Security Confidential S3 E9 Chris Auger

Tyler Smith: Hello everyone, thank you for joining us. I am joined today by Chris Auger from InfoSight. I am Tyler Smith from Dark Rhino Security. We’re going to be talking about Microsoft 365 security and compliance and how we can make that easier for you. Chris, thanks for joining me today.

Chris Auger: Thanks for having me. I’m really looking forward to having this discussion.

Tyler Smith: Awesome, awesome. We will have some time towards the end of the webinar to ask questions, so if everybody can just hold your questions until the end. I’m trying to keep an eye on the chat, so if there are any problems, please go ahead and raise them in there. Without further ado, let’s go ahead and get started. So, a little bit about Dark Rhino Security. We were founded in 2017. We try to provide security services for organizations of all sizes, and we believe that access to security should be affordable for everybody. That’s one of the things that we’ve done: we’ve tried to leverage security services or technologies and wrap services around those technologies to make them accessible for everybody. That’s just a little bit about Dark Rhino. Chris, if you want to do the intro for InfoSight?

Chris Auger: Yeah, so InfoSight was founded by a couple of folks from the Air Force; they ran the Air Force CERT. Basically, they got very frustrated because they were dropped into unknown environments and their job was to determine if any bad actors were rooting around in very complex networks. When they got out of the service, they founded InfoSight to really solve the problems that they were endlessly faced with in the service, specifically around threat hunting, advances in incident response support, and things of that nature. Over time, over the last five years, we’ve evolved, and most recently we are really focusing on Microsoft 365 security compliance and controls. Through our partners like Dark Rhino, we’re solving one of the biggest challenges out there, which is: how do you actually know if your environment is set up properly, and how do you track for configuration drift over time? We will talk more about that shortly.

Tyler Smith: Yep, thanks for giving us that introduction. One of the things that’s become obvious over the last few years is this huge shift to cloud services. A big part of that has been trying to get a handle on what that means for an organization, because while it comes with certain benefits operationally, it also comes with certain risks. Understanding those problems and where they arise is really important. While Microsoft takes care of most of its security needs as far as being able to provide the service, it doesn’t really do a lot for you. Security configuration of Microsoft 365 is something that they leave up to the end users and user organizations. So, that’s one problem. Another problem is the native alerts that come along with the compliance piece are not user-friendly. When it comes to determining if you are out of compliance, setting that up and maintaining it is very difficult to do. Then the last part of it is really monitoring that and keeping your finger on that pulse; it is a challenge in and of itself. Chris, do you want to chime in?

Chris Auger: Yeah, I mean, the reality is Microsoft as a platform has incredible capabilities to be exceptionally secure, but like most Microsoft products, they default to the settings that make it easier to migrate to and easiest to use to eliminate support calls or challenges. It’s not the most secure or the properly secured environment, so that setup is rarely done appropriately. Even with MSPs or MSSPs that we’ve been working with over the past several months as we’ve been launching this platform, the vast majority are actually getting abysmal results. And of the end users that we’re working on, it’s actually even worse than that. If you layer on top of that, for example, the latest SolarWinds breach or what’s going on right now with HAFNIUM, people may have set it up properly to begin with, but the challenge is even though you set it up properly, like in the example of SolarWinds, if a bad actor gets elevated credentials, they use those credentials to swim upstream and change your configuration to allow them to inflict damage. So, it’s one of those things where a lot of the compromises that we’re seeing right now occur when an organization gets compromised, but they’re not inflicting damage on the assets they compromise. Rather, they’re using the credentials to swim upstream and manipulate and cause damage in the cloud environment. So, that’s really why “set it and forget it” is not the right answer. You need to not only set it, but set it and check it. After you check it, you need to monitor it or repeatedly check it on a very frequent basis to ensure that you’re not getting configuration drift. In an ideal world, you’re actually doing real-time monitoring of it. So, if a bad actor does get into your network and does get access to your cloud configuration, we will alert on that immediately when they change something. Maybe it’s out-of-domain forwarding; maybe a new admin was added without multi-factor. This gives us the ability to alert you. Our Dark Rhino service can monitor this continuously and alert you in the event someone made a change that made you less secure.

Tyler Smith: And that’s what you were seeing, like you said. What we were seeing with the SolarWinds investigations and looking at that is the bad actors were using the ability to reconfigure the server settings or the allowances for out-of-domain forwarding, so they could basically put themselves in the middle of all email communications. And that’s kind of the next part. So, if you want to walk us through this, Chris?

