NSA and CISA Release Part III of Guidance on Securing 5G Cloud Infrastructures

by | Dec 2, 2021 | Security, Technology

This article is contributed. See the original author and article here.

CISA has announced the joint National Security Agency (NSA) and CISA publication of the third of a four-part series, Security Guidance for 5G Cloud Infrastructures. Part III: Data Protection examines security during all phases of the data lifecycle—in transit, in use, and at rest. The guidance focuses on protecting the confidentiality, integrity, and availability of data within a 5G cloud infrastructure to protect sensitive information from unauthorized access. This series is being published under the Enduring Security Framework (ESF), a public-private cross-sector working group led by NSA and CISA.

CISA has also released a set of four 5G educational videos to enhance the awareness and importance of the safe and secure development and deployment of 5G infrastructure. 

CISA encourages 5G providers, integrators, and network operators to review the guidance and consider the recommendations. See CISA’s 5G Security and Resilience webpage for more information. 

Azure Marketplace new offers – Volume 177

Azure Marketplace new offers – Volume 177

by | Dec 2, 2021 | Technology

This article is contributed. See the original author and article here.











We continue to expand the Azure Marketplace ecosystem. For this volume, 115 new offers successfully met the onboarding criteria and went live. See details of the new offers below:





























































































































































































































































































































































































































Get it now in our marketplace
Accelario DataOps Platform for MySQL databases.png

Accelario DataOps Platform for MySQL Databases: Accelario DataOps Platform for MySQL Databases accelerates and automates self-service provisioning and data refreshes from on-premises to the cloud and vice versa with minimal downtime. Speed up your go-to-market and application delivery without sacrificing performance.
Accelario DataOps Platform for PostgreSQL database.png

Accelario DataOps Platform for PostgreSQL Databases: Accelerate your application development and cloud migration with Accelario DataOps Platform for PostgreSQL Databases. This self-service platform streamlines database copy and speeds up DevOps pipelines. Reduce wait time for any type of test data to minutes. 
ARGOS CSPM - Contextual Cloud Security Monitoring.png

ARGOS – Contextual Cloud Security Monitoring: Get a precise picture of your cloud security posture with ARGOS’ end-to-end security service. Tools like resource graphs and exploitability checks enable real-time detection and remediation so you can focus on securely deploying applications with speed and efficiency.
Bugzilla Issue Tracker.png

Bugzilla Issue Tracker: Bugzilla Issue Tracker on Ubuntu Server 20.04 is an open-source bug tracking solution that enables users to stay connected with their clients or employees while keeping track of outstanding bugs and issues throughout the software development life cycle.
Cloud Membership Management System.png

Cloud Membership Management System: Caloudi’s AI-powered cloud membership management platform helps consolidate and manage all information related to your retail customer on a single platform. Personalize your client’s shopping experience with targeted messaging and promotions.
DesktopReady for MSP.png

DesktopReady for MSP: DesktopReady for MSP is a Microsoft Azure Virtual Desktop automation platform that enables managed service providers to deliver Windows 10 desktops on Azure. Set up your modern workspace for improved agility and ongoing cost savings.
EcoVadis Sustainability Ratings.png

EcoVadis Sustainability Ratings: Integrate sustainability in your procurement policy, processes, and tools with EcoVadis Sustainability Ratings. This scalable SaaS solution helps screen and assess suppliers’ sustainability performance. This offer is for existing EcoVadis customers only.
MediaValet Digital Asset Management.png

MediaValet Digital Asset Management: This secure, cost-effective digital asset management platform seamlessly integrates with your existing tools and allows marketing teams to create, organize, and distribute high-value digital assets across teams, departments, and partners. 
Metabase on Debian.png

Metabase on Debian: Powered by Niles partners, Metabase is a business intelligence and data visualization tool with SQL capabilities. It offers a simple graphical interface to power in-application analytics without writing any SQL.
Prescript EMR.png

Prescript EMR: Prescript EMR is an integrated healthcare platform for optimizing patient care in both urban and rural settings. Powered by a clinical management system it offers a single portal for administering appointments, electronic medical records (EMR), billing, and more.
Procore Sharepoint Integration.png

