Defend, Govern & Prove:
Managed identity protection

Hello guys, welcome back to the defend govern series. This one is really talking about managed identity and the focus really on this topic is to identify why we're having this conversation. Essentially what's the drive and the main area when we talk about kind of Defend, Govern & Prove the series that we're working on and focusing on is talk about the big gaps the areas where we talk about unification of services products and tools and one of those key areas that we should always be focusing on is identity protection it's that new central pillar to security management across the board it's our new firewall and I'll be talking about this in a bit more detail as we go the key to kind of stopping breaches is managed identity and we have to make sure that gap is bre is covered secure because it stops breaches from even beginning.

It prevents us from almost needing that element of ITDRbased solutions and configurations.

So let's talk about the common thread. Ask any SOC what links every major breach. The answer is always going to be managed identity. It sits there from start to finish. It works across the board when we're talking about infiltration and configuration. The whole principle around this, it's all about managed identity protection. We have to protect the identity for not just ourselves, but for all of our customers, our colleagues, the people that we work with day in and day out.

It's a central pillar to everything we use in the safe browser in browser history where we work day in and day out. Security operations, security operations centers, sorry, worldwide report the same pattern. The compromised identities are the entry point for the vast majority of attacks. Malware downloaded onto devices starts from links we've clicked on through identity breaches where an emails come through a phishing campaign. Maybe it's been a login. Someone's found a link because they've been logged into a different platform.

Someone's logged in and stolen LinkedIn credentials. We've had harvested passwords over the years across multiple platforms and we all have our own vulnerabilities as a result of this. It's plugging that gap. The reality attackers don't break in. They end up logging in. And it starts with that simple scenario for us as MSPs, as customers, anyone that works in the technology world. Protect the identity. Fill that gap. Prot protect the breach. Prevent the breach. Sorry. So, let's look at the identity problem.

Passwords, phishing, and privilege creep.

The modern risk landscape now presents multiple identity vulnerabilities that organizations struggle to address. We have sophisticated phishing campaigns. We're constantly having MFA fatigue, which nowadays we're supporting ourselves and solving with things like number authentication on MFA, which does help to resolve that, but it's still fatigue. And fatigue causes multiple problems. Number one, when you're your own junior individual in a business, you just have to get on with it. But the senior people that are getting these MFA fatigue attacks, if they've got thousands coming in an hour, they're going to start saying, "I want it removed.

I don't want it involved." That fatigue drives kind of loss of protection because we're being overruled by the people that own that business to reduce the requirements. Or if it's not just reducing the requirements, we're actually identifying that they've already been breached because their passwords been attacked, because there's been so many attempts. Overprivileged global admin accounts is also a real concern with permanent access. We're in a world now where most things don't require us to have global admin accounts active 247.

Maybe we have it for break glass accounts. Maybe we have back doors in other areas like enterprise application management. But the fundamental truth is we don't need global admin accounts on 24/7. We have privileged identity management for that. We have the opportunity to just have those locked down and secured. As MSPs, we should have partner center engagement, GDAP relationships, and all of our engineers should be 100% leveraging those support accounts using their own accounts to log into those customer platforms.

So many benefits to it. Audit logging, trails, understanding of what's what access there is, least privilege permission management. We don't need to have global admin to reset a user's password, but we do need user administrative account or help desk admin if it's not even a VIP based user. We've got all these kind of concepts that we can be developing in encouraging ourselves as in an MSP space and we're not always the ones to do so. So, let's look at the identity attack chain.

Where does it often start and how does it end up happening? It starts with phishing. Almost every single event we talk about when it comes to identity breaches starts with phishing. It's a nightmare.

It's the biggest breach we, you know, our biggest compromised area, an area we can always solve is those phishing campaigns, whether it's SMS, phone call, social engineering, an email constantly. We can breach gaps with things like defender for office, consistent cyber training. I know it's a pain to say, but it is incredibly useful. Credential theft top of the list importance the idea once we've got this first breach the first thing the attackers have done they've got your credentials and they're going to start token hijacking so session cookie controls or they're going to go one step further encourage you to do device code and then gain access with your session to cookie and then it becomes a lateral movement and this I think quite is more often than not forgotten about and this is why we use things like Microsoft Defender XDR for it to tell us a story of where that road map is going what happened when that breach took place.

