Modern workplace management with Enterprise Mobility + Security- part 2

In this series of 3 posts I discuss what I see as the modern way of workplace management. In the first post I defined the workplace. Now I would like to start with identity and also add the Enterprise Mobility + Security products of Microsoft in the mix.

Identity:

Since network boundaries are disappearing, identity is the most important part of today’s workplace management. In the past, the Local Area Network was the perimeter to secure. Firewalls, the local network boundary, that was the place to secure. With the adoption of cloud services and also content sharing externally, the original perimeter is being extended to the outside world. The LAN perimeter is fading. What’s there to secure is the identity.

First of all, how do you make it easy for users to access cloud services, preferably with Single Sign On, so using the on-premise’s credential? You extend Active Directory to the cloud and what is a better place to do that than to extend it to Azure. And again, yes I’m prejudiced but 1 of the big advantages is the fact that Microsoft collects a lot of information regarding logons (around 350 billion authentications), logon behaviour, suspicious logons, botnet networks, breaches at major public services (yes Linkedin is one of them, years ago). Microsoft is using that information to make their services better and thus making the services better which customers use. Check out Brad Anderson on Youtube talking about Microsoft Intelligent Security Graph.

With identity becoming very important, you would like to know who is accessing your services, and when it seems to be the right person, you would like to have some reassurance sometimes. Maybe a couple of steps further, you would like to risk assess a person and use that rating or profile to enforce specific policies.

The first Layer of Control is regarding identity. Some of the controls are:

  1. Multi Factor Authentication: an extra layer of security on top of a password. MFA is an Azure cloud service which is very easy to adopt. MFA can be turned on per user, so every time when that user wants to access services via Azure, that user will hit MFA. More granular, it also can be turned on per specific app. This is possible in combination with conditional access. When MFA is turned on, AD/AAD doesn’t accept your domain password anymore but expects a second factor. This can be a text with a code, a phone call where the user needs to push the # key or the use of the Microsoft Authenticator app on a device. It does work with cloud services but also with your on premises environment and even with 3rd party hardware tokens. More details can be found here. Just turning on Azure MFA provides a higher level of identity protection. Be aware that in order to be able to use MFA, you need to enable “Modern Authentication” in your Azure environment on Exchange and Skype for Business. Also be aware that not all clients understand Modern Authentication/MFA, like Apple Mail, Thunderbird and older Office apps. More details on modern authentication and Microsoft clients can be found here,
  2. Azure AD Identity Protection: to put it (too) simply, Azure Active Directory Identity Protection is a cloud based layer of control which helps you detect potential identity vulnerabilities and can define automated actions for those. More details can be found here. On an Azure level, Microsoft can see which identities are trying to log on, from which IP address, location and for example compare that to the last logon (remember the Intelligent Security Graph). Based on many variables a user risk level/profile or sign-in level/profile can be calculated. As a result, for example, a user logging on in the morning in Los Angeles and 3 hours later from an IP address in Madrid can be calculated as a high risk and the last login could be blocked or the user could hit MFA. In this case a very important tool comes around to put an extra layer of control on securing the identity:
  3. Conditional Access: with CA, it is possible to setup policies with several conditions with controls. You can combine the layers of control (identity, trusted/untrusted IP’s, device compliance, MFA and user risk) to grant or block access to cloud services.                                                                                                               Conditional Access is defined as: “When this happens, then do this”. The first part is the Condition Statement and the second part the Controls . An example of a statement: “All users, accessing Exchange Online, from all platforms, using browser and desktop apps, are granted on compliant (Intune managed) devices and when they use MFA. Another example is: “all users, accessing Sharepoint Online, from Windows devices, from all networks except trusted IP’s, using both browser, mobile and desktop apps, are granted when using MFA. Combing the layers of control is very powerful where you can setup a great balance between user friendliness and security.

Client apps/cloud services:

The second Layer of Controls are controls for client apps and cloud services. The first control you have here is the pre-built App Based Conditional Access policy for Exchange Online and Sharepoint Online. With these controls you can force users to use specific Intune manageable apps like the Outlook app to access your Exchange environment. Yes, this is tied to the mobile Android and IOS apps. Again, you can force users to use Outlook by enabling MFA, since Outlook knows about Modern Authentication/MFA. And why would you like to do this, you ask. Very good question but read on about another great feature and I will wrap up an give you my thoughts.

Another great tool to secure your apps and cloud services is Mobile Application Management, provided by Intune on the Microsoft Office apps- desktop and mobile versions. This is a very cool feature and pretty unique. Users can keep on using their well known Office apps like Word, Excel and Powerpoint and you as the organization are able to secure these apps and data inside them. Read here for more details on the MAM features within the Office apps on Android and IOS. Also know that these MAM policies can be configured for the desktop Office apps as well. Windows 10 creators Update (1703) and Office 2016, app versions 1705 and above. Essentially, with MAM you can protect your Office apps on Windows, Android and IOS. An example of what you can do with MAM is that you can deny copy data in Word and paste it in a personal app on your device.  Or, that a PIN is required when opening the apps. This way you prevent data leakage.

Why do I think the client apps/cloud services Layer of Control is such a big deal? Well, Exchange/email is a good example. Within many organization, users are handed a corporate laptop/desktop. That device has a very locked down image, where a lot of settings/features are disabled, I cannot install anything and in a lot of cases the user experience is poor. Within those same companies, you can take any (mobile) device, any browser and any email client and connect to the company’s Exchange environment and download the inbox/create an .OST or use OWA. User experience wise, great! Security wise, maybe not so great!. Data and information we send via email, many times, is very sensitive and I’m sure you don’t want it to be cached on a device with no Layer of Control.

This case of Exchange also is keeping me busy: how would I let my users connect to my Exchange environment (assuming I would have a company and employees). Well for sure I would like to have some sort of control. At least I would like to enforce the Outlook app, and set a PIN on it (maybe even a PIN regardless if there is a device PIN in place). I would disable copy/past from the Outlook app to other, not managed apps, like the device’s notes app. And also, maybe I would add conditional access to the mix to enforce MFA when there is a high risk user profile or the user is at home. Maybe, nowadays, I must consider email as that sensitive that I require an enrollment of the device in Intune. Maybe I would like to have the “corporate data wipe” control in case something bad happens. Of course, I still would like to have the MAM policies in place.

I’m aware this won’t fully protect me against intentional data leakage or fraud. I doubt it if there is a set of tools protecting you against it. Think about the simple camera in your phone. However, the identity layer of control and client apps/cloud services layer of control is a very good start and most likely more than what a lot of customers currently have.

Next, Modern workplace management with Enterprise Mobility + Security- part 3