When Microsoft Messaging Looks Secure but Isn’t — Exchange Server, Hybrid and Microsoft 365 Security with Thomas Stensitzki [MVP]

1
00:00:00,000 --> 00:00:04,400
Yeah, welcome back to the Amcet65 show podcast.
2
00:00:04,400 --> 00:00:10,160
Today we are going deep into one of the most critical and often underestimated
3
00:00:10,160 --> 00:00:15,120
areas of the Microsoft ecosystem, messaging security.
4
00:00:15,120 --> 00:00:20,680
E-Mats remain one of the most important systems in every organization.
5
00:00:20,680 --> 00:00:25,120
It carries business decisions, financial information, customer,
6
00:00:25,120 --> 00:00:30,400
data, credentials, contracts and sometimes the entry-history of a company
7
00:00:30,400 --> 00:00:35,200
communication. Yet many Microsoft messaging environments look
8
00:00:35,200 --> 00:00:41,360
secure on the surface, will still contain serious weakness,
9
00:00:41,360 --> 00:00:45,920
amnesty, yeah, my today's guest is Tomasz Dynitski.
10
00:00:45,920 --> 00:00:50,240
Tomasz is the principal technology consultant and owner of the
11
00:00:50,240 --> 00:00:55,920
Branky course, GmbH in Koga G, where he specialised in enterprise,
12
00:00:55,920 --> 00:01:00,240
consulting and training for Microsoft Exchange, Microsoft 65 and hybrid
13
00:01:00,240 --> 00:01:04,880
collaboration environments. He has been Microsoft MVP for Microsoft
14
00:01:04,880 --> 00:01:10,400
C-65 and experienced since 2018 and holds some of the most advanced
15
00:01:10,400 --> 00:01:14,000
messaging certification Microsoft have ever offered,
16
00:01:14,000 --> 00:01:19,440
including Microsoft's certificate solution, master messaging and Microsoft
17
00:01:19,440 --> 00:01:25,200
certificate master of Exchange Server. Tomasz has more than 25 years of experience
18
00:01:25,200 --> 00:01:29,920
working with Exchange Server, Hybrid Envoyaments, Microsoft 65 and enterprise
19
00:01:29,920 --> 00:01:35,200
messaging architectures. He is also Microsoft Certificate Trainer,
20
00:01:35,200 --> 00:01:39,680
form of NCT Community Lead, author of several books including Exchange
21
00:01:39,680 --> 00:01:43,920
Server, the Sandbook for Adness Art 1, speaker at events such
22
00:01:43,920 --> 00:01:51,920
Exchange Summit, Expept Live, Scottish Summit and the host of Exchange
23
00:01:51,920 --> 00:01:56,560
Unplugged Podcast. Today we will discuss the risk that administrators often
24
00:01:56,560 --> 00:02:01,440
underestimate it's different between one premise, hybrid and cloud
25
00:02:01,440 --> 00:02:05,280
only messaging, Exchange Online Security identity, Mailflow,
26
00:02:05,280 --> 00:02:09,120
Auditification, Operation of the mistakes and what organizations need to
27
00:02:09,120 --> 00:02:13,120
understand before it's too late. Tomasz, welcome, beauty show.
28
00:02:13,120 --> 00:02:18,080
I hope I have nothing to forget. Well, okay, it's a pleasure
29
00:02:18,080 --> 00:02:23,120
being on the show. That's quite an introduction. So actually I haven't listened to such
30
00:02:23,120 --> 00:02:27,920
introduction for quite some time. So I thought, oh yeah, so that's just
31
00:02:27,920 --> 00:02:37,200
definitely describes I'm old. Yeah, you say you're old. You are working for more
32
00:02:37,200 --> 00:02:42,560
than 25 years in the Microsoft Acro system, especially in the Microsoft
33
00:02:42,560 --> 00:02:48,480
messaging technology. What organly attract you to exchange it? Enterprise
34
00:02:48,480 --> 00:02:54,320
messaging? Well, so we do have a limit for this episode, don't we?
35
00:02:54,320 --> 00:03:02,880
To put it right, so I started working with Exchange Server, more or less
36
00:03:02,880 --> 00:03:06,480
I was just going to show you about 2000, yeah, in the time from of the
37
00:03:06,480 --> 00:03:12,080
early 2000s and for whatever reason, I stayed with this and
38
00:03:12,080 --> 00:03:16,400
I started working with the Microsoft and the technology field of Microsoft
39
00:03:16,400 --> 00:03:22,160
as a generalist. So I even did some stuff on the dark side of the moon. So I worked
40
00:03:22,160 --> 00:03:28,560
as a programmer as well. But then I made a choice to focus on Exchange
41
00:03:28,560 --> 00:03:33,600
to being a specialist and even back then I had to make a decision between the
42
00:03:33,600 --> 00:03:38,320
red and the blue pills. So it should be it was either SharePoint
43
00:03:38,320 --> 00:03:46,240
or Exchange and Exchange 1 for various reasons. That's why, you know,
44
00:03:46,240 --> 00:03:54,080
but it's I think that exchange and emails even though that it's already quite
45
00:03:54,080 --> 00:03:59,280
often been said that email is dead nobody's going to use email but this is
46
00:03:59,280 --> 00:04:02,480
simply not the case.
47
00:04:04,480 --> 00:04:10,560
Yeah, I think when I have the chance, I don't make so so much intro,
48
00:04:10,560 --> 00:04:16,640
I get the try to get a little bit deep dive. What are the the main security
49
00:04:16,640 --> 00:04:22,320
difference between Exchange Server on-prem, Exchange Online and
50
00:04:22,320 --> 00:04:28,640
yeah, Hybrid deployments? So let me start with the letter because
51
00:04:28,640 --> 00:04:33,360
so Exchange Hybrid is nothing less than just a logical configuration
52
00:04:33,360 --> 00:04:39,200
or between the two. So your on-premises Exchange organization and your
53
00:04:39,200 --> 00:04:45,360
Exchange Online tenant are from a logical perspective being configured to work
54
00:04:45,360 --> 00:04:49,280
as a single entity so to speak. So they trust each other
55
00:04:49,280 --> 00:04:55,760
even though that your that both environments are literally hundreds of kilometers
56
00:04:55,760 --> 00:05:01,120
apart. But your expectation is when you use Exchange Online
57
00:05:01,120 --> 00:05:05,760
that any email being sent from on-prem shows up as an internal email and vice
58
00:05:05,760 --> 00:05:13,440
versa. So and this is the tricky part on where Microsoft has quite strict
59
00:05:13,440 --> 00:05:20,400
configuration defaults to make that happen and this is the Hybrid configuration for
60
00:05:20,400 --> 00:05:26,880
Mailflow in that case. And yeah, you know, sometimes you see
61
00:05:26,880 --> 00:05:32,400
not so good and sometimes you see well performing the environments.
62
00:05:32,400 --> 00:05:38,800
What would I often see is or I think many many of the organizations I see
63
00:05:38,800 --> 00:05:43,840
they move to the Microsoft 365 because they believe the cloud automatically solves
64
00:05:43,840 --> 00:05:50,320
the security problem. A problem they they show me hey here stands it's secure
65
00:05:50,320 --> 00:05:56,240
on the website. We make it. Which which problem do Microsoft solve?
66
00:05:56,240 --> 00:06:00,240
And which remains the customer's responsibility?
