Introduction:  

Have you ever found yourself in a situation where you wanted to prioritize the riskiest misconfigurations on cloud workloads across Azure, AWS, and GCP? Have you ever wondered how to implement a unified dashboard for cloud security posture across a multicloud environment?

This article covers how you can achieve these scenarios by using Defender Cloud Security Posture Management’s (CSPM) native support for resources inside Azure, and resources in AWS and/or GCP.  

For more information about Defender for Cloud’s multicloud support you can start at https://learn.microsoft.com/en-us/azure/defender-for-cloud/multicloud

To help you understand how to use Defender for Cloud to prioritize riskiest misconfigurations across your multicloud environment, all inside of a single dashboard, this article covers three topic in the following sequence:

Understanding the benefits of Defender CSPM for multicloud environments.
Implementing a unified security dashboard for cloud security posture.
Optimizing security response and compliance reporting.

Understand the benefits of Defender CSPM for multicloud environments: 

When it comes to the plethora of different cloud service at your disposal, certain resource types could be more at risk than others, depending on how they’re configured, whether they’re exploitable and/or exposed to the Internet. Besides virtual machines, storage accounts, Kubernetes clusters, and databases come to mind.

Imagine if you have a compute resource, like an EC2 instance that is public exposed, with vulnerabilities and can access other resources in your environment. When combined together, these misconfigurations can represent a serious security risk to your environment, because an attacker might potentially use them to compromise your environment and move laterally inside of it.

For organizations pursuing a multicloud strategy, risky misconfigurations can even span public cloud providers. Have you ever found yourself in a situation where you use compute resources in one public cloud provider and databases in another public cloud provider? If an organization is using more than one public cloud provider, this can represent risk of attackers potentially compromising resources inside of one environment, and using those resources to move to other public cloud environments.

Defender CSPM can help organizations close off potential entry points for attackers by helping them understand what misconfigurations in their environment they need to focus on first (figure 1), and by doing that, increase their overall security posture and minimize the risk of their environment getting compromised.  

Figure 1: Prioritizing misconfigurations in an environment

By knowing what they need to focus on first, organizations can remediate misconfigurations faster and essentially do more with less, saving the organization both time and resources. By identifying what are the organization’s critical assets and potential threats to those assets, organizations can allocate resources more effectively and prioritize remediation efforts for business critical resources. This helps them address vulnerabilities more quickly and reduces the overall risk to their organization.  

Implement a unified security dashboard for cloud security posture:

Organizations pursuing a multicloud strategy often find themselves in a situation where they need to operate more than one public cloud environment and manage it in ways that can differ across public cloud providers. This is applicable to security as well. Meaning you should take into consideration different security configurations for each resource type in each cloud provider that you’re using.

When you look at large environments, and especially for organizations pursuing a multicloud strategy, this can introduce security risks, particularly if there is lack of visibility across the entire environment and if security is managed in siloes. 

This is also where standardization of cloud security posture across a multicloud estate can help. You need to be able to speak the same language across different public cloud providers. For example, using international standards and best practices, which can be a relevant reference point for senior management. Another one are metrics or key performance indicators (KPIs). You must be able to measure progress and avoid confusion when reporting security statuses. Also, when reporting vulnerabilities to the senior management. One good approach here is to have a centralized CSPM solution (figure 2).

Figure 2: Centralized CSPM solution as part of CNAPP.

By having CSPM as part of a Cloud Native Application Protection Platform (CNAPP), it helps organizations break down security siloes and connect the dots between CSPM and other areas of CNAPP to help paint a fuller picture. 

Optimizing security response and compliance reporting:

Many security teams struggle with the sheer amount of security findings, and needing to prioritize is crucial for effectively minimizing risk in  an organization’s environment. Organizations which are not able to prioritize their remediation efforts I see spending a lot of time and resources, and not getting their desired return of investment (ROI).  

And ROI is important because it’s used to secure future budget allocations for cybersecurity initiatives. Therefore, it’s critical to have simple KPIs to showcase how efforts have prevented breaches, reduced downtime and minimized financial losses. Several organizations that I work with mentioned a real need for a simple KPI that will help them to break down complex security metrics into easy-to-understand KPI, both for the senior management and for the business owners. 

This way, management and business owners, who might not be experts in cybersecurity, can quickly understand why these efforts matter for protecting the business, why they need to prioritize the remediation process, and understand the importance of investing budget in this area.

Another struggle that I see is the need to detect the relevant owners in the organization, who own resources on which an issue or security risk is detected. Ensuring workload owners understand the remediation steps and address the issues quickly is another key point that organizations need to consider. Many organizations already have existing processes in place for this, be it change management or an ITSM, so having a way to integrate with existing business processes and ITSMs can help with this regard (figure 3).

Figure 3: Helping relevant owners understand the remediation steps.

Conclusion:  

This article provides food for thought when it comes to prioritizing riskiest misconfigurations across your multicloud environment, all inside of a single dashboard by using Defender CSPM.

