In this episode…

• Chris revisits his e-mail authentication and security from last time to dig a little deeper.
• Koos recently did some talks about SIEM migrations to Sentinel and keeping things as cost-efficient as possible. He also believes a company shouldn’t focus solely on Microsoft Sentinel, and should consider looking into alternatives alongside it like Azure Data Explorer. And why are companies so focussed on collecting all those logs in a “legacy” matter?
  
  

E-mail Security - Part II

Sequels aren’t always better, but this is an exception. ;)

In this episode, I’ll dive a little deeper into SPF clean-up and flattening and spend some time looking at some newer email security protocols:

• Authenticated Received Chain (ARC)
• MTA-STS (Mail Transfer Agent Strict Transport Security)

To follow on from our previous discussion on SPF, In an SPF record, there isn’t a strict limit on the number of IPv4/6 blocks (ip4/6: mechanisms) you can include. However, there are practical constraints:

• DNS Lookup Limit – SPF allows a maximum of 10 DNS lookups (e.g., include, a, mx, ptr, exists) per evaluation. ip4 and ip6 do not count towards this limit because they are directly included in the record.
• DNS TXT Record Length – A single TXT record (which SPF uses) is limited to 255 characters per segment, but multiple segments can be concatenated. The practical SPF record size limit is about 450–512 characters to avoid truncation issues. If the SPF record exceeds 512 bytes, some email servers may reject it.

If you have too many DNS lookups, a “SPF PermError: too many DNS lookups” is returned during an SPF check, DMARC treats that as fail since it’s a permanent error. There is one solution to this problem that is recommended all over the interwebs called “flattening” an SPF record. Using this method, each of the DNS-querying mechanisms/modifiers is queried for the IP addresses and these then replace the original mechanism/modifier thus reducing the number of DNS lookups. This is great, right?

Danger, Will Robinson!

I don’t personally recommend using SPF flattening unless absolutely necessary, with regular audit and cleanup you may not need it. It is also important to consider that:

• IP addresses do change and can break email delivery
• Flattening requires more administrative overhead to managed IP changes.

There are ‘dynamic SPF’ services available that market themselves as a solution to this - I haven’t got any personal experience with these so YMMV. Please reach out if you have any good or bad experience you’d like to share.

Authenticated Received Chain (ARC)

ARC is an email security mechanism that preserves authentication results (SPF, DKIM, and DMARC) when an email passes through forwarders, mailing lists, or intermediaries.

How ARC Works:

• The original sender sends an email → SPF, DKIM, and DMARC checks are performed.
• A forwarder (e.g., a mailing list, forwarding service) receives the email.
• The forwarder signs the email with ARC headers before sending it to the final recipient.
  • These headers include:
    • ARC-Authentication-Results → Records SPF/DKIM/DMARC results before forwarding.
    • ARC-Seal → Cryptographically signs the ARC chain to prevent tampering.
    • ARC-Message-Signature → Ensures integrity of the forwarded message.
• The recipient verifies the ARC chain to decide if it should trust the forwarded email.

Microsoft 365 already supports ARC, but if you run into issues with email delivery from a particular service, you can add their particular domain to the ARC trusted sealers list in the Microsoft 365 Defender portal

Microsoft Docs Configure trusted ARC sealers

MTA-STS (Mail Transfer Agent Strict Transport Security)

One of problems with SMTP is that encryption is entirely optional. When support for upgrading from plaintext to encryption in the form of the STARTTLS command was added to SMTP the specification explicitly specified that SMTP servers must accept plaintext connections. MTA-STS is a new standard that aims to improve the security of SMTP by enabling domain names to opt into strict transport layer security mode that requires authentication and TLS. MTA-STS is supported in Exchange Online.

MTA-STS requires two things to implement:

• A policy .txt file hosted at: https://mta-sts.domain.com/.well-known/mta-sts.txt
• A DNS TXT record _mta-sts.example.com

Dutch MVP Michel de Rooij has a great post on how to host you MTA-STS record using Github pages

Side note: You may have heard of DANE (DNS-Based Authentication of Named Entities) - DANE requires DNSSEC, which many domains do not implement and therefore kills adoption. MTA-STS is easier to deploy and works with standard DNS.

