Downloaded 82 times
Uploaded byMorgan Simonsen
NIC 2017 Azure AD Identity Protection and Conditional Access: Using the Microsoft cloud to protect your corporate identities and applications
The document discusses the use of Azure Active Directory (AD) for enhancing security and identity management in cloud environments, emphasizing its features such as identity protection and conditional access. It highlights the evolution of cloud identity management and the importance of protecting corporate identities against cyber threats, citing the increasing frequency of cybersecurity attacks. Additionally, it outlines the comprehensive solutions offered by Microsoft to secure user data, applications, and devices through advanced analytics and risk mitigation strategies.
More Related Content
Similar to NIC 2017 Azure AD Identity Protection and Conditional Access: Using the Microsoft cloud to protect your corporate identities and applications
![[PU&D] - Securing IT Against Modern Threats with Microsoft Cloud Security Tools](https://cdn.slidesharecdn.com/ss_thumbnails/noelmicrosoftcloudsecuritytools-200404190312-thumbnail.jpg?width=640&height=640&fit=bounds)
NIC 2017 Azure AD Identity Protection and Conditional Access: Using the Microsoft cloud to protect your corporate identities and applications
- 2. Azure AD IdentityProtection and Conditional Access Using the Microsoft cloud to protect your corporate identities and applications
- 3. About Your Speaker:Morgan Simonsen • Cloud Evangelist@Lumagate • P-TSP@Microsoft • MCSE, MCSA, MCT • MVP • Twitter: @msimonsen • Email: [email protected] • Blog: morgansimonsen.com
- 4. Agenda • Why arewe in this room? - We are all going to the cloud and becoming mobile • The Story so far - Cloud Identity with Azure Active Directory 101 • But I’m worried… - How to protect ourselves in this brave new world • Skynet to the rescue - Azure AD Identity Protection • IFTTTATAT - Azure AD Conditional Access
- 5. Why are wein this room? We are all going to the cloud and becoming mobile
- 6. Easy access 24x7 connectivity Flexibility Global reach Seamless collaboration Agility Reducedfriction 23% greater productivity, 100% higher employee satisfaction Is mobility the answer to better employee productivity?, Forbes Magazine, 29.3.2016 But what about Auditing? Security? Compliance & Assurance?
- 7. Enterprise Mobility+Security The Microsoftvision Identity Driven Security Managed Mobile Productivity Comprehensive Solution AppsDevices DataUsers
- 8. Azure Information Protection Protect yourdata, everywhere Microsoft Cloud App Security Azure Active Directory Detect threats early with visibility and threat analytics Advanced Threat Analytics Extend enterprise-grade security to your cloud and SaaS apps Intune Protect your users, devices, and apps Manage identity with hybrid integration to protect application access from identity attacks Enterprise Mobility+Security The Microsoft solution Privileged Identity Management Identity Protection ENFORCE MFA ALLOW BLOCK Conditional Access Windows 10 Azure AD Join, Health Attestation, Windows Hello, BitLocker
- 9. The Story sofar Cloud Identity with Azure Active Directory 101
- 10. • Microsoft “IdentityManagement as a Service (IDaaS)” for organizations. • Millions of independent identity systems controlled by enterprise and government “tenants.” • Information is owned and used by the controlling organization—not by Microsoft. • Born-as-a-cloud directory for Office 365. Extended to manage across many clouds. • Evolved to manage an organization’s relationships with its customers/citizens and partners (B2C and B2B). Azure Active Directory 33,000 Enterprise Mobility + Security | Azure AD Premium enterprise customers >110k third-party applications used with Azure AD each month >1.3 billion authenticationsevery dayonAzureAD More than 750 M user accounts on Azure AD Azure AD Directories >10 M 90% of Fortune 500 companies use Microsoft Cloud (Azure, O365, CRM Online, and PowerBI) Every Office 365 and Microsoft Azure customer uses Azure Active Directory
- 11. Azure AD TrustFabric Contoso AD Contoso Azure AD Fabrikam AD Fabrikam Azure AD …and trust extends to all Azure AD enabled organizations Business-2-Business (B2B) lets all identities in Azure AD collaborate We are all in the same boat forest
- 12. Hybrid identity components ADDS FIM/MIM Sync • Sync engine • Password Sync • Health (Sync, ADFS, ADDS) • AD FS (optional) • Pass-Through AuthN Salesforce Box DropBox Google … Azure AD Connect Azure AD
- 13. But I’m worried… Howto protect ourselves in this brave new world
- 14. The frequency andsophistication of cybersecurity attacks are escalating $500B total potential cost of cybercrime to the global economy $3.5M average cost of a data breach to a company 200+ median # days attackers reside within a victim’s network before detection network intrusions due to compromised user credentials 75%+
- 16. Azure Active Directory IdentityProtection & Conditional Access Cloud-powered protection
- 17. WE DRIVE BUSINESSEVOLUTION FORWARD Adopt Cloud for Better Security • Past: Cloud was security concern • Now: Cloud is security peace of mind • Economies of Scale Security of Scale • Division of responsibilities • Compliance and Certifications • PCI, HIPAA etc. • Security Talent
- 18. Why use AzureAD to protect our users and apps? • Cloud Cadence release schedule for new features • Insights of scale • World Class Protection • Price • Frankly; what are your other options…?