Procore SharePoint Integration: SyncEzy’s offering allows you to access Procore photos and documents within Microsoft SharePoint and discuss site documents with your construction crew from a central cloud location. Access work files within Microsoft Teams and more.
QuerySurge.png

QuerySurge: Continuously detect data issues in your delivery pipeline with this automated data testing solution from RTTS. QuerySurge optimizes your critical data by integrating Microsoft Power BI analytics in your DataOps pipeline and improves ROI.
Revenue Cycle Management.png

Revenue Cycle Management: Inforich’s solution leverages AI, automation, and analytics to streamline the insurance and clinical aspects of healthcare by linking administrative, insurance, and other financial information with the patient’s treatment plan.
Scheduling as a Service.png

Scheduling as a Service: This employee management scheduling software creates custom scheduling templates using AI to optimize resources and workforce requirements. Improve your field services and control costs by assigning employees based on total labor expense.
Seascape for Notes.png

Seascape for Notes: Seascape for Notes is an archiving solution for Lotus Notes (HCL Notes and Domino). It enables administrators to archive entire Notes applications, mail files, and other custom databases using a streamlined archiving process.
ShiftLeft CORE.png

ShiftLeft CORE: ShiftLeft CORE uses rapid, repeatable static application security testing to help developers fix 91% of new vulnerabilities within the code they are working on in two discovery sprints. Release secure code at scale with this easy-to-use SaaS platform.
Symend.png

Symend: Symend’s relationship-based approach uses behavioral science and analytics to empower customers to resolve past due bills before they reach collections. Determine which strategies will empathetically help customers while lowering your operating costs.
Vitals KPI Management for Healthcare.png

Vitals KPI Management for Healthcare: Vitals KPIM uses artificial intelligence and analytics to improve healthcare services by creating success metrics that align patient satisfaction, business processes and team collaboration. This solution is only available in Chinese.
WhiteSource Open Source Security Management.png

WhiteSource Open Source Security Management: WhiteSource Open Source Security Management offers an agile open source security and license compliance management solution that makes it easy to develop secure software without compromising speed or agility.

Go further with workshops, proofs of concept, and implementations
AKS Container Platform Build-16-Week Implementation.png

AKS Container Platform Build: 16-Week Implementation: In this engagement, BlakYaks will implement a secure and scalable Microsoft Azure Kubernetes Service (AKS) platform built with code for hosting container workloads at scale on Microsoft Azure. 
AKS Container Platform Design- 8-Week Implementation.png

AKS Container Platform Design: 8-Week Implementation: Utilizing enterprise-grade designs, patterns, and operational frameworks, BlakYaks will provide a comprehensive design engagement for a secure and compliant Microsoft Azure Kubernetes Service platform.
Azure IoT Jumpstart Kit- 1-Day Implementation Workshop .png

Azure IoT Jumpstart Kit: 1-Day Implementation Workshop: ACP IT Solutions will help connect your industrial sensors, machines, and production processes with Azure IoT using cost-effective, ready-made retrofitting product bundles. This offer is only available in German.
Azure Managed Services-12-Month Implementation.png

Azure Managed Services: 12-Month Implementation: CoreBTS’ custom Microsoft Azure managed service will help cost-optimize your business processes by enabling your teams to focus on strategic tasks rather than day-to-day operations.
Azure Migration- 4-Week Implementation.png

Azure Migration: 4-Week Implementation: In this collaborative engagement, MNP Digital will seamlessly migrate your servers to Microsoft Azure to optimize your cloud usage and ensure a sustainable foundation, structure, governance, and security for your digital transformation.
Azure Purview Foundations- 3-Week Implementation.png

Azure Purview Foundations: 3-Week Implementation: Coretek will help you create a holistic, up-to-date map of your data landscape with automated data discovery, sensitive data classification, and end-to-end data lineage with Azure Purview Foundations.
Azure Real-Time IoT Data Analytics- 20-Day Proof of Concept.png

Azure Real-Time IoT Data Analytics: 20-Day Proof of Concept: ScienceSoft’s proof of concept is designed to help companies get real-time visibility into operational processes and enable intelligent automation using Azure IoT Hub, Azure Stream Analytics and Microsoft Power BI.