Check out the Microsoft Docs Enhancing mail flow with MTA-STS

Microsoft Sentinel as a SIEM and how to re-think logging strategies

Microsoft Sentinel celebrated it’s fifth anniversary already last September. But a lot has changed since:

• Sentinel’s role as an orchestrator between all the different security products (“all your Defenders are belong to us”)
• New log tiers, each with it’s own pros and cons
  • Auxiliary
• Sentinel is now also part of the “Unified Security Operation Platform”, but it’s still an Azure resource?

During SIEM migrations the topic of Sentinel cost is a big topic. Cloud-native SIEM works a bit different compared to a (dare I say) “legacy” SIEM solution. “Sentinel is expensive” people might say, but you might be using it wrong.

• Consider a multi-tiered log strategy:
  • Real-time analytics
  • Triage & Hunting
  • Compliance & Forensics
• Consider NOT ingesting those logs any longer ;)
  • Please hear me out….
  • Be critical during SIEM migrations
    • Decide per log source what to move or what to drop

Azure Data Explorer

• Very cost effective companion in my opinion to use alongside Sentinel.
• Very scalable and offers UNLIMITED data retention
• Query logs with KQL

Community Project

Yellowhat

We already have Blackhat and Bluehat, but now there’s Yellowhat! 👷🏻‍♂️

A couple of Security MVPs came together to organize a 100% Microsoft Security conference on March 6th 2025. Only deep-dive sessions (Level 400+) led by world-class experts, including Raviv Tamir (Microsoft ILDC), Roberto Rodriguez (Microsoft Redmond), Dirk-jan Mollema, and more announcements soon. All sessions will be broadcast live between 3pm and 9pm CET.

But there are also a few last VIP tickets for in-person visit. Hosted at Microsoft HQ @ Amsterdam and made possible with some great sponsors!

Register your (livestream) ticket now at yellowhat.live

Bluesky.ms

Another great project by Merill Fernando. Bluesky.ms is the authoritative source for Microsoft community-related activity on Bluesky. Its a crowdsourced database of anyone and everyone in the Microsoft community on Bluesky where you can connect with the Microsoft community and get your account verified. Here you can users categorized as:

• Microsoft Community Users
• Microsoft FTEs
• MVPs
• RDs

Check it out and join the community at bluesky.ms

In this episode we sit down with our old friend Antonio Maio. We recorded this episode at Microsoft Ignite 2024 in Chicago, and as always it was an enjoyable conversation with actionable insights. Antonio shares some tips from this Ignite talk to help you:

• Assess your environment at scale
• Protect your information
• Educate your users

Antonio gives us some great information about preparing for Copilot, why it helps to encourage everyone to build their own relationship with Copilot and how to find the balance between data protection and productivity.

For more information on The Cloud Architects podcast, check us out on SoundCloud

• iTunes
• Spotify

In this episode…

• Chris takes a look at email security and digs into SPF, DMARC and all the other acronyms.
• Koos recently had some experience with Entra ID Entitlement Management he wants to share. What are Access Packages? And why should you look into it?
  
  

E-mail Security

When I working with customers doing security assessments - one of the first things I look at is how they have configured email authentication. I pretty much never find these to be optimized and thought it would be a good idea to break them down for our listeners. Email authentication is a group of standards to identify and prevent spoofing, these standards include:

• Sender Policy Framework (SPF): Specifies the source email servers that are authorized to send mail for the domain.
• DomainKeys Identified Mail (DKIM): Uses a domain to digitally sign important elements of the message to ensure the message hasn’t been altered in transit.
• Domain-based Message Authentication, Reporting and Conformance (DMARC): Specifies the action for messages that fail SPF or DKIM checks for senders in the domain, and specifies where to send the DMARC results (reporting).

