Hairless in the Cloud - Microsoft 365 - Security und Collaboration Archiv

News:

STOP THE VOTE !1!!!

KI Fussballkamera verwechselt      glatzköpfigen Linienrichter mit Ball: https://www.heise.de/news/Autonome-Fussballkamera-verwechselt-glatzkoepfigen-Linienrichter-mit-dem-Ball-4943323.html

Teams Connector Sentinel: https://techcommunity.microsoft.com/t5/azure-sentinel/expanding-microsoft-teams-log-data-in-azure-sentinel/ba-p/1811827

Mandalorian Staffel 2: https://www.kino.de/serie/the-mandalorian-2019/news/the-mandalorian-staffel-2-ab-freitag-geht-der-kampf-um-baby-yoda-weiter/

Sign-ins Report for      Service-Principals: https://docs.microsoft.com/en-us/azure/active-directory/reports-monitoring/concept-all-sign-ins

Advanced Password Spray      Attack Detection: https://techcommunity.microsoft.com/t5/azure-active-directory-identity/advancing-password-spray-attack-detection/ba-p/1276936

Low and slow (many thousand       IP addresses as source) e.g. from a botnet

Diese Attacken gehen unter,       fallen fast nicht auf NUR

Wenn Microsoft über ALLE       TENANTS weltweit schaut

Password Spray Detection:       check single hash failing across multiple accounts worldwide

Das alles ist jetzt in ID       Protection

Teams Meeting Recording 3x3: https://admin.microsoft.com/Adminportal/Home?ref=MessageCenter&id=MC225568

Exchange + Adressing (no      groups): https://techcommunity.microsoft.com/t5/exchange-team-blog/plus-addressing-now-available-in-exchange-online/ba-p/1824651

Xbox und Playstation next      gen: https://www.thurrott.com/games/xbox/xbox-series-x/243536/xbox-series-x-review?utm_source=rss&utm_medium=rss&utm_campaign=xbox-series-x-review

Teams News: Spotlight (for      all) https://techcommunity.microsoft.com/t5/microsoft-teams-blog/what-s-new-in-microsoft-teams-october-2020/ba-p/1824864

Teams Display und Audio

https://techcommunity.microsoft.com/t5/microsoft-teams-blog/microsoft-teams-displays-now-available/ba-p/1810291

Jupyter Notebooks in Azure

https://docs.microsoft.com/en-us/azure/sentinel/notebooks

In this episode we deeply talk about Microsoft Defender for Office 365 with our special guest Pawel Partyka. Pawel is Program Manager at Microsoft in the Microsoft Defender for Office 365 team. This is a technically deep dive into the most important features in the area of Email security. Pawel was a great guest and great fun to talk to!

Follow Pawel on Twitter: https://twitter.com/Pawp81

Collaboration

- Stream stirbt und SharePoint lebt

- Meetings werden besser (Together Mode Backgrounds, Custom layouts, Breakout, …)

- Teams Federation in Gruppen Chats

- Meeting Teilnehmer immer auf Mute

- SharePoint File Sharing Guest expiration

- Info Protection (Group oder Datei) und SharePoint Sharing

- Exchange Email +Notation

- Teams Templates im Admin

- Teams Panels, Capacitiy

- Teams search

Links

https://techcommunity.microsoft.com/t5/microsoft-teams-blog/what-s-new-in-microsoft-teams-microsoft-ignite-2020/ba-p/1665600

https://techcommunity.microsoft.com/t5/microsoft-stream-blog/a-new-vision-for-microsoft-stream/ba-p/1686304

https://techcommunity.microsoft.com/t5/microsoft-sharepoint-blog/what-s-new-in-security-and-compliance-in-sharepoint-and-onedrive/ba-p/1696705

Security

- MTP = Microsoft 365 Defender

- MDATP = Microsoft Defender for Endpoint

- OATP= Microsoft Defender for Office 365

- AATP = Microsoft Defender for Identity

The Azure Security Center solutions are rebranded accordingly:

- Azure Defender for Servers

- Azure Defender for IoT (cool CyberX stuff for OT)

- Azure Defender for SQL

- Microsoft Defender for Endpoint (fka: MDATP) now supports Android (GA) and iOS (Preview) and macOS is now supported with TVM.