What accounts did they have afterwards? Did they do anything outside of having access to the password and the account and sending a few emails? That attack chain moment allows us to start building a story that we see. And we've got manage detection coming up in a couple of episodes which you guys can look into and see in a bit more detail what it really means for a managed detection solution. It's going to drive that change. It gives us a bit more of an insight as to how that lateral movement piece works.

Managed detection in the middle here or at the end, sorry, is the pivotal point for us to identify how an attack took place. And that lateral movement that we're referring to in this situation is the movements that attacker is doing. But for us, we're going to see the reactive side of that or the proactive side. What steps can we take and what steps were taken to then remediate these lateral movements. But this is kind of a visualization of just how that attack takes place.

It's just four steps. Starts with a phishing. You know, you attackers can genuinely send thousands of thousands and thousands of emails a day. Just takes one breach and all of a sudden the whole world's flipped upside down for that company, that organization, even that user. In some instances, that phishing campaign that was successful for that individual user could potentially cost them their job. And if you look at this as a perspective as an IT partner, a trusted partner for your organizations, that responsibility kind of sits on us.

What steps can we take to make sure that they don't have that vulnerability defender for office attack campaigns no before training phishing we can leverage different platforms different products to help us make sure cyber training is in place so that people have got more and more confidence and that responsibility and onus is on them to make sure they're definitely protecting themselves further.

So let's look at the Microsoft stack. The Microsoft identity stack is kind of that multi-layer, that area that we can focus on real protection, real advancements and serious security and it starts with the access control, the control plane. What we're talking about now is the control plane that we're focusing on. We can start with access controls. That's the conditions in which we allow people to gain access to the environment. And that product that we use is conditional access or conditional access policies.

It enforces locations, devices, user riskbased control metrics, require device compliance, enforce MFA, block legacy authentication. When we talk about the central pillar to security breaches and preventions, conditional access is our front end. It's our firewall for that identity protection. It's the measures that we can take. In order to get conditional access, we need to do business premium. We can't do that with lesser products which means we are restricted to just the controls Microsoft put in place which in this instance nowadays is MFA and block legacy authentication.

It misses those key areas with device code phishing with session control access session timeouts more broader controls for guest access and security frameworks that cover not just the users but across the entire environment device controls and so on. Then we look at the identity protection and this is really where we protect the environment and put that information into Microsoft dete defender and that sits with detection. So we have some levels of detection with plan one.

I've put plan two in here specifically because we're talking about detecting risky sign-ins impos imposes adaptive MFA and risk based policies. Utilizing Entra ID plan 2 gives us that ITDR coverage like we implement ITDR products because we want to make sure that we're protecting environments and we're monitoring what's going on. If we were to provide a full identity coverage protecting every area across the board, we're almost making it obsolete. It's always going to be needed because there's always going to be risks regardless for a business.

But we take that potential risk and take it to zero. The ability to kind of reduce that down to zero is gamechanging for us because it allows us to really provide a true experience as to what we're delivering.

Then we've got our privilege which is privileged identity management. PIM just in time admin access. The reality is we as administrators and MSPs, we don't need privilege. We don't need global admin accounts. 7:00 in the morning, 8:00 in the morning, 5:00 in the morning, 3:00 in the morning, 9:00 p.m., 10:00 p.m. We don't need it 24/7. We're not working in their environment 24/7. We do to a degree need it day-to-day. There's no question about that. Maybe it's ad hoc support.

We're doing a project, professional services, Defender for Endpoint, Defender for Intune, project migration, Intune, sorry, project migrations. The ability for us is taking that one-step approach and giving ourselves the ability to elevate our rights when we require them. And this ticks the boxes for things like cyber essentials, ISO 27,0001. We don't need the access unless we need it. And they're always separate admin accounts when we talk about privileged identity management and the majority of the work that we would normally do as MSPs is going to be done with GDAP.

