Mathematica Ken

@SwiftOnSecurity @BillQueens IMO after Merills statement. I’d be avoiding unless absolutely necessary and using a managed service like AWS managed AD with checks from purpleknight or pingcastle and just knowing Netapp needs special care.

@MathematicaKen @BillQueens I'm just asking people starting new companies and configuring their IT did not word this well

So what are we looking at these days when it comes to new companies having an Active Directory.

@SwiftOnSecurity @BillQueens Like rationale for its requirement? Or configuration?

@BillQueens I mean I'm just looking for edge cases.

@IAMERICAbooted Either Jira or Servicenow. My bet is Jira “on-prem”.

👀

Wow DoW is suspending CMMC Phase II Requirements Phase I is still on track though: war.gov/News/Releases/…

Wanna put your AIs to the test? Put in flights with a known weather delay and have it try and find the optimal route to get you there. I’ve managed to get all of them to disagree with each other and then argue about the validity of the radar data and plane data.

@rekdt There is the whole part “unless there is evidence of compromise” 🧐

Yeah, so, NIST says you should not rotate passwords on any cadence and only force a password reset on detection of the password being compromised Also, the ATF dot gov website just made me reset my previously unique password Flip a coin where the failure is

@SwiftOnSecurity @CyberCakeX Anecdote: Years ago when I was verifying configs for things like blocking certificate padding I would query obscure GPOs or registry keys when github search used to work and nearly every time Cybercakes repo would come up.

Oh my god. @CyberCakeX has progressed their Harden Windows Security app into something phenomenal. It's even on the App Store! hotcakex.github.io I've mentioned it before but this is $250k cyber consultant security advice and tooling for home user machines essentially.

@NathanMcNulty @SonBoyJim @IAMERICAbooted @fabian_bader @merill I remember the day the “Alchemy” service showed up in app registrations. SecOps had an easy question- we know it’s microsoft but what is it doing and what will break if we block it? Heard some rumors from people but to this day no published answer.

@SonBoyJim @IAMERICAbooted @fabian_bader @merill I highly dislike non-destructive PIN reset, lol, so I would disable those :P @merill has the best list with links to a lot of the other resources that reference Microsoft owned app registrations github.com/merill/microso…

Merill Fernando @merill and I sat down for another Entra Chat last month to talk about how attackers have been known to use those loose SECRETS SECRETS EVERWHERE, even to compromise Microsoft's tenant! If an attacker gets their hands on a secret or certificate+key for an app registration that has application (not delegated) permissions, your conditional access policies and named locations or zones WILL NOT MATTER. They will be able to leverage that API permission acting as an application, from anywhere. Attackers are smart. They will make it blend in with where those service principals normally act from. So, do your best to clean them up so you don't lose control of your environment. When an attacker comprmises a service principal via a compromised owner or compromised secret/cert+key, the will be acting in the context of that service principal when leveraging API access. That can be incredibly hard to see depending on the skill of the adversary. You really need to understand that there's no good way to secure Client Secrets or Certificate+Key. If you have 2 owners for every app registration, those owners can do the following things: 1. Add Secrets, Certificates+Keys, Federations 2. Change Manifests 3. Add/change redirect URIs 4. Change the audience to a multi-tenant app 5. Add dynamic or incremental delegated permissions at runtime that don't require admin consent 6. Provisioning 7. Add assignment 8. Harvest consents for lateral movement 9. Add additional owners 10. Move laterally to other tenants via consent phishing Often times, the application will have more permissions granted through the APIs than the application owner. This is a privilege escalation. Unfortunately, at this time, Microsoft recommends having 2 application owners for governance reasons. This recommendation does not account for the added attack surface. Adding app registration owners is giving someone the equivqalent of Application Administrator for that single application, at a minimum, and often more. If you can, use the serviceManagementReference tag to document application ownership for app registrations instead. When users leave, create an automation that checks thopse serviceManagementReference tags and update as necessary. Yes, we need to govern. We also need security. Only your the following roles should be managing anything related to your Entra App Registrations: Cloud Application Admin, Application Admin, Privileged Role Admin, Global Admin. youtube.com/watch?v=8kAO9T…

@MikeTalonNYC @IAMERICAbooted Also have to consider there is now precedent for holding CISOs personally liable as of 2022.(Uber, Solarwinds, etc..)

@IAMERICAbooted I would do it with a two-year, pay-or-play contract. You fire my ass to cover up your incompetence, which we all know you're gonna do, I get paid.

I see salary ranges for CISOs on LinkedIn. You couldn't pay me enough for that job.

@IAMERICAbooted It’s silly how un-unified they are. I also never got the justification override piece like whats the expected solution to capture that data and action on it?

@IAMERICAbooted “How come you missed this msg center notification about a conditional access change being turned on that has a title and learn page thats takes 4 read throughs to determine its impact to us?”

