Defend, Govern & Prove:
Managed email security

Hello and welcome back to episode two of defend govern. This one is going to be focused around email security. We really want to talk about those pillars of the defense and how we incorporate that into governance and we all incorporate it into proof. And I want to talk through each of the elements we can configure and we can implement within Microsoft. And that starts with for me managed email security day one value. How do we make sure that we are implementing good security practices?

Most phishing attacks, most cyber risks start really with an email that comes in. And I always think that's always a good point to start. I know it's irrelevant when we talk about the encompassed endpoint management solution or defense solution around Microsoft. And probably most people would think and I would tend to agree that identity protection sits at the top of the risk of things we should be talking about from day one. But quick wins email security defender for office is essentially the solution we're looking at.

But before we dive into that and before we go and have a look at the security center and just where we go for those configurations I want to talk around what we had previously versus what we can have now and where that sits within that defend govern element. Where do we look at when we talk about this? So what's the old way? How did it used to look when that started with EOP exchange protection?

What not exchange online protection but protection at the basic level on an exchange server third party gateways that email layer that we had before our MX records pointed to it emails went through it we made sure we created new policy delivery we had advanced threat protection maybe in the form of a different integration or another third party solution and then that separate SIEM integration that security layer cake the area where we had multiple layers from different vendors with different integrations.

So many complexities for us as MSPs to focus on, especially if we had this against 50, 60 plus tenants. We had different gateways, different solutions, different MX records hosted in different locations for domains, different advanced threat protection measures for different solutions and then a different security layer based elsewhere or baked into different platforms elsewhere, different API configurations. And every single one of these came at additional costs and we bolt bolted it on added it individually to our per user per month model added those layers and then 365 came around which came with its own license came with its own uplift.

We started with just the exchange online services, the exchange online protection. We came in with simple licenses around email. They then introduced products, sharepoint online, one drive, that native integration for product suite. And then that identity protection, the entrop piece, the area where we measured it with the connection with AD connect or I think it was called AD sync at one point AD connect now with a hybrid connectivity still identity managed on prem as we started the integration into 365 for that cloud only or cloud first approach already included in that was that license we had it.

So on top of the existing licenses we then added that Microsoft 365. We went from6, shall we say, per user per month on the add-ons we added, excluding RMM and endpoint management, I might add. We then added on another layer with Microsoft 365 licenses. We charged them a fortune to decommission their Exchange on prem servers. We moved three people to 365 as part of that license migration. I even remember the days when we had to update DNS records on the domain controller just to make sure it was pointing in the right location if we had an on-prem server.

Were the days. But now what do we have available to us? Where do most customers sit? And the reality is it's Microsoft 365 for the majority of businesses.

There are a handful out there and I would say a good one, two, maybe three million companies that still maybe use Google Suite or onremise exchange servers and other vendors, but most or a majority look and leverage Microsoft 365 and they probably use it whether they like it or not in some fashion. Maybe it's just productivity licensing i.e. Outlook, Word and Excel. Maybe it is the element of 365 emails, email solution, email integration, SharePoint still being used, collaboration of file management.

The reality is a lot of people are moving to Microsoft 365 and we need a single source for management. Again, that's inforce. So that's why we're having this conversation today. But we also need to unify the services and solutions we use. We've looked at that old layer cake, the security layers, but now we've got this unified, integrated and intelligent platform within Microsoft 365. And that starts with those four you see in front of you. Defender for Office 365.

It's there. It's available. We have the Exchange online protection piece that sits in there by default, but we have those advanced plan ones and plans twos. Defender suite for business. Always recommend using that if you're using business premium for SMBs. It's a small add-on, but the value you get is what you might get with an enterprise E5 licensing. Gives you the ability to really leverage the encompassed unified threat intelligence available with Microsoft. That aside, it's also a native integration.

We're already using it. So adding that layer of defender for office, that integrated intelligence allows us to make sure we're leveraging the best, you know, single point of solution encompassed under one umbrella. That unified threat intelligence really resonates when we talk about protecting phishing resistance, impersonation, spam, malware, safe links, safe attachments. All of that's included and available under a single pane of glass or a single unified threat intelligence. And then we leverage that single pane of glass.