Microsoft Threat Protection == Microsoft 365 Defender + Azure Sentinel + Azure Defender

Neue Attack Simulator Szenarien:

- Credential Harvest

- Malware Attachment

- Link in Attachment

- Link to Malware

News

- Tesla wurde gehackt - naja fast - https://www.zdnet.com/article/elon-musk-confirms-russian-hacking-plot-targeted-tesla-factory/

- Corona Update

- Computer Health: Monitor Placement / Setup - https://ergo-plus.com/office-ergonomics-position-computer-monitor/

 - top eye level

 - Tilt

- Teams Recording in DE und PowerAutomate! - https://techcommunity.microsoft.com/t5/microsoft-teams-blog/what-s-new-in-microsoft-teams-august-2020/ba-p/1619717

- Billige Meetings - https://www.microsoft.com/en-us/microsoft-365/blog/2020/09/08/3-deals-meeting-calling-experiences-microsoft-teams/

- Azure AD B2B Lizenzupdate 50k MAU free - https://azure.microsoft.com/en-us/pricing/details/active-directory/external-identities/

- Fluid Framework Open Source - https://fluidframework.com/playground

- MS Lists GA - https://techcommunity.microsoft.com/t5/microsoft-teams-blog/microsoft-lists-in-microsoft-teams-is-now-generally-available/ba-p/1621979

Grüße

- GeekSprech - https://geeksprech.de/geeksprech-podcast-folge-43-hairless-in-the-cloud-ist-schuld/

Vertrauen in die Cloud

- Apple, Google und/oder Microsoft?

- https://docs.microsoft.com/en-us/microsoft-365/compliance/encryption?view=o365-worldwide

- Wer hat den Key? Wer hat den Key erstellt?

- Service Encryption

 - Exchange Online, Skype for Business, SharePoint Online, and OneDrive for Business

 - Customer Key (aka Advanced Encryption with BYOK)

 - HSM or AKV

 - Availability Key

- Azure Information Encryption

 - Single file Verschlüsselung

 - RMS

 - BYOD

 - HYOK-DoubleKeyEncryption - Only Unified Labeling Client

 - https://techcommunity.microsoft.com/t5/microsoft-security-and/announcing-public-preview-of-double-key-encryption-for-microsoft/ba-p/1534451

 - Double Key Encryption helps organizations protect their mission-critical data - a small volume of their overall data.

- Customer Lockbox

 - Organisatorisch, technisch unterstützt und zertifiziert

NEWS

Mimikatz: https://dirkjanm.io/digging-further-into-the-primary-refresh-token/

Ignite 2020: https://www.microsoft.com/en-us/ignite

Become a KQL Ninja: https://security-tzu.com/2020/08/07/become-a-kql-ninja/

Teams: https://techcommunity.microsoft.com/t5/microsoft-teams-blog/what-s-new-in-microsoft-teams-july-2020/ba-p/1551561

SCC Report: https://github.com/jangeisbauer/SCCReport

Booking "14 people are      currently watching this product" --> random()*12 + 3: https://twitter.com/RoninDey/status/1292002070363541505?s=20

MCAS spoofing: https://stephanwaelde.com/2020/08/04/mitigate-mcas-issue-with-user-agent-spoofing/

Überall tauchen DUOs auf: https://twitter.com/matvelloso/status/1291576776238305281?s=20

I LIKE TO MOVE IT

Mover.io (2019 gekauft)

"Alternativen"      SharePoint Migration Tool, ShareGate, AvePoint, …

Viele Anbindungen (14): S3, AZ Blob, Box, Dropbox, G Suite, Gdrive, O365, OneDrive

User vs Admin

Self Service Migration

OneDrive 2 OneDrive

DropBox 2 OneDrive

OneDrive 2 DropBox

Admin driven migration

Immer noch die Rede von       User!

User Mapping = Site Mapping       = Url 2 Url

Permission Mapping (upn =       upn) - damit auch B2B machbar?

UX

Anmelden an Service 1

Anmelden an Service 2

Auf jeder Seite den Ordner       wählen

Im Ziel auch anlegbar

Tech

2 AAD Apps (alles       OIDC/Oauth)

Anmeldung an zwei Tenants in derselben Browser Session

Mover OneDrive (user consent)

Office 365 Mover (admin consent)

Keine "Lizenz"

Performance: Mein OneDrive 45k 106 GB = 12 stunden

Use Case

Blob to SharePoint über ein Schedule

https://www.youtube.com/watch?v=vuo8kD5zF5I

BUT YOU ARE NOT ALLOWED TO: Microsoft Endpoint Data Loss Prevention

Public Preview

Native built into Windows (in MDATP component and edge)

Compliance.microsoft.com

Sensitive Info Type: ex german passport number

AND Share Condition: Is shared with somebody inside or outside my org

Audit or restrict activities      on windows devices

Upload to cloudservices or       access by unallowed browsers

Copy to clipboard

Copy to USB

Copy to network share

Access by unallowed apps

Print

https://techcommunity.microsoft.com/t5/microsoft-security-and/announcing-public-preview-of-microsoft-endpoint-data-loss/ba-p/1534085

