Enable Azure ATP (Microsoft Defender for Identity) and Install ATP Sensor
Azure ATP (Microsoft Defender for Identity),   is a cloud-based security solution that leverages your on-premises Active Directory signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization.


You can enter the Azure ATP portal either by logging in to the portal https://portal.atp.azure.com and selecting your instance, or browsing to the instance URL: https://<instancename>.atp.azure.com, such as https://51sec.atp.azure.com




After logged in, there are a couple of steps to follow to get your instance up and running. You will need to activate your ATP with a sensor installation.

1  Click Sensors menu on the left side

2  Download Azure ATP Sensor setup file, either on Domain controller or one of domain member servers. If it is not on Domain controller, you will need to set up mirroring traffic from DC to your member server. 

3  Double click exe file to start installation. 

4  Since we are not installing it on DC, the option we have is standalone server. It requires configuration of port-mirroring from the domain controllers to receive network traffic. 

5  Enter the access key to link the standalone sensor installation to your Azure ATP instance. 

6  Once installation completed, there are two services showing in the Services MMC. 

7  Configure your sensor.

8  Modify and change your configuration of sensor, making sure it can reach out to your DC.

via Blogger https://ift.tt/31mHhFo
October 19, 2020 at 02:20PM Cloud

Security Controls Based on NIST 800-53 Low, Medium, High Impact

Since NIST 800-53 was first introduced, the number of controls has greatly expanded; the initial version of 800-53 contained approximately 300 controls and NIST 800-53 rev 4 contains 965 controls. 

Despite the complexity, each NIST 800-53 revision makes the controls set increasingly valuable. As things like mobile, IoT, and cloud evolve, NIST continuously enhances 800-53 to make migration an ongoing requirement.

800-53 (Rev. 4) Security Control Catalog
Low-Impact
Moderate-Impact
High-Impact

 

Security Objectives / Impact / Required Security Controls
	Confidentiality	Integrity	Availability
Low	Login Audit Encryption in transit Patch Management Centralized Authentication	Antivirus	Onsite Backup Change Control Patch Management Vulnerability Management SLAs
Moderate	Login Audit System Health Monitoring Encryption at rest Encryption in transit MFA Secure Delete DLP Patch Management Centralized Authentication Machine Authentication Role Based Authentication Network IDS Cloud Isolation	Antivirus File Integrity Monitoring	High Availability Onsite Backup Change Control Patch Management Vulnerability Management SLAs
High	Login Audit System Health Monitoring Encryption at rest Encryption in transit MFA Priviledged Access Management Patch Management Machine authentication Host IDS Network IDS SSL Decryption Secure Delete DLP Penetration Testing Centralized Authentication Role Based Authentication Cloud Isolation	Antivirus File Integrity Monitoring	High Availability Onsite/Offsite Backup Scalability DR Site Change Control Patch Management Vulnerability Management DDoS Protection SLAs
The following list is showing those most common controls align with the impact level in 800-53.  Impact / Required Security Controls (Based on 800-53))   Low Moderate High Access Control / Firewall       Account Management       Security Awareness Training       Security Assessment / Categorization       System Inventory       Key Protection / Management       DoS Protection       Remote Access from External Network  Monitoring, Managed, Privileged Commands Controlled and Documents,  Information Protected, Disabled non-secure network protocols Wireless Access Authentication, Encryption, Monitoring, (Restrict Users)   Physical Access Control       System Maintenance       Patch Management       System / Login Audit / Response       System Health, Usage Monitoring       Encryption in transit       System Hardening       Software Usage Restrictions       Antivirus/Antimalware       Vulnerability Scanning       Onsite Backup / Recovery       Alternate Storage Site & Backup / Recovery       Access / Configuration Change Control       Least Privilege       PKI Certificates       Anti-SPAM       Endpoints Advanced Threat Protection       Encryption at Rest       Device Identification &  Authentication       Network IDS       File Integrity Monitoring       Role-based Authentication       Centralized Authentication       Separation of Duties       DLP       Application Partitioning       Multi Factor Authentication       Secure Delete       Penetration Testing       Vulnerability Management       Supply Chain Protection       Network Segregation (DMZ, Subnets, Mgmt Interface)       DR Site       Privileged Access Management       SIEM       Host IDS

via Blogger https://ift.tt/35dcbRJ
October 19, 2020 at 11:02AM Architecture

Security Portals for Microsoft, Azure, Windows and Office 365
Here is a list for Security Related Portals of Microsoft, Azure, Windows and Office 365.