That pane of glass of what's going on. How do we make sure it's protected? Now, security center, I'll show you a bit later, has some very good reports available that single source for secure score, the recommendations just to get you on your way for improvements. You're probably spending, and I'll say this already, but you're probably spending additional money on protection that your license already covers. Email security add-ons seemed essential once, but should we really be using this or layering it on products now?

Adding on to that fatigue for our engineers. Should we really be needing it? Do we really need it? I kind of would suggest we don't. Everyone has their own opinions. This is why we're having this conversation. I like the idea of challenging people to think, should we be adopting a better solution or a better fix. And that's Microsoft 365. That's your defense. That's your governance. Starting that layer within a single unified platform, building it out in a tenant and pushing out on mass to your customers is absolutely priceless.

Being able to use the security baselines in inforcer to push these out really helps to kind of grow and streamline that process. Being proactive as we look for that delivery. So what does it look like? Let's go back to that old model, the gateway gap. What was it previously? The gaps that we had before.

We sold the SPF checks, the DKIM, URL writing, attachments, all through a third party gateway. It worked. It did the job. Whether that was an on-prem server, Exchange server with a connection to a third party gateway in the cloud, all that configuration was in place. They used their own private data centers of third party. But it came with some flaws. Sometimes delivery delays, internal blind spots if it's all internal. Fragmented management, post delivery gaps, all of this stuff still to a degree kind of exists, but we can manage it under a single platform rather than looking at different portals to do that control.

So I'm going to skip past this further. It's something you guys can read if you want to by pausing the video. But Microsoft's approach I think is the area we should be focusing on more and that starts with that Microsoft native layered and integration. Defender for office isn't merely an anti-spam filter anymore. It's become a comprehensive ecosystem. It's identity-driven. It's behavior-based and it's integrated directly within the Microsoft security signals across our entire environment. Leveraging a an area in the background of a trillion signals a day that Microsoft's managing.

We should be leveraging a tool that's already receiving this information and adopting and growing and understanding. And there's four pillars to that layer. So we have our perimeter, the EOP, block, spam, malware, no malicious senders. It's added an advancement. You've got your advanced threat protection. Most things are already included in business premium, but we can layer it up with defender suite for business with advanced measures. So attack sim automated investigations and response. Apologies if this slide is slightly outdated.

But we can start that ATP piece, the advanced threat protections, that additional layer. Guess what? It's native. It's integrated into 365. It's part of defender for office. And then we look at that next layer. Where do we sit with data exfiltration and enforcement the governance piece of this defend, govern is purview, data loss prevention, and sensitivity layering. So outside of defender for office we can layer in protection on emails on safe links on safe attachments with purview data loss prevention sensitivity labeling is all encompassed.

It's a native integrated layered solution. It's all in one and we should be looking at this as an opportunity to provide that unified piece. We are focused on Microsoft or managed email security in this specific episode but everything connects together and leveraging inforcer we can then start managing those policies as a single layer and I think it's a good example here the security flow is email inbound it's EOP filtering defender analysis it gets back into the mailbox but we have that layer of purview DLP enforcement as well every stage is connected for every threat tracked it's a really good statement.

We want to make sure that the stages are in place, but we are tracking every single possible threat and we leverage the security center, the hunting, the advanced hunting that's available in there to really see what's going on when threats do creep up in phishing or do creep up in email flow. And the transparent solution is it does. Phishing will always get through some spam filters, but the more layers we have in an integrated native solution, the easier it is for us to be able to hunt, track, defend, and remediate.

We need to do those three those four different elements to make sure that we're pro protected. If this was all across different third party solutions, we'd be logging into multiple portals, run this process, then run this process, log into this portal, make sure this is in place. Having it under a single pane of glass, a security center for comprehensive advanced filtering and management really helps to speed up that delivery. When a when attack does take place, we can track the process.

We can see how it got in and we can make sure the remediations are in place in the future. Doing that across multiple portals is going to take time. So where do we sit when we talk about the proof of this?