Chris Auger: Yeah, so if you look at the anatomy of an attack and how organizations get massively impacted by compromises, the first part of the attack is that bad actors use very sophisticated methods to phish. You’re not getting an email from some random prince in Nigeria anymore; now you’re actually getting an email from your boss, or from a friend, or they’re looking at your Facebook page or connecting through you some way. You’re getting a picture or something from someone you know, often about something you did. That spear-phishing is incredibly targeted, and they’re getting really, really good at it. It’s not some random thing; rather, you’re now getting an advanced attack in which someone sends you a file that looks like it’s from a funny friend of yours saying, “Hey, this is another picture about what we did last weekend,” that they derived from your Facebook page, your Twitter feed, or your Instagram post. You have no reason to doubt that. You open it, and now you’re on the hook. What they’ll often do is deploy a password logger or do something behind the scenes to scrape your credentials. They’ll get into your environment; that will now breach your account. Now they have access to your credentials. Now they’re incredibly dangerous unless you have the ability to track and monitor that. Dark Rhino will talk about their other services that they do with Okta a little bit, but unless you have sophisticated ways to track identity, now you have somebody else logging in from somewhere else that can do significant damage. From there, now that they have this authentication, they have the keys to the kingdom. Once they have the keys, just think of what an administrator of your Microsoft 365 environment has the power to do. A very scary way to think about it is that administrators have the ability to backup and restore. Guess what? A backup is effectively copying all your confidential information to another location, and then they can access that and do real damage to your overall company or to really whatever they want to do. Through that, they can also deploy other things into your environment. They can put out GPO objects or other things to deploy software in your environment that now looks like it’s coming from you. What they’re really doing is potentially deploying ransomware throughout your environment, and then they hit detonate. Now, all of a sudden, not one machine goes dead, but your entire organization also gets encrypted, and you’re basically out of business unless you either pay the ransom or, if you’re lucky, you have a really good backup strategy. That’s the key. When you look at the overall kill chain, the sooner you can actually detect and stop the compromise, the better. I think that the phishing and spear-phishing is getting so sophisticated that stopping that is going to be incredibly difficult. Stop posting on Facebook, stop posting on Instagram, stop doing Twitter? Yeah, like that’s going to happen. Even though, personally, I never do that. From there, they acquire your credentials. The best thing you can possibly do is intercept them before they can do that, and that’s really what monitoring your environment is all about. Having your credentials isn’t bad until they do something with them. As they attempt to manipulate things, intercepting that kill chain at that point in time is the most effective way to stop that exfiltration of data. If you’re in the healthcare world, that’s incredibly expensive. The HIPAA violations and penalties start kicking in, and now you’re up for a huge fine if you release medical information. If you’re in school districts and you release information on kids, the fines are enormous. So it’s all about stopping the attack before they can actually inflict damage or compromise your information.

Tyler Smith: That’s right. And that’s one of the things that, as you’d mentioned, we try to have something to address the major attack vectors. This is taken from the Verizon report. You can go and look this up, but as you can see on the left — and I apologize because I tried to get a grayscale version of this, it was the only one I could snag a copy of — but on the left you can see in 2015 where these avenues of breach started, and you can see on the right where they’ve ended up in 2021 as far as prevalence is concerned. You can see at the top the number one thing, as Chris had mentioned, is phishing. That’s becoming the “gateway drug,” if you will, to a data breach. The next thing is the stolen credentials that Chris also mentioned. Again, neither of these things in and of themselves is really that bad; it’s what the actor is going to do with it in your environment. One of the things that they often can do is reconfigure settings on different systems. Because it is so central to that data exfiltration, the Microsoft 365 server and those settings allowing things like out-of-domain forwarding — which I keep bringing up because it was seen in a recent incident response that was tied to SolarWinds — out-of-domain forwarding was used to exfiltrate information. It was bad that the SolarWinds compromise happened within their organization. It was bad that, obviously, they got access to the Microsoft server to make these changes. But no one was monitoring; the real pin holding everything together is that no one was monitoring those configurations for change, and they hadn’t really been set up properly to begin with. That’s where the service that we offer comes into play. The other thing is when you look at the pricing for this — and I’ll turn this over to Chris because this is really your domain — but when you look at the pricing of what you pay for with the available Microsoft 365 tools that would help you maintain control over this, versus what you actually get from them, it doesn’t really hold up, right Chris?