So that privileged identity management uplift is associated to the direct accounts within their environment. We don't need this specifically for ourselves within GDP access because there are controls, there are measures, there's MSA agreements. Don't forget above all else, we're the trusted partner for that customer monitoring. This one really sits more for onrem AD, but it's completely present for entry ID protection monitoring. We have monitoring in place across the board. The answer is everyone needs it.

I deliberately put who really needs this? We all do. If we're using on-prem AD hybrid identities, then we should absolutely be implementing defender for identity running that across the board. Again, requires the right level of licensing and permission management. But regardless of whether it's the defender for identity or it's enter ID protection for monitoring, we need to monitor the environments. I've deliberately put defender for identity here as the product because more often than not we talk about identity and everyone thinks defender for identity and actually what they don't realize is defender for identity is all about on-prem AD and hybrid identity signals entry id protection provides that monitoring detection for cloudbased identities and the last area I'll talk on is governance and identity around governance so that's life cycle management access reviews entitlement vis visibility It is a P2 license.

I leveraged this loads in my previous job. The focus on needing identity protection and identity governance is absolutely top of the list. A lot of breaches not just don't just happen with the users themselves, but it's guest accounts can cause data breaches if we over permission, we give them too much access. We need to do life cycle management, access reviews, and entitlement management. And this comes as a whole package around governance on identity. The ability to review guest accounts, make sure they're not accessing things.

If it's post 90 days and they haven't signed in, we need to be removing the accounts. Make a list, but they need to go. And we can automate those processes with access reviews. We can automate with reviewing those permissions. We can let guest accounts know that their accounts are going to be purged 14 days if they don't sign back in. We have these controls and measurements to allow us to really drive home successful tidy Microsoft 365 environments that allow us to be the best of the best in an ITDR situation.

The more that we control these layers in identity, the stronger that we're going to be providing a position for those customers as a result.

So where does this all sit? This starts with policy to proof managed identity model. It all starts with the configurations we do. We have to access and evaluate what's going on. So we need to evaluate the tenant identity posture. This is legacy authentication. MFA coverage, the admin account proliferation. If you look at inforcer as a whole, we have entry ID dashboard gives you a single pane of glass to assess what's going on in their entry environment.

Not only can we obviously dig deep ourselves, but we can assess those on the dashboard. We can run specific checks within Entra with the assessment engine. Once we've done those reviews and we've spoken to the customer, the next step on our journey is going to be applying our best practice policies. Policies that matter to us as an MSP as an IT professional, but is also critical for the industry and the customer that we work for.

Every industry is different, but the fundamental truth is identity configuration is going to be the same no matter where your in industry is because we need to protect every single customer we have. There isn't a unique tenant per customer. There's a secure tenant across the board. It's a standard process. When you guys develop a best practice baseline configuration for a Microsoft 365 tenant, all of that development is standardized across your customers. When we talk about best practice, we start with Entra and that's conditional access policies.

That's maybe that privileged identity management role, blocking legacy authentication, enforcing MFA. All those controls are things that we need to start applying and that still sits within the defense. We talk about assess, we talk about apply, then we talk about configuration. Implementing those identity governance is the next step. So we still haven't finished the defensive package when we talk about giving the best protection for managed identity the managed identity model but once we've done the configuration entitlement management access packages automating expiry policies making sure that we don't have these potential breaches with guest accounts we then need to monitor and that comes through with governance.

So that's drift detection, signing risking logs, utilizing defender to make sure that we are protecting devices, auto remediations on identity risks. We implement identity risky sign-ins. If we take away anything from today, maybe we should be considering putting entry plan 2 across the board for all our customers because we got so much control on the one topic, the firewall, the identity being the new perimeter. And then the final element which we always talk about is reports.

We have to demonstrate that we have that customer aligned to security or industry best practices and then we need to continue continuously improve on this. Nothing stays the same. Microsoft take testament to that. They make sure that we are on our toes all the time. Constant changes and configurations. It's a pain, but it's an absolute necessity for us. We have to be on top of our game and be ready to make changes as they come in.

So we have to report on alignments monthly. Demonstrates not just where the customer sits, but it proves the value that we're giving to our customers as a result of this.

