Protecting your data with Azure AD

Arjan Cornelisssen SharePoint & Office 365 Architect WorkTogether.tech @arjancornelis

Is the new control plane Identity Is the new control plane De medewerker wordt nu het centrale punt om te beveiligen On-premises / Private cloud

Top attacks against Azure AD IAM for employees, partners, and customers lllllllll lllllllll Breach Replay Password Spray Phishing 4.6B attacker-driven sign-ins detected in May 2018 200K password spray attacks blocked in August 2018 23M high risk enterprise sign-in attempts detected in March 2018 John Doe lllllll Passwords are the problem 4

140+ 75%+ $6T $4M Sobering statistics 4/3/2019 6:35 PM Sobering statistics 140+ median # days attackers reside within a victim’s network before detection network intrusions due to compromised user credentials 75%+ $6T annual cost of cybercrime to the global economy $4M average cost of a data breach to a company The frequency and sophistication of cybersecurity attacks are escalating © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Conditions Controls 40TB Microsoft Cloud Cloud SaaS apps Corporate Network Geo-location MacOS Android iOS Windows Windows Defender ATP Client apps Browser apps Google ID MSA Azure AD ADFS Employee & Partner Users and Roles Trusted & Compliant Devices Location Client apps & Auth Method Conditions Force password reset Require MFA Allow/block access Terms of Use ****** Limited Controls Machine learning Policies Real time Evaluation Engine Session Risk 3 40TB Effective policy Cloud SaaS apps On-premises apps Microsoft Cloud App Security Microsoft Cloud

Multi Factor Authentication Custom Controls

Conditional Access with MFA

Block legacy authentication Block legacy auth using Azure AD Conditional access – majority of password spray attacks use legacy auth Over 5000 tenants block legacy auth using Conditional access

Demo Conditional Access Policies -> What If for Twitter Wazug test user NL IP: 84.86.200.150 Afghanistan IP: 43.230.209.0 Twitter Google -> Terms of use

Microsoft Enterprise Mobility + Security Technology Benefit E3 E5 Azure Active Directory Premium P1 Secure single sign-on to cloud and on-premises app MFA, conditional access, and advanced security reporting ● Azure Active Directory Premium P2 Identity and access management with advanced protection for users and privileged identities Microsoft Intune Mobile device and app management to protect corporate apps and data on any device Azure Information Protection P1 Encryption for all files and storage locations Cloud-based file tracking Azure Information Protection P2 Intelligent classification and encryption for files shared inside and outside your organization Microsoft Cloud App Security Enterprise-grade visibility, control, and protection for your cloud applications Microsoft Advanced Threat Analytics Protection from advanced targeted attacks leveraging user and entity behavioral analytics Identity and access management Managed mobile productivity Information protection Threat Detection

Admin side

Privileged Identity Management Discover, restrict, and monitor privileged identities User Administrator Administrator privileges expire after a specified interval User Enforce on-demand, just-in-time administrative access when needed Ensure policies are met with alerts, audit reports and access reviews Manage admins access in Azure AD and also in Azure RBAC

Privileged Identity

Demo PIM Role activate Azure resource demo

Identity Secure Score Insights into your Visibility into your Identity security position and how to improve it Guidance to increase your security level Insights into your Identity security position Set an ideal score. Choose controls to achieve ideal score based on impact. Ignore controls that are not valid for you. 3rd party product support. Easily compare score against other organizations View trends Checkout your Identity secure score now @ http://aka.ms/MyIdentitySecureScore

Secure Score http://aka.ms/securitysteps Checkout your Identity secure score now @ http://aka.ms/MyIdentitySecureScore

Azure monitoring

Preview features

Password-less with Microsoft Authenticator app Password-less for MSA accounts Available today Password-less for Azure AD accounts In Public preview today Now in preview https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-authentication-phone-sign-in aka.ms/gopasswordless

Demo

Our Security mindset needs to be updated