Special Guest: Christian Baumgartner

Ein neuer Tenant muss her, auf was muss ich achten. Namen, Dienste, …

News

Collaboration Bar im Test

https://glueckkanja.com/blog/collaboration/futureworkplace/teams/2020/06/yealink-vc210-product-review/

Teams Breakout rooms

https://myteamsday.com/2020/04/17/breakoutrooms-in-teams/

Corona App

https://mobile.twitter.com/ard_bab/status/1272909142819299330

BLM

https://www.hanselman.com/blog/EasilyRenameYourGitDefaultBranchFromMasterToMain.aspx

gkgab

https://www.gab.de/fuehrende-microsoft-partner-fusionieren/

https://glueckkanja.com/de/unternehmen/media-kit

Neuer Tenant

Name des Tenant

Christian, wie hast du das "bulk" geprüft

Services

Exchange

Teams

SharePoint

OneDrive

Security

Conditional Access

All the ATP

Migration

O365

Security

AD

News from Build

Edge

Sidebar search

Pinterest integration

Switch profiles

Progressive Web Apps

Lists

Project Reunion

Desktop und UWP

Neue Auth Api für MFA in https://techcommunity.microsoft.com/t5/azure-active-directory-identity/manage-your-authentication-phone-numbers-and-more-in-new/ba-p/1257359

PowerToys

Linux GUI apps

Fluid Office Doc (Modularisierung von Content)

Every Developer is welcome - Scott Hanselman - https://mybuild.microsoft.com/sessions/871ef73f-f04a-405b-a0fa-01d7433067d1

Windows 2004

Graphic Card Temp in Task Manager

Only with dedicated GPU card

Only supported in Celsius

Rename virtual desktops

Reset from cloud

Win Taste und Punkt für Emojis Menü   

Windows Hello PIN in Safe Mode

Recover from the cloud

Restart Apps

Many Notepad features      

Stephan Wälde (Lead Cloud Architect bei der Glück & Kanja Consulting AG)

Twitter: @stephanwaelde

Blog: https://stephanwaelde.com

Begriffserklärung

Access Token / bearer token

OAUTH

User vs. App

Besser Principal und Ressource Owner

Client != Device

Client eher Anwendung

Delegated vs App Permission

Basic

Ressource MS Graph

Ressource Owner

Client (Anwendung: Client ID)

Auth Server (AAD)

Access Token --> Resource

Refresh Token --> AAD

ID Token --> client

Username, Displayname, Email

Azure AD

PRT --> sso browser holt sich von OS

MSAL aware apps machen SSO

Enterprise Apps

Wie kann man die Tokens "anfassen"?

https://JWT.MS (ID und Access Token)

Fiddler

F12

Oder selber schreiben

Frage an Jan :)

RFC von OAUTH 2.0https://tools.ietf.org/html/rfc6749

News

Microsoft 365 Consumer - Briefing: https://www.youtube.com/watch?v=0SkHWXH49js&feature=emb_title

Stuntman on Twitter: https://mobile.twitter.com/gamaniak/status/1252663994629922823

Teams Community Day: https://www.teamscommunityday.de/de/agenda-online/

Bill Gates schreibt 13 Seiten über "Pandemic I": https://www.gatesnotes.com/Health/Pandemic-Innovation?WT.mc_id=20200423090000_Pandemic-Innovation_BG-TW_&WT.tsrc=BGTW

Kontaktverfolgung per PEPP-PT: https://www.heise.de/newsticker/meldung/Corona-Kontaktverfolgung-und-PEPP-PT-Es-zaehlt-mehr-als-kryptographische-Eleganz-4708335.html

CVE-2020-3952 bekam ein CVSS score von 10: https://www.guardicore.com/2020/04/pwning-vmware-vcenter-cve-2020-3952/

Access Review Office Hour: https://twitter.com/fionnagan/status/1249772350725189643?s=20

Cloudeight Event am 22. Mai: https://www.cloudeight.ch/?mec-events=session-16-go-hack-yourself-with-microsoft-advanced-threat-protection-mdatpmit mir, Ingo Gegenwarth, Hans Brender etc, organisiert von Drago Petrovic

Trust in Tech am 29. April organisiert von Alex Benoit, sprechen wird diesmal Christian Müller von der Infowan über Sentinel und Co: https://www.meetup.com/de-DE/Trust-in-Tech-Cologne/events/270165772/?isFirstPublish=true

GitHub for free: https://mobile.twitter.com/natfriedman/status/1250092565090562049

Attack Surface Reduction Rules 

https://techcommunity.microsoft.com/t5/microsoft-defender-atp/demystifying-attack-surface-reduction-rules-part-2/ba-p/1326565

Meetings Everywhere

Anbieter

Zoom

WebEx

Skype

Google

Meet

Hangouts

Facetime?