Reviewers:   

Giulio Astori, Principal Product Manager, Microsoft 

​Microsoft Tech Community – Latest Blogs –Read More 

Is it possible to create a Windows Device Configuration Profile that will push a particular wallpaper to the device is the user’s Entra profile > Department value is “MHS”, for example? 

Currently, we are sending a District branded lock screen and desktop image based on the device name but are wondering if this can be even more dynamic based on the primary user’s Entra profile, instead?  We have different lock screens using this same logic for Staff, Student and Long-Term Subs.  

Thank you for considering!

​Is it possible to create a Windows Device Configuration Profile that will push a particular wallpaper to the device is the user’s Entra profile > Department value is “MHS”, for example?  Currently, we are sending a District branded lock screen and desktop image based on the device name but are wondering if this can be even more dynamic based on the primary user’s Entra profile, instead?  We have different lock screens using this same logic for Staff, Student and Long-Term Subs.   Thank you for considering!   Read More

​

Initiating the Minimum Viable Product Phase:

​Microsoft Tech Community – Latest Blogs –Read More 

Cybersecurity has become a critical concern for businesses of all sizes, 82% of ransomware attacks are targeted at small and medium-sized businesses [1]. In today’s digital landscape, businesses face an array of security threats that can compromise sensitive data, disrupt operations, and diminish customer trust. Small businesses seek effective, scalable, and user-friendly solutions to operate securely. Microsoft 365 for Business offers a suite of solutions tailored to meet productivity and security needs, with three distinct plans – Microsoft 365 Business Basic, Microsoft 365 Business Standard, and Microsoft 365 Business Premium.

Business Basic includes key Microsoft cloud services like Microsoft Teams and Microsoft SharePoint, apps like Microsoft Word and Microsoft Excel, and foundational identity, email, and mobile device security that’s essential for protecting your business. Business Standard includes everything in Business Basic plus desktop apps like Microsoft Loop and Microsoft Clipchamp. Business Premium takes security to the next level, offering extensive protection that includes everything in Business Standard, plus comprehensive cybersecurity features from Microsoft Intune, Microsoft Purview, Microsoft Entra ID, Azure Virtual Desktop, and Microsoft Defender. With Business Premium, users benefit from layered protection for devices, email, and collaboration content, as well as data encryption, sensitivity labels, and Data Loss Prevention (DLP) capabilities.

By choosing Microsoft 365 for Business, you can leverage security solutions that are not only effective, but also scalable and user-friendly, allowing you to manage your business with confidence. In this blog, we’ll discuss four ways Microsoft 365 for Business can enhance your company’s security.

Four ways Microsoft 365 for Business helps secure your business

Enable your employees to access business data and applications with identity and access management

Your online security and privacy depend on using strong, unique passwords for each of your accounts. However, passwords alone are prone to loss or theft, which cybercriminals can use to access your data. To enhance your protection, additional identity and access controls are necessary.

Both Business Basic and Business Standard plans include Microsoft Entra ID Free, enabling you to set up multi-factor authentication (MFA) for your Microsoft accounts and apps. Beyond entering your password, you can use your phone, email, or an app to receive a code or approve a sign-in request. This extra layer of security can block over 99.9% of account compromise attempts [2].

Business Premium takes identity and access controls to the next level by incorporating Microsoft Entra ID P1, offering enhanced identity protection through conditional access policies. These policies grant or block access based on user identity, location, and sign-in methods, ensuring business data remains secure by permitting access only under specific criteria. For example, if cybercriminals from overseas attempt to breach your company’s data by stealing passwords, conditional access policies in Microsoft Entra ID P1 with Microsoft 365 Business Premium can automatically block or require additional verification via multifactor authentication (MFA) for login attempts from countries where your business doesn’t operate. This helps ensure that only authorized personnel can access your data, no matter where or when they log in, providing robust protection against unauthorized access. 

Keep your business data safe and secure when collaborating

Working in a hybrid environment presents challenges in communication and collaboration with teams, customers, and partners while protecting your business data. With Business Basic and Business Standard, you can utilize SharePoint to manage file access and Microsoft Teams for secure collaboration within your organization. For customers deploying Copilot for Microsoft 365, who want to prevent oversharing or surfacing sensitive files, Restricted SharePoint Search helps ensure that only content from reviewed and governed sites appears in search results, providing a secure and controlled generative AI experience. Both plans also include audit capabilities, allowing you to track and review user activities, access, and changes to documents, which help to maintain security and compliance. 

Business Premium extends the capabilities in Business Basic and Business Standard with additional Microsoft Purview functions, allowing you to label and protect sensitive files and emails, including those used or generated by Copilot for Microsoft 365. For example, imagine you own a retail shop that collects and stores confidential information, like credit card numbers, in an Excel file for future use. This file might be protected by a password, but it’s frequently shared via email for company use, which means anyone could download the document and save their own copy. With Business Premium, you get advanced capabilities like Data Loss Prevention (DLP) and Microsoft Purview Information Protection, to help classify and protect sensitive data like customer or employee information, confidential business data, social security numbers, credit card numbers and more. By applying the appropriate label and protection policies such as encrypt or do not forward, you can help ensure sensitive information is secured to protect your data wherever it goes.