Without too much of a deep dive, it’s important to understand that email authentication protocols validate your outbound email - the theory is that if everyone validates the email they send, it becomes easier to identify email sent by bad actors.

SPF

SPF is used to validate the ‘RFC5321.MailFrom’ sender to ensure that the email is being sent by someone authorized for that domain. This validation is done in the form of a SPF record - a TXT record in DNS - you’ve probably seen these, they start with a string: “v=spf1”

When you add a new domain to M365, it will automatically generate a ‘base’ SPF record for you - it’s important to understand that it is the minimum required and does not take into account any other services you may use (payroll, etc) or on-prem email relays you may have so the record should be optimized for your exact needs.

Some tips for optimizing your SPF record:

• Use a hardfail ‘-all’
• Align SPF and DMARC (more on DMARC shortly)
• Monitor your SPF record and clean it up regularly
• Limit your records to 10 DNS Lookups - more on SPF clean-up and flattening in future episode

For more info about SPF, check out the official documentation

DKIM

When using DKIM, the receiving server makes a DNS request using the sender’s domain name (RFC5322.From) and obtains the public key from a DNS record in the DNS zone of the sending domain and compares it to the private key in the message from the sending server.

DKIM is easy enough to configure, but it is important to know that it is not configured automatically in M365 for custom domains - you need to create your CNAME records and enabled it yourself. The records are in the format:

• selector1._domainkey.domain.com
• selector2._domainkey.domain.com

Some tips for implementing DKIM:

• Pay attention to your mail routing and where your email is being sent from, i.e, third party providers like Mimecast etc or third party services like Salesforce.
• Plan to rotate your DKIM keys every 3-6 months.

DMARC

DMARC essentially ties SPF and DKIM together where the sender specifies what to do with email on behalf of the domain if it does not meet the requirements of SPF and DKIM.

DMARC is implemented as another TXT record starting with the string: “v=DMARC1” - Once you have implemented a record, receiving servers can verify the incoming email based on the DMARC policy. If the email fails the check, the email can be delivered, quarantined, or rejected - based on the instructions in the DMARC record. DMARC will pass if the RFC5321.MailFrom and RFC5322.From are equal, and/or SPF and DKIM are aligned.

Some tips for implementing DMARC:

• You should always use p=reject - only time to use anything else is when first implementing a DMARC policy
• In M365, setup a DMARC policy for you Microsoft Online Email Routing Address (MOERA) , aka ‘onmicrosoft.com’ domain
• Monitor and update your policy regularly

It’s also really important to monitor your DMARC reports - they are no good just sitting in a shared mailbox. These reports help you gain visibility into your email traffic and are useful to:

• Detect and prevent domain spoofing
• Ensure legitimate emails are getting delivered
• Protect your brand/reputation

There are many DMARC reporting services available - some are free, the good ones cost money and you can even roll your own. Either way, I’d encourage everyone to have something in place.

Check out learndmarc.com to help you validate your configuration.

Official documentation can be found here

In our next episode, I’ll dive a little deeper into SPF clean-up and flattening and spend some time looking at some newer email security protocols:

• Authenticated Received Chain (ARC)
• MTA-STS (Mail Transfer Agent Strict Transport Security)

Entra ID Entitlement Management

Microsoft: “Manage access (and lifecycle) for your users at scale, by automating access request workflows, access assignments, reviews, and expirations.”

Help with scenario’s for people insider your org:

• People in your organizations need access to various groups and applications to perform their jobs. Users might not know what access they should have, and even if they do, they could have difficulty locating the right individuals to approve their access.
• Once users find and receive access to a resource, they could hold on to access longer than is required for business purposes. Also when they move into different roles in the future, you might want to strip them of previous permissions.

But also outside your org:

• These scenarios gets more complicated when you collaborate with people outside your org. You might not know who in the other organization needs access to your resources, and they won’t know what applications and groups your’re using.
• And you also need to invite these users as guests inside your directory, and clean them up once they no longer touch your resources.

