Windows 10: Analysis Report (AR19-133A) Microsoft Office 365 Security Observations

Brink · May 14, 2019

Summary

As the number of organizations migrating email services to Microsoft Office 365 (O365) and other cloud services increases, the use of third-party companies that move organizations to the cloud is also increasing. Organizations and their third-party partners need to be aware of the risks involved in transitioning to O365 and other cloud services.

This Analysis Report provides information on these risks as well as on cloud services configuration vulnerabilities; this report also includes recommendations for mitigating these risks and vulnerabilities.

Description

Since October 2018, the Cybersecurity and Infrastructure Security Agency (CISA) has conducted several engagements with customers who have used third-party partners to migrate their email services to O365.

The organizations that used a third party have had a mix of configurations that lowered their overall security posture (e.g., mailbox auditing disabled, unified audit log disabled, multi-factor authentication disabled on admin accounts). In addition, the majority of these organizations did not have a dedicated IT security team to focus on their security in the cloud. These security oversights have led to user and mailbox compromises and vulnerabilities.

Technical Details

The following list contains examples of configuration vulnerabilities:

Multi-factor authentication for administrator accounts not enabled by default: Azure Active Directory (AD) Global Administrators in an O365 environment have the highest level of administrator privileges at the tenant level. This is equivalent to the Domain Administrator in an on-premises AD environment. The Azure AD Global Administrator accounts are the first accounts created so that administrators can begin configuring their tenant and eventually migrate their users. Multi-factor authentication (MFA) is not enabled by default for these accounts.[1] There is a default Conditional Access policy available to customers, but the Global Administrator must explicitly enable this policy in order to enable MFA for these accounts. These accounts are exposed to internet access because they are based in the cloud. If not immediately secured, these cloud-based accounts could allow an attacker to maintain persistence as a customer migrates users to O365.

Mailbox auditing disabled: O365 mailbox auditing logs actions that mailbox owners, delegates, and administrators perform. Microsoft did not enable auditing by default in O365 prior to January 2019. Customers who procured their O365 environment before 2019 had to explicitly enable mailbox auditing.[2] Additionally, the O365 environment does not currently enable the unified audit log by default. The unified audit log contains events from Exchange Online, SharePoint Online, OneDrive, Azure AD, Microsoft Teams, PowerBI, and other O365 services.[3] An administrator must enable the unified audit log in the Security and Compliance Center before queries can be run.

Password sync enabled: Azure AD Connect integrates on-premises environments with Azure AD when customers migrate to O365.[4] This technology provides the capability to create Azure AD identities from on-premises AD identities or to match previously created Azure AD identities with on-premises AD identities. The on-premises identities become the authoritative identities in the cloud. In order to match identities, the AD identity needs to match certain attributes. If matched, the Azure AD identity is flagged as on-premises managed. Therefore, it is possible to create an AD identity that matches an administrator in Azure AD and create an account on-premises with the same username. One of the authentication options for Azure AD is “Password Sync.” If this option is enabled, the password from on-premises overwrites the password in Azure AD. In this particular situation, if the on-premises AD identity is compromised, then an attacker could move laterally to the cloud when the sync occurs. Note: Microsoft has disabled the capability to match certain administrator accounts as of October 2018. However, organizations may have performed administrator account matching prior to Microsoft disabling this function, thereby synching identities that may be have been compromised prior to migration. Additionally, regular user accounts are not protected by this capability being disabled.

Authentication unsupported by legacy protocols: Azure AD is the authentication method that O365 uses to authenticate with Exchange Online, which provides email services. There are a number of protocols associated with Exchange Online authentication that do not support modern authentication methods with MFA features. These protocols include Post Office Protocol (POP3), Internet Message Access Protocol (IMAP), and Simple Mail Transport Protocol (SMTP). Legacy protocols are used with older email clients, which do not support modern authentication. Legacy protocols can be disabled at the tenant level or at the user level. However, should an organization require older email clients as a business necessity, these protocols will not be disabled. This leaves email accounts exposed to the internet with only the username and password as the primary authentication method. One approach mitigate this issue is to inventory users who still require the use of a legacy email client and legacy email protocols. Using Azure AD Conditional Access policies can help reduce the number of users who have the ability to use legacy protocol authentication methods. Taking this step will greatly reduce the attack surface for organizations.[5]

Solution

CISA encourages organizations to implement an organizational cloud strategy to protect their infrastructure assets through defending against attacks related to their O365 transition, and securing their O365 service.[6] Specifically, CISA recommends that administrators implement the following mitigations and best practices:

Use multi-factor authentication. This is the best mitigation technique to use to protect against credential theft for O365 users.

Enable unified audit logging in the Security and Compliance Center.

Enable mailbox auditing for each user.

Ensure Azure AD password sync is planned for and configured correctly, prior to migrating users.

Disable legacy email protocols, if not required, or limit their use to specific users.

References

[1] Azure AD baseline protection

[2] Mailbox auditing enabled by default

[3] Unified audit log

[4] Soft matching administrator accounts

[5] Block Office 365 Legacy Email Authentication Protocols

[6] Microsoft security best practices for Office 365

Revisions

May 13, 2019: Initial version

Click to expand...

