If you own a computer, watch the news, or spend virtually any time
online these days you have probably heard the term “phishing.” Never in a
positive context…and possibly because you have been a victim yourself.
Phishing refers to a variety of attacks that are intended to convince
you to forfeit sensitive data to an imposter. These attacks can take a number of
different forms; from spear-phishing (which targets a specific individual within
an organization), to whaling (which goes one step further and targets senior
executives or leaders). Furthermore, phishing attacks take place over multiple
channels or even across channels; from the more traditional email-based attacks
to those using voice – vishing – to those coming via text message – smishing.
Regardless of the type or channel, the intent of the attack is the same – to
exploit human nature to gain control of sensitive information (citation
1). These attacks typically make use of several techniques including
impersonated websites, attacker-in-the-middle, and relay or replay to achieve
their desired outcome.
The Microsoft 365 cloud environment benefits from an extensive monitoring and security infrastructure. Using machine learning and human intelligence that looks across worldwide traffic can rapidly detect attacks and allow you to reconfigure almost in real time. None of the following scenarios apply to my org, and I’m ready to move forward with my migration.
For all types of migrations, the following AD FS scenarios can’t be migrated to Azure AD.
Custom attribute store to retrieve additional claims from LDAP and SQL
Non-Microsoft MFA provider integrated with AD FS
Non-Microsoft Mobile Device Management (MDM) integrated with AD FS
Non-persistent virtual desktop infrastructure (VDI) with Windows 11
Windows Hello for Business in certificate authentication mode
Azure AD Cloud Sync with hybrid Azure AD join
Dual-federation (for example, Azure commercial and Azure China 21Vianet)
Sign-in with SamAccountName or EmployeeID
For staged rollouts (migrating a small group), the following configurations are unsupported.
Legacy authentication, such as POP3 and SMTP
Nested groups, dynamic groups, and groups that contain contact objects
If your application includes the “domain_hint” attribute
Windows 10 version 1903 or older for both hybrid Azure AD join or Azure AD join if user has a non-routable UPN
What to expect
To get custom guidance for migrating to Azure AD, you’ll first answer a few questions about your Active Directory Federation Services (AD FS) infrastructure. Then implement either pass-through authentication (PTA) or password hash sync (PHS) to give users a streamlined experience while accessing your org’s apps
he Identity workshop for Developers, you will create an opportunity to upskill & upgrade to secure and contemporary practices while developing, integrating, migrating, and managing apps on the Microsoft Identity Platform. The workshop is designed to be hands-on, which will not only enable you to learn and practice the latest but also earn Badges. We look forward to your participation in the Identity workshop for Developers for an engaged and immersive learning experience. You have 3 opportunities to register for the workshop.
When: Tuesday – Thursday, February 14 to 16, 2023 Time: 9AM UTC to 12 PM UTC (EMEA/IST) Where:Microsoft Teams Meeting When: Tuesday – Thursday, March 14-16, 2023 Time:9:00 AM – 12:00 PM (Pacific Time) Where:Microsoft Teams Meeting Modules for the workshop:
STPPA: In the “Special Topics on Privacy and Public
Auditability” series, the NIST privacy-enhancing cryptography (PEC)
project, in the cryptographic technology group,
hosts talks on various interconnected topics related to privacy and public
auditability. The goal is to convey basic technical background, incite
curiosity, suggest research questions and discuss applications, with an
emphasis on the role of cryptographic tools.
Ransomware is a type of malicious attack where attackers encrypt an
organization’s data and demand payment to restore access. Attackers may
also steal an organization’s information and demand an additional
payment in return for not disclosing the information to authorities,
competitors, or the public. This Ransomware Profile identifies the
Cybersecurity Framework Version 1.1 security objectives that support
identifying, protecting against, detecting, responding to, and
recovering from ransomware events. The profile can be used as a guide to
managing the risk of ransomware events. That includes helping to gauge
an organization’s level of readiness to counter ransomware threats and
to deal with the potential consequences of events.
NIST today released its Artificial
Intelligence Risk Management Framework (AI RMF 1.0),
a guidance document for voluntary use by organizations designing, developing,
deploying or using AI systems to help manage the risks of AI technologies. The
Framework seeks to cultivate trust in AI technologies and promote AI innovation
while mitigating risk. The AI RMF follows a direction from
Congress for NIST to develop the framework and was produced in
close collaboration with the private and public sectors over the past 18
months.
AI RMF 1.0 was released at a livestreamed event today with Deputy
Secretary of Commerce Don Graves, Under Secretary for Technology and Standards
and NIST Director Laurie Locascio, Principal Deputy Director for Science and
Society in the White House Office of Science and Technology Policy Alondra Nelson,
House Science, Space, and Technology Chairman Frank Lucas and Ranking Member
Zoe Lofgren, and panelists representing businesses and civil society. A
recording of the event is available here.