Chris Auger: Yeah, I mean, Microsoft is unquestionably the dominant provider of productivity tools, and Microsoft is also the absolute master of bundling a bunch of stuff together and forcing you to buy these big packages. The reality is most people or most organizations’ employees need email, Word, PowerPoint, and maybe if you’re in finance or whatever, you use Excel. They don’t necessarily need nor want all the other stuff that Microsoft packages together. But you want secure email, you want Word, you want PowerPoint. Basically, you go, “Hey, I can go with 365 Business Standard.” Oh wait, you want security? You have to jump up and pay more per user per month just to have the ability to see if you are compliant, to get access to their security center at all. Even with that, it doesn’t do the real-time monitoring. If you go forward one slide to the enterprise pricing, you actually have to leap up from that E3 level if you want their full security scoring. They’re going to make you use Teams and a bunch of other stuff and voice and things in order to get there, but you’re going to jump from around $12.50 a month up to much higher pricing per user in order to get the advanced capabilities. InfoSight’s mission, working with Dark Rhino, is: how can we provide you with that ability not only to look at your environment and look at the controls and see if you are set up properly by comparing that to CIS or the Center for Internet Security benchmarks, but on top of that, we have the ability to make it easy enough to do it every day, and that will turn into real-time monitoring. It’s really InfoSight partnering with Dark Rhino that gives you the same security capabilities that you might get in E3 or E5 at a significantly reduced price point in a much easier-to-consume form. Tyler alluded to the fact that Microsoft is not known for ease of use. I looked at our own security alerts, and we were getting dozens of alerts every day because Microsoft decided to say it’s a critical alert that some feature changed. So you’ve got this real numbness caused by having so many alerts that people start ignoring them. It’s kind of like when I was in college; I just ignored car alarms because I lived by a parking lot and they were going off all the time. I never cared anymore; I didn’t even look to see which car it was. It’s that numbness, that alert fatigue. That’s really Dark Rhino’s job. The service they’re going to deliver will not only verify how compliant you are and how you’re set up, but enable you to have the advanced capabilities without having to make that leap in pricing.

Tyler Smith: Right, that’s right. And it’s much more focused. Like Chris mentioned, it’s the clutter that comes with those higher-end Microsoft licensing tiers; you get just a ton of extra stuff that you just don’t need. What we can do is allow you to focus very, very directly. The other thing you can do is also use CIS, as they have a full benchmark. If you have the time, you could do this on your own, but what we have is a process that’s extremely affordable and pretty much automated, so you don’t have to worry about anything other than when you get an alert from it. You know that it’s worth looking at because something has changed. So, just really quick, what it does at a very high level: it inspects your Microsoft 365 environment. Then, what we can do is give you the benchmark score, which is going to outline the findings that we’ve discovered and give you a score of where they fall next to best practices. The way that it works is you go fix those things, or we can help you fix those things, and then we can go back and take another look and see where you fall. The other part of that is, above and beyond, we can continue to monitor and alert you as things change so that you can respond when it’s not an expected change. Chris, anything to add?

Chris Auger: Yeah, one thing I will call out: I highly recommend you do this assessment with Dark Rhino. Second bit of advice is don’t freak out if you get an F so far. We’ve done this on dozens and dozens and dozens of environments, soon to be hundreds, and so far, only one has actually got a B; no one’s got an A yet. Almost everyone is failing miserably. But the beauty is even though they’re failing, Dark Rhino can put you on a path to correct it, so you at least know it. Then from there, you get to a security baseline. Once you’re at that baseline, monitoring it to make sure that a bad actor doesn’t change it is absolutely critical. But I think going through this assessment — the ostrich approach is not the right answer. It’s kind of like going for a physical: you really hate going, but you feel great after you have it. Getting that check of your environment is totally not impactful to your organization. Auditors aren’t going to come into your environment; it’s all done remotely. And Dark Rhino has really turned this into a seamless process, so you know exactly where you stand compared to the standard on where you should be, and you can get on a path to correct your environment.

Tyler Smith: Yeah, and one of the things is I really cannot overstate the simplicity of the process. It takes something that, honestly, when I looked at what was required for us to do this manually by comparison, it’s the difference between transplant surgery and trimming your fingernails. I mean, it really was the complexity of where to look in Microsoft for all this stuff, what it’s supposed to be set to, and everything; it’s just a lot of stuff to juggle. Especially if you don’t have that comprehensive security level of service from Microsoft that lets you get the automated score. This is just an example of some of the controls that we look at. And again, the simplicity of how we can get this done versus how it’s done manually — you can absolutely do it manually, but I would invite everybody to reach out and just give it a shot. Honestly, it’s very, very simple. One of the other things, Chris, you can probably elaborate more, is this is where this is at right now. There are continuing improvements to what we can do from the reporting side and alerting side that are in the pipeline.

Chris Auger: Yeah, so right now, we do checks on the most critical security settings. Over the next few months, this is going to turn into over a hundred controls that we’re going to validate against and look at, which are going to be stack-ranked and prioritized based on the damage they can inflict if someone was to manipulate or change one. The other huge part of the value that Dark Rhino provides is knowing if you passed or failed is interesting; knowing if you passed or failed on a control-by-control basis is super important. In other words, that consultative value that Tyler, Manoj, Kevin, and the team can provide you is just absolutely critical because getting an F is one thing; getting an F with a path to get an A that is rapid is something entirely different. That’s really where the value of Dark Rhino over time can provide is that consultative value to help you prioritize which ones come first and actually get you on a path to being healthy. Then once you’re healthy, maintaining that health over time is really what it’s all about.