So we've spoken about the governance and the defense we do the configuration with our baseline the alignment and a drift detection that we have available with these native blade integrations utilizing inforcer implementing purview but we also need to be able to prove it prove that value so the proof visibility reports and metrics 90% of what you need when we talk about particularly defender for office is available in the security center on Microsoft end and that's great it gives you those metrics.

We can look at the threat protection. We can block. We can look at the DLP hits per site per mailbox sensitivity label tracking, phishing detection trends, attack simulation results, safe link and attachment performance. Those reports and I'll show you in a minute are all available in the security center. But we still need to make sure that we are adding the additional layers of governance. So drift detection, we need to make sure that we are being alerted to changes being made in policies.

At the moment, we're tracking the metrics and the reports on email flow, the vulnerabilities, threat related vectors and attacks that come in. That's all managed and controlled within the security center. You'll see some of the just the analysis of some companies I've worked for in the past. 72,000 malicious emails stopped this month across monitored tenants. That's a huge number. Massive 98% detection accuracy. False positive rate is under 2%. And it's 247 continuous monitoring, the automated threat response.

You can literally measure every single attack prevented per tenant. That's ROI in the purest form. That's the metrics we talk about when we deliver this to customers. Generating value, showing the value that we're giving. We don't need to explain the theoretical protection anymore because we can show the numbers by logging into the security center. We can show the numbers by logging into inforcer and demonstrating that we're aligned to our best practice. We're governed by the best practices our MSP sets.

We've got those drift detections for a reason to be able to measure what changes are being made and guess what govern that response. So let's talk about the inforcer layer. It's that automation. It's that ROI and it starts with the four pillars that we look at.

So baseline enforcement that's that defense piece the piece where we're leveraging that single pane of glass what single solution with Microsoft we're implementing our best practices on for defender for office the data loss prevention policies that we can implement around exchange protection starts with our baseline you guys build your best practice baseline I said in the last episode it's not about being unique it's about being secure you implement the baseline that fits the needs for the industries you're working in you build it through your tenant and you align at that point to your customers environments.

Whether it's a new company or not, everything should always be measured against your best practice. Some companies might need some improved or stricter conditions. If you're in finance, you've got FCA regulations to consider. But everything starts with that alignment piece. You build out the practices that fit the needs of your industries you're working in. Then you continue that governance with alignment. Aligning that engine automatically detect the configuration drifts. Ashure governance making sure the ongoing governance is in place like safe links being disabled and alerts before vulnerabilities emerge.

All those things we can be proactive in by aligning companies to our best practice, our values that we build as a security MSP. And then the assessment reports we have to be able to report on it. It's that ROI proving the value. You can log into the security center and run a report that says these are all the emails that Microsoft and ourselves have remediated today because of the policies we configured. But fundamentally we want a friendly executive friendly visualization or report assessment reports in inforcer offers that for you and that in turn provides the ROI evidence quantifies the attacks that have been blocked.

Those policies are enforced with the alignment report the assessment engine that we have available in inforcer. It drives that ROI evidence. It proves the value you guys are giving to your customers and generates that purpose-built delivery. So, I want to encourage you guys to stop paying twice and start proving the value. And that starts with not overlaying or duplicating layers of payments and solutions that are already available in Microsoft. Utilizing leveraging Defender for Office as your native intelligence form.

Microsoft Defender just generally gives you guys the ability to start adding value, saving customers money, but generating ROI in return for professional services delivery, proving the value you guys get. Sometimes it's just about customers showing we're doing the job right. A report does that. That's where your professional services can implement better protection, better methods, measures, really good for project delivery. But more importantly, it's that ongoing governance. Governance as a service delivery that measurement of proving what we're doing every time.

And that's where we've got those three pillars again. Native Microsoft protection with your defense and configuration, configure it with inforcer, keep it native, your governance, automated policy enforcement at scale, again alignments, drift detection, making sure that the policies are governing as expected. We want to be alerted to a change being made, but then proving it, making sure the measurable IR ROI with every report. What do we give the customer that generates and proves that they are it's value for money?

And it's important. So, before I go to what's coming next, which is our managed email security, let's drop into the security center and just see what's available today. Where can we go for some of the internal reports that freely there outside of what's available in inforcer? So bear with me a second. Here we are. So this is the security center for a domain of Craig called Copilot Manager.