So let's look a bit more into the inforcer integration. Visibility's MSAs have always lacked is the multi-tenant management view. The view of where identity sits across the board. So for us with Defend, Govern & Prove, we need to configure those environments. We assess, we configure, and then we enforce. And those three elements still sit within that Defend, Govern & Prove. It's that defense and that governance when we talk about assessing, configuring, and enforcing. But the reality is on top of all this as well as like the drift detection in place is we have to prove the value.

We have to make sure we're running those assessments or those alignment reports to generate value. All three of those elements when we talk about identity which is that new firewall is available for us to implement and deliver within inforcer and we should absolutely be leveraging this from start to finish. So what does a zero trust metric looks look like from philosophy to proof? I love using that terminology. It's one thing to claim for us that we enforce MFA.

It's in an entirely different environment when we talk about demonstrating that coverage. We don't just say yes, we enforce MFA. We have to prove it. When we talk about regulations, regulatory businesses and auditors, insurance providers, more often than not, and particularly nowadays, we are being forced, absolutely forced to prove and demonstrate that we have this from the day we implemented it on day one to 365 days later when the audit takes place. All of that element is proving the value.

We have to demonstrate what we're imple implementing and we can map those identity controls to CIS, cyber essentials, essententraliz on the horizon. But for you guys, you can map these compl processes and prove that value to your customers with the assessment engine, the alignment reports when we talk about our industry best practices as an MSP specifically. So let's look at key takeaways here. Let's wrap this up nicely. We've got serious areas that we need to consider.

Identity being that new perimeter I think that needs to be hammered home to most businesses nowadays is identity is so important. If there's one thing we can take away from this and maybe we do share this with our customers. Customers need to know that identity is that new firewall. Yeah, we have a network. Yeah, we put firewalls in place.

But compromisation, phishing campaigns, successful data breaches, start with identity. Start with those campaigns against our own identity. It's the most important thing that we should be protecting. It doesn't matter if a 365 tenant has one user in for a business or it has 150 users in or a thousand. It's the same principles. The security around that tenant needs to be exactly the same regardless. So, we do need to be considering an uplift in licensing to business premium.

Yes, it comes at a cost with your customer, maybe a cost to a degree to yourselves, but the security around it is absolutely priceless. So many customers utilize Microsoft 365. We're having this conversation because there are breaches to this day. Delivering that full stack of protection is another thing we should consider. If we've got customers on business premium, we've got customers with entra plan twos. Let's utilize the full stack. Focus on governance, detection, implementing those highprofile changes that are going to drive successful protection for a customer's environment and let's automate the proof.

So Mike's inforcer particularly are going to be driving out a scheduling agent shortly, but right now we've got proof with drift detection changes being made. Perfect for co-management, perfect for customers that have their own admin access, perfect for us monitoring what's going on in the customer's environment. We also can sell this service. So aligning to best practice, making sure that customers are showing we're showing our customers, sorry, that we are providing that continuous value. And then the last area is transforming that identity into revenue.

So whenever we talk about anything to do with an MSP and products that we implement, we're a business. We have to make money. And we can do that with driving revenue changes. The reality is we pay we charge per user per month more often than not or a flat fee based on the customer's pro portfolio. But sometimes we overlook how important security protection is and ongoing security service offering. When we provide break fix and reactive support, we always sometimes overlook the proactive steps we should be implementing.

Microsoft got hundreds of changes this year. How do we manage those? How do we make sure we're still able to monitor that, implement it for our customers, but also retain the revenue that we should be getting? MSPs have to be profitable because that's how we drive successful change. It's how we be proactive. It's how we demonstrate proactive measures for our customers. It's through knowledge that we will be a profitable business. It's through knowledge that security we're implementing is going to drive successful change.

So my last point identity is the new perimeter. We talk about Defend, Govern & Prove they are pivot pivotal for us to drive positive change. So the next episode we got coming now is compliance and governance and I really want to hammer home where we talk about compliance and governance. This doesn't just sit with identity that we've spoken around life cycle management access reviews. There's so much more around compliance and governance that we should be looking at and implementing for our customers.

Thank you guys for watching. All the best and look forward to seeing you on the next episode.