Source: https://www.us-cert.gov/ncas/analysis-reports/AR19-133A

:)

freebird_9924 · May 14, 2019

office 365 vs office 2013

my Microsoft surface came with 1 month trial of ms office 365 , now it's expired.now I wanna know if I she subscribe to office 365 or uninstall it & install office 2013. what's the difference between both?

Cristian_25H · May 14, 2019

Microsoft Releases Office 365 Home Premium

Microsoft Corp. today announced worldwide availability of Office 365 Home Premium, a reinvention of the company's flagship Office product line for consumers. Office 365 Home Premium is a cloud service designed for busy households and people juggling ever-increasing work and family responsibilities.

The new offering includes the latest and most complete set of Office applications; works across up to five devices, including Windows tablets, PCs and Macs; and comes with extra SkyDrive storage and Skype calling -- all for US$99.99 for an annual subscription, the equivalent of US$8.34 per month.

"Today's launch of Office 365 Home Premium marks the next big step in Microsoft's transformation to a devices and services business," said Steve Ballmer, CEO of Microsoft. "This is so much more than just another release of Office. This is Office reinvented as a consumer cloud service with all the full-featured Office applications people know and love, together with impressive new cloud and social benefits."

Microsoft also announced it will now deliver many new features and services to the cloud first, transforming the company's traditional three-year release cycle. Now, new features and services stream to subscribers as soon as they are ready, keeping subscribers always up to date while eliminating the hassles of upgrading.

"This is a major leap forward," said Kurt DelBene , president of the Microsoft Office Division. "People's needs change rapidly, and Office 365 Home Premium will change with them."

Simultaneously, Microsoft today released Office 365 University for college or university students, faculty and staff at a price of just US$79.99 for a four-year subscription -- the equivalent of US$1.67 per month. Globally, the company also released updated versions of the traditional Office suite: Office Home and Student 2013, Office Home and Business 2013 and Office Professional 2013. Office 365 for businesses will be released globally with new capabilities on Feb. 27.

Time to Do the Things You Want
In a recent global survey, nearly 60 percent of people said they don't have the time to do the things they want to do, and more than 80 percent said they could save one or more hours a day if they were better organized. Office 365 Home Premium is designed to help people be more productive from virtually anywhere and find the flexibility to do the things they want.

"Between kids and career, I'm never completely at home or completely at work -- and thanks to technology, that suits me just fine," said Jen Singer , an author, blogger and mom of two teen boys. "With Office 365 Home Premium, I can work around my kids' schedules, so I can drive the soccer carpool, coordinate errands while at a doctor's office and still hit my deadlines at work. And, with one subscription for everyone in my family, it's an absolute steal."

To help people find more time to do the things they want, Microsoft is introducing Time to 365 (http://www.office.com/timeto365), a new crowd-sourced website where people can find and share tips, tricks, ideas and inspiration from around the world. Contributors include experts such as "techorating" pro Janna Robinson (http://www.jannarobinson.com) and everyday working parents who have found ways to simplify their lives. Tips on the site include, for example, an idea for organizing your grocery list with OneNote on your phone, a pointer on how to pick the right-sized TV for your living room, and ways to use Office applications to help plan a child's birthday party.

About Office 365 Home Premium
Office 365 Home Premium is available in 162 markets in 21 languages and includes the following:

● The latest and most complete set of Office applications: Word, Excel, PowerPoint, OneNote, Outlook, Publisher and Access
● One license for the entire household to use Office on up to five devices, including Windows tablets, PCs or Macs, and Office on Demand available from any Internet-connected PC
● An additional 20 GB of SkyDrive cloud storage, nearly three times the amount available with a free SkyDrive account
● 60 free Skype world calling minutes per month to call mobile phones, landlines or PCs around the world
● Future upgrades, so you always use the latest time-saving technology

People can learn more about Office 365 Home Premium or try it free for 30 days at http://www.office.com.

Douglas Clelland · May 14, 2019

Cortana & Office 365 Integration

We are trying to integrate Cortana with our Office 365 subscription, but it never works. Here are the steps we have done:

Turned on Cortona in the Office 365 Admin portal

We are using Windows 10 1703 – connected Office 365 service to Cortana

Did the same on windows 10 mobile with no luck, Cortana says its connected to Office 365, but sees no data and we are getting zero errors

We went rough office 365 support first and tried all fo their suggestions, they kicked us over to Windows support which is currently closed.

We are on v1703 with all updates in place, it does not work on Windows 10 desktop or mobile

any ideas? I can give you all steps 365 support had us run through if that will be helpful

Thank you

Doug

Windows 10: Analysis Report (AR19-133A) Microsoft Office 365 Security Observations

Analysis Report (AR19-133A) Microsoft Office 365 Security Observations

Analysis Report (AR19-133A) Microsoft Office 365 Security Observations

Analysis Report (AR19-133A) Microsoft Office 365 Security Observations

Analysis Report (AR19-133A) Microsoft Office 365 Security Observations - Similar Threads - Analysis Report AR19

DebugDiag Analysis report

DebugDiag Analysis report

DebugDiag Analysis report

Microsoft office 365

Microsoft Office 365

Analysis Toolpack in Office 365

Microsoft Office 365

Microsoft office 365

Microsoft Virtual Academy courses: Office 365 security

Users found this page by searching for:

Microsoft Office 365 Security Observations

overview of CISA AR19-133A

CISA AR19-133A