67
00:06:00,240 --> 00:06:08,720
Well, first of all, it doesn't solve any problems
68
00:06:08,720 --> 00:06:13,280
right out of the box. You can compare the if you set up your
69
00:06:13,280 --> 00:06:18,480
new tenant and you get your first Exchange Online license into that tenant,
70
00:06:18,480 --> 00:06:25,600
you get an instance of Exchange which technically you can compare with
71
00:06:25,600 --> 00:06:29,680
just doing a simple default setup of Exchange Server. So it comes with
72
00:06:29,680 --> 00:06:36,640
default settings. Yes, it works. So there's quite a low
73
00:06:36,640 --> 00:06:41,040
barrier to use it to start using email with Exchange Online.
74
00:06:41,040 --> 00:06:46,080
But nevertheless all the communication flow, all the transport pipelines, all the
75
00:06:46,080 --> 00:06:50,480
transport configuration for anti spam, anti mailware, anti fishing, and what's the
76
00:06:50,480 --> 00:06:56,880
however you can think of runs in default and you still have to
77
00:06:56,880 --> 00:07:02,800
tweak and configure depending on your needs. So that's the general message from
78
00:07:02,800 --> 00:07:06,080
Microsoft. Here you go. Here's a switch on and you can use email
79
00:07:06,080 --> 00:07:13,440
but you have to configure it depending on your needs.
80
00:07:13,440 --> 00:07:18,080
This what did you think is hybrid Exchange? Inherently more
81
00:07:18,080 --> 00:07:26,000
complicated for security perspective or is it the Exchange on-prem?
82
00:07:26,000 --> 00:07:35,120
First of all, I'd say it's not complicated. It gets complicated and in this case I
83
00:07:35,120 --> 00:07:40,320
need to throw the ball over to the network team, to the firewall team, and
84
00:07:40,320 --> 00:07:47,120
everyone else being responsible for network security. So when it comes to
85
00:07:47,120 --> 00:07:55,680
having the possibility to use the standard default configuration for let's say
86
00:07:55,680 --> 00:07:59,680
a full classic hybrid which requires that your Exchange Service publish to the
87
00:07:59,680 --> 00:08:05,360
Internet using a reverse proxy. So when I say default, I already
88
00:08:05,360 --> 00:08:12,720
refer to security standard defaults. You do not expose your on-premises
89
00:08:12,720 --> 00:08:17,600
Exchange server to the Internet without any kind of reverse proxy in front of it.
90
00:08:17,600 --> 00:08:22,320
But that's standard for let's say decades now. So,
91
00:08:22,320 --> 00:08:34,800
Natheles, if you do not have any special security network requirements,
92
00:08:34,800 --> 00:08:41,360
normally a hybrid setup and sorry for any consultant charging
93
00:08:41,360 --> 00:08:45,760
more time year at default hybrid configuration between Exchange server and
94
00:08:45,760 --> 00:08:52,320
Exchange Online can be configured and put into a production in a day.
95
00:08:52,320 --> 00:08:56,640
But this is normally definitely true for lab environments,
96
00:08:56,640 --> 00:09:02,640
but the music, you know, all of this comes when you see an on-premises environment
97
00:09:02,640 --> 00:09:11,280
on a customer side. Classic customer environments do not run like a lab setup.
98
00:09:11,280 --> 00:09:17,600
So they have, you know, the security teams, the network teams, each of those teams
99
00:09:17,600 --> 00:09:25,280
has different views on how to configure things the best to their knowledge.
100
00:09:25,280 --> 00:09:31,760
Right? And this is where normally or not normally at say, sometimes there's
101
00:09:31,760 --> 00:09:36,240
slightly some tension between the Exchange Messaging team and the Security
102
00:09:36,240 --> 00:09:44,880
Network of people. And what will you say, how important is identity security
103
00:09:44,880 --> 00:09:53,520
compared with traditional email security controls? So I'd say identity security comes first.
104
00:09:53,520 --> 00:10:01,040
So you do have to protect the identity of each user, even though
105
00:10:01,040 --> 00:10:07,200
regardless if it's a real person, so a human being or if it's a technical service
106
00:10:07,200 --> 00:10:12,400
account, whatever, these are all the same identities requiring the very same
107
00:10:12,400 --> 00:10:18,720
identity protection mechanisms in place. Right? So you should not think about having
108
00:10:18,720 --> 00:10:25,920
a vehicle security idea for some kind of a room or service account, whatever you can
109
00:10:25,920 --> 00:10:34,640
think of. Right? And which roles, which administrative roles are especially
110
00:10:34,640 --> 00:10:42,080
associative in the Exchange Online? So we do have the the Exchange Administrator
111
00:10:42,080 --> 00:10:49,120
role that comes from an Android perspective. So Exchange Online,
112
00:10:49,120 --> 00:10:55,200
even though that it's based on the on-premises product, but it has been forked quite a few years ago,
113
00:10:55,200 --> 00:11:02,560
but nevertheless, Exchange Online uses in turnies, so-called role-based access control,
114
00:11:02,560 --> 00:11:09,360
the AeroBug role model, which is pretty specific to provide access to certain
115
00:11:09,360 --> 00:11:14,400
functionality within Exchange, but from an identity protection perspective. And in this case,
116
00:11:14,400 --> 00:11:20,640
we talk about EntraID. We do have the Exchange Administrator, which is more
117
00:11:20,640 --> 00:11:26,800
as the goal and key to configure anything messaging related. So we do have recipient management,
118
00:11:26,800 --> 00:11:36,160
which is our help desk, so that help desk role, which allows certain base functionality
119
00:11:36,160 --> 00:11:43,520
to exchange recipients objects, but we are focusing on Exchange Admins and if you do have
120
00:11:43,520 --> 00:11:50,160
license, the privileged identity management, so PIM, you should definitely configure your
121
00:11:50,160 --> 00:12:01,200
Exchange Amendment using PIM because it's about just having administrative access to your tenant
122
00:12:01,200 --> 00:12:10,560
when you need it. And how should children organizations especially manage
123
00:12:11,680 --> 00:12:21,840
emergency or break glass accounts? We talk about break glass accounts. First of all, you should still
124
00:12:21,840 --> 00:12:29,040
have a, for example, a phyto-key in place. So the days are over, if you simply use
125
00:12:29,040 --> 00:12:38,480
on or disable MFA for break glass accounts and use such a, what kind of 256 character-long,
126
00:12:38,480 --> 00:12:45,440
complicated password, which no one is capable of entering, and it's printed on some kind of
127
00:12:45,440 --> 00:12:53,440
emergency, emergency cheat, which is in a locker where nobody has a key. Now these days,
128
00:12:53,440 --> 00:13:00,720
the break glass account should have a phyto-key, should be secured by a phyto-key. So I do not use
129
00:13:00,720 --> 00:13:07,840
some kind of MFA, for example, using a personal Microsoft Authenticator, which is used by
130
00:13:07,840 --> 00:13:16,000
Administrator A, but Administrator A, as you can think, is on vacation when that emergency happens.
131
00:13:16,000 --> 00:13:28,960
So, but yeah, I think a little bit, do you say the MFA protection, is it enough to protect
132
00:13:28,960 --> 00:13:39,680
that specific access, or did we need more or something other? Okay, so when it comes to
133
00:13:39,680 --> 00:13:46,880
accessing a tenant by default, as long as I do have the proper credentials, I can access that
134
00:13:46,880 --> 00:13:53,760
very tenant from anywhere in the world. So you need to think, or start thinking about,
135
00:13:55,280 --> 00:14:05,760
how sensitive is information in my M365 tenant? Shall I reduce access to their tenant for
136
00:14:05,760 --> 00:14:13,520
administrative logins to certain countries, to certain regions, maybe to a well-known IP address,
137
00:14:13,520 --> 00:14:23,600
so that administrative access is only possible from our headquarters, or from subsidiaries,
138
00:14:23,600 --> 00:14:30,800
whatever you can think of. But as you already mentioned, brakeless accounts, you should always
139
00:14:30,800 --> 00:14:38,960
think and plan for the unthinkable. So, how do you access your tenant if you have configured
140
00:14:38,960 --> 00:14:44,880
that only access from your headquarters, but for whatever reason your headquarters is trucked by
141
00:14:44,880 --> 00:14:52,160
disaster? So, no network or intake access from that very headquarters is possible. So, how do you
142
00:14:52,160 --> 00:15:01,360
access your tenant in that case? So, it's quite a scenario or multiple scenarios you have to think of.