Azure Sentinel Onboarding- 2-Week Proof of Concept.png

Azure Sentinel Onboarding: 2-Week Proof of Concept: Enhance your organization’s threat detection and response capabilities in this proof of concept. The experts from Stripe OLT Consulting will help your organization modernize its security operation by onboarding Microsoft Azure Sentinel into your own tenant.
ECF Data Azure Sentinel- 2-Day Workshop.png

Azure Sentinel: 2-Day Workshop: In this workshop you will partner with ECF Data to modernize your security operation and capture threat intelligence using Microsoft Azure Sentinel and move your organization’s defenses from a reactive state to a proactive one.
Azure Services‎- 1-Week Implementation.png

Azure Services‎: 1-Week Implementation: Manapro Consultants will demonstrate how Microsoft Azure services can transform your applications and lower operational costs as you lay the foundations for your cloud migration journey. This offer is available only in Spanish.
Azure Site Recovery and Backup- 3-Week Proof of Concept.png

Azure Site Recovery and Backup: 3-Week Proof of Concept: Using your existing on-premises and/or cloud servers, Insight will guide you through the concepts of cloud backup and disaster recovery and configure a working prototype. Learn how Azure Site Recovery can simplify and reduce the cost of your disaster recovery solution.
Azure Site Reliability Engineering (Managed Service)- 12-Month Implementation.png

Azure Site Reliability Engineering (Managed Service): 12-Month Implementation: BlakYaks will create and implement a custom managed service for all your Microsoft Azure hosted platforms to keep them up-to-date and aligned to your strategic requirements. Cost-optimize your business processes and site reliability engineering operations.
Windows Virtual Desktop on Azure- 2-Week Proof of Concept.png

Azure Virtual Desktop: 2-Week Proof of Concept: Insight’s proof of concept will give you the foundational knowledge to configure a secure, scalable, virtual desktop infrastructure using Microsoft Azure Virtual Desktop. Empower your employees with a flexible work environment.
Azure Virtual Desktop- 5-Week Implementation.png

Azure Virtual Desktop: 5-Week Implementation: Is your organization struggling with transitioning to remote work? 3Cloud will deliver an Azure Virtual Desktop deployment tailored to meet your operational and security needs. You’ll learn about various deployment scenarios and how to enable remote work for your organization.
Azure Virtual Desktop & Windows 365 Managed Services.png

Azure Virtual Desktop & Windows 365 Managed Services: The experts from Cubesys will develop a virtualized desktop strategy that includes a roadmap and cost-benefit analysis for an enterprise-wide implementation of Microsoft Azure Virtual Desktop and Windows 365. Learn how you can access your desktop and apps from anywhere.
Backup as a Service- 12-Month Implementation.png

Backup as a Service: 12-Month Implementation: Using Microsoft Azure and Commvault, Databarracks’ implementation will proactively resolve any security issues and help your organization monitor, manage, and restore backups so your critical data is always protected.
Cloud-Native Consulting- 2-Week Implementation.png

Cloud-Native Consulting: 2-Week Implementation: Alerant engineers will develop a wholistic understanding of your business needs before creating a roadmap to discover, plan, and develop cloud-native solutions to speed up your enterprise’s digital transformation.


Data Innovation Studio- 2-Week Workshop.png

Data Innovation Studio: 2-Week Workshop: In this innovation workshop, the experts from Data#3 will help your organization further its analytics and AI capabilities by delivering a tailored roadmap using a modern data platform reference architecture for Azure services.
Data Lake for Mortgage Servicing- 4-Week Implementation.png

Data Lake for Mortgage Servicing: 4-Week Implementation: Invati will simplify and reduce loan servicing costs and improve business insights by mapping your team’s mortgage data sources to a single point of access using Azure Data Lake and Azure Synapse Analytics.
Data Quality & MDM - 4-Week Proof of Concept.png

Data Quality & MDM: 4-Week Proof of Concept: Using machine learning models built on Microsoft Azure components, the experts at Tredence will improve your data by removing duplicates and inconsistent records. Access reliable data for better business insights.
Data Security Protection- 4-Week Workshop.png

