PAMonster @mightypamonster - Tumblr Blog

Sometimes it feels like the Self Bootstrapping mentality has seeped too deep into the roots of the IT domain.

Factors of Loss

Something you forgot Something you lost Something you were Somewhere you went Something you did

Day 9 - SC-900 - Conditional Access & AAD Security Default Settings

-Conditional Access in Azure AD(AAD) -A feature of AAD that provides an extra layer of security before allowing Authenticated(AuthN) users to access data or other resources -Policies analyze signals to automate decisions for Authorizing(AuthZ) access to resources -Signals include sources such as: -User Attributes(Group Memberships) -Location(IP range, office location) -Device(Domain joined, platform type/OS, version compliance) -Application(App)(App policy, client type) -Risk(Sign-in/user risk) -Access Controls: As signals are reviewed & will trigger a type of verification requirement based on the status/policy of the signals -i.e. should the AuthN attempt require MFA, allow without verification, block outright, etc -Session Controls: If verification is completed AuthZ is confirmed & the identity is granted access to resources, apps, data, etc. -Security Defaults in AAD: -Preconfigured security settings designed to provide Organizations(orgs) protection from common attacks more easily -Requiring all users to register for AAD Multi-factor Authentication(MFA) -Requiring Administrators(admin) to perform MFA -Requiring users to perform MFA when necessary -Blocking legacy AuthN protocols -Protecting privileged activities like access to the Azure portal -These defaults are in place for orgs that have not had the opportunity to configure more granular conditional access policies. -Orgs will often turn off the security defaults as they implement their organization specific conditional access/security control config within their environment. -These defaults are implemented at creation of tenants created on/after 22 October 2019

#security #environment #compliance #iam #pam #authentication #authorization #sc900 #microsoft #conditionalaccess #mfa #100daysofcybersecurity

Day 8 - SC-900 - Self-Service Password Reset(SSPR), Password Protection, & Password Management Capabilities

Self-Service Password Reset(SSPR): -Benefits of SSPR: -Gives users the ability to quickly change/reset their password -Users can follow prompts to unblock themselves w/o admin involvement -Reduces the most common type of helpdesk(HD) call

-Requirements of SSPR Use: -User must be: -Assigned an Azure AD(AAD) license -Enabled for SSPR by an admin -Registered with the AuthN method they want to use -Note: Two(2) or more AuthN methods are recommended in case one(1) is unavailable. -Tip: Enable SSPR for a group -Note: this tip does require AAD Premium Plan 1

-SSPR Use Cases: -Password Change: When a user knows their password but wants to change it to something new. -Password Reset: When a user cannot sign in because they forgot their password & want to reset it. -Account Lock: When a user cannot sign in because their account is locked out.

-SSPR Supported AuthN Methods: -Email -Mobile App Notification -Mobile App Code -Mobile Phone -Office Phone -Security Questions

-Combined Registration for AAD MFA & SSPR: -Starting 15 Aug 2020 all new AAD tenants will be auto enabled for combined registration -After 30 Sept 2022 all users will register security info through the combined registration experience

Password Protection & Management Capabilities: -AAD Password Protection -Users often choose weak passwords that are susceptible to dictionary attacks -AAD provides both global & custom banned password lists -A password change request fails if there's a match in these banned passwords lists -Supports hybrid environments; AD domain controllers are not put at risk

-Banned Password Lists: -Global Banned Password List: A global banned password list with known weak passwords is auto updated & enforced by Microsoft -Custom Banned Password Lists: Lists of custom banned passwords created by admins to support specific business security needs(Brand/Product names, company location names, etc)

-Smart Lockout -Microsoft system created to help lock out bad actors(BA) that try to guess user passwords, use brute-force, or password spray attack methods -By default it locks the account from sign-in attempts for one(1) minute after ten(10) failed attempts & longer as failures continue -Uses familiar location vs unfamiliar location to differentiate between genuine user & bad actor -Integration with On-Prem AD: -Can be integrated with hybrid deployment that use password hash sync/pass-through authentication -Protects on-prem AD Domain Services(ADDS) accounts from being locked out

#microsoft #azure #iam #authentication #sc900 #100daysofcybersecurity #SSPR #activedirectory #passwordprotection #study #certification #security

Day 7 - SC-900 - Multi-factor Authentication(AuthN)(MFA) in Azure AD(AAD)

-Azure MFA Requires 2 or more AuthN methods: -Something you know(PIN/Password) -Something you have(Trusted Device) -Something you are(Bio-metrics)

-Additional Verification methods for AAD MFA: -Microsoft Authenticator App -Windows Hello for Business -Fast Identity Online(FIDO)2 Security Key -Open Authentication(OATH) Software Token -SMS/Text Message -Voice Call

-User Registration for AAD MFA: -Users can self register for self-service password reset & AAD MFA in one step for simple on-boarding -Admins can decide which forms of 2ndary AuthN can be used