Tyler Smith: Exactly. One of the things that we really wanted to accomplish with this service was not just giving organizations another dashboard or another scorecard that they look at one time and forget about. The idea is actionable intelligence. We want organizations to understand what the risks are, why they matter, and how to fix them in a practical and affordable way. A lot of organizations, especially small and medium-sized businesses, don’t necessarily have a full-time Microsoft security engineer sitting around monitoring these configurations every day. So what we wanted to do was simplify that process to where they can still maintain a strong security posture without having to build a massive internal team to support it.

Chris Auger: Yeah, and honestly, one of the biggest challenges organizations face is configuration drift over time. Even if you set everything up correctly today, environments evolve. People change settings for operational reasons, admins make updates, Microsoft introduces new features or defaults, and before long you’ve drifted away from your original secure baseline. That’s one of the reasons continuous monitoring matters so much. Security isn’t a one-time event. It’s not “we secured it in January and now we’re done.” It’s a continuous operational process.

Tyler Smith: That’s exactly right. Security is really about maintaining consistency over time. And honestly, most breaches don’t happen because somebody had absolutely no security. They happen because there was one small gap, one overlooked setting, or one change that nobody noticed. Attackers are looking for those small cracks. They don’t necessarily need massive vulnerabilities if they can find a simple configuration issue that gives them leverage.

Chris Auger: Exactly. And Microsoft 365 environments are extremely powerful, but that power comes with complexity. There are so many different controls, permissions, policies, and integrations that it’s easy for things to slip through the cracks. The average organization just doesn’t have the time or expertise to continuously review every setting manually. That’s why automation combined with expert oversight becomes so valuable.

Tyler Smith: One of the other things we’ve noticed is that organizations often assume because they’re in the cloud, they’re automatically secure. There’s this perception that “Microsoft handles security for us,” and while Microsoft absolutely secures the infrastructure itself, the customer still owns responsibility for configuration, identity management, access controls, and data governance. That shared responsibility model is something that many organizations don’t fully understand.

Chris Auger: That’s a huge point. Microsoft secures Microsoft’s infrastructure. They secure the data centers, the physical systems, and the uptime of the service. But they don’t know your business requirements. They don’t know who should have access to what, whether multi-factor authentication should be enforced in certain scenarios, or whether forwarding rules should be allowed externally. Those are business-level security decisions that organizations still have to own themselves.

Tyler Smith: And that’s where assessments become so valuable because they help organizations understand where they stand today. A lot of people don’t even know if they’re configured securely or not. Once they see the report, it gives them a roadmap they can follow to improve.

Chris Auger: Exactly. And honestly, one of the things I appreciate most about the approach here is that it’s practical. We’re not trying to boil the ocean. We’re not saying you have to spend hundreds of thousands of dollars or completely redesign your environment overnight. We’re saying: let’s identify the highest-risk items first, let’s remediate those, let’s establish a secure baseline, and then let’s maintain that baseline moving forward. That’s achievable for organizations.

Tyler Smith: Right, because security maturity is a journey. Nobody wakes up one day and suddenly has perfect security. It’s about continuous improvement, understanding where your risks are, and taking measurable steps to reduce them over time.

Chris Auger: And one thing I’ll emphasize again is don’t be discouraged if your initial assessment score isn’t great. That’s actually normal. The important thing is visibility. Once you know where the issues are, you can start fixing them. The organizations that get into trouble are the ones that assume they’re fine without actually validating it.

Tyler Smith: Exactly. It’s always better to identify weaknesses proactively than to discover them after an incident. The assessment process gives organizations an opportunity to strengthen their environment before an attacker finds those gaps.

Chris Auger: And ultimately, that’s really the goal here: reducing risk, improving visibility, and helping organizations maintain confidence that their Microsoft 365 environment is configured securely and stays that way over time.

Tyler Smith: Absolutely. So for anybody listening, if this is something you’re interested in or if you’d simply like to understand your current Microsoft 365 security posture better, feel free to reach out to us. The process is straightforward, it’s non-invasive, and it can provide a tremendous amount of value very quickly.

Chris Auger: And honestly, even if you think your environment is configured well, validate it. Security assumptions are dangerous. Verification matters.

Tyler Smith: Well said. Chris, thank you again for joining us today and for sharing your expertise.

Chris Auger: Absolutely. Thanks for having me. It was a great conversation.

Tyler Smith: And thanks to everybody who joined us today. We appreciate your time and look forward to speaking with you again soon.