In a previous article, I discussed initial user compromise with cookie hijacking and the subsequent attacks we could see after. This week, I wanted to zoom in on persistence techniques and talk about the common methods we see in Microsoft 365 today. I also pair these with recommended security baselines (mapped to the CIS Controls) […]
In previous articles, I’ve talked about how Passkeys are one of the strongest forms of MFA that you could roll out in an organization given that they are considered phishing resistant and can protect us against threats like a man in the middle attack. It’s unlikely that many of us have reached a maturity level […]
In this guide, we’ll explore how you can leverage Azure Key Vault to securely manage secrets in your single-tenant or multi-tenant PowerShell scripts. This will enable you to securely access authentication tokens and other sensitive information needed to interact with downstream customer environments. Let’s dive in! Understanding the Secure Application Model Many of us are […]
Below are all of the latest feature updates coming to Microsoft 365 Editable Versions available If you would like editable versions of this documentation so that you can white-label it and send to end users, there is a monthly subscription you can sign up for to obtain this content as well as in depth guides […]
MFA methods have evolved greatly over the years to accommodate shifts in the attack surface as well as new attack methods. In this article, I wanted to cover the evolution of MFA and highlight how different types of MFA can still leave your users exposed. This includes common attack methods and how to overcome them […]
As a general principle, you should always try to institute a strict policy of requiring managed devices to access corporate resources across your customers. You would think selling a customer on this wouldn’t be hard given the security considerations, but the reality is that we will always have customers that will get upset if you […]
Checklist do not equal compliance One of the major gaps I hear when talking to MSPs about security and compliance is a lack of understanding the “why” behind the security checklist being instituted in client environments. Many of us out there follow some checklist, especially for Microsoft 365, that we try to implement in our […]
Below are all of the latest feature updates coming to Microsoft 365 Editable Versions available If you would like editable versions of this documentation so that you can white-label it and send to end users, there is a monthly subscription you can sign up for to obtain this content as well as in depth guides […]
In April 2024, Microsoft announced it was looking to standardize its licensing model for Teams to align with the changes made in October 2023 for the European Economic Area (EEA) and Switzerland. Effectively the European commission was accusing Microsoft of monopoly like practices by not allowing users to have a price break if they wanted […]
For most of us out there, conditional access is something we still either struggle with or have extreme inconsistencies when it comes to implementing policies across our customer environments. I would say that most environments still have some pretty significant security holes given misconfiguration of policies or a lack of understanding in the scope of […]
Checklist do not equal compliance One of the major gaps I hear when talking to MSPs about security and compliance is a lack of understanding the “why” behind the security checklist being instituted in client environments. Many of us out there follow some checklist, especially for Microsoft 365, that we try to implement in our […]
Below are all of the latest feature updates coming to Microsoft 365 Editable Versions available If you would like editable versions of this documentation so that you can white-label it and send to end users, there is a monthly subscription you can sign up for to obtain this content as well as in depth guides […]