Entitlement Management will make all this much easier by creating Access Packages 📦.

Access Packages

Grant access to

• Entra Security Groups
• Microsoft 365 Groups and Teams
• Entra Enterprise Applications (SaaS applications and custom-integrated applications with federation/SSO)
• Sharepoint Online sites

Users can visit myaccess.microsoft.com and select an Access Package that’s available to them.

Lot of different approval steps inside AP policy.

• Different approvals steps for people inside and outside your org
• Scope to specific external org(s)
• Enable Access Reviews to make sure people are actually using their permissions
• What’s great is that external users are automatically invited AND disabled/cleaned upon unassignment of an Access Package.

Licensing

• Entitlement Management is part of Entra ID Governance
• When you think you have all Entra ID features because you have Entra ID Premium P2 licenses, you’re wrong. ;-)
• Luckily Access Packages are still part of P2, but some specific features might now. For example PIM-enabled Group with Access Reviews.

How we use this as an MSSP

• Security Analists
• External sponsors for approvals
• Conditional Access for highest MFA strength
• Trust MFA Claim

Entitlement Management links

What is entitlement management?

More on Entra ID Governance features

Detailed Governance feature per license

Community Project

Yellowhat

We already have Blackhat and Bluehat, but now there’s Yellowhat! 👷🏻‍♂️

A couple of Security MVPs came together to organize a 100% Microsoft Security conference on March 6th 2025. Only deep-dive sessions (Level 400+) led by world-class experts, including Raviv Tamir (Microsoft ILDC), Roberto Rodriguez (Microsoft Redmond), Dirk-jan Mollema, and more announcements soon. All sessions will be broadcast live between 3pm and 9pm CET.

But there are also a few last VIP tickets for in-person visit. Hosted at Microsoft HQ @ Amsterdam and made possible with some great sponsors!

Register your (livestream) ticket now at yellowhat.live

We’ve all been prompted to create a Passkey when logging in to online services like Google - but are Passkeys ready for enterprise use? Do we still need MFA? What’s is FIDO2? We asked Microsoft MVP Darren Robinson to help us dive into the world of Passkeys & verifiable credentials. Darren helps us understand the different types of Passkeys, their use-cases and, he shares some strategies for dealing with those pesky legacy apps and authentication protocols.

For more information on The Cloud Architects podcast, check us out on SoundCloud

• iTunes
• Spotify

Topics

• Chris takes a look at the Intune announcements from Ignite
• Koos has some thoughts on new capabilities within Defender XDR and some other Security-related updates.
  
  

Ignite book of News

• Ignite ‘24 Book of News
• The terms ‘Copilot’ and ‘AI’ were used 259 and 392 times respectively 😜
• Only two product/feature renames! 😳
  • ‘Azure Virtual Desktop for Azure Stack HCI’ has been renamed ‘Azure Virtual Desktop for Azure Local’
  • ‘Microsoft Purview Data Catalog’ has been renamed ‘Microsoft Purview Unified Catalog’.

Intune & Entra

Intune

Microsoft Security Copilot in Intune will expand to more platforms & scenarios

We’ll see integration and start to surface in more places inside Intune and the greater Intune Suite:

• Intune Advanced Analytics - Natural language help with KQL queries, multi-device queries, etc.
• Endpoint Privilege Management (EPM) - Copilot insights into apps requesting elevation
• Policy Management - Easier to setting help, insights into settings in other policies, conflicts etc.
• Windows Autopatch - Natural language insights into Win 10/ Win 11 updates, issues with updates etc.

Microsoft Intune is expanding its core device hardware inventory capability for Windows to iOS, Android, macOS and Linux devices.