143
00:15:01,360 --> 00:15:09,040
What I think about is the dangers of using a Legend-C,
144
00:15:09,040 --> 00:15:15,680
Identifications, or all the management methods. So, my question is, how should companies deal with
145
00:15:15,680 --> 00:15:22,480
old applications that still require basic authentication or a Legend-C SMTP?
146
00:15:22,480 --> 00:15:30,160
Okay, don't use it. So, it's a simple answer, but it's not a simple answer that fits, you know,
147
00:15:30,160 --> 00:15:37,440
or everybody needs it. But if your applications, in the case we are talking about soft applications,
148
00:15:37,440 --> 00:15:42,560
or even hardware devices about whatever you can think of, so anything that can or want to send
149
00:15:42,560 --> 00:15:53,280
an email, and it's not capable of using modern authentication methods. So, we therefore cannot
150
00:15:53,280 --> 00:16:00,720
directly connect and authenticate to exchange online, you should definitely consider
151
00:16:00,720 --> 00:16:09,600
keeping an on-premises relaying host in place, simplifying your network infrastructure so that
152
00:16:09,600 --> 00:16:18,000
the connectivity of such applications then connects to your on-premises relay SMTP server,
153
00:16:18,000 --> 00:16:26,480
quote-unquote, and exchange. And then transfer the authentication
154
00:16:26,480 --> 00:16:36,320
misses or even the SMTP routing on a more secure manner for the relay system towards exchange
155
00:16:36,320 --> 00:16:46,000
online. Yeah, I think, yeah, identity attack path is heck out famous.
156
00:16:46,000 --> 00:16:53,040
Absolutely. Can you walk us through a realistic attack path that begins with a compromised
157
00:16:53,040 --> 00:16:57,360
user count and yeah, eventually affects the messaging environment?
158
00:16:58,720 --> 00:17:09,120
Well, coming from a messaging background, I'd say, the simple attack start with a malicious email
159
00:17:09,120 --> 00:17:19,920
doesn't it? So, and the funny thing is that as long as you use HTML and colder emails, which we are
160
00:17:19,920 --> 00:17:26,320
mostly used because we like to have proper smileys in our email bodies.
161
00:17:26,800 --> 00:17:37,200
This such an email is not or has to be rendered by your email client, so by audio. So, and
162
00:17:37,200 --> 00:17:46,800
a such an email body as in each HTML can contain active content, so some kinds of scripts and such,
163
00:17:47,680 --> 00:18:00,080
which can already contain malicious URLs. And as soon as such an email is not being filtered by your
164
00:18:00,080 --> 00:18:07,680
anti-mailware, anti-fishing or anti-spam solutions, which it showed. So, I just make it more
165
00:18:07,680 --> 00:18:15,360
to have an advertisement in this place, watch out for a proper email security solution.
166
00:18:17,520 --> 00:18:26,160
Well, the code exit being executed does not necessarily mean that the user opening or just having
167
00:18:26,160 --> 00:18:30,560
an email in preview notices that something is going to happen.
168
00:18:30,560 --> 00:18:40,640
All right, so maybe there's some kind of automaticaling that starts to download additional
169
00:18:40,640 --> 00:18:50,160
malicious code because the URL itself did not look such malicious to the scanners, therefore it passed
170
00:18:50,160 --> 00:18:58,560
the scanning mechanism. So, it then passes, downloads the, finally, with the malicious code and
171
00:18:58,560 --> 00:19:05,440
whatever that happens. It's like a key logger or whatever you can think of. And then it fetches
172
00:19:05,440 --> 00:19:13,760
your credentials. Then there are multiple ways in how to fetch credentials either by having a
173
00:19:13,760 --> 00:19:20,720
key logger in place or by fetching already cash credentials out of the memory. And
174
00:19:20,720 --> 00:19:30,080
say, one of the bad things is if you use your daily user account, which you use for classic office
175
00:19:30,080 --> 00:19:36,160
communication, is the very same account which you use for your administrative work. So,
176
00:19:36,160 --> 00:19:45,200
if you're single, you're one account, you thus have additional privileges against, for example,
177
00:19:45,200 --> 00:19:50,560
the on-premises environment, like a, yeah, my default account is a domain administrator, which it
178
00:19:50,560 --> 00:19:59,200
shouldn't. Or, for example, for the cloud perspective, I, let's say, I am, have the permanent assignment
179
00:19:59,200 --> 00:20:08,880
of as a global administrator in the cloud. No, it shouldn't. So, it's a bad idea. Well, the attack path,
180
00:20:08,880 --> 00:20:18,720
in that case, is too low, right? Not too already gain action or do something on that very same day
181
00:20:18,720 --> 00:20:26,160
when you open that email. Maybe the code simply passes your credential information. Let's say,
182
00:20:26,160 --> 00:20:33,840
your current active or of token over to a, to a malicious third party and they start trying to use
183
00:20:33,840 --> 00:20:39,760
that very same authentication token, which is valid at that very moment from a different location.
184
00:20:39,760 --> 00:20:47,280
And in that case, we have, we need, what do we have to hope that, Entra, you know, sees that, oh, wait,
185
00:20:47,280 --> 00:20:55,520
you could just, um, worked or access the system from Berlin. And then in the very same second,
186
00:20:55,520 --> 00:21:02,560
I do have a very authenticated access from the other side of the world, which can't happen,
187
00:21:02,560 --> 00:21:12,720
it can be so that Entra then blocks such an authentication attempt. Is there any, I say,
188
00:21:12,720 --> 00:21:21,600
all of the events that we are security teams, a detection tool? Yep. So actually,
189
00:21:23,040 --> 00:21:31,440
the slightly depends on, if you're having the, a proper, entry ideal licensing in place. So, um,
190
00:21:31,440 --> 00:21:38,160
the events themselves are being locked, but it depends on your license, for example, if there's
191
00:21:38,160 --> 00:21:44,800
an automatic action in place for it. Let's say, if there's a suspicious logon attempt,
192
00:21:44,800 --> 00:21:52,240
Entra can force you to revalidate your credentials within the digital MFA as an example.
193
00:21:53,120 --> 00:21:58,240
Right. But it is definitely, uh, visible in the sign-in, sign-in logs.
194
00:21:58,240 --> 00:22:07,680
So, and you can see the reason, for example, why a log in fail. So let's say it comes from an already
195
00:22:07,680 --> 00:22:14,640
known malicious IP address. Um, it's being blocked because it looks like some kind of a instant,
196
00:22:14,640 --> 00:22:18,800
uh, let's see, let's see, correct term, something with, um,
197
00:22:20,640 --> 00:22:25,680
some kind of a, you know, um, travel situation, which is simply not possible. So,
198
00:22:25,680 --> 00:22:31,120
impossible travel as an example, right? So, just five minutes between log in from Germany and
199
00:22:31,120 --> 00:22:37,360
the next one from South Africa. In that case, Entra would say, nah, we are not ready yet. So,
200
00:22:37,360 --> 00:22:43,200
this is currently not a, uh, a later approach, which is a tricky thing, for example, if you use
201
00:22:43,200 --> 00:22:51,280
the very same account, let's say on, uh, in your office network, but you are connected via the
202
00:22:51,280 --> 00:22:58,640
band or into a data center, which is located in a different geography. And in that case, you log in
203
00:22:58,640 --> 00:23:04,160
comes a valid log in comes from a totally different region. So you do have to watch out, for example,
204
00:23:04,160 --> 00:23:09,840
adjusting any kind of automated log in, um, audits.
