breach mentality, its important for security admins to have the ability to remotely attest the security state of a device. With the Windows 10 April 2018 Update, Windows Defender System Guard runtime attestation contributes to establishing device integrity. It makes hardware-rooted boot-time and runtime assertions about the health of the device. These measurements are consumed by Windows Defender ATP and contribute to the machine risk level assigned to the device.

The single most important goal of Windows Defender System Guard is to validate that the system integrity has not been violated. This hardware-backed high-integrity trusted framework enables customers to request a signed report that can attest (within guarantees specified by the security promises) that no tampering of the devices security state has taken place. Windows Defender ATP customers can view the security state of all their devices using the Windows Defender ATP portal, allowing detection and remediation of any security violation.

Windows Defender System Guard runtime attestation leverages the hardware-rooted security technologies in virtualization-based security (VBS) to detect attacks. On virtual secure mode-enabled devices, Windows Defender System Guard runtime attestation runs in an isolated environment, making it resistant to even a kernel-level adversary.

Windows Defender System Guard runtime attestation continually asserts system security posture at runtime. These assertions are directed at capturing violations of Windows security promises, such as disabling process protection.

Azure Active Directory

Azure Active Directory is a cloud identity and access management solution that businesses use to manage access to applications and protect user identities both in the cloud and on-premises. In addition to its directory and identity management capabilities, as an access control engine Azure AD delivers:

• Single sign-on experience: Every user has a single identity to access resources across the enterprise to ensure higher productivity. Users can use the same work or school account for single sign-on to cloud services and on-premises web applications. Multi-factor authentication helps provide an additional level of validation of the user.
• Automatic provisioning of application access: Users access to applications can be automatically provisioned or de-provisioned based on their group memberships, geo-location, and employment status.

As an access management engine, Azure AD makes a well-informed decision about granting access to organizational resources using information about:

• Group and user permissions
• App being accessed
• Device used to sign in (e.g., device compliance info from Intune)
• Operating system of the device being used to sign in
• Location or IP ranges of sign-in
• Client app used to sign in
• Time of sign-in
• Sign-in risk, which represents the probability that a given sign-in isnt authorized by the identity owner (calculated by Azure AD Identity Protections multiple machine learning or heuristic detections)
• User risk, which represents the probability that a bad actor has compromised a given user (calculated by Azure AD Identity Protections advanced machine learning that leverages numerous internal and external sources for label data to continually improve)
• More factors that we will continually add to this list

Conditional access policies are evaluated in real-time and enforced when a user attempts to access any Azure AD-connected application, for example, SaaS apps, custom apps running in the cloud, or on-premises web apps. When suspicious activity is discovered, Azure AD helps take remediation actions, such as block high-risk users, reset user passwords if credentials are compromised, enforce Terms of Use, and others.

The decision to grant access to a corporate application is given to client devices in the form of an access token. This decision is centered around compliance with the Azure AD conditional access policy. If a request meets the requirements, a token is granted to a client. The policy may require that the request provides limited access (e.g., no download allowed) or even be passed through Microsoft Cloud App Security for in-session monitoring.

Microsoft Intune

Microsoft Intune is used to manage mobile devices, PCs, and applications in an organization. Microsoft Intune and Azure have management and visibility of assets and data valuable to the organization, and have the capability to automatically infer trust requirements based on constructs such as Azure Information Protection, Asset Tagging, or Microsoft Cloud App Security.

Microsoft Intune is responsible for the enrollment, registration, and management of client devices. It supports a wide array of device types: mobile devices (Android and iOS), laptops (Windows and macOS), and employees BYOD devices. Intune combines the machine risk level provided by Windows Defender ATP with other compliance signals to determine the compliance status (isCompliant) of the device. Azure AD leverages this compliance status to block or allow access to corporate resources. Conditional access policies can be configured in Intune in two ways:

• App-based: Only managed applications can access corporate resources
• Device-based: Only managed and compliant devices can access corporate resources

More on how to configure risk-based conditional access compliance check in Intune.

Conditional access at work

The value of conditional access can be best demonstrated with an example. (Note: The names used in this section are fictitious, but the example illustrates how conditional access can protect corporate data and resources in different scenarios.)

