Email security is a war between security professionals and malicious actors. Security professionals are often following malicious actors and reacting to changes. Unfortunately, success in this war is dependant on information. To aid in that effort, every major security vendor that works in the email world has some way to report bad emails. Each report can be examined to figure out what techniques were used to bypass existing security.…
An important security concept that has cropped up over the past few years is Multi-Factor Authentication (MFA). Its predecessor, 2 Factor Authentication, has been around for decades but has become less common recently due to some inherent flaws. Put simply, both techniques improve security, but how? To get to that, let’s go through the MFA acronym backward, so I can explain how things come together.…
Update: Due to some changes in how MS handles MFA in O365, I’ve had to completely re-write this article. Updated instructions follow.
MFA in O365
Office 365 MFA is probably the best thing to enable for securing the environment. Microsoft has gone through a number of iterations on setting this up, but has finally ended with the existing settings.…
What are Cloud Service Providers
Moving from a traditional IT infrastructure to a cloud-based or hybrid infrastructure is a complicated undertaking. Cloud systems will reduce the level of control an organization has over their application, and getting the right setup is sometimes difficult. This is where Cloud Service Providers (CSP) come in. I should first point out that CSP is a Microsoft term for organizations that partner with them to provide migration, administration, architectural, security, and development services to their customers.…
What does “Shared Responsibility” Mean
“Shared Responsibility” explains the demarcation line between what a cloud provider controls and what a cloud consumer controls. In a traditional DIY IT environment, responsibility for everything rests entirely on the business and its IT personnel. Electricity, physical security, hardware, software, and everything else has to be purchased, installed, maintained, and administered by the company directly or through an intermediary.…
Though you may not know it, DNS (Or Domain Name System) is probably the most used things on the Internet. In fact, you’re using it right now. For those who don’t know what DNS is or does, it is the system we use to translate Domain Names to IP Addresses.
What is DNS?
DNS was created to allow easy creation, distribution, and update of “Internet Names.”…
Take a minute to go over this post from Dirk-jan Mollema. Go ahead and read it. I’ll wait…
Did you realize how scary that kind of attack is? As an IT guy who specializes in Exchange server and loves studying security, that article scared the snot out of me. Based on my experience with organizations of all sizes I can say with a good bit of authority that almost every Exchange organization out there is probably vulnerable to this attack.…
Office 365 Encryption with Azure Information Protection
As I mentioned in an earlier post, email encryption is a sticky thing. In a perfect world, everyone would have Opportunistic TLS enabled and all mail traffic would be automatically encrypted with STARTTLS encryption, which is a fantastic method of ensuring security of messages “in transit”. But some messages need to be encrypted “at rest” due to security policies or regulations.…
IT people, for some reason, seem to have an affinity towards designing solutions that use “cool” features, even when those features aren’t really necessary. This tendency sometimes leads to good solutions, but a lot of times it ends up creating solutions that fall short of requirements or leave IT infrastructure with significant short-comings in any number of areas.…
I don’t often have an opportunity to post a rant in an IT blog (And even less opportunity to create a click-bait headline), but here goes nothing! Cisco’s method of doing ESMTP packet inspection is INCREDIBLY STUPID and you should disable it immediately. Why do I say that? Because when Cisco ASAs/whatever they call them these days are configured to perform packet inspection on ESMTP traffic, the preferred option of doing so is to block the STARTTLS verb entirely.*…