205
00:23:13,120 --> 00:23:18,960
So, uh, I think over here, we are running a little bit out of time, but, uh, yeah, uh, I see,
206
00:23:18,960 --> 00:23:24,640
I have so many questions. So, so, and we are on your way here and really want to talk about, uh, let's
207
00:23:24,640 --> 00:23:31,200
just talk about the mail flow. Why is understanding the complete mail pass is so important?
208
00:23:31,200 --> 00:23:41,440
Um, first of all, because SMTP as a protocol from the ATEs of the last century is such a tolerant
209
00:23:41,440 --> 00:23:52,640
protocol. You can, so SMTP routing allows you to do, um, very horrific things, right? So you can
210
00:23:52,640 --> 00:24:00,000
do whatever you want to route, uh, emails. And if you have to, for example, do you have to know
211
00:24:00,000 --> 00:24:08,000
where is my entry point for, uh, internet, mails as an example? So do you start your, uh, inbound
212
00:24:08,000 --> 00:24:17,040
emails on premises using a gateway or a multiple gateways in the parameter network, for example,
213
00:24:17,040 --> 00:24:24,640
before they reach exchange. And then, uh, if you are an enterprise, you might have multiple exchange
214
00:24:24,640 --> 00:24:31,280
database, available groups across multiple regions. So the email is being routed.
215
00:24:32,720 --> 00:24:39,680
Wherever it is needed and then out of sudden it needs to be routed, um, to exchange online, so to a
216
00:24:39,680 --> 00:24:47,760
totally different routing address. And then it has to pass again, a protection layer because
217
00:24:47,760 --> 00:24:53,680
even in hybrid, the message will pass through the shared online protection stack and, uh, partially
218
00:24:53,680 --> 00:25:00,160
through the Fender before it's finally being delivered two year, um, to the mailbox to the final
219
00:25:00,160 --> 00:25:10,000
recipients mailbox. And on its way from entering the SMTP gateway of the company until it reaches
220
00:25:10,000 --> 00:25:19,440
the final recipients mailbox, each hop, each connector has a different settings that might interfere
221
00:25:19,440 --> 00:25:29,760
with the proper delivery of that email. Even if it's message size, content, uh, conversion, whatever.
222
00:25:29,760 --> 00:25:37,120
That's why as an exchange administrator, you have to have a full understanding, a full view
223
00:25:37,120 --> 00:25:46,160
of your various, um, yeah, as a TP route. It's not just a single, there's definitely never a single
224
00:25:46,160 --> 00:25:56,160
line from the left to the right of a visual diagram. Yeah, interesting. There are also, I think, uh,
225
00:25:56,880 --> 00:26:02,640
how, how, how, what was I, I don't know, the right word for, for, for this package, but there are
226
00:26:02,640 --> 00:26:12,560
SPF, D Kim and, and, right, what is this services tools, I don't know, but the right word for,
227
00:26:12,560 --> 00:26:17,680
what did they do and how did they work and, you know, roll that, the, so,
228
00:26:17,680 --> 00:26:26,000
the, let's start with the SPF, which is already 15 years and older, so this is a policy framework,
229
00:26:26,000 --> 00:26:35,120
and then we have the, uh, domain, uh, key thing and the DMACC, so the reporting around, let's say,
230
00:26:35,120 --> 00:26:42,960
what's going to happen if SPF and they can fail. But all of the three are mechanisms not to protect
231
00:26:42,960 --> 00:26:53,760
me or my infrastructure for receiving emails, but, uh, I do configure these things for my domain,
232
00:26:53,760 --> 00:27:04,560
for sending emails, so, um, SPF, uh, describes the allowed hosts either my name or my IP address,
233
00:27:04,560 --> 00:27:14,160
that are allowed to send as my company domain. Say, so the SPF record of controls.com states,
234
00:27:14,160 --> 00:27:23,360
for example, the IP addresses of my sending, uh, on-premises servers, uh, they do include a reference
235
00:27:24,000 --> 00:27:29,680
to the, um, external third party marketing infrastructure that say, well, I, I, I, do,
236
00:27:29,680 --> 00:27:37,200
that I use to send newsletters because I do want that clients receive my newsletter
237
00:27:37,200 --> 00:27:42,880
with my company name and then my company email address because it's a corporate identity thing,
238
00:27:42,880 --> 00:27:49,600
right? Marketing, uh, only works, uh, if my marketing emails are being received as a control,
239
00:27:49,600 --> 00:27:58,560
so common, not as gmail.com as an example. And the receiving side then can check the SPF record,
240
00:27:58,560 --> 00:28:06,720
or normally these days they do, if the email is being, uh, or trying to be delivered from valid hosts.
241
00:28:06,720 --> 00:28:14,720
And I say, uh, one, one configuration of the SPF says, okay, if there is a failure in the mid,
242
00:28:14,720 --> 00:28:21,760
so there's a mismatch between the sending host and the SPF record, I, at the honor of the domain
243
00:28:21,760 --> 00:28:29,520
because it's a DNS record, I say, hey, receiving server, how should you, shall you, you know,
244
00:28:29,520 --> 00:28:38,720
react to this? You can either be very strict, so do not accept it. You can then either say, um,
245
00:28:38,720 --> 00:28:48,400
yeah, accept it, but you may flag it as, um, spam, so it's being received, uh, it's the receiving side,
246
00:28:48,400 --> 00:28:54,560
accepts that message, but delivers us to the inter-recipient, for example, with a, uh,
247
00:28:54,560 --> 00:29:00,960
some not spam confidence level slightly higher. So it might be spam and might be not take a look,
248
00:29:01,520 --> 00:29:09,600
de-recipient, right? Or you can say, it simply ignored, which is more or less here,
249
00:29:09,600 --> 00:29:14,960
like not having any kind of things, right? And then,
250
00:29:14,960 --> 00:29:23,280
but why some organizations implement these technologies, but they are still, yeah,
251
00:29:23,280 --> 00:29:35,520
remaining valuable to do spoofing, right? So because the larger general email providers, like, uh,
252
00:29:35,520 --> 00:29:47,520
Gmail and other ones, um, tend to not accept emails if the sending domain does not have any of those
253
00:29:47,520 --> 00:29:54,240
DNS entries in their zone. So they do check if there is a spare record, if there is a demarc record,
254
00:29:54,240 --> 00:30:02,000
uh, and such. So, and some companies, especially, let's say, small and medium-sized businesses,
255
00:30:02,000 --> 00:30:13,760
um, how should I phrase it? Um, simply edit the required DNS records to the company DNS zones,
256
00:30:14,800 --> 00:30:22,960
but the configured values, more or less state, I don't care except anything, right? Except from
257
00:30:22,960 --> 00:30:34,320
any sending IP, which is not good. It's like having none. So this, so this case, especially the demarc
258
00:30:34,320 --> 00:30:44,080
records, so the demarc record describes, uh, or defines a policy, uh, which might or might be not
259
00:30:44,080 --> 00:30:56,480
being, um, recognized by the receiving party. And it describes what to do if SPF or DKM or SPF and DK
260
00:30:56,480 --> 00:31:10,240
money, those fails. And the least risky policy is none. So do nothing. So this is more or less like,
261
00:31:10,240 --> 00:31:21,600
you know, a floodgate for allowing SPF from wherever. And, um, yeah, the other one would, the next level
262
00:31:21,600 --> 00:31:28,960
would then be Quarantine and the third option is a reject. And I think they are pretty safe explaining,
263
00:31:28,960 --> 00:31:37,360
but nevertheless, this is just what I say as the owner of a domain, how a receiving party should
264
00:31:37,360 --> 00:31:45,520
react. It does not define, uh, explicitly that the receiving party definitely reacts like I wanted
265
00:31:45,520 --> 00:31:50,880
to because there's something called like the administrative override. So a receiving party can say,
266
00:31:50,880 --> 00:32:02,160
yeah, um, our policy is to accept all of the emails because we do not want to, um, lose any
267
00:32:02,160 --> 00:32:09,200
possible email from our clients just, you know, to, uh, miss any kind of a contract or an order or
268
00:32:09,200 --> 00:32:16,240
whatever the reason is. And they can simply override what you said or what you couldn't figure it
269
00:32:16,240 --> 00:32:27,360
for your domain. So there's no guarantee. Um, I think we have this, this people made to people,
270
00:32:27,360 --> 00:32:35,200
but what happened when I say a marketing platform ticket system CRM platforms or other tasks or
271
00:32:35,200 --> 00:32:48,000
AI services, a set mail on, on behalf of the company. Um, my recommendation is you subdomains.