Data Security Protection: 4-Week Workshop: Freedom Systems will help you understand your business’s security requirements and leverage Microsoft Enterprise Mobility and Security platform to protect and secure your organization. 
DevOps Assessment-1-Day Workshop.png DevOps Assessment: 1-Day Workshop: Xpirit will leverage their expertise in DevOps and help roll out tooling and methodology as they facilitate your organization’s transition to the cloud. Companies in highly regulated sectors such as defense and finance will benefit from this offer.
Digital Twin Smart Spaces- 3-Month Proof of Concept.png

Digital Twin Smart Spaces: 3-Month Proof of Concept: T-Systems MMS will identify, optimize, or sublet unused space by tracking the digital version of available physical workspaces in real-time via its Smart Spaces platform using battery-less sensors and Azure IoT services.
Disaster Recovery as a Service with Azure-12-Month Implementation.png

Disaster Recovery as a Service with Azure Site Recovery: 12-Month Implementation: Databarracks’ 24/7/365 service is compatible with both Windows and Linux Operating Systems and uses cloud-native solutions like Azure Backup and Azure Site Recovery (ASR) to implement a simple, secure, and cost-effective disaster recovery solution.
Disaster Recovery as a Service- 12-Month Implementation.png

Disaster Recovery as a Service with Zerto: 12-Month Implementation: Databarracks will replicate your on-premises or cloud servers using Zerto Virtual Manager into a Zerto Cloud Appliance hosted in Microsoft Azure. At the point of recovery, Zerto uses Azure queues and Azure virtual machine scale sets to accelerate recovery.
Education diagnostic system- 5-Day Implementation.png

Education Diagnostic System: 5-Day Implementation: In this implementation SiES IT will help set up an appraisal platform to assess the value and quality of educational institutions using Microsoft Azure services. This offer is only available in Russian.
Identity Cleanse- 5-Day Workshop.png

Identity Cleanse: 5-Day Workshop: The experts from ITC Secure will consolidate and reconcile all sources of user and account information to assess your environment and improve the security of your ecosystem using Microsoft Azure Active Directory.
Intelligent Hybrid Cloud Platform Hosting Solution- 3-Week Implementation.png

Intelligent Hybrid Cloud Platform Hosting Solution: 3-Week Implementation: In this offer, Acer AEB will provide a consistent multi-cloud and on-premises management platform with the successful implementation of Azure Stack HCI (hyperconverged infrastructure) architecture and its integration with Azure Arc. This offer is only available in Chinese.
Linux to Azure Migration- 16-Day Workshop.png

Linux to Azure Migration: 16-Day Workshop: SVA consultants will help your organization analyze its existing Linux infrastructure and develop a roadmap and business case to move your servers and applications to Microsoft Azure using Microsoft’s Cloud Adoption Framework (CAF). This offer is only available in German.
Microsoft Azure Migration & Deployment- 3-Month Implementation.png

Microsoft Azure Migration & Deployment: 3-Month Implementation: In this offer, Insight’s specialists will guide you through the adoption and migration of Microsoft Azure and ensure your deployment process is tailored to your organization’s exact business goals and needs.
Migrate to Azure- 15-Day Deployment.png

Migrate to Azure: 15-Day Deployment: Learn how Nebulan’s iterative approach using the Microsoft Cloud Adoption Framework can cost-effectively migrate your top 10 workloads, including Windows and SQL Server, to Microsoft Azure. This offer is only available in Spanish.
Migrate to Azure- 5-Week Implementation.png

Migrate to Azure: 5-Week Implementation: In this offer, Xavor will implement a low-risk, data-driven Microsoft Azure cloud migration solution tailored to your organization’s unique needs. Ensure business continuity and improve performance with governance, automation, and control of multi-cloud environments.
ML Ops Framework Setup- 12-Week Implementation.png

ML Ops Framework Setup: 12-Week Implementation: Tredence’s automated industrialized machine learning operations platform will help you generate higher ROI on your data science investments and offer clear and robust analytical insights with minimal manual effort using Microsoft Azure DevOps.
Modern Data Warehouse- 4-Week Proof of Concept.png

Modern Data Warehouse: 4-Week Proof of Concept: In this proof of concept, devoteam will demonstrate how its solution built on Azure Data Lake, Azure Analytics, and Azure Synapse can transform and modernize your legacy data landscape. 
Modernize with Azure Kubernetes Service- 5-Day Workshop.png

