10 méthodes de sécurisation de votre espace Microsoft 365 - Mohamed Amar ATHIE

Notes de l'éditeur

• #5: Microsoft’s approach to empowering security in the modern workplace can help. Microsoft recognizes that an organization's data is their most valuable asset. We also recognize that most enterprises lack the ability to understand what data is sensitive and control access to that data. This includes your emails and documents, but also includes things like employee passwords and customer credit card numbers. Once a bad actor has compromised a user identity, they can log into the device as you and they have the device. Then, they can log into your apps as you and then they get your data. You need to identity and threat protection that keep users, devices, and applications safe by correlating threat information across your entire digital footprint and automating incident response. Surrounding all of this, security insights recommend ways to optimize the configuration of your security tools and provide a quantifiable measurement of your security posture. Microsoft 365 provides holistic security across these four aspects of security. By helping enterprise businesses secure corporate data and manage risk in today’s mobile-first, cloud-first world Microsoft 365 enables customers to digitally transform by unifying user productivity and enterprise security tools into a single suite that enables the modern workplace.  Identity &  Access Mgmt Secure identities to reach zero trust Threat  Protection Help stop damaging attacks with integrated and automated security Information Protection Protect sensitive information anywhere it lives Security  Management Strengthen your security posture with insights and guidance
• #6: In just a few short years, we’ve heard customers go from saying “I do not want to move to the cloud because of security” to firmly (and correctly) stating “I need to go to the cloud because of security.” Which means that the work cloud providers do to keep their platforms safe – as well as compliant – become increasingly critical. By choosing Microsoft, customers gain the benefits of one of the largest and most secure cloud platforms on the planet. It starts with operational excellence in the cloud (clock-wise on the globe) Physical security Operational security Global cloud fabric that runs our clouds (Office365, Azure) and our security services The first side is the secure foundation of our cloud services. This is about how we operate our own cloud services, Azure, Office 365 and so forth. We have some of the world's best physical security, with fences and barbed wire and so on to provide secured building environments and within those buildings, secure server environments.   To enter a server environment, for example, a person would have to pass through multiple physical layers and provide multiple forms of identification. They would also be scanned for metal in their pockets to make sure that they are not bringing devices in to steal information. So, there's a great deal of physical security in place that we do on behalf of all of our customers in our cloud services and that make it possible for our customers to really leverage the investment that we've made in that respect.   Operational security I touched on a minute ago when we talked about the human piece of the Intelligent Security Graph. One of the ways this comes to life is in our continual testing of our services, making sure that that we're finding vulnerabilities faster than the bad guys can. We have a big focus on red team, blue team exercises. If you're not familiar with those, the idea is that we have dedicated professionals whose job it is to be on the good side but act like the bad guys—they’re constantly trying to find ways to penetrate the services, find ways that hackers might attack us so that we can shore up our defenses.   Another example of our operational excellence is around restricted access. When Microsoft employees need elevated access so that they can do maintenance on a service, or so they can investigate a customer support issue, they only have access to exactly the resources they need to access and for only exactly the amount of time that they need it. So, they have just in time and just enough access to do their work, and then they get out. They don't have any standing elevated access that allows them to view customer data.   And this is something, again, where we can make an investment at Microsoft that gets heavily leveraged because all of our customers benefit.   Lastly, customer controls are a huge important part of this. This is something that we get asked about a lot when we talk to customers about our cloud services. What are the things that I have at my control so that I can decide how I want to manage my data and access to it? Access controls, of course, are the very foundation of it. Multi-factor authentication for admins at customer sites who are in charge of operating Azure for that customer or operating Office 365. Having multi-factor authentication of course is a basic that we think is fundamental.   And lastly, network and distributed denial of service protection is in place for all of these services. We do basic protection to ensure our services work reliably, and Azure customers can take advantage of additional protection at the network layer to suit their needs.