Entra

New capabilities strengthen Microsoft’s Security Service Edge solution

If you recall, earlier this year Microsoft announced it’s SSE solution that consists of:

• Microsoft Entra Private Access - Helps provide secure access to private resources
• Microsoft Entra Internet Access - Provides secure access to all internet and SaaS apps

Announced at Ignite, Entra Private Access will have some new features added:

• Quick access policies, generally available, make it easy to onboard private apps to Microsoft Entra.
• App Discovery, coming soon to public preview, makes it easy to discover all your private apps.
• Private DNS, in public preview, makes it easy to configure single label names or hostnames that users can use to access resources seamlessly.
• Private network connectors available in the Azure, AWS, and Google Cloud marketplaces, in public preview, improve the admin experience and simplify deployment of private network connectors.

Entra Internet Access is also getting some new features:

• Continuous access evaluation (CAE) support, in public preview, allows network access to be revoked in near real-time when it detects a critical event. It’s like gaining an automatic emergency switch that turns off the Internet until policy conditions are met. Because these controls operate at the network level, they work whether or not the application or client supports modern authentication and CAE natively.
• TLS inspection, in private preview, provides comprehensive visibility of encrypted traffic and enables enhanced URL web category filtering based on full URLs. 

Microsoft Security Copilot will be embedded directly into Microsoft Entra admin center, bringing the available identity skills from the standalone Security Copilot experience, along with new identity capabilities, directly to identity admin workflows

Defender XDR

Very broad subject of course.

So when we think of “Defender” we might still think about Defender for Endpoint, right?

XDR = Cross Detection & Response

Defender XDR = Defense suite with “all the defenders” like:

• Microsoft Defender for Endpoint (Defender ATP)
• Microsoft Defender for Office 365 (Office 365 ATP)
• Microsoft Defender for Identity (formerly: Azure ATP)
• Microsoft Defender for Cloud Apps (formerly: Cloud App Security)
• Microsoft Defender Vulnerability Management
• Microsoft Defender for Cloud (Azure Defender)
• Microsoft Entra ID Protection (AAD Identity Protection)
• Microsoft Purview (Data Loss Prevention)

Unification of portals

Different role for Sentinel.

First Sentinel as orchestrator if you will.

Nowadays all “Defenders” are unified in the “Defender portal” (security.microsoft.com).

Last year rebranded to “Unified Security Operations Platform” where also Sentinel (Azure resource) was added as well.

But there are still some features missing for which you needed to switch back to the Azure Portal.

• Workbooks are now available
• Sentinel will now also be available to customers who do not use Defender XDR. Customers will be able to access the embedded Security Copilot experience.

I hope other missing functionality like automation rules and playbooks management will be added soon as well.

Other new integrations

• Purview Insider Risk Management is now integrated in the incident page

This appears to be a big year for data security. More on this later…

Most notable product now GA

• Microsoft Security Exposure Management

  Before I explain what it is, it’s good to understand the different ways Attackers and Defender generally operate.

  John Lambert (Microsoft Corporate Vice President Security) once said:

  • Windows Security team since 2000
  • Led the Microsoft Threat Intelligence Center (MSTIC)

  Defenders think in lists, attackers think in graphs. As long as this is true, attackers win.

  Most defenders focus on protecting their assets, prioritizing them, and sorting them by workload and business function. They have plenty of lists of assets in system management services, in asset inventory databases and even in spreadsheets. There’s one problem with all of this. Attackers don’t have a list of assets, they have a graph. Assets are connected to each other by security relationships. Attackers breach a network by landing somewhere in the graph and start hacking their way to the next point, finding vulnerable systems by navigating the graph. Who creates this graph? Well, you do.

  According to Microsoft Security Exposure Management:

  • Helps you to: understand your attack surface
  • Helps you to: think like an attacker
  • Helps you to: prioritize actions to protect most critical assets.

  It does this by consolidating posture data like:

  • Endpoints
  • Cloud
  • Applications
  • Identities
  • Data
  • Vulnerabilities
  • Attack Surface

  From both Microsoft AND third-party solutions:

  • ServiceNow CMDB
  • Qualys VM
  • Rapid7 VM
  • Tenable
  • Wiz (coming soon)
  • Palo Alto (coming soon)

  And present the data with three three key components:

  • Attack Surface Management Visualize these relationships in a graph, that’s what gives you the “attackers perspective” of your organization.
  • Attack Path Analysis Highlights how an attacker could potentially abuse your exposures and security gaps. It will show how they would be able to traverse their way through your organization, to your most critical assets.
  • Unified Exposure Insights Get dynamic metrics and scores for security initiatives like Cloud & Endpoint Security, Ransomware Protection and Zero Trust. This helps you prioritize efforts to close the most important gaps first.