Modernize with Azure Kubernetes Service: 5-Day Workshop: The experts at SVA will lead a hand-on workshop to demonstrate how Azure Kubernetes Service (AKS) can provide an agile developer environment in Microsoft Azure while reducing costs and administrative overhead. This offer is only available in German.
Secure OnMesh- 8-Week Proof of Concept.png

Secure OnMesh: 8-Week Proof of Concept: Make security an intrinsic part of your digital fabric with Logicalis’ Secure OnMesh solution. In this engagement you will learn how Secure OnMesh leverages Microsoft Azure Sentinel to protect your entire digital ecosystem with AI-enabled threat hunting capabilities.
Truveta Data Migration- 3-Month Service.png

Truveta Data Migration: 3-Month Service: Tegria’s service helps healthcare organizations build scalable data pipelines from the cloud to the Truveta healthcare data platform using Microsoft Azure tools like Data Factory and Databricks. Truveta anonymizes and maps patient data and automates file creation.
Windows to Azure Migration- 16-Day Workshop.png

Windows Server to Azure Migration: 16-Day Workshop: SVA will identify and prioritize all your assets located on-prem Windows server environment and help move them to Microsoft Azure using a Cloud Adoption Framework-aligned approach. This offer is only available in German.

Contact our partners

AccessGov

AI and Data Projects: 2-Hour Briefing

Azure Analytics: 5-Day Assessment

Azure Cloud Adoption: 2-Week Assessment

Azure Cloud: 4-Week Assessment

Azure Container Platform Security: 6-Week Assessment

Azure Migration: 3-Day Assessment

Azure Migration Readiness: 2-Week Assessment

Azure Session: 2-Hour Initial Assessment

Azure Virtual Desktop Services

C-Track Comprehensive Court Case Management Solution

Cisco Integrated System for Microsoft Azure Stack

Cloudera Data Platform 7.2.x Runtimes

CloudXR Introductory Offer – Windows Server 2019

Cryptographic Risk Assessment

Cyber Care – Managed SAP Connector for Azure Sentinel

Cybersecurity: 1-Week Assessment



Data Estate Assessment: 2-Week Assessment

DataNeuron: Automated Learning Platform
Data Science & AI: 1-Week Assessment

Digia Cloud Cost Management Reporting

DLO Starter

e4Integrate

eMission Cloud View: 10-Week Assessment

eZuite Cloud ERP

HPC Cluster – CPU Based Cluster on SUSE Enterprise Linux 15.3 HPC

iEduERP

iFIX Intelligent Service Automation

impress.ai

Intelligent Document Processor



iPILOT Teams Direct Routing

IQ3 Cloud – Azure Managed Cloud

Journey to Cloud: 1-Hour Briefing

KIVU Expense

KPN Outbound Email Security Solution

Logicworks Managed Services for Azure

Loopr Data Labelling

Mammography Intelligent Assessment

MIND’s SAP on Azure: 1-Day Briefing

Minimum Viable Cloud: 6-Week Assessment

MT Cloud Control Volumes

Networking Services for Cloud: 1-Hour Briefing

OneDrop

Oracle Database

Orbital Insight Defense and Intelligence

PwC Promo and Assortment Management Tool (RGS)

Qlik Forts

Quality Management Software System

SailPoint Sentinel Integration

Sarus Private Learning

Scale by indigo.ai

Sentiment Analysis (Call Centre) by BiTQ

SINVAD

Thunder Threat Protection System Virtual Appliance for DDoS Protection

Urbana IoT Platform

Versa SASE in vWAN

Wipro Smart Asset Twin

Unlock hidden insights in your Finance and Operations data with data lake integration

Unlock hidden insights in your Finance and Operations data with data lake integration

by | Dec 2, 2021 | Dynamics 365, Microsoft 365, Technology

This article is contributed. See the original author and article here.

You chose Dynamics 365 for your enterprise to improve visibility and to transform your business with insights. Is it a challenge to provide timely insights? Does it take too much effort to build and maintain complex data pipelines?