- 19. Mission: Protect ourusers • World class signal due to massive amount of relevant data • One of the world’s largest consumer identity services (the Microsoft Account service) • One of the world’s large enterprise identity services (the Azure AD service) • One of the world’s largest consumer email services (Outlook.com) • One of the world’s largest enterprise email services (Office 365) • One of the world’s largest online gaming services (Xbox Live) • Signals from services like SharePoint Online, Skype and OneDrive to strengthen our analysis • Feeds from Microsoft Digital Crime Unit and Microsoft Security Response Center • Partnering with Law Enforcement, Security Researchers, Industry further enhances signal Microsoft Daily Statistics Source: https://www.microsoft.com/sir
- 20.
- 21.
- 22.
- 23.
- 24. Azure Active Directory Analysis Seems Good Seems Bad Classifier Schrödinger's User ? Credentials Self-reportingThreatdataRelying parties Behavior10+ TB Logs
- 25. Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior10+ TB Logs Schrödinger's User ? Credentials
- 26. Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior Schrödinger's User ? Label Data We were right! Credentials 10+ TB Logs
- 27. Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior Schrödinger's User ? Label Data We were wrong! Credentials 10+ TB Logs We were right!
- 28. Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior Schrödinger's User ? Security Analyst Label Data We were wrong! Credentials 10+ TB Logs We were right!
- 29. Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior Schrödinger's User ? Security Analyst Label Data Code updates to Classifier We were wrong! Credentials 10+ TB Logs We were right!
- 30. Credentials Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior Schrödinger's User ? Security Analyst Label Data Deploy new Classifier Code updates to Classifier We were wrong! 10+ TB Logs We were right!
- 31. Credentials Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior Schrödinger's User ? We were wrong! Analyze Label Data Update Deploy 10+ TB Logs We were right!
- 32. Learner Credentials Azure Active Directory Analysis Seems Good Seems Bad Classifier Self-reportingThreatdataRelying parties Behavior Schrödinger's User ? Label Data We were right! We were wrong! Analyze Update Deploy 10+ TB Logs
- 33. How Identity Protectiondetects and mitigates cyber attacks • Sign in Risk • Invoked on each login, evaluating that particular login • 100 data points (signals) • Result sent as input to Conditional Access • User Risk • Invoked on each login, evaluating accumulated data • Background process • Collects data over time
- 34. Identity Protection inAction: EDU Attack
- 35. We noticed asharp increase in password lockouts Large elevation in user lockouts. Inspection show lockout increase from single org. Users Locked Out Per Day
- 36. Suspicious IP activityvery different from in-country IPs Generally lower user volume Generally successful In- Country Traffic Suspect IP Mostly failure traffic Single UserAgent
- 37. Detailed suspicious IPview showed automated attacks Initial bad guy test run Large scale account failures/minuteAccounts Accessed Per-Minute, Suspect IP
- 38. The Bad Guysare getting smarter too • Botnets are bigger, cheaper and more available • Bad guys are effectively defeating 2nd factor authentication • Bad guys are feeding our machine learning systems bad data • The bad guys have machine learning too
- 39. Risks Identified byAAD Identity Protection • Leaked credentials (High) • Impossible travel to atypical locations (Medium) • Sign-ins from infected devices (Low) • Sign-ins from anonymous IP addresses (Medium) • Sign-ins from IP addresses with suspicious activity (Medium) • Signs in from unfamiliar locations (Medium) • Lockout events
- 40. Identity Protection APIs •Microsoft Graph API • https://graph.microsoft.io • IdentityRiskEvents • Sign-ins and other events that have been analyzed and found to be “risky” by Identity Protection’s machine learning and algorithms
- 41. Enable AAD Identity Protection •EMS E5/AAD P2 required • Identity Protection works for any sign-in to Azure AD
- 42. Demo: Identity Protectionin the Azure Portal
- 43. Multi-Factor Authentication (MFA)Registration Policy • Pre-Canned Conditional Access Policy • Edit: Users • Access: Allow • Access Controls: MFA registration • Monitor Current Registration Status • You should enforce this!
