this is susan bradley for cso online
recently malwarebytes reported that solarwinds hackers had accessed internal emails of their
company using the same intrusion vector that had been used in other attacks
now in reading between the lines my interpretation is that the abuse appeared to be applications with
privileged access to microsoft office 36365 azure environments the representative stated that the
investigation indicated that the attackers leveraged a dormant email protection product
within their office 365 tenant that allowed access to a limited subset of internal company emails
i think it came from attackers using a trick to authorize third-party sites to share
authentication versus oauth now what exactly is oauth oauth 2.0 is an open standard for
token-based authentication and authorization that allows the application to obtain authorization
without actually exposing the user's passwords directly but in making this linked connection you
can inadvertently authorize a third-party product to have more rights than you intend it's one of
the reasons why i recommend to always set your oauth settings so that you the administrator has
access to approve at a minimum these approvals now normally it's set inside to allow user consent for
apps but i recommend that you take a look at your settings and set it up so that the authentication
only allows user consent for apps from verified publishers for selected permissions and then you
want to enable the admin consent workflow to allow users to request authorization you want
to go into your azure active directory portal and you want to go to azure active directory
then you want to look for enterprise applications
then you want to look for consent and permissions
and you want user consents settings
and again you want to choose the section where you allow
user consent for apps from verified publishers
now the next setting you want to do is something called an admin consent
workflow and again we're going back into our azure active directory
you want to go back under enterprise applications and this time you want to look under user settings
and in this section down here where it says admin consent request preview you want to turn this
on and you want to select the users the global administrators that are going to
get these requests and currently you can set them up so that they get email notifications
you'll want to set a time for how long these consent requests stay out there
once this setting is in place only when a person or user goes to add something that requires oauth
approval instead of getting an immediate connection with their user account
a request goes to you the administrator so you get the authorization you then have to follow up and
say hey did i intend for that user to have it if it's okay for that user to have it you then click
on the approval and it gets approved but it's not an automatic immediate connection to your
assets inside your office if you have a license for cloud app security you can even go farther
investigate risky cloud applications in the portal you want to go to investigate and then to oauth
apps now if you have this license to cloud app security you go in here
click on investigate and you want to look at oauth apps and see which ones are in here and if you've
approved them and if it's like hmm i didn't approve that you want to track back and see
what permissions they've turned on and what they're accessing in your environment
detectors often know how to attack your systems better than you know how to protect them
so take the time to investigate the common attack techniques that are being used in targeted cloud
attacks right now ensure you set up your cloud applications to be protected from the start
so setting these proper alerts and permissions for oauth applications is a key way to keep your
network safe and secure as always don't forget to go out to the youtube channel
for the idg tech talk until next time this is susan bradley for cso online stay safe stay secure