If your solution includes using a data lake, you can now simplify data pipelines to unlock the insights hidden in that data by connecting your Finance and Operations apps environment with a data lake. With general availability of the Export to Data Lake feature in Finance and Operations apps, data from your Dynamics 365 environment is readily available in Azure Data Lake.

Data lakes are optimized for big data analytics. With a replica of your Dynamics 365 data in the data lake, you can use Microsoft Power BI to create rich operational reports and analytics. Your data engineers can use Spark and other big data technologies to reshape data or to apply machine learning models. Or you can work with a data lake the same way that you work with data in a SQL database. Serverless SQL pool endpoints in Azure Synapse Analytics conveniently lets you query big data in the lake with Transact-SQL (T-SQL).

Why limit yourself to business data? You can ingest legacy data from previous systems as well as data from machines and sensors at a fraction of the cost incurred when storing data in a SQL data warehouse. You can easily mash-up business data with signals from sensors and machines using Azure Synapse Analytics. You can merge signals from the factory floor with production schedules, or you can merge web logs from e-commerce sites with invoices and inventory movement.

Can’t wait to try this feature? Here are the steps you need to follow.

Install the Export to Data Lake feature

The Export to Data Lake feature is an optional add-in included with your subscription to Dynamics 365. This feature is generally available in certain Azure regions: United States, Canada, United Kingdom, Europe, South East Asia, East Asia, Australia, India, and Japan. If your Finance and Operations apps environment is in any of those regions, you can enable this feature in your environment. If your environment isn’t in one of the listed regions, complete the survey and let us know. We will make this feature available in more regions in the future.

To begin to use this feature, your system administrator must first connect your Finance and Operations apps environment with an Azure Data Lake and provide consent to export and use the data.

To install the Export to Data Lake feature, first launch the Microsoft Dynamics Lifecycle Services portal and select the specific environment where you want to enable this feature. When you choose the Export to Data Lake add-in, you also need to provide the location of your data lake. If you have not created a data lake, you can create one in your Azure subscription by following the steps in Install Export to Azure Data Lake add-in.

Choose data to export to a data lake

After the add-in installation is complete, you and your power users can launch the environment for a Finance and Operations app and choose data to be exported to a data lake. You can choose from standard or customized tables and entities. When you choose an entity, the system chooses all the underlying tables that make up the entity, so there is no need to choose tables one by one.

Once you choose data, the system makes an initial copy of the data in the lake. If you chose a large table, the initial copy might take a few minutes. You can see the progress on screen. After the initial full copy is done, the system shows that the table is in a running state. At this point, all the changes occurring in the Finance and Operations apps are updated in the lake.

That’s all there is to it. The system keeps the data fresh, and your users can consume data in the data lake. You can see the status of the exports, including the last refreshed time on the screen.

Work with data in the lake

You’ll find that the data is organized into a rich folder structure within the data lake. Data is sorted by the application area, and then by module. There’s a further breakdown by table type. This rich folder structure makes it easy to organize and secure your data in the lake.

Within each data folder are CSV files that contain the data. The files are updated in place as finance and operations data is modified. In addition, the folders contain metadata that is structured based on the Common Data Model metadata system. This makes it easy for the data to be consumed by Azure Synapse, Power BI, and third-party tools.

If you would like to use T-SQL to work with data in Azure Data Lake, as if you are reading data from a SQL database, you might want to use the CDMUtil tool, available from GitHub. This tool can create an Azure Synapse database. You can query the Synapse database using T-SQL, Spark, or Synapse pipelines as if you are reading from a SQL database.

You can make the data lake into your big data warehouse by bringing data from many different sources. You can use SQL or Spark to combine the data. You can also create pipelines with complex transforms. And then, you can create Power BI reports right within Azure Synapse. Simply choose the database and create a Power BI dataset in one step. Your users can open this dataset in Power BI and create rich reports.

Next steps

Read an Export to Azure Data Lake overview to learn more about the Export to Data Lake feature.

For step-by-step instructions on how to install the Export to Data Lake add-in,see Install Export to Data Lake add-in.

We are excited to release this feature to general availability. You can also join the preview Yammer group to stay in touch with the product team as we continue to improve this feature.