• #7: Microsoft operates in over 190 countries, which means that its cloud platform must comply with and adhere to some of the most stringent compliance standards in the world. Microsoft is committed to meeting industry and government regulatory requirements for our customers. We have more certifications than any other cloud provider. For more info: https://azure.microsoft.com/overview/trusted-cloud/
• #8: We invest in built in controls across the layers  I want to highlight the second component of Azure security- enabling defense in depth and simplifying security management with built-in controls and services as well as integrating partner solutions. These are the solutions that you can use to get enhanced protection for your Azure workloads quickly. Identity: With the industry leading solution for Identity and access management with Azure Active Directory, you can get greater control over protecting against identity threats. Capabilities like Role based access control, MFA or Identity protection will ensure the right users are getting the appropriate level of access and will help you minimize risks associated with identity thefts or misuse of admin privileges Data protection: Ensure confidentiality and integrity of data by leveraging multiple encryption options for data at rest in virtual machines, databases and storage. Data encryption controls are built-in to services from virtual machines to storage, SQL, CosmosDB and Azure Data Lake. Azure Key Vault enables you to safeguard and control cryptographic keys and other secrets used by cloud apps and services. Network security: You can establish secure connections to and within Azure using virtual networks, network security groups, VPN, and ExpressRoute. Protect and ensure availability of your apps, protect against network layer threats with services like Web Application Firewall, Azure Firewall and Azure DDoS Protection  Threat Protection and Security Management: Finally it is equally important to assess security state continuously, especially as cloud workloads change dynamically. Azure Security Center will help you monitor security state of Azure resources and hybrid workloads. It will provide a dynamic security score card and recommendations to improve your security in a centralized console making security management easier across different resources. And you get advanced threat protection across many services like virtual machines, servers, apps, Azure SQL, Storage, containers on VMs – backed by Microsoft Intelligent Graph you are able to detect and respond to threats quickly across these services. Azure also offers a robust log management system and you can get lot more insights from Log Analytics. Lastly, you can extend the security capabilities of Azure with a rich array of products built specifically for the Azure platform. The Azure Marketplace includes partner solutions for antimalware, networking security, encryption, monitoring and alerting, application security, authentication, and more. You can take your trusted security partner to protect resources across hybrid environments.
• #9: Build 2012
• #10: Is your end user authentication seamless and secure? How much control do you have over access? How do you secure identities against current and emerging threats? So, our approach in identity and access management is really threefold: secure authentication and we believe password-less is the best. Conditional access to reach Zero trust Identity protection - safeguard those identities when they are used as part of an OS session or application session. The first question to ask yourself is, can I make my access protection stronger while also making things easier for users? This is about how people sign in, how often they have to sign in, and how we authenticate that they are who they say they are. We find that across all of our analytics, as we look at all of those 450 billion authentications that we process every month for Azure Active Directory and Microsoft Account, that the proper application of a username and password is not a tremendous predictor of a genuinely authenticated person. In other words, just knowing the username and password doesn't prove that I am who I say I am. How can we improve that? How can we get to a world that's beyond passwords, beyond what we know are faulted technology for proving authentication, and at the same time make it easier for end users? The second question is, how much control do you really have over access? Not only who is accessing what but also, can those access control policies change depending on the conditions?   So, for example, I might be a very trustworthy employee of Microsoft today, and I might be allowed to access certain sensitive information. Tomorrow, I might be a slightly less trustworthy employee, for a variety of reasons we'll get into in a moment, and I might not be allowed to access that same information. Can your access control policies adapt to those changing conditions? Can you make decisions on the fly? This is a technique being championed by many industry experts and analysts.   Some analysts refer to this as adaptive security. The identity space is the primary control point for such a capability.  And then lastly, we ask, how do you protect user credentials? This is really about, in this imperfect world where we do sometimes rely on username and password, keeping those credentials protected once they're used. So that when they're stored as part of an operating system session for example, that they can't be hijacked by an attacker and then used to access other things that the genuine legitimate user is not trying to access.
• #11: Passwords are your biggest vulnerability, partly because they are the target of most attacks we see today. 81% of all attacks were the result of weak/compromised credentials. But there is hope. We are investing in the next gen of authentication solutions such as password-less authentication where you can eliminate passwords entirely from the end user flow. We also continue to invest in tried and tested solutions such as MFA as well as innovative cloud-powered solutions like Azure AD Password Protection to help you secure your user credentials. Multi-factor Authentication (MFA) can protect you against 99.9% of identity attacks including Phishing, breach replay and password spray – the most predominant identity attacks today. We heard feedback from our customers to include more options and we recently announced the support for OATH hardware tokens for MFA. There is no longer an excuse for organizations to not turn on MFA! But there is more…
• #12: Conditional access is an integrated capability across our security products that enables you to handle access scenarios using a policy-based approach. It lets you automate access controls, so that you can address two opposing goals: Empower users to be productive wherever and whenever Protect your corporate assets at any time How conditional access works: You will define conditions, such as who the user is, their device health or user location, that trigger a policy (Click) In real time, your conditional access policy is evaluated alongside trillions of daily threat signals from the Intelligence Security Graph (Click) Each access attempt is then assigned a session risk of Low/Med/High, which determines (Click) The access controls that are enforced in real time for that session, allowing you to: Require MFA to prove identity Limit the actions the user can take in cloud apps Restrict access to sensitive data (for example: prevent downloads or sharing functionality) Require a password reset Block access or block access from legacy authentication clients that can circumvent security measures like MFA This protection can extend to ALL your users, ALL their devices, from ANY location, through ANY app – on-premises or in the cloud, to ALL your data. Some common access concerns that conditional access can help you with: How do you restrict access if a detected sign-in risk indicates a bad actor? What if you need a stronger proof of identity for access attempts that are initiated from other unexpected countries or regions of the world? What if access should only be granted to devices that are managed by your IT department? What if an access attempt is performed using a cloud app that has known vulnerabilities?
