MCAS Data Protection Blog Series: Do I use MCAS or MIP?

by Contributed | Dec 22, 2020 | Technology

This article is contributed. See the original author and article here.

Microsoft Cloud App Security (MCAS) versus Microsoft Information Protection (MIP): Do I use MCAS or MIP?

December 2020

Hi everyone! Welcome to the third blog of my MCAS Data Protection Blog Series! If this is your first time seeing this blog, check out my landing page for some more information about me and what I’ll be covering!

Well, Happy December! For this month, I won’t be focusing on a specific app but more so on deciding when to use our information protection services. There’s a lot of overlap, integration, and separate components that go into these two services.

Overview: At a high level, AIP is a cloud-based solution that enables organizations to discover, classify, and protect documents and emails by applying labels to content. AIP is part of the Microsoft Information Protection (MIP) solution, and extends the labeling and classification functionality provided by Microsoft 365. MIP is the common information protection stack that’s leveraged by AIP’s unified labeling client. For more information, see the Microsoft 365 documentation. For information on AIP versus MIP, please check out our documentation.

MCAS and AIP are both a part of our MIP Offering. For this blog, I’ll be using MIP to identify all the non-MCAS components.

NOTE: To provide a unified and streamlined customer experience, AIP client (classic) and Label Management in the Azure Portal are being deprecated as of March 31, 2021. This timeframe allows all current AIP customers to transition to our unified labeling solution using the Microsoft Information Protection Unified Labeling platform. Learn more in our official deprecation notice.

NOTE: This blog is also relevant for Office 365 unified sensitivity labels if you already migrated your classification labels for the Office 365 Security and Compliance Center. If you did not migrate your existing classification labels, and you begin to create new labels in the Office 365 Security and Compliance Center, Microsoft Cloud App Security will only use the preexisting labels configured in the Azure Information Protection portal.

Before we begin, it is important to know that we love our portals and you can do quite a few of the same activities on each of these portals. This can get confusing for a lot of folks. For the purpose of the integration of MCAS with AIP, I’ve called out some of the capabilities within these portals that have been of importance for many of my customers. In additional, the portals have different links based on if you’re using non-commercial instances.

Important Portals

In addition, to see more guidance on integrating MCAS with AIP, check out our documentation.

MCAS has two different ways of inspecting data in your environment. You have the built-in inspection as well as the Data Classification Service (our example is using AIP Classification Labels or Sensitivity Labels from MIP). When you set up the integration between AIP and MCAS, there are a few dependencies.

NOTE: If you’re using the classic AIP client, those labels will populate in MCAS. If you’ve migrated over to unified labeling, you’ll be using the sensitivity labels from the Security and Compliance Center (protection.office.com) or the Compliance Center (see above for a high-level overview of a few portals).

The MCAS integration with AIP enables an added level of protection by automatically encrypting files. When AIP encrypts files, applications that support AIP like Office 365, know how to open the files and honors permissions set in the classification labels. Use labels to apply specific protection rules. For example, set a file that can be opened but not shared, printed, forwarded, or edited.

This strong level of protection travels with the file. The file is still protected if you send the file, copy it, or store it in your online storage app. If one of your employees loses a thumb drive with the file on it, the file will be locked. Should someone try to open the file, the file owner will receive an alert. With MCAS, you can apply protection automatically. For example, set all files that have credit card numbers, or were uploaded by the finance department and are shared externally, to be automatically protected with a classification label.

Please see below for some of the limitations and the most asked questions regarding these two service offerings. I’ve put together the product to use and some deployment guidance.

Scenarios

Limitations

Please let me know if you have any questions regarding MCAS vs MIP in the comments. I’ll do my best to answer and provide you with additional resources.

This blog will also be a part of our newly published MCAS Ninja Training, check it out at aka.ms/MCASNinja (Update Coming January/February 2021).

Azure AD workbook to help you assess Solorigate risk

by Contributed | Dec 22, 2020 | Technology

This article is contributed. See the original author and article here.

In the interest of helping customers concerned about the Solorigate attacks we are publishing a new workbook in the Azure AD admin portal to assist investigations into the Identity Indicators of Compromise related to the attacks. The information in this workbook is available in Azure AD audit and sign in logs, but the workbook helps you collect and visualize the information in one view.

The workbook is split into 5 sections, each aimed at providing information associated with the attack patterns we have identified:

1. Modified application and service principal credentials/authentication methods


2. Modified federation settings


3. Azure AD STS Refresh token modifications by service principals and applications other than DirectorySync


4. New permissions granted to service principals


5. Directory role and group membership updates for service principals

First, we’ll detail how to access the workbook and then walk through each of these in turn.

Accessing the workbook

If you organization is new to Azure Monitor workbooks, you’ll need to integrate your Azure AD sign-in and audit logs with Azure Monitor before accessing the workbook. This allows you to store, and query, and visualize your logs using workbooks for up to 2 years. Only sign-in and audit events created after Azure Monitor integration will be stored, so the workbook will not contain insights prior to that date. Learn more about the prerequisites to Azure Monitor workbooks for Azure Active Directory. If you have previously integrated your Azure AD sign-in and audit logs with Azure Monitor, you can use the workbook to assess past information.

To access the workbook:

1. Sign into the Azure portal


2. Navigate to Azure Active Directory > Monitoring > Workbooks

In the Troubleshoot section, open the Sensitive Operations Report

Modified application and service principal credentials/authentication methods

One of the most common ways for attackers to gain persistence in the environment is by adding new credentials to existing applications and service principals. This allows the attacker to authenticate as the target application or service principal, granting them access to all resources to which it has permissions.

