Need to Know podcast–Episode 298

In this episode I look at the recommended best practices for managing your emergency access or ‘break glass; accounts in Microsoft 365. In the news we welcome the arrival of the Intune Suite and major update to Windows 11. Listen along for all the details.

You can listen directly to this episode at:

https://ciaops.podbean.com/e/episode-298-break-glass/

Subscribe via iTunes at:

https://itunes.apple.com/au/podcast/ciaops-need-to-know-podcasts/id406891445?mt=2

The podcast is also available on Stitcher at:

http://www.stitcher.com/podcast/ciaops/need-to-know-podcast?refid=stpr

Don’t forget to give the show a rating as well as send me any feedback or suggestions you may have for the show.

This episode was recorded using Microsoft Teams and produced with Camtasia 2022.

Brought to you by www.ciaopspatron.com

Resources

@directorcia

@directorcia@twit.social

Join my shared channel

CIAOPS merch store

Become a CIAOPS Patron

CIAOPS Blog

YouTube edition of this podcast

The Microsoft Intune Suite fuels cyber safety and IT efficiency

Introducing a big update to Windows 11 making the everyday easier including bringing the new AI-powered Bing to the taskbar

Total Identity Compromise: DART lessons on securing Active Directory

Skilling snack: Intro to Azure Active Directory

Defender for Endpoint(MDE): Integrate with Compliance & Conditional Access Policy

Mitigate risks with application block in Defender Vulnerability Management

SharePoint Roadmap Pitstop: February 2023

Microsoft is named a Leader in the 2022 Gartner® Magic Quadrant™ for Endpoint Protection Platforms

Manage emergency access accounts in Azure AD

Exchange Online Spam Filters

This video provides an introduction to Exchange Online Spam policies. particularly Inbound and Outbound policies plus Connect Filter Policies. You’ll see how to view the existing policies, make changes to these policies as well as create new ones using the Microsoft 365 Security Administration console.

Microsoft 365 incident response training now on demand

pexels-pixabay-69934

I have now made available in the CIAOPS Academy:

Microsoft 365 Incident Response

on demand training course. The aim of this training is to help you better prepare for a security incident inside the Microsoft 365 environment. You’ll learn what settings you should enable and what processes you should have in place before an incident occurs. The sessions will also take you through common examples of incidents and help you understand what needs to be done when they occur and how to minimise risk and impact to a business. The sessions will also take your through the post-incident process to build confidence with what information needs to be maintained and how to prevent similar incidents re-occurring. The final session will be a group hands on lab and discussion so you can put all the skills you have learned to the test.

A course quiz and certification of completion are also available as part of this course. Inside the course you’ll find over 8 hours of video content plus a host of resources and scripts for you to use.

Normally, this course is AU$399 but for a very limited time and for a limited number of people I am offering 33% off if you use this direct link:

https://www.ciaopsacademy.com/p/microsoft-365-incident-response?coupon_code=FIREMEUP&product_id=4576434

or use the code

FIREMEUP

at checkout.

Microsoft Defender for Endpoint: The Ultimate Solution for Endpoint Security

In today’s digital world, endpoint security is more important than ever. With the rise of cyberattacks and malware, it’s essential to have a robust security solution in place to protect your business from potential threats. One of the best options available is Microsoft Defender for Endpoint. In this blog post, we’ll take a look at the benefits of using Microsoft Defender for Endpoint to secure your business.

  1. Real-time protection: Microsoft Defender for Endpoint provides real-time protection against malware and other threats. It uses advanced threat intelligence to detect and block malicious activity, keeping your business safe from harm.

  2. Cloud-based: Microsoft Defender for Endpoint is a cloud-based solution, which means it can be accessed from anywhere with an internet connection. This makes it easy to manage and monitor your security, even when you’re on the go.

  3. Easy to use: The user interface of Microsoft Defender for Endpoint is simple and easy to navigate. This makes it easy for even the most non-technical users to manage and monitor their security.

  4. Automated security: Microsoft Defender for Endpoint automates many of the security processes, such as malware scanning and vulnerability assessments. This helps to reduce the risk of human error and ensures your security is always up-to-date.

  5. Integration with other Microsoft products: Microsoft Defender for Endpoint integrates seamlessly with other Microsoft products, such as Office 365 and Azure. This allows for a more comprehensive security solution, as well as improved collaboration and productivity.