Blue Jeans

GoToMeeting

Discord, Twitch, Mixer

Microsoft Teams

Free Version

Commercial

News

M365 Corona Einschränkungen: https://admin.microsoft.com/Adminportal/Home?source=applauncher#MessageCenter?id=MC207439

GK Home Office: https://mobile.twitter.com/glueckkanja/status/1242839888459976704

Pimp your Meeting with Scott: https://www.hanselman.com/blog/TakeRemoteWorkerEducatorWebcamVideoCallsToTheNextLevelWithOBSNDIToolsAndElgatoStreamDeck.aspx

Teams Background Noise Suppression and more: https://techcommunity.microsoft.com/t5/microsoft-stream-blog/new-and-coming-soon-background-noise-suppression-mobile-video/ba-p/1221048

Teams Collab Bars: https://techcommunity.microsoft.com/t5/microsoft-teams-blog/the-first-collaboration-bar-for-microsoft-teams-is-now-available/ba-p/1231706

GK Future Workplace @ School: https://glueckkanja.com/blog/teams/realmjoin/intune/futureworkplace/collaboration/2020/03/modern-workplace-at-school/

Microsoft Teams Live Meeting

https://docs.microsoft.com/en-us/microsoftteams/teams-live-events/what-are-teams-live-events

Nicht das Meeting wie sonst (Meeting != Event)

Nicht Live (10-40 Sekunden Versatz)! Nur die Producer können sprechen!

Producer & Consumer

Ressourcen (CPU Power)

Am besten zwei Producer

Am besten vorher mal testen

Kein Client für die Consumer, Teams Client geht aber

Q&A, Live Transcription (Englisch, Türkisch, Spanisch, …), Recording

https://docs.microsoft.com/en-us/MicrosoftTeams/teams-live-events/plan-for-teams-live-events

License

An Office 365 Enterprise E1, E3, or E5 license or an Office 365 A3 or A5 license

A Microsoft Teams license

A Microsoft Stream license

Sentinel Fusion

https://docs.microsoft.com/en-us/azure/sentinel/fusion

correlation

More Stuff

Non Teams Meeting Demo: https://martinfowler.com/articles/effective-video-calls.html

News

Corona

HICnight: https://hairlessinthecloud.com

Alternativlos: https://alternativlos.org/45/

https://www.heise.de/security/meldung/Troy-Hunt-will-seinen-Pruefdienst-Have-I-Been-Pwned-nun-doch-behalten-4676778.html

Tweeter Fleets: https://www.heise.de/newsticker/meldung/Twitter-testet-selbstloeschende-Kurznachrichten-Fleets-4676631.html

Betriebsrat und MDATP: https://glueckkanja.com/blog/security/microsoft/gk/2020/03/mdatp/

MDATP for Linux: https://chrisonsecurity.net/2020/02/27/microsoft-defender-atp-for-linux/

NFL nutzt Teams: https://www.microsoft.com/en-us/microsoft-365/blog/2020/03/03/empowering-nfl-microsoft-surface-microsoft-teams/

Whats new in Teams (2020-02):      https://techcommunity.microsoft.com/t5/microsoft-teams-blog/what-s-new-in-microsoft-teams-february-2020/ba-p/1199785

MCAS

Discovery: Shadow IT

Connect via App Connect

Salesforce

Box

Dropbox

Gsuite

etc

Connect via MDATP Client

Investigate

Activity

Users & accounts

Oauth apps

MCAS: https://docs.microsoft.com/de-de/cloud-app-security/

Remote Work

https://www.hanselman.com/blog/LoveInATimeOfCoronaVirusTipsTricksAndBestPracticesForWorkingRemotely.aspx

Time zone Unterschiede

Video sollte man an machen

Blur your Background

Vielleicht nur am Anfang

Bandbreite

Nicht alle wollen/können

https://twitter.com/shanselman/status/1232747403133906944?s=20

Timing (call delay)

Laut sprechen wenn man im Raum mit mehreren Leute ist

Nutzt einfach in Teams die Test Call Funktion um euer Audio zu checken

MUTE!

