Identity & Access Management Concepts

By Ashwin Venugopal -

 




Evolution of Identity Technology

Nowadays, mobile devices, cloud computing, Internet of Things (IOT), and identity and access management are capable enough to secure on-premises as well as cloud identities while also managing the access to sensitive information inside and outside the corporate network.

Microsoft 365 take comprehensive approach:

  • Azure Active Directory (Azure AD) is used for unified identity management to secure and manage single sign-on at scale.
  • Passwordless authentication like integrated phone authentication (Microsoft Authenticator) and biometrics (Windows Hello) are introduced for user convenience and productivity.
  • Hardware credential isolation like Trusted Platform Module (TPM) and security keys can be done for simple as well as secured authentication on shared devices.

Identity Challenges

As cyberscurity attacks have become more and more sophisticated, password alone can no longer cope up against unauthorized access. The risks to your data are crystal clear:

  • It is estimated that 81% of security breaches are due to identity theft and as identity and access controls are inconsistent across platforms, services as well as devices, this means that once the user is outside your network perimeter, they potentially at risk for attack.

  • As 73% of the users use the same password for multiple accounts to remember the credentials for multiple apps and devices, it means the breaching of a user's identity for one account may allow the hackers to move laterally throughout your network.

  • As most of the users prefer productivity over security, 80% of the employs uses non-approved SaaS apps for work introducing vulnerabilities into your network.

The new threat landscape requires to protect identities more than the perimeters:

  • Users should have constant access to use different technologies across multiple mobile devices, cloud apps, and services.
  • Lack of visibility and control over their technologies may lead the users to suffer from an increase in identity attacks.
  • All the organizations should evolve their data privacy regulations and constantly monitor their security practices to remain compliant.
  • Users always wants to stay productive with the help of simple authentication experience. 

Identity Governance Process

Your primary identity provider with Microsoft 365 is EITHER:
  • Active Directory Domain Services (AD DS), which is an intranet identity provider hosted on computers running Windows Server generally used by the organizations containing an extra on-premises identity provider. 
OR
  • Azure Active Directory (Azure AD), which is a cloud-based Identity as a Service (IDaaS) having various capabilities for managing as well as protecting your environment generally used by the organizations having no existing on-premises infrastructure and also by enterprise customers with on-premises infrastructure using Azure AD connect to easily manage this hybrid identity environment. 

The following steps will help you to plan your identity governance infrastructure in an cloud or hybrid environment:

  • Plan for users & groups- which means identify the users, groups, and group memberships along with their corresponding Azure AD accounts.

  • Secure your privileged identities- which means you must plan secure your global administrator accounts and find which users can have global admin roles along with the dedicated global admin accounts. 

  • Configure hybrid identity- you should determine which on-premises identities in AD DS you want to sync with the Azure AD tenant used by your Microsoft 365 subscription and plan to configure Azure AD connect to implement the synchronization. 

  • Configure secure user authentication- set-up multi-factor authentication as a second level of security for user sign-ins and determine a way to configure the second authentication method on a per-user account basis.

  • Simplify access for users & plan to use Azure AD to enable Self-Service Password Reset (SSPR)-  It allows the users to reset or unlock their passwords without the help desk intervention. However, you must plan to implement password writeback for hybrid environment allowing the users to update their passwords through Azure AD SSPR even if their accounts and attributes are stored on-premises.  

  • Use groups for easier management- You must identify the Azure AD groups that group owners can manage on their own. Self-service group management allows the group leaders who understands the business use for the group, to have an easy day-to-day control of membership.



















Comments

Post a Comment

Popular posts from this blog

Deployment (Part 3)

By Ashwin Venugopal -
Image
  To read part 1, please click  here To read part 2, please click  here Microsoft Monitoring Agent (MMA) MMA is used across multiple Microsoft solutions and has undergone a few name changes as its features and functionality have evolved. If it is being considered to be used, then following areas should be covered during a Microsoft Sentinel deployment project: Consider the timelines and the strategy for a migration to AMA (Azure Monitor Agent) before the MMA end-of-life.  Consider the central deployment and management methodology for MMA. Determine which endpoints are in scope for deployment as these affect the log ingestion volume significantly.  Azure Monitor Agent (AMA) Organizations with MMA as the main Microsoft Sentinel agent should start planning the migration to AMA as soon as possible to avoid a rushed migration. One of the main advantages of AMA is the ability to control the log collection policy centrally and apply different policies against different...
Read more

Deployment (Part 1)

By Ashwin Venugopal -
Image
  To read part 2, please click  here To read part 3, please click  here Azure Resources Microsoft Sentinel needs following resources to be created: Subscription (if a dedicated subscription(s) will be used) Resource group(s) Log Analytics workspace(s) Automation rules/playbook Alert rules Workbooks Microsoft Sentinel offers hundreds of alert rules, workbooks, and automation playbook templates along with hunting scripts. The templates can be used to activate/deploy schedule alerts, create customized dashboards, create automation playbooks and perform threat-hunting activities. Generally, once deployed, the resources created have to be adjusted to match the existing environment, configure local credentials, etc. Methods of deployment: Manual- Administrator can manually configures the Microsoft Sentinel resources with the help of Azure portal. Any manual process has the inherent risks of human operator error, lack of compliance with potential change control procedures, and u...
Read more

Project Resourcing (Part 2)

By Ashwin Venugopal -
Image
  To read part 1, please click  here Engineering - SIEM The SIEM engineers configures Microsoft Sentinel, including Log Analytics, Logic Apps, workbooks, and playbooks. They are also responsible for the following high-level tasks: Initial configuration of Azure tenant, including provisioning required resources, assigning access roles, and configuring workspace parameters like log retention, resource tagging, and blueprints.  Deployment and configuration of syslog/CEF log collection agents in appropriate locations to collect logs from on-premises devices. Generally, it will be joint effort of both system engineer and SIEM engineer, involving configuration and potential troubleshooting.  Working with system owners to enable log forwarding and configuring any required parsing of log data in Log Analytics.  Working with security operations to create and deploy KQL analytic rules to offer detections for SOC/Computer Security Incident Response Team (CSRIT) use. Tuning...
Read more