-Options for Pushing MFA Registration: -Using AAD Identity Protection(Easiest) -Prompt user to register for MFA when they attempt to use an app that requires MFA -Enforcing MFA registration using an AAD Conditional Access policy

-AAD MFA Registration Policy -Can be enabled to require users to register for AAD MFA next time they sign in -Users have 14 days to complete registration -Note: This requires AAD Premium P2

-App Passwords: -Older, non-browser apps don't understand pauses/breaks in AuthN process -App passwords replace traditional passwords to allow an app to bypass MFA & work correctly -Note: App passwords don't work with Conditional Access-based MFA policies & modern AuthN

#azure #security #microsoft #business #iam #sc900 #studying #certification #mfa #activedirectory #fido2 #oath #windowshello #authentication #identityprotection #100 days of cyber security

Day 6 - SC-900 - Authentication Methods in Azure AD(AAD)

Passwords: -Weakest of authentication methods in AAD -Subject to classic exploitation techniques such as password spraying & bruteforce attacks -Still subject to exploitation even with enforced complexity -Can be combined with other non-controlled application methods to bolster it, such as: -SMS: -SMS is considered less than secure in practical application. -Voice Call

-Can be combined with controlled application methods to bolster it, such as: -Microsoft AuthN App: -Can be used as a primary form of AuthN to sign into an AAD account -Can be used as additional verification option for self-service password reset(SSPR) or AAD multi-factor authentication(MFA) events. -Users must download the phone app & register their account to use this application.

-Open Authentication(OATH) Token One-Time Password(OTP) -Open standard that specifies how time-based OTP(TOTP) codes are generated -Software Token: -AAD generates a secret key, or seed, that is input into the app & used to generate each OTP -Typically an application -Hardware Token: -Small hardware devices that look like a key fob -Secret key/seed programmed into the token -Displays a code that refreshes every 30 or 60 seconds

Passwordless: -Windows Hello -AuthN feature built into Windows 10 -Replaces passwords with strong two-factor AuthN(2FA) on PCs & Mobile Devices -Allows userse to AuthN to: -Microsoft Account -AD Account -AAD Account -Identity Provider Services -Relying party services that support FIDO2 AuthN -Windows Hello is for personal devices. -Uses a PIN or biometric gesture. -Windows Hello for Business is for business owned devices -Uses Key-based or cert-based AuthN -Solves the following problems: -Password reuse -Exposure of symmetric network credentials during/after a server breach -Replay attacks -Password exposure due to phishing

-Microsoft Authenticator -Fast Identity Online(FIDO)2 Security Key: -Uses public-key (Asymmetric) cryptography for user AuthN -User has a physical device(USB or NFC) -AuthN Sequence: -Provide Username > Cryptographic Challenge > Use FIDO2 key to sign > service verifies response > Access is granted

#IAM #sc 900 #microsoft #100 days of cyber security #azure active directory #Authentication

Day 5 - SC-900 - Azure Active Directory

Azure AD identity types: User -Representation of an entity that is managed by Azure AD -Both Guests & Employees are represented as users -Azure AD B2B collaboration: Feature within External Identities that includes the capability to add guest users & enables orgs to securely share apps & services with guest users from other orgs

Service Principal -An Identity for an application -Enables AuthN & AuthZ of the app to resources that are secured by the AD tenant -App must first be registered w/ Azure AD to enable identity & access integration -Once registered a service principal is created in each Azure AD tenant where the app is used.

Managed Identity -Special type of service principal that is auto managed in Azure AD -Eliminates the need for admins & devs to manage credentials -User Assigned: -Identity that can be shared by multiple resources & has a lifecycle independent of said resources -System Assigned: -Identity that is tied to the lifecycle of a specific service or resource & cannot be shared. -When the choice is available using system-assigned managed identities to minimize admin effort.

Device -A piece of hardware(mobile device, laptop, server, printer, etc) -Azure AD Registered: Provides users w/ support for BYOD device scenarios -Azure AD Joined: Device joined to Azure AD through an org account which is then used to sign into the device. -Hybrid Azure AD Joined: Domain joined device to Azure AD & on-prem AD. -Device registry allows for Single Sign-On(SSO) to cloud-based resources. -Azure AD joined devices also benefit from the SSO experience to resources & apps that rely on on-prem AD -Device registry also allows for device management with Intune to control how an org's devices are used -Mobile Device Management(MDM) for company-owned devices -Mobile Application Management(MAM) for personal devices

Overview of the Hybrid Identity Model -All scenarios with Hybrid AD require an on-prem AD instance! -Azure AD password hash synchronization: -Simplest way to enable AuthN for on-prem directory objects in Azure AD -User is authed by Azure AD -Azure AD Pass-through Authentication (PTA) -User is Authed directly against on-prem AD -Can be used to enforce AD restrictions not present in Azure AD(logon hours) -Federated Authentication -AuthN for orgs that need advanced measures not supported by Azure AD(smart cards, certs) -Azure AD passes the request to on-prem AD