The post Unlock hidden insights in your Finance and Operations data with data lake integration appeared first on Microsoft Dynamics 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Introducing Azure AD custom security attributes

Introducing Azure AD custom security attributes

by | Dec 1, 2021 | Technology

This article is contributed. See the original author and article here.

This public preview of Microsoft Azure Active Directory (Azure AD) custom security attributes and user attributes in ABAC (Attribute Based Access Control) conditions builds on the previous public preview of ABAC conditions for Azure Storage. Azure AD custom security attributes (custom attributes, here after) are key-value pairs that can be defined in Azure AD and assigned to Azure AD objects, such as users, service principals (Enterprise Applications) and Azure managed identities. Using custom attributes, you can add business-specific information, such as the user’s cost center or the business unit that owns an enterprise application, and allow specific users to manage those attributes. User attributes can be used in ABAC conditions in Azure Role Assignments to achieve even more fine-grained access control than resource attributes alone. Azure AD custom security attributes require Azure AD Premium licenses.


 


We created the custom attributes feature based on the feedback we received for managing attributes in Azure AD and ABAC conditions in Azure Role Assignments:



  • In some scenarios, you need to store sensitive information about users in Azure AD, and make sure only authorized users can read or manage this information. For example, store each employee’s job level and allow only specific users in human resources to read and manage the attribute.

  • You need to categorize and report on enterprise applications with attributes such as the business unit or sensitivity level. For example, track each enterprise application based on the business unit that owns the application.

  • You need to improve your security posture by migrating from API access keys and SAS tokens to a centralized and consistent access control (Azure RBAC + ABAC) for your Azure storage resources. API access keys and SAS tokens are not tied to an identity; meaning, anyone who possesses them can access your resources.  To enhance your security posture in a scalable manner, you need user attributes along with resource attributes to manage access to millions of Azure storage blobs with few role assignments.


Let’s take a quick look at how you can manage attributes, use them to filter Azure AD objects, and scale access control in Azure.


 


Step 1: Define attributes in Azure AD


The first step is to create an attribute set, which is a collection of related attributes. For example, you can create an attribute set called “marketing” to refer to the attributes related to the marketing department. The second step is to define the attributes inside the attribute set and the characteristics of the attribute set. For example, only pre-defined values are allowed for an attribute and whether an attribute can be assigned a single value or multiple values. In this example, there are three values for the project attribute—Cascade, Baker, and Skagit—and a user can be assigned only one of the three values. The picture below illustrates the above example.


 


Step 1.png


 


Step 2: Assign attributes to users or enterprise applications


Once attributes are defined, they can be assigned to users, enterprise applications, and Azure managed identities.


 


Step 2.png


 


Once you assign attributes, users or applications can be filtered using attributes. For example, you can query all enterprise applications with a sensitivity level equal to high.


 


Enterprise applications.png


 


Step 3: Delegate attribute management


There are four Azure AD built-in roles that are available to manage attributes.


 


ABAC.png


 


By default, Global Administrators and Global Readers are not able to create, read, or update the attributes. Global Administrators or Privileged Role Administrators need to assign the attribute management roles to other users, or to themselves, to manage attributes. You can assign these four roles at the tenant or attribute set scope. Assigning the roles at tenant scope allows you to delegate the management of all attribute sets. Assigning the roles at the attribute set scope allows you to delegate the management of the specific attribute set. Let me explain with an example.


 


Xia.png


 



  1. Xia is a privileged role administrator; so, Xia assigns herself Attribute Definition Administrator role at the tenant level. This allows her to create attribute sets.

  2. In the engineering department, Alice is responsible for defining attributes and Chandra is responsible for assigning attributes. Xia creates the engineering attribute set, assigns Alice the Attribute Definition Administrator role and Chandra the Attribute Assignment Administrator role for the engineering attribute set; so that Alice and Chandra have the least privilege needed.

  3. In the marketing department, Bob is responsible for defining and assigning attributes. Xia creates the marketing attribute set and assigns the Attribute Definition Administrator and Attribute Assignment Administrator roles to Bob.