How many emails do you get per day about advisories for m365 services, especially copilot? Is it just me or has it become insane? It seems like things have become really unstable.

I spoke with several vendors/contractors around privileged access reviews and access reviews and I think some companies aren’t being held to same compliance standards as others and a large amount are providing incomplete or non-accurate data and getting away with it.

@sil_views @IAMERICAbooted I had some issues with external sharing and email. In 2/3 of my support cases it was my DLP policy rules Order of operation within the individual ruleset. The other was an initial configuration could only be cleared by recreating the policy, modifications wouldn’t fix it.

@IAMERICAbooted Pro tip: Design your DLP policies with business continuity in mind and prepare for exception management to be labor intensive. Prepare for DLP policy blocking entire mail flow or external sharing across all services, because it will happen.

In my opinion, the admin portals that take the most broad set of skills and experience go like this, in this order: Purview, Intune, Entra, Security Center, Exchange, SharePoint, Teams, App Admin Center Purview sits at the inner most layer of the security onion and requires knowledge and experience with all the others + network + PKI + Federation + Azure + SaaS + AD + 3rd party cloud.

@IAMERICAbooted I sat there for a few hours and performed each type of guest invite I could think of to see how it presented in audit logs.

@MathematicaKen Omg Guests has been a PITA for me to learn about. So many gotchas

Since many of you are experiencing Guest explosions due to the retirement IDCRL Protocol aka enablement of EnableAzureADB2BIntegration, and, many of you don't have experience with reconstructing Guest architecture to meet the organizations needs (yes, there are many different kinds of Guests), let me provide some insight on some settings you may want to look at. 1. In the admin center (admin.microsift.com), there are settings in the Org Settings for Microsoft365 Groups that allow you to disable the ability for group owners to add Guests to groups. The reality is that most organizations, even highly regulated organizations, do not require tight control of Group and Team ownership which use RSC permissions. Therefore, you may want to consider this setting. 2. If you want fluidity with ops with less administrative burden and user frustration, let Teams Admins and SharePoint admins determine trusted domains for Guests. If you're in the Defense Industrial Base, you might want to force B2B collaboration to the most restrictive settings in Entra where the domain is managed there too. Otherwise, it's probably not necessary unless you have PCI data in SharePoint or Teams (I really hope that's not the case). 3. Evaluate if turning off ability for group members outside your organization to access group content is right for your organization. When turned on, group members can invite Guests to the M365 group via Outlook on the web. It's turned on by default. 4. You need to understand how the organization shares and collaborates in depth before you go changing settings for external identities, like who can invite Guests and Guest access. 5. Governance of Guests should be automated. You will want to put all Guests in dynamic groups for access reviews. If they haven't logged in for x days, get rid of them. Not manually. Automated. 6. Require MFA for Guests! Don't rely on their home tenant settings. 7. In SharePoint for your sharing policies, you can set your sharing policies to Existing Guests when enforcing B2B Collaboration to reduce confusion for group owners. Make it easy for Group Owners to request Guest access. The business needs to collaborate and make money. 8. If you have a certain app you are hosting that some external people need to access, but dont require access to anything in M365, consider putting the app on a subdomain and adding local Guests for that scenario.

@NathanMcNulty @RowanSaintLouis Interesting you went that direction I immediately was thinking PAM portal or Middleware w/ no LOS unless from those services.

@RowanSaintLouis There's a lot of nuance in that question ;) Are they using a separate machine for the secondary account? If not, it's just as exposed as the primary account. You could also consider either ZTNA (like Global Secure Access) or Entra auth so you can use CA or similar auth controls

Yo @NathanMcNulty We use separate AD accounts for users to query SQL DBs. The idea was that if a user’s standard account was compromised, an attacker couldn’t query our SQL DBs. What do you think? Should we just let users connect to SQL DBs with their standard account?

@merill I need a rebel tip for how to stop people from sharing phones for authenticator and making an MFA tree outside the warehouse.

Now that I'm no longer at Microsoft, I'm free to share some of my rebel tips 😎 Who wants me to post them?

@AdamGell Easy just say a few keywords that rhyme with çřypto, pòłymárkët, bǒt, or name some pôlitîcal figures.

I need more followers to boost my ego. Please help me.

@IAMERICAbooted Yes Scout desktop app does it - cowork does not. Rumors all around on all this changing.

@MathematicaKen Does Scout do that? Im hoping for Cowork one day :p

I can't wait to have an agent to handle all my email and Teams messages :p

@QuinnyPig Uh I think we also learned from the Microsoft stories that they only needed a US citizen(without technical knowledge IIRC) to shoulder surf the support agent from another country.

Because folks are confused: GovCloud guarantees the AWS employees touching it are US citizens. The account owner has to be a “US Person” but the IAM users and downstream app users? AWS says that’s your problem, not theirs. Which is why it doesn’t solve the Fable issue.