- 44. Sign-in risk remediationpolicy • Pre-Canned Conditional Access Policy • Edit: Users and Conditions • Access: Allow or Block • Access Controls: MFA Authentication • Monitor Number of Sign-ins impacted • Do not enforce this unless you have high number of users registered with MFA!
- 45. User risk remediationpolicy • Pre-Canned Conditional Access Policy • Edit: Users and Conditions • Access: Allow or Block • Access Controls: Require Password Change • Monitor Number of users impacted • Should probably be enabled for High immediately • AADP SSPR is a nice add-on feature to have enabled
- 46. User Experience –Suspicious Sing-In • Sign-in Risk Policy enforced
- 47. User Experience –User at Risk • User Risk Policy enforced
- 48. Licensing • Azure ActiveDirectory Premium P2 required • Enterprise Mobility+Security E5 • If users don’t have it they cannot self-remediate! Plan features Enterprise Mobility + Security E3 Enterprise Mobility + Security E5 Identity and access management •Microsoft Azure Active Directory Premium P1 •Secure single sign-on to cloud and on-premises apps •Multi-factor authentication •Conditional access •Advanced security reporting •Azure Active Directory Premium P2 •Risk-based conditional access •Privileged identity management •Includes all P1 capabilities
- 49. Using Identity Protectionwith Conditional Access for Applications
- 50. Wide range ofEnterprise Mobility Scenarios Locked Down Device Managed Device Personal Device Unknown Device Example Point-of-sale or maintenance tablet or PC Company provided phone, tablet or PC Personal phone, tablet or PC Kiosk at a hotel Type of user Task Worker Information Worker Information Worker Information Worker Level of Access Desired by Organization varies across the spectrumLevel of Access Desired by Organization varies across the spectrum MDM Enabled ꭕ Won’t Enable MDM ꭕ Can’t Enable MDM
- 51. Conditional Access BuildingBlocks • "When this happens" is called condition statement • "Then do this" is called controls • The combination of a condition statement with your controls represents a conditional access policy
- 52. Conditional Access Application Per apppolicy Type of client (Web, Rich, mobile) Cloud and On-premises applications User attributes Group membership Devices Domain Joined compliant Platform type (Windows, iOS, Android) Location IP Range ENFORCE MFA ALLOW BLOCK Risk Session risk User risk
- 53. Demo: Conditional Accessfor Applications in the Azure Portal
- 54. Devices Controls inConditional Access • Compliant Device: • Intune Compliance Policy • SCCM • Domain Joined Device: • Azure AD Registered Device (DRS) • Windows 10 Domain Joined: Creates object in AD which is synced to cloud by AAD Connect • (Windows 10 Azure AD Joined: Registers at join) • Windows 7, 8, 8.1 domain joined: ADFS claims configured for DRS • Windows 8.1 could potentially also enroll in MDM manually and become compliant that way
- 55. Azure AD DeviceRegistration Prerequisites • Device Registration Allowed • USERS MAY WORKPLACE JOIN DEVICES:ALL • DNS Records: • Internet Explorer Settings (these are defaults) • Don’t prompt for client certificate selection when only one certificate exists: Enable • Allow scripting: Enable • Automatic logon only in Intranet zone: Checked • Group Policy to enforce registration Entry Type Address enterpriseregistration.contoso.com CNAME enterpriseregistration.windows.net enterpriseregistration.region.contoso.com CNAME enterpriseregistration.windows.net
- 56. ADFS Claims forDRS • Additional Claims: • http://schemas.microsoft.com/ws/2012/01/accounttype • http://schemas.microsoft.com/identity/claims/onpremobjectguid • http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid • http://schemas.microsoft.com/ws/2008/06/identity/claims/issuerid
- 57.
- 58. Please evaluate thesession on your way out… Hated It! Meh… Best session ever!