Microsoft Security Exposure Management not only went GA, but it also received a couple of updates during Ignite

• DACL Support XSPM now includes Discretionary Access Control Lists (DACLs) in attack path analysis.
• Hybrid Attack Paths now identifies hybrid attack paths, capturing routes that originate on-premises.

Read more details about Microsoft Security Exposure Management going GA here.

Several other notable new additions

• Defender for Office 365 now provides AI-powered email and collaboration security. Using purpose-built Large Language Models. Initial rollout to select customers shown impressive results of a 99.995% attacker intent detection accuracy and filtering.

• Defender Cloud Security Posture Management (CSPM) received new additions. CSPM provides detailed visibility into the security state of your Cloud assets and workloads, and provides hardening guidance to improve your security posture. But not only Azure Cloud, AWS and GCP as well.

  • API security posture
    Mapping APIs in Azure API Management’s to back-end to gain full context across the entire app, including compute and storage.
  • Container security posture Azure, AWS and Google Cloud Platform and third party/private registries like Docker Hub and JFrog Artifactory
  • AI security posture Azure OpenAI Service, Azure Machine Learning and Amazon Bedrock
• Microsoft launched “Zero Day Quest” - A $4 million AI and cloud security bug bounty program. “hacking event will be the largest of its kind”. Started on November 19th and runs until my birthday on January 19th.
• New capabilities in Purview Data Loss Prevention will prevent oversharing of sensitive information and detect risky AI usage in Copilot.
• Microsoft Purview Data Security Posture Management (DSPM) (preview). Will provide centralized visibility from across Microsoft Purview data security solutions into one place.
  • Information Protection
  • Insider Risk Management
  • Data Loss Prevention

  Data Security Posture Management will help:

  • identify possible labeling and policy gaps
  • unusual patterns and activities that might indicate potential risks and opportunities.
• Security Copilot new features:
  • During incident investigations, analysts commonly review details about related evidence entities (like IP, accounts and devices) There already was a ‘Device Summary’ but now there’s also a new ‘Identity Summary’, highlighting behavioral anomalies and potential misconfigurations.
  • MDTI (Threat Intelligence) indicator skills can leverage threat intelligence in MDTI to link any IoC (indicator of compromise) to all related data and content.
• Security Copilot enhancements:
  • ‘Script and file analysis’ simplifies complex investigations by translating what a script does into natural language and streamlining the analysis of multiple executable files.
  • ‘Incident Report’ compiles all response activities into a detailed report of the security incident. It now comes with third-party integration with ServiceNow
  • ‘Incident Summary’ in Copilot standalone experience is able to retrieve more details like entities and across both Sentinel and Defender
  • ‘Guided Response’ Enables security analysts to easily communicate with end users by dynamically generating text for analysts to use
• Security Copilot now in more products:
  • Purview
  • Entra
  • Intune
• 2025 will be the year of Microsoft Purview and Data Security.

Community Project

Entra ID Security Config Analyzer (EIDSCA)

Speaking of Workbooks; Sami 🇫🇮, Thomas 🇩🇪 and Markus 🇫🇮 have created the “Entra ID Security Config Analyzer (EIDSCA)” a while ago. And it contains a lot of great stuff but one of which is a Workbook which will evaluate your Entra ID tenant settings with several best practices.

Check out the project on Github.

Follow us on your favorite podcast platform or check us out on YouTube

Topics

• Chris has some thoughts about MFA usage and deployment,
• Koos recently ran into some issues with Passkeys and wants to share a couple of do’s and don’t’s and also discuss future roadmap features.
  