272
00:32:48,960 --> 00:32:59,120
So such services, any of those mentioned, such services should never send emails like directly as,
273
00:32:59,120 --> 00:33:06,960
let's say, at contoso.com as a sending address. They should send as ad use letter dot contoso.com,
274
00:33:06,960 --> 00:33:17,920
right? At, uh, CRM dot contoso.com because in that case, you can, it helps you to identify, um,
275
00:33:17,920 --> 00:33:27,840
the sending environments. And it helps you to, for example, define dedicated SPF and, uh,
276
00:33:27,840 --> 00:33:36,160
the payment on demarc, uh, values for such subdomains. Uh, so there's no requirement that you must
277
00:33:36,160 --> 00:33:43,680
configure those, but you can, which provides a different opportunity because it's simply to control
278
00:33:45,360 --> 00:33:57,600
the sending system is more granular. And, um, what, I think, I think, may, may, make, I think a little bit
279
00:33:57,600 --> 00:34:08,400
about, um, a company that calls you right, Thomas, uh, our emails get, gets, moved by using the connozco,
280
00:34:09,440 --> 00:34:17,360
consorto domain, or what's your, or, where's the gays you process here? And that case, I
281
00:34:17,360 --> 00:34:24,960
definitely would, uh, prefer to see if there is a demarc policy in place because with the demarc policy,
282
00:34:24,960 --> 00:34:31,280
you not only define the, uh, the policy, you know, if, uh, messages have to be rejected or
283
00:34:31,280 --> 00:34:41,680
quarantined, but you define an email address where sending systems, uh, send a so-called demarc report
284
00:34:41,680 --> 00:34:50,960
to because normally I do not know as a company, which other systems in the world use or send emails
285
00:34:50,960 --> 00:34:58,720
using my email address. But with a demarc entry, um, having that so-called, uh, uh,
286
00:34:58,720 --> 00:35:05,200
a Rua, the Rua, and an email address, which is the email address for aggregated demarc reports.
287
00:35:05,200 --> 00:35:16,320
I get an XML report, for example, from, GMX, or from Gmail, um, depending on the configuration I have,
288
00:35:16,320 --> 00:35:23,440
so on a daily basis, weekly basis, whatever I define, um, which I can, then, can analyze because I
289
00:35:23,440 --> 00:35:30,960
get an information from the third, from the, from other S&TP servers, from other email servers,
290
00:35:30,960 --> 00:35:42,240
who send mails with my controls, or.com email, uh, a, a, send valid emails, or, for example,
291
00:35:42,240 --> 00:35:50,160
send not so valid emails. And they are not very, there's a technical report,
292
00:35:50,160 --> 00:36:01,600
so I already said these are XML reports. I prefer to use the multiple demarc report, um, commercial
293
00:36:01,600 --> 00:36:10,400
demarc report engines out there, which then can automatically, uh, decipher such XML and make
294
00:36:10,400 --> 00:36:17,120
nice, fancy dashboard views, which are much more easy to consume and to analyze.
295
00:36:17,120 --> 00:36:23,280
And then you do have to find address. So, for example, if you do have, uh, a demarc policy,
296
00:36:23,280 --> 00:36:30,320
with a piece, a policy equals none, so there's no one over there, everyone can use it, because
297
00:36:30,320 --> 00:36:36,320
edits being received by anybody, like a valid email, because I said so anyone can send,
298
00:36:37,360 --> 00:36:43,520
right? So I then have to find you my SPF records, um, because there's a risk thing, especially
299
00:36:43,520 --> 00:36:50,080
about SPF records, because there is a little bit, uh, a technical defined limit of a maximum of
300
00:36:50,080 --> 00:36:59,440
10 so-called SPF lookups. So, for example, my SPF record is far too long and the important systems are,
301
00:36:59,440 --> 00:37:06,640
are on a lookup position, 11 or 12, they might, they won't be properly rendered by receiving party.
302
00:37:07,280 --> 00:37:15,920
So, SPF optimization is a tricky thing and, um, if you use multiples external Z-Services,
303
00:37:15,920 --> 00:37:23,040
it's a good thing to move those then to, uh, as mentioned, to subdomains, because then you have, um,
304
00:37:23,040 --> 00:37:24,720
much more options.
305
00:37:24,720 --> 00:37:34,960
Well, when I think a long time, we have this, this, this, pushing problems, why,
306
00:37:35,760 --> 00:37:42,160
why is still so effective all all these, these, these many years, I think we have all these,
307
00:37:42,160 --> 00:37:48,800
these modern security controls, we have to defend them. Why, why, there's a, why, I have no one
308
00:37:48,800 --> 00:38:03,040
found here a solution? Well, how should I phrase it? Um, phishing emails have gone, I've got
309
00:38:04,880 --> 00:38:13,760
excellent of the years, you know, in the very beginning, they were easy to identify, right, misspellings,
310
00:38:13,760 --> 00:38:21,440
um, whatever, it was a pretty obvious, this is not a professional email, but these days,
311
00:38:21,440 --> 00:38:34,240
um, the phishing emails look like a proper email from a delivery service because, for whatever reason,
312
00:38:34,240 --> 00:38:39,840
everybody of us, you know, is in need for, let's say, for, for watching our for such a notification,
313
00:38:39,840 --> 00:38:45,440
because we have something, you know, all that somewhere, and for whatever reason, yeah, and I'm
314
00:38:45,440 --> 00:38:51,920
writing for the notification emails of the, uh, the HL, and yeah, yeah, or whatever attracts me,
315
00:38:51,920 --> 00:39:03,360
right? And it's, it, to be honest, there are certain moments, so known then, where such emails,
316
00:39:03,360 --> 00:39:12,240
even, but say, nearly got me, but at the very end, because the easiest thing is to
317
00:39:12,240 --> 00:39:22,000
watch out for if you move your mouse over a hyperlink in such an email, how, what does the link say in
318
00:39:22,000 --> 00:39:30,160
the, um, mouse over so in the tooltook, uh, you, uh, because the easiest thing these days is to embed
319
00:39:30,160 --> 00:39:39,920
some kind of a very similar character, which looks similar, for example, like an O or a zero,
320
00:39:39,920 --> 00:39:45,600
but is a character from a different chassis or from a different language from a different
321
00:39:45,600 --> 00:39:53,360
low-cal, which in the very first moment, looks like, um, it is no, but it isn't, and therefore,
322
00:39:53,360 --> 00:40:00,880
the different domain, which routes me to a very good fancy company site for a delivery service,
323
00:40:00,880 --> 00:40:06,400
which looks with the very same, and then, yeah, um, me unsure, but uh, quickly please enter your
324
00:40:06,400 --> 00:40:13,680
credentials, um, because we do have to verify and out of a sudden, bong, you even, um, you know,
325
00:40:13,680 --> 00:40:21,840
gave your username, add valid password as you think, to a third party. And this can even happen,
326
00:40:22,560 --> 00:40:31,040
I had a very same situation, uh, just a few, let's say two or three months ago, where I received
327
00:40:31,040 --> 00:40:42,720
a one-drive sharing link, which was very well made. Even the website looked pretty good,
328
00:40:42,720 --> 00:40:49,680
but then I was a little, no, as always, even so, especially, called cancer, use cancer,
329
00:40:50,400 --> 00:40:57,120
at ass summaries, or, for example, just ask the sender of that email, did you send me that?
