Over the last seven years, I've spent considerable time in Microsoft 365 Security and Compliance solutions. What has become abundantly evident is that cloud security is not just one thing. We've seen Microsoft mature its security offerings in the cloud. At the same time, industry standards like NIST, CIS, and ISO all adopted cloud computing as the de facto IT standard for most, if not all, companies across the globe. It seems that each week, a new security acronym arrives on the scene - SIEM (Security Information and Event Management), SOAR (Security Orchestration, Automation, and Response), CSPM (Cloud Security Posture Management), ASPM (Application Security Posture Management, SSPM (SaaS Security Posture Management, XDR (Extended Detection and Response).
In this evolution of cybersecurity, organizations have had to change their traditional perimeter security approach to a decentralized model. This transition has single-handedly changed how the world views IT security.
Securing data in the cloud introduces a colossal new set of challenges for organizations. Here are just a few cybersecurity challenges with managing your data within cloud platforms:
Managing who has access to what resources can be complex, especially in enterprise organizations with numerous users and roles. Poor Identity Access Management (IAM) practices can lead to unauthorized access. Privileged account management is also critical, as mismanagement of these accounts can lead to elevated risks if these accounts are compromised.
Companies must understand who is responsible for securing what in the cloud and Microsoft has published a diagram that covers shared responsibility in the cloud. Cloud providers and customers share responsibility for some security measures, whereas other measures are the full responsibility of one or the other. A misunderstanding of this division of responsibilities can lead to security gaps. Ensuring vendor security can be another challenge. Do your vendors have robust security measures, and do you regularly assess these practices? Relying on third-party services and software in the cloud creates additional supply chain risk, but it's nearly unavoidable.
Figure 1: Microsoft's Shared Responsibility Model.
Incorrectly configured cloud resources can lead to vulnerabilities, which result in data exposure and other security incidents. With cloud providers like Microsoft constantly introducing new products, features, settings, and portals, it can take time to keep up with the changes and security gaps these changes introduce.
Be it Microsoft, AWS or Google, one thing remains the same:
Hackers are no longer targeting firewalls or networks. Cloud providers have pretty much built infrastructure that manages and thwarts would-be attackers. Providers manage Denial of Service attacks and mitigate brute force attacks. Companies are not as concerned with traditional attack vectors because, for the most part, cloud providers handle that for you. It's become a misnomer of sorts. "We have solutions in the cloud that our provider protects." For the most part, traditional perimeter security is completely ubiquitous to the consumer.
However, identities are one of the world's most significant compromised attack vectors right now. Just have a look at some of the following statistics:
Even Microsoft fell prey to hackers with the now famous "Midnight Blizzard" hack announced at the beginning of 2024. In an update this week (7/1/24), Microsoft is contacting enterprise customers potentially affected by the Midnight Blizzard data breach.
With new security gaps come new solutions and approaches. Since its launch in the fall of 2023, ENow's AppGov Score and App Governance Accelerator have been deployed by companies worldwide, helping them assess and identify security risks in their Microsoft Entra ID application environments.
Working side-by-side with global Security MVPs, ENow has taken the message of improving identity and application security in Microsoft Entra ID to the masses, walking customers through concepts and recommended practices and publishing articles like the one I wrote about "The Anatomy of a Cyber Attack" back in February 2024. They believe this community-driven approach and knowledge sharing allow companies to better understand the exposure and risks associated with running applications in the cloud.
At the same time, ENow has been exposed to what the world looks like from a customer's perspective, and what they have seen in aggregate is startling. The thing is, it's nobody's fault. You can't blame the vendors who build based on industry needs. You can't blame organizations, as we expect them to grow and upskill at an unrealistic pace. You can't blame the partners, as the customers' requests drive their focus.
Over the last year, we have been delivering webinars/blogs/white papers/eBooks with the single purpose of educating customers, engineers, partners, and consultants across the globe about what they should be:
Over the last ten months, we've had a phenomenal and enlightening journey. We've experienced the weird, the bad, and the wonderful of identity and SaaS application security. Some things have fascinated us; we often ask, "How is that possible?"
In the end, the only thing that we can do is ensure that as many companies as possible have a continuous view of what the applications in their Entra ID environment are doing, their current risk profile, what it all means, and, most importantly, what they need to do to ensure that their cloud investment is adequately protected.
So many things have changed in cybersecurity in recent years. Identity Admins must worry about application security. Developers must build applications with security at the forefront of their design. Infrastructure engineers are no longer responsible for the "App," and security analysts have had to up and cross-skill in various approaches to address their SaaS security posture.
The AppGov Community Forum is moderated by Microsoft Security & Identity MVPs and subject-matter experts to answer your questions around Entra ID, managing Enterprise Applications, Application Registrations, and the impact of Tenant Settings on an application's lifecycle.