• #13: As a security provider to 90% of the Fortune 500, we are in a unique position where most major security vendors are also partners. Every customer has different needs and configurations, so we have seen it all and partner with our peers in a number of ways. Example: In 2018, we created the Microsoft Intelligent Security Association to build an ecosystem of intelligent security solutions that better defend against a world of increased threats, by sharing security signals from the Intelligent Security Graph. https://www.microsoft.com/security/association
• #14: While no single security provider will cover your entire digital footprint, through Microsoft’s investments and scale within enterprise organizations, our customers have an advantage in creating a comprehensive, adaptive security program. END-TO-END SECURITY A set of holistic security capabilities that can reduce the number of security vendors you manage. Individual components that are purpose-built to integrate together, which decreases the total cost of ownership. Because security is natively built-in, deployment and on-going security management is simplified for security administrators. Security capabilities extend beyond Microsoft products to secure 3rd party platforms, apps and services (Windows, Mac, iOS, Android, Dropbox, Box, salesforce.com, etc.) Includes standard integration capabilities, so you can connect your other security tools (3rd party or homegrown) Intelligent, adaptive security gives users more freedom and autonomy in how they work and collaborate, from anywhere on any device Threat protection gain insight from the 6.5 trillion signals/ day compiled by the Intelligent Security Graph from across the global Microsoft ecosystem
• #15: Microsoft 365 secures more than just Microsoft products Provides single sign on for thousands of applications, allowing you to use Azure Multi-Factor Authentication (MFA) or the one you have already deployed Monitors and protects how your data is accessed in real-time across your non-Microsoft cloud apps and services (Box, Salesforce, etc.) Integrates with your current Data Loss Prevention solution Maintains data classification and protection when emails or documents travel to non-Microsoft platforms Protects emails and files on any device (Windows, Mac, iOS or Android) Extends Microsoft data labels and protections to any non-Microsoft or internally-developed solution Integrates security signals from Microsoft’s Intelligent Security Graph into your SIEM Protects workloads running in the cloud, for both Windows and Linux
• #16: Messaging Update: Going with “Customers that have Microsoft 365 E5 Security can replace up to 24 other security vendors” Use top blue sections to calculate (total = 27) Don’t include security management, since they are not products, but features) (total = 25) Subtract 1 since we assume customer is will use / have a solution in place (total =24) Reason for increase – MDATP added lots of capabilities since we published the 19 figure in Q3
• #17: Is your end user authentication seamless and secure? How much control do you have over access? How do you secure identities against current and emerging threats? So, our approach in identity and access management is really threefold: secure authentication and we believe password-less is the best. Conditional access to reach Zero trust Identity protection - safeguard those identities when they are used as part of an OS session or application session. The first question to ask yourself is, can I make my access protection stronger while also making things easier for users? This is about how people sign in, how often they have to sign in, and how we authenticate that they are who they say they are. We find that across all of our analytics, as we look at all of those 450 billion authentications that we process every month for Azure Active Directory and Microsoft Account, that the proper application of a username and password is not a tremendous predictor of a genuinely authenticated person. In other words, just knowing the username and password doesn't prove that I am who I say I am. How can we improve that? How can we get to a world that's beyond passwords, beyond what we know are faulted technology for proving authentication, and at the same time make it easier for end users? The second question is, how much control do you really have over access? Not only who is accessing what but also, can those access control policies change depending on the conditions?   So, for example, I might be a very trustworthy employee of Microsoft today, and I might be allowed to access certain sensitive information. Tomorrow, I might be a slightly less trustworthy employee, for a variety of reasons we'll get into in a moment, and I might not be allowed to access that same information. Can your access control policies adapt to those changing conditions? Can you make decisions on the fly? This is a technique being championed by many industry experts and analysts.   Some analysts refer to this as adaptive security. The identity space is the primary control point for such a capability.  And then lastly, we ask, how do you protect user credentials? This is really about, in this imperfect world where we do sometimes rely on username and password, keeping those credentials protected once they're used. So that when they're stored as part of an operating system session for example, that they can't be hijacked by an attacker and then used to access other things that the genuine legitimate user is not trying to access.