  6. Advanced threat protection: Microsoft Defender for Endpoint offers advanced threat protection, including behavioral-based detection, machine learning, and ransomware protection. This provides an extra layer of security to keep your business safe from even the most sophisticated attacks.

  7. Compliance and regulatory standards : Microsoft Defender for Endpoint can help you meet compliance and regulatory standards, such as HIPAA and PCI-DSS. This can help to reduce the risk of fines and reputational damage caused by non-compliance.

In conclusion, Microsoft Defender for Endpoint is an excellent security solution that offers real-time protection, cloud-based management, easy usability, automation, integration with other Microsoft products, advanced threat protection and compliance and regulatory standards. It is essential for any business looking to secure their endpoints. By using Microsoft Defender for Endpoint, you can rest assured that your business is protected from potential threats and that you are meeting compliance standards.

———————————————————————————————

If you have read this far, then you’ll really know that this post is about ChatGPT rather than Microsoft Defender for Endpoint.

This is what I asked ChatGPT to do:

write a blog post on the benefits of Microsoft defender for endpoint

Now it can also generate code as well like the response to:

create a powershell script to connect to Exchange online

to which it gave me:

Here is a basic PowerShell script that can be used to connect to Exchange Online:

$UserCredential = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session

This script will prompt the user to enter their Exchange Online credentials, and then create a new PowerShell session using those credentials. It will then import the session, allowing you to run Exchange Online cmdlets. You can then run command specific to your needs like, getting mails, setting mailbox etc.

It is important to note that in order to run this script, you will need to have the Exchange Online PowerShell module installed on your machine. Also, make sure that you have the necessary permissions to access the Exchange Online instance.

Of course none of these answers are ‘prefect’, however they are surprisingly good and will be for many a great time saver. If you ask people what the toughest part of any process is, most will say that just getting started is. So using ChatGPT to at least handle this task should make it far easier to kick off any process. Best of all? You can do that today!

The interesting thing for me is that at the moment ChatGPT is just a stand alone chat style question and answer application. However, what happens when it starts being integrated with other service via API calls? What happens when the power of ChatGPT increases and improves.

If you have been at this IT ‘stuff’ for a long as I have you’ve seen many ‘revolutions’ and ‘this changes everything’ moments, many of which didn’t pan out. If nothing else, I think ChatGPT has lifted consciousness about AI and what it can potentially do to the wider population audience (i.e. muggels). What happens after that is the interesting part. Will that ‘enlightenment’  kick ChatGPT to the next level or will fade back into the shadows to be reborn again in the future? Only time will tell.

However, I think that if you are interested in seeing where ChatGPT could go then start using as I have and exploring the possibilities. I can honestly say it has helped me commercially (this blog post is a good example, even the part ChatGPT didn’t write for me). The best way to sum it up at this stage is:

We always overestimate the change that will occur in the next two years and underestimate the change that will occur in the next ten. Don’t let yourself be lulled into inaction. – Bill Gates

Who knows? In a short while maybe I can automate ChatGPT to do all my blog posts and you’d never be the wiser!

Blocking web sites with Defender for Cloud Apps

Link to video = https://www.youtube.com/watch?v=CQOcUrS93FA

Thanks to the integration between Microsoft Edge browser, Cloud Apps Discovery (which is part of Defender for Cloud Apps) and Defender for Endpoint you can quickly and easily block most web based applications. In the example I prevent Facebook access on a Windows 11 device using the Edge browser. It is important to note that this blocking capability currently won’t work with third party browsers, however there are other ways of blocking sites with these browsers using other methods that are not covered in this video.

[CORRECTION] – Please note that in the video I may have indicated that this is possible with Microsoft 365 Business Premium. By default, it is not. Apologies for the confusion I may have caused here

Evaluating SaaS applications using Defender for Cloud Apps

Recently, there has been much talk and gnashing of teeth over what to do about the recent LastPass breach. There is plenty of chatter about wanting to make a change and much discussion about what to actually change to.

As a LastPass customer I’m starting the process of evaluation myself and a handy tool I found to help in the decision process is Microsoft Defender for Cloud Apps (i.e. the old MCAS).

image

If you go into the Discover menu, you’ll find a Cloud app catalog option as shown above.

image

Enter the name of app you wish to search for and hit Enter.

image

That should give you a page load of information like that shown above, which you can drill into if you want more details.

Of course, this information should only be part of your evaluation but it does provide a lot in one place for you to reference.