This is Susan Bradley for CSO Online. Today I'm going to talk about four pillars of security
recently Microsoft held their it professional conference called microsoft ignite
the conference sessions are now all online and can be watched at your leisure
prior to the conference i was able to sit down with Microsoft ciso
brett talked about some key elements that all of us should be doing in our firms in order
to keep them more secure Brett's been working for Microsoft for over 30 years during that time he's
moved from senior engineer to now corporate vice president and chief information security officer
pillar number one multi-factor authentication
based on the 2020 verizon data breach investigations report stolen credentials are
behind eighty percent of cyber attacks eighty percent that's a key reason that microsoft is
pushing so much on passwordless techniques because the attackers are going after our credentials
phishing 20 use of stolen credentials are hacking 20 top top threads are those credentials so what
are you doing about them microsoft has three main password list options for windows deployments
first is windows hello for business which includes biometric authentication
and for cloud only deployments you'll need windows 10 version
1511 or later a microsoft azure account zero active directory as your multi-factor
authentication and modern management for hybrid deployments you'll also need a version windows
10 version 15 11 or later next one thing that i personally use is the microsoft authenticator app
note that you can also use the google authenticator app for general two-factor
verification but you'll need the microsoft app at this time for the passwordless implementation
currently it's in preview but i'd advise you to check it out and finally and i've seen this with
a lot of financial firms they prefer the fido 2.0 security keys you'll need something like
yubikey which supports resident key client pin secrets and multiple accounts per rp
the next key element that brett pointed out was patching his recommendation is to not delay and to
patch immediately now i disagree mainly because i work out here with users and and machines
and like many enterprises i don't patch immediately but i patch after i test so i verify
that there's no issues in my environment and then about a week later i do roll out the updates
until such time that enterprises have absolute trust in patches
i don't think we can immediately patch i still think we need to test before we roll out updates
the next key element he said was zone device control ensuring that all devices connecting
to your network including company owned personal and edge devices like printers
and phone systems should be identified patched and secure especially now with work from home
that we're doing with coronavirus we have so many devices and so many things connecting
to our network do you know what those are do you have tools in order to patch those
do you have identification elements so you know what is attaching to your network
and i'll go even farther and suggest one more element that you probably should look at
is ensuring that your consultants are also using secure and up-to-date tools when they remote in
and provide assistance with your firm i've seen too many ransomware attacks these days that have
started with the attacker gaining access to the business through their consultants
often the managed service provider provides the entry point so you want to make sure that
you check with your consultants and make sure that they're providing secure tools as well
next brett talked about benchmarks as a key element to secure your business ensuring that
you're following best practices means that you want to compare yourself to other benchmarks so
microsoft 365 natively includes several tools such as the microsoft secure score but you can also use
tools such as the cis controls for example there's a guide to implementing cis controls or center for
internet security with microsoft 365 premium plan and i'll recommend that you go out to these sites
on a regular basis now this is my demo account so obviously i don't have that great of a secure
score but you want to come out here and make sure it's not ever going down as you can see here
but actually going up so check your secure score microsoft also makes changes out here every now
and then and changes benchmarks and changes items so you want to every month come out here in review
you can also download benchmarks from the center for internet security they include one
from microsoft office in office 365. you want to look at the microsoft 365 security center
and keep in mind some of these sites are changing their name for example the microsoft
threat protection is now being called the microsoft 365 defender
and azure advanced threat protection is now microsoft defender for identity
so some of these sites will change and some of your landing pages will change so be aware of that
i'm a fan of the microsoft defender security center and this you
can get with an e5 subscription if you don't already have an e5 subscription
i highly recommend that you get a trial test it out see what you're missing see
if there's there's information in here that you really need to know or to keep your firm secure
microsoft will be consolidating many of these places and also putting more information
to make everybody more secure so take a look at all the different
security centers across all the different products
and make sure you're familiar with where they're located and what information they bring
technology is changing rapidly these four pillars multi-factor authentication patch management
management of endpoints and devices and comparing yourself to benchmarks are all pillars of good
business security these days attackers are getting smarter and they're finding new ways
to come after us use these to make yourself more secure as always stay safe stay secure
make sure you check out the videos on the idg tech talk youtube channel
until next time this is susan bradley for cso online
you