This is that single pane of glass, the source of truth when we look at an XTR solution in one place for Microsoft Defender. We're talking about email security. I'm going to be dropping into this platform a lot over this series because I really think it adds value. Most of you already know how to do configurations. I'm not talking about configurations but almost a recap for business owners for sales rep account management the general engineers first second third line this resonates with all of you guys architects on reminding ourselves where things are how do we go about doing vulnerability checks and running things there are loads of people out on the web on YouTube that talk around hunting advanced hunting KR delivery looking at research highly recommend looking at those people and reading through what they have to offer with their GitHub sub repos.

But for email security, it starts under email and collaboration. So we've got our real-time detections, basically a report that allows us to see vulnerabilities taking place. So we're pleased to know this is a brand new tenant, so there aren't any in here, but the ability to drop down and do just basic checks. We've got some advanced checks available here, change the dates. This is malware. Perhaps we want to look at phishing content in intentionally.

Is there content malware available? It's a single pane of glass to show you things in real time. I think it's hugely valuable. It gives us the ability to start tackling those conversations we've not had in the past. The other area is reviewing. It sounds really cheesy and trivial, but when we talk about ROI for our customers, are we generating revenue or are we proving that value? All of this is available here. Your Exchange message trace isn't in the Exchange admin center anymore.

We can come directly in here. It will take us to the admin center where we could go straight in and we can start running message traces. We can start looking at information again. Security center leverage inforcer. If you use a GDAP, click onto the to the dashboards and select security center. It'll take you straight in there using your credentials. No more partner center or lighthouse. Drives me mad. The other area is where we do the configuration.

So if we're building a baseline from scratch and we're going to be leveraging inforcer to deploy that for our customers, we need to start with building it in here. Maybe we're leveraging it we're still from you know borrow from our current existing customers but you guys can build your framework and start it from scratch here. So we click on policies and rules under email and collaboration and it's all available for us to dive into configure manage and administer in this environment.

Anti-phishing, anti-spam, malware, safe attachments. It's all available. If you're using a third-party phishing simulation environment, you'd be doing advanced delivery here to override for special use cases. So, if you click in here, you've got your fisting simulation in place or a secops mailbox, for example. But you build out your foundations of a secure environment utilizing the threat policy configuration in the security center. Now, there's two things to be aware of. Firstly, presets always in place.

If you're going to go down the route of doing proper configuring this properly, you'll be turning off these protections. But if you're not capable or you don't have the right team involved in understanding how best to deliver security policies firstly, you can use YouTube to get people's opinions and reviews. Leverage Microsoft secure score because it gives you some recommendations you should be implementing. But if you're really unsure, you have these standard levels of protection and it tells you exactly what it's doing, what the aggressions are, tighter controls, more aggressive.

Personally, if you really aren't going to configure them yourselves, I'd be turning on strict protection and managing those settings if I needed to. But for me, I like to build things out from scratch because there's different configurations. If we take anti-fish as an example, we'll just call this anti phishing. When we click next, we've got the ability to associate multiple policies to different users. I always make sure and I say this whenever I bring on customers in the MSPOS app formally, make sure you've associated this your main policy to all the domains.

You if you don't associate it, the policy is doing absolutely nothing. And it's vital that we include every domain that we manage. There is going to be some cases where there's different businesses in a single tenant. But I do want to emphasize a lot of people do configure different policies for different businesses within a single tenant, but they're all connected to the same tenant. So if one is stricter than another, maybe we should be putting this as a red flag and going hang on, you're all in the same tenant, you're all collaborating on the same file structure, maybe it's admin units, configuration changes, but fundamentally you're all in the same tenant.

So maybe that input should or inbound information should always be the same. Once you've selected these, you've got your steps and controls you can do to mitigate threats. So phishing protection, spoof protection, it's all configured here. You can set your thresholds. Microsoft tell you what these thresholds look like and what the aggressions are. You want to enable protection impersonation. Do we need to manage and protect specific users within a business? So you can see up to 350 internal and external users for enabled protection.