Achtung: Teams Mute vs. Telefon mute

Vorbereiten

Rüstzeiten

PPTX, Browser, Login

Meeting aufzeichen

Verpasst

Abgelenkt

Nicht verstanden

Verzögerung in der Kommunikation

Chat ist nicht Telefonieren oder in Person

Kommunikation auch auf dem Handy dabei haben

Equipment

Headset ist super hilfreich

Achtet auch Echo

Kann euer Device von daheim arbeiten

Umgebung

Familie bescheid geben

Gesundes Essen

Geht auch mal raus

News

Neue Office App: https://www.mobiflip.de/shortnews/microsoft-office-app-android-ios/

MTP ist GA, iOS und Android bekommt Defender: https://www.microsoft.com/security/blog/2020/02/20/microsoft-threat-protection-intelligence-automation/

Gesichtsmaske mit deinem Gesicht: https://www.androidcentral.com/face-id-mask-lets-you-use-face-unlock-while-protecting-you-viruses

Security Roadshow: https://glueckkanja.com/de

Microsoft Teams wo wie wann: https://techcommunity.microsoft.com/t5/microsoft-teams-blog/microsoft-at-integrated-systems-europe-2020/ba-p/1177964

Tesla gibt Gas: https://www.heise.de/newsticker/meldung/Klebeband-verwirrt-autonome-Teslas-4665187.html

BOT

https://de.wikipedia.org/wiki/Bot

https://powerva.microsoft.com

https://azure.microsoft.com/en-us/services/bot-service

https://dev.botframework.com/

PIM

Edward Snowden

Just-in-time

Time-bound

Approval

Require mfa

Justification

Notifications

Access reviews

Audit history

Assignment

Role

Activiation Duration

Mfa / Approval /       Notification

Eligible / Permanent

Justification

Ticket-Number !!

Powershell Module

Access Review

Scheduled job that reviews       membership of all or certain roles

Reviewer kann dann       entscheiden, ob Leuten Permission weggenommen wird

           bzw. dies kann automatisch getan werden

Special Guest: Koby Koren (Senior PM Manager for Azure Sentinel at Microsoft)

https://twitter.com/KobyKoren

Azure Sentinel

https://azure.microsoft.com/en-us/services/azure-sentinel/

NEWS

HIC-NIGHT: https://hairlessinthecloud.com

Anti-Phishing Vorschlag: https://twitter.com/janvonkirchheim/status/1224014388652314624?s=20

Stephan Waelde blogged über AD Stuff: https://stephanwaelde.com/

John Lambert @ Darknet  Diaries: https://twitter.com/janvonkirchheim/status/1219649342551793664?s=20

Thomas Naunheim hat über App Consents geblogged:https://twitter.com/janvonkirchheim/status/1219635032517640193?s=20

Panos to rule them all: https://www.zdnet.com/article/microsoft-to-combine-its-windows-client-and-hardware-teams-under-chief-product-officer-panos-panay/

Jeff Teper bekommt Teams: https://mobile.twitter.com/jeffteper/status/1225266848586846209

App Launcher updates for      admins: https://techcommunity.microsoft.com/t5/office-365-blog/updates-to-office-com-and-the-office-365-app-launcher/ba-p/1150503

Yammer Native Mode: https://docs.microsoft.com/en-us/yammer/configure-your-yammer-network/overview-native-mode

Insider Risk

Insider Trading ist nicht      neu: kurz vor dem Wallstreet Crash 1929 hat Albert Wiggin,

Chef der Chase Bank 40k Aktien seiner Bank geshorted. Damals gabs noch kein Gesetz

gegen das shorting gegen die eigene Company und der Typ hat 4Mio$ verdient - die ihm allerdings

anschließend wieder abgenommen wurden. Aufgrund dieses Falles wurde dann ein paar Jahre später

ein entsprechendes Gesetz erlassen.

In den Folgejahren gab es      noch viele Beispiele wie dieses. Dabei ging es um Wissen darüber dass eine      Company

gekauft wird oder dass z.B. ein Medikament, an dem ein Pharmaunternehmen gearbeitet hat nicht genehmigt wurde. Mit diesen Informationen kann man natürlich schnell Geld verdienen.

Microsoft baut den Compliance      Bereich in Office 365 weiter aus

Insider Risk Management

Communication Compliance

departing employee data  theft & data leaks--> connect with HR

Sharepoint Sites hinzufügen

Sensitive info type 

Indicators

Office Templates

https://regarding365.com/how-to-create-an-organisation-assets-library-in-sharepoint-online-to-store-office-templates-b19e1a435191

Add-SPOOrgAssetsLibrary 

https://docs.microsoft.com/en-us/powershell/module/sharepoint-online/add-spoorgassetslibrary