 This section includes the following data to help you detect such actions:

• All new credentials added to apps and service principals, including the credential type


• Top actors and the amount of credentials modifications they performed


• A timeline for all credential changes

You can use the filters present in this section to further investigate any of the suspicious actors or service principals that were modified.

For more information: Apps & service principals in Azure AD – Microsoft identity platform

Modified federation settings

Another common approach to gaining a long-term foothold in the environment is modifying the tenant’s federated domain trusts and effectively adding an additional, attacker controlled, SAML IDP as a trusted authentication source.

This section includes the following data:

• Changes performed to existing domain federation trusts


• Addition of new domains and trusts

Any actions which modify or add domain federation trusts are rare and should be treated as high fidelity to be investigated as soon as possible.

For more information: What is federation with Azure AD?

Azure AD STS refresh token modifications by service principals and applications other than DirectorySync

Refresh tokens are used to validate identification and obtain access tokens. Manual modifications of these tokens may be legitimate but have also been observed to be generated as a result of malicious token extensions.

When reviewing the data in this section the admin should check new token validation time period with high values and investigate whether this was a legitimate change or an attempt to gain persistence by the attacker.

For more information: Refresh tokens in Azure AD

New permissions granted to service principals

In cases where the attacker cannot find a service principal or an application with a high privilege set of permissions through which to gain access, they will often attempt to add the permissions to another service principal or app.

This section includes a breakdown of the AppOnly permissions grants to existing service principals. Admins should investigate any instances of excessive high permissions being granted, including, but not limited to, Exchange Online, Microsoft Graph and Azure AD Graph

For more information: Microsoft identity platform scopes, permissions, and consent

Directory role and group membership updates for service principals

Following the logic of the attacker adding new permissions to existing service principals and applications, another approach is adding them to existing directory roles or groups.

This section includes an overview of all changes made to service principal memberships and should be reviewed for any additions to high privilege roles and groups.

Conclusion

This workbook includes an overview of some of the common attack patterns in AAD, not only in Solorigate, and should be used as an investigation aid in conjunction with the steps described in the articles linked at the beginning to ensure your environment is safe and protect is from malicious actors.

For additional hunting with Azure Sentinel see http://aka.ms/sentinelsolorigatehunt.

The Solarwinds attack is an ongoing investigation, and our teams continue to act as first responders to these attacks. As new information becomes available, we will make updates through our Microsoft Security Response Center (MSRC) blog at https://aka.ms/solorigate.

Please reach out to me on twitter at @Alex_t_weinert if you have questions or suggestions for improvement.

Managing Mission-Critical Access Applications

by Contributed | Dec 22, 2020 | Technology

This article is contributed. See the original author and article here.

Microsoft Access is the most popular desktop database in the world with millions of databases; some being mission critical. As such, CTO’s need to recognize and manage these kinds of applications to ensure business success and continuity.

The very worst moment to find out you’ve got a mission critical Access database is when it stops working, with little-to-no knowledge of how to troubleshoot the issue. Therefore, we’d like to cover what you can do in situations like these to ensure individual and business success.

Follow these steps to identify mission critical applications:

1. Inventory all Access files that end in ACCDB on your network.


2. Sort the list by last modified date.
   
   
   
   • Most, but not all Access applications are split into a data file and a programming file; it is likely that the data file will have a more recent date with a file name that ends in BE.
   
   
   
   


3. With your sorted list, approach departments and ask them to identify any mission critical apps, along with a brief summary of what the database does and why it’s mission critical. Ask them to list the owner of the databases and the author, who may not be the same.

Make sure best practices are followed:

Now that you’ve identified your mission critical databases, follow these best practices:

• Make sure every database is split into a Front End file with code, with a Back End file containing your raw data.
  
  
  
  • The Back End file should be on your network, and you should ensure to back up the file each night.
  
  
  • The Front End file should be saved on each user’s PC.
  
  
  
  


• Have a database diagram created for each database if there is none.


• Ensure that the VBA and macro code is well documented.


• Add a table to document changes to the system by version and date.


• Modify the startup form to include the version and issue date.


• Meet with the database owner and author to document and understand the business case for the application:
  
  
  
  • Why is it mission critical?
  
  
  • Why can’t they use existing enterprise systems?
  
  
  • Are they experiencing issues with slowness and bugs that may impact performance as the system grows? (Access has a hard limit of 2 Gigabytes in size and as you approach it, it will get slower).
  
  
  
  

Maintenance

Maintenance of the Access database consists of doing a compact and repair on your Back End file every 3 or 6 months, as needed.

Your employees will continue to use Access, enable them.

Access can be a great tool in the right hands, allowing companies to leverage its ease of programming and rapid development. With your applications remaining as toolsets in Office installed on your desktops, your employees can successfully learn how to develop and manage Access apps, while fully reaping its benefits.

Summary:

As a result of its short development cycle, Access is the ‘go–to’ application for productivity improvements. Therefore the time to identify when an Access application is mission critical is before a key developer leaves, or if the system stops working or becomes unstable. IT managers need to be proactive, working with departments to identify databases and document their behavior. Having a strategy in place for dealing with mission critical Access databases will ensure your company can continue leveraging the technology for years to come.

About the Author:

Juan Soto is the President of IT Impact and a leading professional in the industry. He has been named an Access MVP by Microsoft since 2011 and is a frequent author on the official Microsoft Access blog as well as the co-founder of AccessUserGroups.org, where groups of Access enthusiasts around the world meet once a month on a wide range of topics. You can reach Juan at https://accessexperts.com/contact/