Manage your devices to keep them compliant and secure

Device management helps ensure that your devices remain secure, up-to-date, and compliant with your organizational policies, to prevent unauthorized access, security breaches, data loss, and other incidents that could harm your business. Business Basic and Business Standard include Basic Mobility and Security, allowing you to apply essential security policies and access rules to your mobile devices. For example, you can require a PIN or password for device access or remotely wipe a device if it’s lost or stolen.

Business Premium takes this a step further with Microsoft Intune P1, offering advanced tools to manage Microsoft 365 resources on both personal and company-owned devices. For instance, you can deploy and protect applications across various devices and platforms, enforce compliance policies to ensure devices meet security standards, restrict data sharing to prevent leaks, configure device settings to maintain consistency, and monitor device health and status to proactively address potential issues. For example, Intune App Protection Policies can help to separate work apps from personal apps, so work documents and files are only saved in authorized and secure folders, like OneDrive for Business, to protect sensitive information.

Defend your business against cyberthreats like phishing and ransomware

Cybercriminals are constantly seeking ways to deceive you into giving up your information or infecting your systems with malicious software. One of their most common methods is phishing, where they impersonate a trusted entity and send you an email or message with a link or attachment that leads to a fake website or downloads malware onto your device. Phishing is pervasive and effective; the frequency of business email compromise (BEC) attacks has skyrocketed to over 156,000 daily attempts. Microsoft data shows attempted password attacks increased more than tenfold in 2023, from around 3 billion per month to over 30 billion [3]. These attacks can lead to identity theft, data breaches, ransomware, and other serious consequences. 

Microsoft 365 for Business offers security solutions to protect against growing threats. Business Basic and Business Standard include Exchange Online Protection (EOP), a cloud-based service that filters out spam, malware, phishing, and other email threats before they reach your inbox. Business Premium offers enhanced protection with Microsoft Defender for Office 365 P1, which extends security features to Microsoft Outlook, Microsoft Teams, Microsoft OneDrive, and Microsoft SharePoint. It includes layered protection with Safe Links and Safe Attachments. Safe Links check the links in your emails and messages in real-time, blocking access to malicious or compromised websites. Safe Attachments scans your attachments for malware, removing or replacing unsafe files.

 Business Premium also includes sophisticated ransomware protection with Microsoft Defender for Business, that helps secure devices across Windows, iOS, Android, Linux and Mac from a single solution. It offers AI-powered endpoint detection and response (EDR) capabilities, including Automatic attack disruption, an industry-first capability that correlates millions of individual signals to identify active ransomware or other sophisticated attacks with high confidence. It then disrupts the attack in real-time by automatically containing compromised assets the attacker has access to and stops them from going any further in your environment. This game-changing capability limits a threat actor’s progress early on and dramatically reduces the overall impact of an attack, from associated costs to loss of productivity. Automatic attack disruption is on by default so you can focus on what really matters – your business. This proactive approach ensures your devices are not only protected from known threats but are also resilient against emerging cyber threats, significantly reducing the risk of data breaches and security incidents.

Don’t wait to protect your business

Cyberattacks are becoming increasingly sophisticated and causing bigger impacts to small and medium-sized businesses. Microsoft 365 for Business offers productivity and security solutions tailored to meet your business’ specific security needs, helping you run your operations securely and efficiently.

Partners tools to manage Microsoft 365 business customers with Microsoft 365 Lighthouse

Partners play an important role in helping small and medium-sized businesses stay secure. Recognizing this, we built Microsoft 365 Lighthouse, a unified portal for managed service provider (MSP) partners that helps you manage Microsoft 365 business accounts across multiple clients from a single pane of glass. This tool allows partners to streamline security management, monitor compliance, and respond to threats efficiently – helping ensure that all managed businesses maintain robust security standards.

Learn more to help secure your business

Customer resources:

Check out the infographic to see how the Microsoft 365 for Business plans compare: aka.ms/SMB-infographic 
Compare all Microsoft 365 plans 
Explore how Microsoft Security for Business can help (SMB security page)
Learn about Microsoft 365 for Business Security best practices: https://aka.ms/SMB-best-practices

Partner resources:

Get the Business Premium partner playbook: aka.ms/M365BPPartnerPlaybook
Discover how to grow your business at scale with Microsoft 365 Lighthouse: aka.ms/M365Lighthouse

References:

[1] The devastating impact of ransomware attacks on small businesses, University of Maryland Law, April 2023 

[2] https://www.microsoft.com/security/blog/2019/08/20/one-simple-action-you-can-take-to-prevent-99-9-percent-of-account-attacks/ based on MSFT internal study

[3] Microsoft Digital Defense Report 2023 (MDDR)

​Microsoft Tech Community – Latest Blogs –Read More