330
00:40:57,120 --> 00:41:04,960
Is there a real email? There is no need to access that very content in that very minute.
331
00:41:04,960 --> 00:41:10,160
Double check, if it, so, it looks or feels suspicious.
332
00:41:10,160 --> 00:41:18,000
Yeah, there was one attack, I really felt really funny, it is, or really, really creative, was the
333
00:41:18,000 --> 00:41:24,000
R& Microsoft, uh, they, they changed their N to the R& and it looks like it's more,
334
00:41:24,000 --> 00:41:29,840
this, this, this, I've, I've thought, thought this was, it was a really funny, funny, good idea.
335
00:41:29,840 --> 00:41:35,040
Yes, it was, because especially depending on the resolution of the device, especially, especially
336
00:41:35,040 --> 00:41:42,000
if you're, your mobile device, right, it simply looks like them, because just that final
337
00:41:43,120 --> 00:41:49,760
digit between the two characters, which you normally, you know, on a spot I've had this pay,
338
00:41:49,760 --> 00:41:59,440
you simply don't see. It was more, this was a really, really funny, uh, attack, father thing.
339
00:41:59,440 --> 00:42:06,880
But, uh, what, what, what role can, can Microsoft Defender, uh, I think Microsoft Defender
340
00:42:06,880 --> 00:42:14,000
for Office 365 play and preventing and investigating the text? I think the very, the most important
341
00:42:14,000 --> 00:42:23,760
functionality these days, I say is the, um, uh, saffering functionality. So that it does not only
342
00:42:23,760 --> 00:42:34,880
scan in hyperlinks while they are, uh, during the process of, um, delivering that email, but to
343
00:42:34,880 --> 00:42:42,240
rewrite the embedded email link to a saffering URL. So the very time that you click that link,
344
00:42:42,240 --> 00:42:48,080
you do not directly go to the final target, but you're being the redirected to the Defender
345
00:42:48,080 --> 00:42:59,360
saffering portal. Um, and again, depending on the configuration in your tenant, you can either,
346
00:42:59,360 --> 00:43:05,440
if it's malicious, you're, you journey to that website or to that target link ends here,
347
00:43:05,440 --> 00:43:12,000
right? Because it's being identified and the administrator configured the saffering functionality,
348
00:43:12,000 --> 00:43:21,600
you say, okay, uh, it's pretty suspicious. You can't move on to that link. Because when I say you
349
00:43:21,600 --> 00:43:26,560
have to configure it, because there's an option to allow the end user, the option to,
350
00:43:27,840 --> 00:43:33,040
all right, so to move on to the very target anyway, which, well,
351
00:43:33,040 --> 00:43:44,160
the words that I think of are not for the public, um, right? So when this is,
352
00:43:44,160 --> 00:43:52,800
it's important, and um, it's, it's, the, the, the, the information for the security teams. So
353
00:43:53,520 --> 00:43:58,560
Defender that case, because Defender has a dedicated portal, which even with your role as an
354
00:43:58,560 --> 00:44:05,440
exchange administrator and enter, you have access to alpha to the functionality of the Defender
355
00:44:05,440 --> 00:44:14,560
portal, which is messaging, uh, related, right? So it's not the case that you only have access to
356
00:44:14,560 --> 00:44:20,080
the exchange admin center as an exchange administrator, but you do have a, for example, access to the
357
00:44:20,080 --> 00:44:25,920
Defender portal and to the messaging security staffs for the messaging, uh, to the email explorer,
358
00:44:25,920 --> 00:44:33,840
to verify very granularly any, or each email that is being routed via, um, yeah, which went through
359
00:44:33,840 --> 00:44:43,280
Defender. You can analyze the attachments, links, whatever you need. And again, it's a licensing thing.
360
00:44:44,800 --> 00:44:51,600
Yeah. So I recommend if, if you mean it's serious, or if you're serious, when it comes to
361
00:44:51,600 --> 00:45:01,600
email security, take definitely a look at the Defender P1 and P2 feature set and watch out for where
362
00:45:01,600 --> 00:45:10,480
Defender P1 and P2, uh, where's the part of any license plan? Sorry, example, it doesn't make any
363
00:45:10,480 --> 00:45:17,280
sense to license it on its own because, uh, you watch out or take a look at, uh, if it's, uh, for example,
364
00:45:17,280 --> 00:45:27,600
included in Microsoft 365, uh, E5, E3, depending on the functionality you want. Yes. It comes with a cost,
365
00:45:27,600 --> 00:45:33,440
but security comes always with a cost, right?
366
00:45:37,200 --> 00:45:45,760
Um, what I think about is, is a little bit, um, what, what role do is do is, I say, uh,
367
00:45:45,760 --> 00:45:52,240
infrastructure as a code play for, for, for, for, for, for exchange. Is that the topic?
368
00:45:52,240 --> 00:46:04,560
So, inf, uh, the, um, well,
369
00:46:06,160 --> 00:46:13,440
anything about having in now an API for, um, exchange, uh, let's say for Microsoft 365,
370
00:46:13,440 --> 00:46:19,520
in that case for parts of exchange online for Microsoft configuration API for M365,
371
00:46:19,520 --> 00:46:29,600
you definitely can, um, extract your, your current configuration and use that the, uh,
372
00:46:30,320 --> 00:46:40,640
code, quote unquote, so the export of configuration as a default set cell. If anyone changes
373
00:46:40,640 --> 00:46:46,240
the configuration using PowerShot or UI, some like any changes to your production environment,
374
00:46:46,240 --> 00:46:51,280
and then you'd have a data comparison between the configuration, which it should, how it should be,
375
00:46:51,280 --> 00:46:57,920
and see the difference compared to the products that you can then reverse such configurations
376
00:46:57,920 --> 00:47:03,440
because the configuration has to be done using the XML set and not the live configuration, the 10.
377
00:47:03,440 --> 00:47:14,560
All right. And, um, oh, I think, I'm not really sure if it's that, but I think so, because I,
378
00:47:14,560 --> 00:47:22,400
I think I can do the, the, the, I have, yeah, we have say PowerShell, we have, uh, the graph API,
379
00:47:22,400 --> 00:47:29,680
and we have now, we have mcp, did you think we have the new risk through these mcp on,
380
00:47:29,680 --> 00:47:31,840
from for the exchange out?