SurelyMoney is one of the most prestigious financial institutions in the world, helping over a million customers carry out their business transactions seamlessly. The company uses Microsoft 365 E5 suite, and their security enterprise admins have enforced conditional access.

An attacker seeks to steal information about the companys customers and the details of their business transactions. The attacker sends seemingly innocuous e-mails with malware attachments to employees. One employee unwittingly opens the attachment on a corporate device, compromising the device. The attacker can now harvest the employees user credentials and try to access a corporate application.

Windows Defender ATP, which continuously monitors the state of the device, detects the breach and flags the device as compromised. This device information is relayed to Azure AD and Intune, which then denies the access to the application from that device. The compromised device and user credentials are blocked from further access to corporate resources. Once the device is auto-remediated by Windows Defender ATP, access is re-granted for the user on the remediated device.

This illustrates how conditional access and Windows Defender ATP work together to help prevent the lateral movement of malware, provide attack isolation, and ensure protection of corporate resources.

Azure AD applications such as Office 365, Exchange Online, SPO, and others

The executives at SurelyMoney store a lot of high-value confidential documents in Microsoft SharePoint, an Office 365 application. Using a compromised device, the attacker tries to steal these documents. However, conditional access tight coupling with O365 applications prevents this from taking place.

Office 365 applications like Microsoft Word, Microsoft PowerPoint, and Microsoft Excel allow an organizations employees to collaborate and get work done. Different users can have different permissions, depending on the sensitivity or nature of their work, the group they belong to, and other factors. Conditional access facilitates access management in these applications as they are deeply integrated with the conditional access evaluation. Through conditional access, security admins can implement custom policies, enabling the applications to grant partial or full access to requested resources.

Figure 3. Zero Trust network model for Azure AD applications

Line of business applications

SurelyMoney has a custom transaction-tracking application connected to Azure AD. This application keeps records of all transactions carried out by customers. The attacker tries to gain access to this application using the harvested user credentials. However, conditional access prevents this breach from happening.

Every organization has mission-critical and business-specific applications that are tied directly to the success and efficiency of employees. These typically include custom applications related to e-commerce systems, knowledge tracking systems, document management systems, etc. Azure AD will not grant an access token for these applications if they fail to meet the required compliance and risk policy, relying on a binary decision on whether access to resources should be granted or denied.

Figure 4. Zero Trust network model expanded for line of business apps

On-premises web applications

Employees today want to be productive anywhere, any time, and from any device. They want to work on their own devices, whether they be tablets, phones, or laptops. And they expect to be able to access their corporate on-premises applications. Azure AD Application Proxy allows remote access to external applications as a service, enabling conditional access from managed or unmanaged devices.

SurelyMoney has built their own version of a code-signing application, which is a legacy tenant application. It turns out that the user of the compromised device belongs to the code-signing team. The requests to the on-premises legacy application are routed through the Azure AD Application Proxy. The attacker tries to make use of the compromised user credentials to access this application, but conditional access foils this attempt.

Without conditional access, the attacker would be able to create any malicious application he wants, code-sign it, and deploy it through Intune. These apps would then be pushed to every device enrolled in Intune, and the hacker would be able to gain an unprecedented amount of sensitive information. Attacks like these have been observed before, and it is in an enterprises best interests to prevent this from happening.

Figure 5. Zero Trust network model for on-premises web applications

Continuous innovation

At present, conditional access works seamlessly with web applications. Zero Trust, in the strictest sense, requires all network requests to flow through the access control proxy and for all evaluations to be based on the device and user trust model. These network requests can include various legacy communication protocols and access methods like FTP, RDP, SMB, and others.

By leveraging device and user trust claims to gate access to organizational resources, conditional access provides comprehensive but flexible policies that secure corporate data while ensuring user productivity. We will continue to innovate to protect the modern workplace, where user productivity continues to expand beyond the perimeters of the corporate network.

 

 

Sumesh Kumar, Ashwin Baliga, Himanshu Soni, Jairo Cadena
Enterprise & Security