  

MFA

Its almost 2025 - Is MFA still relevant today? Is MfA an unachievable utopia? The answers are definitely and no!

Seriously though, we’ve been talking about this for over a decade now - but it dawned on me recently that we always say “go enable MFA” and maybe we really should be saying “here’s how you enable MFA”. Believe it or not, I still see organizations that don’t have ANY MFA deployed - this happens for many reasons:

• Legal/political reasons
• Device restrictions

Its important to think of this as a process of continuous improvement and not ‘set and forget’ Where should you be? What does a MFA MVP look like? At a bare minimum, MFA should be enabled for all accounts in the tenant. In my opinion, I would go a little further than this - At a bare minimum, MFA should be enabled for all accounts in the tenant and all admin roles should be using phish-resistant MFA.

What do we mean by phish-resistant MFA?

• FIDO / WebAuth authentication
• Public key infrastructure (PKI)-based

These are things like FIDO2 tokens (Yubikey/Token2), Windows HfB, Passkeys, etc.

How should you configure MFA? Use Conditional Access - this requires at least Entra ID P1. If you don’t have at least P1, you can still deploy MFA via the ‘security defaults’ in M365, but you will lack granular control. Conditional Access is an important security tool so I’d encourage you to consider this during your next license cycle/true up.

You want to create at least 2 CA policies for MFA:

• One policy to apply MFA for all users in administrative roles. Scope this policy to the roles, not to users/groups
• One policy to MFA for all users. Scope this policy to ‘All users’

Once we you have these in place - your next step is to require phish-resistant MFA on the Admin roles. These align with the latest CIS benchmarks. If you’re not using Microsoft Authenticator - I’d strongly recommend moving toward that for as many users as possible. Avoid SMS where possible.

What about break glass accounts? For years we’ve been saying you should break glass accounts from MFA - this guidance in outdated. The recommendation now is to use FIDO2 tokens or similar for these. This also means that you need to consider your processes for using, storing and testing these.

Takeaways

• If you don’t have MFA deployed - don’t let perfect be the enemy of good. Start now and deploy where you can.
• Limit exclusions - look are service principals etc
• It is not all or nothing
• Security is not ‘set and forget’

MFA - Links

CISA - Implementing Phishing-Resistant MFA

Conditional Access authentication strength

Passkeys

AiTM

As more organizations embrace multi-factor authentication (MFA) to block most password-based attacks, threat actors are moving up the cyberattack-chain by bypassing MFA authentication altogether.

Adversary-in-the-middle (AiTM) attacks

• Involves attackers tricking users into clicking a link and completing MFA on the attacker’s behalf.
• Token theft is when an attacker steals tokens and makes a copy to get to the users’ resources without needing a username, password, or a successful MFA challenge.

What are passkeys?

A passkey is a strong, phishing-resistant authentication method based on World Wide Web Consortium’s (W3C) WebAuthN standard.

Passkeys solve the issue with phishing attacks because AiTM phishing is done by using a proxy server, which phishes the password and session cookie right after the user performs MFA. Which allows the attacker to use the session cookie for as long as the cookie is valid.

Evilginx is a demonstration of what adept attackers can do. It is the defender’s responsibility to take such attacks into consideration and find ways to protect their users against this type of phishing attacks.

Passkeys are a pair of cryptography keys generated by your device. And without the private key, the attacker cannot login on the users behalf, because accessing the private key is protected by using a PIN or biometric methods.

Passkeys provide passwordless logon, where each passkey is a unique digital key which cannot be reused. Therefore they cannot be abused in AiTM attacks.

Two types of passkeys

Two types of Passkeys; device-bound and syncable passkeys. Device-bound is more secure because the key is stored and bound to a physical device.

Passkeys popup on Github, Paypal and 1Password. These are examples of syncable passkeys.

