SECTION 9 Cyber Security

This week we’re working on DR plans and Password Polices. The DR plan is for our DNS servers. We can’t afford to lose them. The password policy is about reducing risk with longer passwords. We’ve also got another tool for the toolbox.

LINKS

1. psftp

2. SANS Polices

3. SANS Password Policy - Link to the PDF

4. Wireshark

FIND US ON

1. Facebook

2. Twitter - DamienHull

We don’t know much about 365 conditional access polices, but they look awesome. We’re also adding tools to the toolbox and deploying new devices. No rest for the crazy.

LINKS

1. What is Conditional Access?

2. What are security defaults?

3. Nmap

FIND US ON

1. Facebook

2. Twitter - DamienHull

Our Microsoft 365 has failed logins from Russia. What do we do? Time for a risk assessment. We’re going to make our 365 more secure.

Microsoft 365

1. Error Codes - Lookup the error codes

2. Security Defaults

DeepBlueCLI

1. DeepBlueCLI - The GitHub site

2. Webcast: Attack Tactics 7 – The Logs You Are Looking For - Covers DeepBlueCLI

3. Log Analysis Part 2 – Detecting Host Attacks: Or, How I Found and Fell in Love with DeepBlueCLI - Good article

Sysmon

1. Getting Started With Sysmon

FIND US ON

1. Facebook

2. Twitter - DamienHull

We’re talking about weekly tasks, 365 authentication issues, and training. On the training front we have ITIL 4, SOC and Windows 10.

LINKS

1. The SOC Age Or, A Young SOC Analyst's Illustrated Primer - Presentation from BHIS

2. SOC Core Skills w/ John Strand

3. ITIL 4 Foundation Course

FIND US ON

1. Facebook

2. Twitter - DamienHull

This week we connected Jitibt to 365, found hidden licensing and learned how to be a SOC analyst. You can now contact us by sending email to [email protected].

LINKS

1. Black Hills Information Security Youtube Channel

2. CIS Benchmarks

3. Jitbit

FIND US ON

1. Facebook

2. Twitter - DamienHull

We’re learning how to manage emergency accounts and data retention in 365. The good news, Microsoft has some pretty cool tools for data retention. The bad news, retention policies are a bit confusing.

LINKS

1. MJFChat: How to Handle Office 365 Backups

2. Microsoft 365 Retention Policies

3. Manage emergency access accounts in Azure AD

FIND US ON

1. Facebook

2. Twitter - DamienHull

We’re slowly creating our test environment for Microsoft 365. We’re also looking at ways we can backup 365. Slow and steady wins the race. We’re two people learning to be 365 admins. Breaking something could equal a lot of downtime. We can’t afford downtime.

LINKS

1. MJFChat: How to Handle Office 365 Backups

2. Microsoft 365 Retention Policies

FIND US ON

1. Facebook

2. Twitter - DamienHull

We did it! We migrated to 365. There were a few bumps along the way. Nothing major. We’re doing a quick review of the process and next steps. We have to learn how to be 365 admins.

FIND US ON

1. Facebook

2. Twitter - DamienHull

Time to prep for a long winter with Covid-19. We want a nice environment for IT projects and studying. We still need to finish our Windows 10 cert. We’ve got other Microsoft 365 certs to look at. I’m finally going to get the ITIL cert. Lots to do this winter.

LINKS

1. Microsoft Learn

2. ITIL Training - This is the one I’m looking at. I’m sure there are others.

FIND US ON

1. Facebook

2. Twitter - DamienHull

Yup, another 365 migration review. Overall we’re doing pretty good. We still need to make sure we’re moving in the right direction. Are we achieving our goals? What are our goals? How are we doing? How do we feel about the project?

LINKS

1. Microsoft 365: Getting started - Even at this stage this is still relevant

2. Plan your setup of Microsoft 365 for business - We’re close to running the setup wizard

3. Microsoft 365 identity models and Azure Active Directory - Windows 10 Authentication

FIND US ON

1. Facebook

2. Twitter - DamienHull