NIST also today released, for public comment, a companion
voluntary AI RMF Playbook,
which suggests ways to navigate and use the framework, a Roadmap for future work to enhance the Framework and its
use, and the first two AI RMF 1.0 crosswalks with key AI standards and US and EU
documents.
NIST plans to work with the AI community to update the framework
periodically and welcomes suggestions for additions and improvements to the
Playbook at any time. Comments received through February 2023 will be
included in an updated version of the Playbook to be released in spring 2023.
The report specifies the various categories, subcategories, and
requirements for a successful submission, including security characterization,
technical description, open-source implementation, and performance evaluation.
The process intends to help the NIST cryptographic technology group collect
reference material to promote a public analysis of the viability of threshold
schemes and related primitives. This will support the NIST multi-party
threshold cryptography and privacy-enhancing cryptography projects in
developing future recommendations.
Threshold schemes should NOT be submitted until the final version
of this report is published. However, using the present draft as a baseline,
potential submitters are encouraged to prepare early for future submissions.
The public comment period is open through April 10, 2023. See
the publication
details for a copy of the initial public draft and instructions for
submitting comments.
Here is a list of the new state data privacy statutes slated to come online in 2023:
(1) Most of the provisions of the California Privacy Rights Act (CPRA) become effective on Jan. 1, 2023. CPRA amended the California Consumer Privacy Act (CCPA), which had already created a number of individual rights modeled after the GDPR. CPRA created a new state agency, similar to data protection agencies in the EU countries charged with enforcing the GDPR.
(2) The Colorado Privacy Act (CPA) becomes effective on July 1, 2023. In addition to creating rights patterned after the individual rights under GDPR, CPA requires data security and contract provisions for vendors and assessments for “high-risk” processing.
(3) The Connecticut Data Privacy Act (CDPA), like Colorado’s new privacy law, goes into effect on July 1, 2023. CDPA likewise creates a suite of GDPR-like individual rights, and requires data minimization, security, and assessments for “high risk” processing.
(4) The Utah Consumer Privacy Act (UCPA) becomes effective on Dec. 31, 2023. It provides for certain GDPR-like individual rights, and also requires data security and contract provisions. But UCPA does not include expressly required risk assessments.
(5) The Virginia Consumer Data Privacy Act (VCDPA) becomes effective Jan. 1, 2023. It provides for certain GDPR-like individual rights. But in 2022, the “right-to-delete” was replaced with a right to opt out from certain processing.
With the growing adoption and support of IPv6 across enterprise networks, service providers, and devices, many customers are wondering if their users can continue to access their services and applications from IPv6 clients and IPv6 networks.
Today, we’re excited to announce our plan to bring IPv6 support to Microsoft Azure Active Directory (Azure AD). This will allow customers to reach the Azure AD services over IPv4, IPv6 or dual stack endpoints.
For most customers, IPv4 won’t completely disappear from their digital landscape, so we aren’t planning to require IPv6 or to de-prioritize IPv4 in any Azure AD features or services. However, it is important you start planning and prepare for IPv6 support by taking the actions recommended in this blog, and also checking in for updated guidance at https://aka.ms/azureadipv6.
We’ll begin introducing IPv6 support into Azure AD services in a phased approach, starting March 31st, 2023.
We have guidance below which is specifically for Azure AD customers who use IPv6 addresses and also use Named Locations in their Conditional Access policies.
Customers who use named locations to identify specific network boundaries in their organization need to:
Conduct an audit of existing named locations to anticipate potential impact;
Work with your network partner to identify egress IPv6 addresses in use in your environment;
Review and update existing named locations to include the identified IPv6 ranges.
We created an easy to remember link where we’ll continue to share additional guidance on IPv6 enablement in Azure AD. Access these details here: https://aka.ms/azureadipv6.
Learn more about Microsoft identity:
Get to know Microsoft Entra – a comprehensive identity and access product family
I been telling people if you are going to use a password manager understand the settings and configuration issues. This is true of all software.
I have said over and over again.
Use on each site different, a strong password and change them regularly. and go to multi-factor solutions.
I found a great article on a site I review from time to time. Here is the article to look at:
LastPass has been breached: What now?
If you have a LastPass account you should have received an email updating you on the state of affairs concerning a recent LastPass breach. While this email and thecorresponding blog posttry to appear transparent, they don’t give you a full picture. In particular, they are rather misleading concerning a very important question: should you change all your passwords now?