Microsoft currently only offers device-bound passkeys. This can be a FIDO2 key, or recently with their Authenticator app on Mobile. At first I thought this was quite odd, because during the process of the latter you need to scan a QR code and open it with the Authenticator app. So how does this prevent an attacker to provide a phishing QR code through a proxy? Well, the authentication device you scan the QR with needs to be in close proximity of the device that generates the QR code. This is also why you need to have Bluetooth enabled on your smartphone for this to work. And since this is still a Passkey authentication where the private key is needed for the authentication, phishing the session cookie has no use for the attacker.

The challenges

The downside to all of this is support. And that’s why I wanted to bring this topic to today’s Podcast.

• Logging in from a desktop can be a bit awkward due to the QR code scanning process.
• Bluetooth restrictions may apply in your company?
• Break-the-Glass Storing physical keys in a safe require additional thoughts about the logistics of it
  • Take a look at OTP based MFA perhaps, but be aware of the additional dependency of “Entra ID MFA services”
• iOS 17 - only one password manager. –> iOS 18 solves this!
• Remote Desktop limitations
  • Especially on a Mac! :-( (no WebAuthN redirection)
  • Be careful with RDP from the Windows Store as well!

If you really need tight security where you want to check device compliance and risk status as well, you probably have a Virtual Desktop or equivalent solution setup of for externals. And there’s effectively no way to satisfy a Phishing-resistant MFA strength if they access this from a Mac…

Passkeys - Links

Enable Passkeys for your organization

Build resilience with credential management

Simulate your own AitM attack with Evilginx

Enable passkeys in Microsoft Authenticator (preview)

Microsoft Entra ID FIDO2 provisioning APIs (preview)

Community Project - Maester

What is Maester?

Maester is a PowerShell based test automation framework to help you stay in control of your Microsoft security configuration.

Maester is built on the Pester framework - the team has put in a lot of work to provide an ‘easy button’, but allows you to create your own tests. Maester helps you monitor your Microsoft 365 tenant by running a set of tests to ensure your configuration is in compliance with your security policies.

Currently provides built-in tests:

• Secure Cloud Business Applications (SCuBA) Security Configuration Baseline - CISA
• Entra ID Security Config Analyzer (EIDSCA) - mapped to the MITRE ATT&CK framework.
• Maester community tests (36)

Maester - Links

Maester

Introducing Maester

Follow us on your favorite podcast platform or check us out on YouTube

Introducing the podcast and getting to know Chris & Koos, our backgrounds, interests etc. We also take a look ahead at our first episode coming soon!

Follow us on your favorite podcast platform or check us out on YouTube

It seems everyone is selling AI at the moment - how can we make the most of these technologies in a measured, controlled way without exposing ourselves to data leakage or other unintended consequences? In this episode we’re joined by Saaim Khan as we dive into some of the challenges faced by organizations rushing to adopt AI technologies. Saaim takes us through the role of governance in AI, the importance of a well-thought-out business case, and shares 5 simple questions to help you start taking control of your data governance.

For more information on The Cloud Architects podcast, check us out on SoundCloud

• iTunes
• Spotify

Have you heard the story of malware that targets programmable logic controllers (PLCs) on industrial systems and causing fast-spinning centrifuges to tear themselves apart? How about the disgruntled employee in Australia who tampered with a supervisory control and data acquisition (SCADA) system and released 265,000 gallons (~1M l) of sewage from a waste management plant? In this episode we’re joined by Operational Technology (OT) Security expert Roger Hill as we discuss OT security, the convergence of OT and IT and how we can defend against OT / IOT attacks.

For more information on The Cloud Architects podcast, check us out on SoundCloud

• iTunes
• Spotify

No language encryption here… In this episode we have the honor of sitting down for a late-night discussion with our Dutch friends Koos, Jeroen and Maarten. We really enjoyed their interesting and unique perspective on the global threat landscape and how the ransomware-as-a-service economy continues to grow. We also talk about cyber warfare, the challenge of attack attribution and share some practical guidance on how keep your organization secure.

For more information on The Cloud Architects podcast, check us out on SoundCloud

• iTunes
• Spotify