Enforce multi-factor verification for users (Best Practice 6/10)

Enabling two-factor authentication should be the standard and perhaps it should be enforced as the minimum requirements for authentication for any cloud service. Password are not safe, and users keeps making the same mistakes protection and securing their password.

I highly recommend that you require two-step verification for all of your users. This includes administrators and others in your organization who can have a significant impact if their account is compromised.

There are multiple options for requiring two-step verification. The best option for you depends on your goals, the Azure AD edition you’re running, and your licensing program. There are numerous options in Azure AD. From using the build-in option included in the regular subscription, to using Azure Multi-factor authentication server for on-premise services or using a third part solution such as DOU, VIPAccess, Okta, or RSAID with Federation.

Enabled the functionality of Conditional Access (Best Practice 3/10)

The idea of the cloud is to allow users to access the resources by using a variety of devices and apps from anywhere at any time. Since the perimeter of the network is no longer the edge but the identity, IT administrators face the challenges, therefore controlling the devices and making sure that these devices meet the standards for security and compliance, is a very effective way to protect the cloud implementation.

The trade between security and productivity here plays an important role. IT admins need to think about how a resource is accessed before they can make a decision about access control. With Azure AD Conditional Access, IT administrators can address this requirement. With Conditional Access, IT admins can make automated access control decisions based on conditions for accessing your cloud apps.

Best practice: Manage and control access to corporate resources. Configure Azure AD Conditional Access based on a group, location, and application sensitivity for SaaS apps and Azure AD–connected apps.

Best practice: Block legacy authentication protocols. Attackers exploit weaknesses in older protocols every day, particularly for password spray attacks. Configure Conditional Access to block legacy protocols. See the video Azure AD: Do’s and Don’ts for more information.

Image result for conditional access

 

 

*Image from Official Microsoft Website – Credit: https://docs.microsoft.com/en-us/azure/active-directory/conditional-access/overview

Types of conditions:

  • Sign-in risk: Azure AD Identity Protection detects sign-in risks. How do you restrict access if a detected sign-in risk indicates a bad actor? What if you would like to get stronger evidence that a sign-in was performed by the legitimate user? What if your doubts are strong enough to even block specific users from accessing an app?
  • Network location: Azure AD is accessible from anywhere. What if an access attempt is performed from a network location that is not under the control of your IT department? A username and password combination might be good enough as proof of identity for access attempts from your corporate network. What if you demand a stronger proof of identity for access attempts that are initiated from other unexpected countries or regions of the world? What if you even want to block access attempts from certain locations?
  • Device management: In Azure AD, users can access cloud apps from a broad range of devices including mobile and also personal devices. What if you demand that access attempts should only be performed with devices that are managed by your IT department? What if you even want to block certain device types from accessing cloud apps in your environment?
  • Client application: Today, you can access many cloud apps using different app types such as web-based apps, mobile apps, or desktop apps. What if an access attempt is performed using a client app type that causes known issues? What if you require a device that is managed by your IT department for certain app types?

Prevent Data Leakage using Exchange Online Transport Rules and Raise the Office365 Secure Score

Over the last month, two clients contacted me requesting immediate support to mitigate and stop the data leakage caused by compromised credentials of specific users in Office365 and Exchange Online. The use of Multi-Factor Authentication has become a best practice and could have prevented this situation. However, there are other security controls that we recommend putting in place to prevent data leakage from Office365.

The bad actors’ “modus operandi” it is usually the same. After compromising the account, hackers access the compromised mailbox using OWA or perhaps Outlook, and setup multiple mailboxes rules. Some of these rules are to exfiltrate data of the organization such as auto-forwarding or send phishing emails to saved contacts and expand their malicious activity. Usually, the last mailbox rules we have identified is to automatically delete their activity from the “Sent Items” folder so it will be unnoticeable by the user.

One of the ways we can help stop data exfiltration from client created rules is using Exchange Transport Rules. Implementing a Transport Rule based around the following can stop emails that are set to be Auto-Forwarded to an external address.

In summary you create a rule based on the following logic.

  • IF The Sender is located ‘Inside the organization’
  • AND IF The Recipient is located ‘Outside the organization’
  • AND IF The message type is ‘Auto-Forward’
  • THEN Reject the message with the explanation ‘External Email Forwarding via Client Rules is not permitted’.

Transport Rule

This will stop delivery of the Auto-Forward message and issue an NDR message to the sender. Exceptions can be also created if needed.

Similarly, this will help you to increase your Office365 Secure Score which now has a new security control called ‘Client Rules Forwarding Blocks’ that implements a Transport Rule to help mitigate client created rules that Auto-Forward to external addresses.