External Identity Types -Emps are commonly working w/ people both inside & outside of the org -External users may need access to resources inside of the org -Azure AD External Identities is a set of capabilities that enables orgs to allow access to external users -Two different types of Azure AD External Identities: -Business to business(B2B): Collaboration type that allows an org to share apps & resources with external users -Enables orgs to share apps & resources with guest users from other orgs -Uses an invitation & redemption process -Can perform Self Service Password Reset through their own org's usual process -Admins can also enable self-service sign-up user flows to allow external users to sign up without admin intervention. -Business to Consumer(B2C): Identity management solution that allows for management of identities on consumer-facing apps -Enables external users to use their preferred social, work, or local identities for SSO to an org's apps -A Customer Identity Access Management(CIAM) solution -Supports many users & billions of AuthNs per day -Automatically handles threats like DoS , password spray, or brute-force attacks -External users are managed in the Azure AD B2C directory, separately from the org's employee & partner directory

#Microsoft #azure active directory #IAM #PAM #active directory #sc-900

Day 4 - SC-900 - Identity Concepts

Identity is the primary security perimeter

The four(4) pilliars of Identity: -Administration: The creation & management of identities for users, devices, & services. -Authentication: The act of challenging a party for legitimate credentials. -"AuthN" -Service provided by an identity provider -Multi-factor authentication(MFA) can help make authentication more secure -Something you know(pin, password) -Something you have(trusted device) -Something you are(biometrics)-Evaluating conditions around an authentication request(location, device state) can help make authentication more secure. -Evaluating risk around a user's authentication request -Identity Providers create, maintain, & manage identity info whole providing AuthN services to apps. -Can provide Single Sign-On(SSO) which enables access to multiple resources with a single logon.

-Authorization: The act of processing incoming identity data to determine an appropriate level & type of access. -"AuthZ" -Specifies what resources someone is allowed to access & what they can do with those resources -Role-based Access Control(RBAC) is a collection of permissions of actions that can be performed.

-Auditing: The act of tracking who does what when, where, & how in a system or application.

Identity Federation is a system of trust between two parties for authenticating users & conveying info needed to authorize their access to resources -Enables access across org boundaries by establishing trust relationships between the orgs' identity providers -Typically includes AuthN & AuthZ -Allows admins to implement different and/or more rigorous levels of access control -Active Directory Federation Services(ADFS) ensures that all AuthN occurs on premises & enables implementation of stronger access control

Identity may be a user, application, or even a device Identity has moved closer to the entities working outside the physical network perimeter Policy-based protection travels with the identity wherever it resides

#100 days of cyber security #infosecurity #cybersecurity #sc 900 #certification #pam #iam

Day 3 - SC-900 - Encryption, Hashing, & Broad Compliance Concepts

Hashing is a one way function designed to scramble plain text into an unique digest in an indecipherable way.

Hashing has the following requirements: -Must accept any length of characters into its input -Must produce a fixed length of characters for its output -Must be relatively easy to compute -Must not be reversible -Must avoid collisions(having two different inputs that produce the same output)

Encryption is the act of scrambling plain text in a way that can be reversed via a medium(key, passphrase, silly dance, etc) Symmetric encryption is when plaintext is encrypted & decrypted by the same key. Symmetric encryption is often fast to operate & used for working with bulk encryption/decryption. Asymmetric encryption is when plantext is encrypted with a single key & then decrypted by a different key. -Public/Private key encryption

#certification #sc 900 #100 days of cyber security #cybersecurity #iam #what is a break?#infosecurity #encryption #hashing #compliance #symmetric #asymmetric

prokopetz

Thesis: vampires are so melodramatic as a form of behavioural infosec. While their bewildering collections of odd mannerisms make it easy to clock them as vampires, they also make it extremely difficult to tell which of those mannerisms stem from some esoteric weakness or strange limitation on their vampire powers, and which are just them being extra.

Day 2 - SC-900 - Defense-In-Depth & the Zero Trust Methodology

Defense-in-Depth operates on a principle of not leaning on a singular point of failure. Instead it is the philosophy of putting many "smaller" controls at different points within an environment. This allows for more opportunities for vulnerabilities like misconfiguration, poor policy implementation, legacy systems, & the like to act as a single target for threats.

More eyes watching & make bad actors work harder.

Defense-in-Depth Layers: Data, Applications, Device/Computers, Network, Perimeter, Identity & Access Management, Physical This layered approach is key in Zero Trust; where nothing is assumed or trusted within an environment. Zero Trust Core Principles: -Assume Breach -Verify Explicitly -Enforce Least-Privilege Access