381
00:47:31,840 --> 00:47:46,160
Well, so mcp and anything that's, let's say, which is normally used by, uh, agents, connectors,
382
00:47:46,160 --> 00:47:55,760
and such, which normally targets only content, not the configuration itself. Right. And I
383
00:47:55,760 --> 00:48:08,800
can't say anything about, you know, about the future and what's going to be, but it's, in that case,
384
00:48:08,800 --> 00:48:18,240
more risky to you, for example, having, uh, wrongly configured permissions for any programmatic access to
385
00:48:18,240 --> 00:48:27,520
content, regardless of its sharepoint exchange, online or such, because exchange, online and sharepoint,
386
00:48:27,520 --> 00:48:37,920
uh, these two are the largest, let's say storage providers for the m365 space.
387
00:48:38,800 --> 00:48:46,880
Right. Because a very similar of all those, nice services that we use utilize,
388
00:48:46,880 --> 00:48:53,760
either of the two, so sharepoint or exchange as a storage engine for kind of files for stuff
389
00:48:53,760 --> 00:49:01,920
that you create as a user. And especially from an exchange perspective, your, nice and fancy
390
00:49:01,920 --> 00:49:10,560
inbox that you see in outlook is just a very small part of the folder structure of your inbox. So
391
00:49:10,560 --> 00:49:16,240
most of the folder structure of your exchange, online inbox is being hidden from you because it's
392
00:49:16,240 --> 00:49:29,280
only accessible via APIs. Anyway, um, yeah, uh, what I a little bit think about it's, we have these,
393
00:49:29,280 --> 00:49:38,240
uh, what is this called? I think Microsoft secure score. Yeah. Um, should organization use such
394
00:49:38,240 --> 00:49:47,120
tools as, as a primary security matter, or is it more, uh, yeah, it's green, it's fine. It's
395
00:49:47,120 --> 00:49:55,520
stuff. It's definitely not a one way street. So the secure score or even the compliance score that
396
00:49:55,520 --> 00:50:05,680
we have for the compliance portal are tools. They can help me as a, uh, as I'm illustrator, the owner
397
00:50:05,680 --> 00:50:12,960
of a tenant to make configuration decisions that Microsoft recommends to me. So if you take a
398
00:50:12,960 --> 00:50:20,240
complete close look at these things, uh, at both of the scores, um, they have always two sides.
399
00:50:20,240 --> 00:50:26,560
There's one that stuff Microsoft config is, which is normally 100% already because it's stuff that is
400
00:50:26,560 --> 00:50:31,520
configured by Microsoft in the environment in real infrastructure for you. And then there's
401
00:50:31,520 --> 00:50:36,320
the customer side, the stuff that I have to configure, which I have to make decisions on.
402
00:50:36,320 --> 00:50:44,880
So I don't have to make, um, educated decisions on. And the decisions to make,
403
00:50:45,600 --> 00:50:52,240
that's a funny part because secure score in that case is a, um, marketing vehicle because
404
00:50:52,240 --> 00:50:57,280
some things you can only configure if you do have a proper license in your tent.
405
00:50:57,280 --> 00:51:04,400
Right. So securing some stuff, let's, let's read so very little for my company. I do want to
406
00:51:04,400 --> 00:51:14,000
have this. Let's set, yeah, click here to start a trial. So watch out. So, um, but again, you
407
00:51:14,000 --> 00:51:20,720
do have to make an educated decision, um, on the required security functionality that you do want
408
00:51:20,720 --> 00:51:28,560
to enable disabled. So depending on what it's about, but again, it depends a proper licensing in your
409
00:51:28,560 --> 00:51:42,480
tent. Yeah. When, when we think, uh, all, all these, these topics, um, can we say how, how important
410
00:51:42,480 --> 00:51:48,560
is operational discipline compared with the individual security settings?
411
00:51:48,560 --> 00:52:01,760
Um, what do you mean by this? So just, um, yeah, we have these, I say, uh, I have my, my,
412
00:52:01,760 --> 00:52:09,040
my security settings, my individual stuff, I can click, I don't know, my, I don't know, uh, my
413
00:52:09,040 --> 00:52:16,480
defender, my, uh, I don't know what, what, all, all these, uh, as an end user, yeah, the end user,
414
00:52:16,480 --> 00:52:22,960
and, and how, our importance is the end user and how, uh, is, is the, yeah, say, the, the,
415
00:52:22,960 --> 00:52:31,360
what the company does on their side to, to, yeah, have an operational excellence or,
416
00:52:31,360 --> 00:52:39,360
operational discipline, it's always, you know, the tricky part is to find a proper balance on the
417
00:52:39,360 --> 00:52:48,560
one hand to keep the end users in a productive state so that I'm not going to limit them too much,
418
00:52:48,560 --> 00:52:56,400
but at the very same time, not opening too much or allowing the security level too much.
419
00:52:57,040 --> 00:53:06,160
So it's not that easy because I see clients, uh, on each side, uh, so some of them are very, very
420
00:53:06,160 --> 00:53:15,360
restrictive. Uh, for example, hardening the end client system where you do not even see your C drive,
421
00:53:15,360 --> 00:53:24,240
right? And on the other side where, and users are simply, you know, um, yeah, you are a local
422
00:53:24,240 --> 00:53:29,040
administrator, uh, because it keeps it simple for our help desk because you can install your printer,
423
00:53:29,040 --> 00:53:35,120
whatever you want, uh, on your own. So there is not even a process in place. For example, I do have
424
00:53:35,120 --> 00:53:42,560
to request being administrator or having a administrative rights on my client for the next hour
425
00:53:42,560 --> 00:53:51,760
and providing a reason to do so. So, and anything in between, right? But it, it, normally, it depends on
426
00:53:51,760 --> 00:53:57,760
your business. It depends on the data you're working with. So if you're only the, uh, let's say, um,
427
00:53:57,760 --> 00:54:04,400
in the medical sector, or have any sensitive data, which is in the regulated, uh, section,
428
00:54:04,400 --> 00:54:12,720
yeah, it's not necessarily the best idea to move to the cloud as an example without any additional
429
00:54:12,720 --> 00:54:23,280
configuration in place. Um, I think what's, or my favorite topic is governance, uh, and compliance,
430
00:54:23,280 --> 00:54:30,960
and, uh, yeah, also we have the DLP topic. So, so how should we, or how should messaging security
431
00:54:30,960 --> 00:54:41,680
connect it with the governance and compliance? Um, but it comes to compliance, use M365 DLP policies,
432
00:54:41,680 --> 00:54:49,360
use, uh, pervious sensitivity labels, um, but do it in a very,
433
00:54:49,360 --> 00:55:01,200
well, thoughtful and plentiful manner, right? Because rolling out the label, uh, sensitivity
434
00:55:01,200 --> 00:55:10,400
labels rolling out to DLP policies and applying, um, such things to objects to files, to emails,
435
00:55:10,960 --> 00:55:17,920
to folders, to other storage containers is not something that you're going to change, uh, easily,
436
00:55:17,920 --> 00:55:29,040
as soon as it is a product of use, right? But use those, um, this functionality to protect your
437
00:55:29,040 --> 00:55:34,800
data because of the other, if good things about sensitivity labels is, that's a sensitivity label,
438
00:55:35,520 --> 00:55:44,720
are travel with the secured object, right? Yeah, if I put the label on a file, it stays with that file.