We can also just protect on impersonation protection. Again the security the secure score for Microsoft do recommend these individual changes. We have a YouTube webinar series coming out with my colleague Milo who really does a deep dive into what secure score is really offering and I highly recommend reviewing that over the six-part series seeing the differences and the recommendations and why Microsoft do it where the pain points why is it implemented as we uplift security layers we've got more policies so they're all things we should be considering when we make these changes but Microsoft are changing this regularly so when a new configuration comes in.

It's important for you guys to be leveraging platforms like inforcer and their community like the Discord community they have or the dispatchers platform and webinar they use is really important because we're looking at a new features Microsoft introduced and we're consolidating it and making it available for MSPs. So I would highly recommend leveraging it and fundamentally that's how you configure the best practices in email security. The last thing I want to show you guys is the reports here.

I don't think they get enough credit, but in here you can start running email and collaboration reports which are run by Microsoft. Gives you a real good breakdown of what's going on with your little web cards and we can export these cards or you can start running reports specifically about mailflow. What's the route that things are taking? Managing the schedules, reports for download. Download as many reports as you need. The ones I really will tackle and I think really highlight some good reports is a general security report from Microsoft is a huge value.

You can run a complete export of this and it generates a really good report which we'll demonstrate at a later series or later episode. But that's where we sit when we talk about email security. It's a single layer. Everything that we're talking about when we talk about a unified defense and then governance and proof starts with using the Microsoft native tools leveraging inforcer as your multi-tenant single pane of glass with quick links for your defend for your service desk but fundamentally adding that layer of additional governance that we need when we talk about drift detection we talk about alignments keeping them on track with the ongoing configuration we've got in place.

So, let's talk let's talk about recapping. What do I want you guys to take away from this? And I think there's four areas we want to talk about.

Stop doubling the payments for email protection. If you've already got available in a license, I highly encourage you to create a professional services scope of works. Let's generate income and sell the service of use using Defender for Office. Show them what they're going to save on each month with the external protection they've had previously because at the end of the day that's how we measure support costs. Maybe we just absorb it and make it happen. We've got inforcer now.

We can do these policy deployments in very little time overall. Look at the blind spots. Gateways create blind spots. So third party gateways are going to cause internal threats. And it's not just threats for the customer. They're blind spots for you guys as MFPs as well. Because if you don't have alerts coming from them, sometimes you're not logging into every single portal every day. They're blind spots. Single point of failure. Get those alerts generating coming through into your PSA integration or PSA platform.

Look at the areas where we've got blind spots and let's remediate those. Leveraging Microsoft. We have a native integrated solution allin-one where we've got customers using Microsoft. The MSPs watching this are using Microsoft already. It's a stack that we're utilizing. So let's leverage every area. If a license is operating offering sorry a service we should be using it. Why aren't we? So Microsoft plus purview plus inforcer completes the defense cycle we talk about with Defend, Govern & Prove those three measures we need to complete and adhere to and challenge people on.

And the last area is transforming the policies into evidence. inforcer turns those security deployments into quantifiable ROI showing attacks that are being blocked, showing the drifts that are being prevented and compliance maintained across every managed tenant. We don't have every single report, but you can leverage what's available as I've shown you today in the security center plus the drift detection with your emails, plus the assessment engine and the alignment reports to demonstrate they're still on track.

There's been no change to the environment. We're giving you the best value for money. That starts with ROI, quantifiable data, transforming those policies, those configurations to an enforced solution that we can demonstrate with drift detection and proof with the alignment reports and the assessment engines that are available with inforcer. That guys is a wrap. I say it on at the end of every episode. Now, if you want to know more, if you're new to what Force is offering and you want to see a bit more of a demo as to what it's going to do and you're leveraging multiple tenants for your customers, reach out to us, get a demo with our sales team, engineers like myself, our pre-sales technical team like me, we'll be on those calls.

We can go through those solutions with you, explain where that ROI and the investment is available. Some, you know, the idea of inforcer is to become that embedded solution for yourselves. So give us a call. Let's get a demo booked in and we'll go from there. Thank you very much for your time. Look out for episode three. It's going to be about managed endpoint security focusing around where we can leverage that and we'll be moving forward from there.

Thank you very much.