• Azure ATP - https://portal.atp.azure.com/
• Microsoft Cloud App Security - https://portal.cloudappsecurity.com
• Windows Defender ATP - https://securitycenter.windows.com/
• O365 ATP - https://protection.office.com/
• Microsoft 365 Compliance - https://compliance.microsoft.com/
• Microsoft Service Trust Portal https://ift.tt/2qkdgRX
• Microsoft Azure Identity Protection - https://portal.azure.com/#blade/Microsoft_AAD_IAM/IdentityProtectionMenuBlade/
• Microsoft Azure Security https://portal.azure.com/#blade/Microsoft_AAD_IAM/SecurityMenuBlade/

via Blogger https://ift.tt/37k4Br8
October 18, 2020 at 01:54PM Cloud

Microsoft Azure Identity Protection Respond Procedures and Action Explaination

 Identity Protection is a tool that allows organizations to accomplish three key tasks:

• Automate the detection and remediation of identity-based risks.
• Investigate risks using data in the portal.
• Export risk detection data to third-party utilities for further analysis.

Investigate

Risky users

With the information provided by the risky users report, administrators can find:

• Which users are at risk, have had risk remediated, or have had risk dismissed?
• Details about detections
• History of all risky sign-ins
• Risk history

Administrators can then choose to take action on these events. Administrators can choose to:

• Reset the user password (Not Security Administrator)
• Confirm user compromise
• Dismiss user risk
• Block user from signing in (Not Security Administrator)
• Investigate further using Azure ATP

Risky sign-ins

The risky sign-ins report contains filterable data for up to the past 30 days (1 month).

With the information provided by the risky sign-ins report, administrators can find:

• Which sign-ins are classified as at risk, confirmed compromised, confirmed safe, dismissed, or remediated.
• Real-time and aggregate risk levels associated with sign-in attempts.
• Detection types triggered
• Conditional Access policies applied
• MFA details
• Device information
• Application information
• Location information

Administrators can then choose to take action on these events. Administrators can choose to:

• Confirm sign-in compromise
• Confirm sign-in safe

How to manually remediate risks and unblock users

There is an option to enable automated remediation using risk policies, such as MFA or Change password (SSPR - Self-Service Password Reset) to remediate risks. For some reasons, if MFA and Require Change Password options are not available for your organization, but Risk policy has been enabled to block user's access. Here are some manual process :
via Blogger https://ift.tt/3nQyGnQ
October 13, 2020 at 04:41PM Cloud

Azure Security Best Practices

This post summarizes some collected best practices from online for Microsoft Azure Security. 

Shared Responsibility model for cloud security

1  AWS - Shared Responsibility Model

2  Azure: - Shared Responsibilities for Cloud Computing

3  CIS: Shared Responsibility for Cloud Security: What You Need to Know

Sources:
1. Microsoft Azure, https://docs.microsoft.com/en-us/azure/security/fundamentals/shared-responsibility
2. Amazon Web Services, https://aws.amazon.com/compliance/shared-responsibility-model/

Azure Security Reference Model

1  Reference Design - Azure Administration Model

2  Best practices and tips to secure your hybrid cloud environment

2  Best practices - Identity & Access Management

• Centralize Identity management. Designate a single Azure AD directory as the authoritative source.
• Enforce SSO and Multi Factor Authentication.
• Leverage Azure RBAC with Privileged Identity Management.
• Actively monitor for suspicious activities using AAD anomaly reports.
• Use Azure AD for storage authentication.

3  Best Practice - for Azure Storage

Advanced Threat Protection for Azure Storage
Alerts on anomalous access & potential data exfiltration


via Blogger https://ift.tt/2GEs2A6
October 05, 2020 at 03:28PM Cloud