this is susan bradley for cso online if there's one silver lining that has come out of the solar
winds or solar gate incident is that microsoft and other vendors have been publishing a huge amount
of security blogs and content there's some been some very very helpful posts about the situation
and even if you're not directly impacted i highly recommend that you look at these resources
and review some of the guidance that they're presenting
first off the microsoft resource center my or i should say the msrc response center
has put together a com complete listing of all sorts of resources and blog posts
it's kind of a one-stop shop for everything that they've been putting out regarding the attack
all sorts of information for security administrators specific guidance how to
get help and assistance and in particular if you have azure active directory and microsoft 365
i recommend that you take a look at this azure ad workbook to help you assess your solargate risk
and it guides you through the process of going to the azure portal
going to azure active directory monitoring and workbooks and in the troubleshooting section
they want you to open up the sensitive operations report now keep in mind that if you're like me
now this is a demo site that i have when i went to that same workbook section i hadn't yet turned on
azure 80 integration with log analytics so i had to enable that and it doesn't take that long to
set up but if you've never done it before you need to do it because obviously none of this will work
now you do need a what's called an azure p1 or p2 license in order to set this up because you
need to monitor the user id and that's another thing i highly recommend as well so look into
your licensing and you may need to increase it in order to do some of this monitoring
now here's the sample report for the sensitive operations and the good thing is is as you can
see here nothing occurred in the last 48 hours so thankfully i had no sensitive
no one trying to do any updates to service principal authentication methods or
changes to service principle authentication or applications bottom line i didn't have any the
potential attacker techniques in my tenant the first tool that has been released by the cisa
a government agency and cloud forensics team uh and this is to help detect possible
compromised accounts and applications in the azure microsoft 365 environment
and as you can see it goes through and make sure that you don't have any of these issues and you
can download the powershell command and run it through your system crowdstrike is another vendor
who released a free tool and in particular they found that it was interesting that they
identified a reseller's azure account used for managing their office and licenses was observed
in making abnormal calls to microsoft cloud apis there was an attempt to read email and kind of
an investigation into their environment and they released this free tool to
better understand and see what was going on in their environment too and one of the things that
they pointed out is that there's a specific url that you have to go to to see what vendors have
licenses or or rights into your system when you go to this particular url you'll see the partners
or relationships that you have and you can see that i have two vendors on my my demo site
i have two vendors that have global administrator rights into my system
so think about that if something happens to them or attacker goes after them they then
have rights into my system as well so you want to look for these relationships in your cloud vendors
they too have a github powershell script that you can run on your environment
and it queries different configurations and gives you recommendations as to what you
should do to your environment the cyber security and infrastructure security agency has also put
together a website recapping all of the tools and guidance that they have so again if you haven't
been to this website i highly recommend that you take a look at their information and i highly
recommend you spend the time looking at these tools and running them against your environment
even if you weren't directly impacted take the time to understand what you might need to do
what what weaknesses you have in your system what partners you need to ask and reach out to them and
say hey what are you doing to prevent this kind of attack from occurring so that you don't come in
and attack me and as always make sure you check out the website on youtube for the
idg tech talk youtube channel until next time this is susan bradley for cso security online
you