 


Step 4: Achieve fine-grained access control with fewer Azure role assignments


Let’s build on our fictional example from the previous blog post on ABAC conditions in Azure Role Assignments. Bob is an Azure subscription owner for the sales team at Contoso Corporation, a home improvement chain that sells items across lighting, appliances, and thousands of other categories. Daily sales reports across these categories are stored in an Azure storage container for that day (2021-03-24, for example); so, the central finance team members can more easily access the reports. Charlie is the sales manager for the lighting category and needs to be able to read the sales reports for the lighting category in any storage container, but not other categories.


 


With resource attributes (for example, blob index tags) alone, Bob needs to create one role assignment for Charlie and add a condition to restrict read access to blobs with a blob index tag “category = lighting”. Bob needs to create as many role assignments as there are users like Charlie. With user attributes along with resource attributes, Bob can create one role assignment, with all users in an Azure AD group, and add an ABAC condition that requires a user’s category attribute value to match the blob’s category tag value. Xia, Azure AD Admin, creates an attribute set “contosocentralfinance” and assigns Bob the Azure AD Attribute Definition Administrator and Attribute Assignment Administrator roles for the attribute set; giving Bob the least privilege he needs to do his job. The picture below illustrates the scenario.


 


RBAC.png


 


 


Bob writes the following condition in ABAC condition builder using user and resource attributes:


 


Role assignment condition.png


 


To summarize, user attributes, resource attributes, and ABAC conditions allow you to manage access to millions of Azure storage blobs with as few as one role assignment!


 


Auditing and tools


Since attributes can contain sensitive information and allow or deny access, activity related to defining, assigning, and unassigning attributes is recorded in Azure AD Audit logs. You can use PowerShell or Microsoft Graph APIs in addition to the portal to manage and automate tasks related to attributes. You can use Azure CLI, PowerShell, or Azure Resource Manager templates and Azure REST APIs to manage ABAC conditions in Azure Role Assignments.


 


Resources


We have several examples with sample conditions to help you get started. The Contoso corporation example demonstrates how ABAC conditions can scale access control for scenarios related to Azure storage blobs. You can read the Azure AD docs, how-to’s, and troubleshooting guides to get started.


 


We look forward to hearing your feedback on Azure AD custom security attributes and ABAC conditions for Azure storage. Stay tuned to this blog to learn about how you can use custom security attributes in Azure AD Conditional Access. We welcome your input and ideas for future scenarios.


 


 


 


Learn more about Microsoft identity:


New Microsoft Teams Essentials is built for small businesses

New Microsoft Teams Essentials is built for small businesses

by | Dec 1, 2021 | Business, Microsoft 365, Technology

This article is contributed. See the original author and article here.

Perhaps no one has been hit harder over the past 20 months than small businesses. To adapt and thrive in this new normal, small businesses need comprehensive solutions that are designed specifically for them and their unique needs.

The post New Microsoft Teams Essentials is built for small businesses appeared first on Microsoft 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

CISA Adds Five Known Exploited Vulnerabilities to Catalog

by | Dec 1, 2021 | Security, Technology

This article is contributed. See the original author and article here.

CISA has added five new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence that threat actors are actively exploiting the vulnerabilities listed in the table below. These types of vulnerabilities are a frequent attack vector for malicious cyber actors of all types and pose significant risk to the federal enterprise.

CVE Number  CVE Title Remediation Due Date
CVE-2020-11261 Qualcomm Multiple Chipsets Improper Input Validation Vulnerability 06/01/2022
CVE-2018-14847 MikroTik Router OS Directory Traversal Vulnerability 06/01/2022
CVE-2021-37415 Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability 12/15/2021
CVE-2021-40438 Apache HTTP Server-Side Request Forgery (SSRF)  12/15/2021
CVE-2021-44077 Zoho ManageEngine ServiceDesk Plus Remote Code Execution 12/15/2021

Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities established the Known Exploited Vulnerabilities Catalog as a living list of known CVEs that carry significant risk to the federal enterprise. BOD 22-01 requires FCEB agencies to remediate identified vulnerabilities by the due date to protect FCEB networks against active threats. See the BOD 22-01 Fact Sheet for more information.

Although BOD 22-01 only applies to FCEB agencies, CISA strongly urges all organizations to reduce their exposure to cyberattacks by prioritizing timely remediation of Catalog vulnerabilities as part of their vulnerability management practice. CISA will continue to add vulnerabilities to the Catalog that meet the meet the specified criteria.