439
00:55:44,720 --> 00:55:51,840
Regardless if I do it, uh, attach it as a tuning email, if I proiled to you, why USB stick or whatever
440
00:55:51,840 --> 00:56:03,120
uploaded, wherever a label document is a label document. Do you think it? Um, it's interesting. I think
441
00:56:03,840 --> 00:56:10,880
actually, this is not the, these topics, but comes in my mind. What's when, when the, the, the baddest
442
00:56:10,880 --> 00:56:19,200
parts or bad things happens, you're totally compromised, um, okay, you have done your, your backup,
443
00:56:19,200 --> 00:56:25,920
but, uh, I think, yeah, you can have, I don't know, uh, the company, it's, it's really complex, so,
444
00:56:25,920 --> 00:56:32,000
they save their, their backups and they have their data in these backups, but they,
445
00:56:32,560 --> 00:56:39,200
all to lose their, their, their configuration, how can they, yeah, I don't know, uh, backup,
446
00:56:39,200 --> 00:56:44,480
their, their, their configuration, is there any best practice and, uh, show, they own, show,
447
00:56:44,480 --> 00:56:48,720
they use their best, their, the, the configuration parts, when they get hacked.
448
00:56:48,720 --> 00:56:57,920
Well, I think this is definitely, uh, first of all, thing that you have to get in contact with your
449
00:56:57,920 --> 00:57:05,120
clock provider, it just being hacked and, for example, even having lost your tenant, it's not only
450
00:57:05,120 --> 00:57:12,000
about the data, for example, but all the domains and all your identity domains in that very tenant.
451
00:57:12,000 --> 00:57:19,440
You know, how useful is a configuration for my contoso.com identity stuff when, uh, when I
452
00:57:19,440 --> 00:57:25,840
cannot use that contoso.com domain in a newly set up tenant, because the system, the
453
00:57:25,840 --> 00:57:29,760
abstracts, the files tells me when I do want to add that domain, nah, that domain is already
454
00:57:29,760 --> 00:57:33,680
registered with another tenant and, and I do not have access to that tenant anymore.
455
00:57:33,680 --> 00:57:41,520
So there's no simple and quick answer to that. But if your responsible, um,
456
00:57:41,520 --> 00:57:49,520
come, you do should have a business continuity, uh, option for such a scenario in place,
457
00:57:51,280 --> 00:57:59,840
because starting thinking about that situation in that very moment is not the best idea because
458
00:57:59,840 --> 00:58:10,880
it's quite a stressful situation. When I'm also from an interesting, what, what did you think about AI?
459
00:58:10,880 --> 00:58:16,960
How, how will AI change email security in the next few years? What, what did you think?
460
00:58:19,600 --> 00:58:31,680
email security, um, I think would benefit from it, but again, because yeah, all the malicious
461
00:58:31,680 --> 00:58:38,640
parties are going to use AI, you know, to identify, um, zero-day compromises of exchange server,
462
00:58:38,640 --> 00:58:45,040
and maybe all the stuff that might be still in place in exchange online, whatever, so, um,
463
00:58:45,840 --> 00:58:52,560
this is the, is one side on the other side, AI, yeah, it's a small,
464
00:58:52,560 --> 00:59:00,720
you know, if it's, is it AI, or is it just machine learning, well, how can we say, because,
465
00:59:00,720 --> 00:59:06,960
this is already learning how you work and how you, how you send emails, right?
466
00:59:09,760 --> 00:59:24,400
I think everything, if, if elves, uh, contains AI, but, maybe, um, yeah, um,
467
00:59:24,400 --> 00:59:34,560
you're, you're, what, what, what, what, what did you, I don't know, how I spelled it right,
468
00:59:35,760 --> 00:59:41,280
granny, cause is your, is your company? Yes, what, what, what did you do with, with, with your company,
469
00:59:41,280 --> 00:59:50,320
or what project working you on? So, um, I'm primarily, um, clients of all sizes, so it's,
470
00:59:50,320 --> 00:59:57,120
it's a small, medium-sized businesses, but even, uh, globally large enterprises, anything in between,
471
00:59:57,120 --> 01:00:04,320
happy to, you, you know, move their on premises environment to a currently supported state, so,
472
01:00:04,320 --> 01:00:09,280
there's quite a lot of work to do for upgrading exchange server infrastructure to exchange
473
01:00:09,280 --> 01:00:15,840
those subscription addition. Unbelievable, even though that exchange was 2016 and 2019 are out of
474
01:00:15,840 --> 01:00:22,560
support since October last year, but, ah, they're still out there, and I even saw it exchange
475
01:00:22,560 --> 01:00:30,960
over 2013 environment last week, so, yes, because they work, they, they do not stop, they run,
476
01:00:30,960 --> 01:00:38,240
so, you know, never change running system, period, and moving to exchange online in a supported
477
01:00:38,240 --> 01:00:43,280
manner, for example, using some kind of a hybrid configuration, this is the software I,
478
01:00:43,280 --> 01:00:49,040
where clients definitely need help, because each infrastructure and the possibilities to connect
479
01:00:49,040 --> 01:00:57,600
to exchange online, either for a single full migration, so moving all mailboxes to exchange
480
01:00:57,600 --> 01:01:07,040
online, then getting rid of, ah, on-prem, or for a, ah, full hybrid setup, because the environment will
481
01:01:07,040 --> 01:01:14,400
stay in a hybrid setup for, for ever, because for, well, some companies tend to say that, ah,
482
01:01:14,400 --> 01:01:20,240
some content, let's say, the sea level mailboxes remain on premises because there's highly sensitive
483
01:01:20,240 --> 01:01:26,640
content, and we do not trust the cloud providers, yadda, yadda, yadda, um, because they do not understand
484
01:01:26,640 --> 01:01:32,400
the content of sensitivity labels, but that's a different story. Um, so, and anything in between,
485
01:01:32,400 --> 01:01:40,240
and most companies already have some kind of a security flow, a gateway, a combination in place,
486
01:01:40,240 --> 01:01:49,200
and then they need to have consultancy about, can we use it, ah, with exchange online, can we,
487
01:01:49,200 --> 01:01:54,320
how do we have our mailboxes, all of the, the entry, the, the, the, it was changed from on-prem
488
01:01:54,320 --> 01:02:03,840
to the exchange online and such, so, let's just stop it, so, ah, I do. Yeah. Cool, and, ah, you are also
489
01:02:03,840 --> 01:02:09,120
our podcast those with the exchange, um, plaque, um, plaque, what, what can listeners expect from
490
01:02:09,120 --> 01:02:17,920
your podcast? So the exchange, um, plaque, the podcast is a, ah, it's not, I do not publish on a regular
491
01:02:17,920 --> 01:02:24,240
basis, because it's about technical content, technical situations, stuff that you need to know,
492
01:02:24,240 --> 01:02:32,160
or that you don't want to have to watch out for, ah, and, and this stuff, and, ah, I do have, um,
493
01:02:32,160 --> 01:02:37,600
come time to time, I have guests, where we talk about their expertise, that they are sharing
494
01:02:37,600 --> 01:02:45,920
the knowledge, so, ah, I just had the, the upcoming episode I talk with, um, my team's end up about,
495
01:02:45,920 --> 01:02:52,240
well, about DMug and such, because since, ah, this year DMug is now an official standard, it's not
496
01:02:52,240 --> 01:03:00,080
just an, ah, proposal anymore. And, well, so exchange on plaque is focusing as you can guess,
497
01:03:00,080 --> 01:03:07,200
on exchange and messaging related to topics, so, and it's more or less seen in a combination,
498
01:03:07,200 --> 01:03:14,720
with the community project website for exchange, for it, it's pros.block, which is the other thing
499
01:03:14,720 --> 01:03:22,640
that I do, um, because I believe that we need to persist, exchange related knowledge,
500
01:03:22,640 --> 01:03:26,320
because I think it's vanishing, right?
501
01:03:26,320 --> 01:03:38,720
So, um, yeah, we have a little bit over the time, but I hope you have some time for the rapid
502
01:03:38,720 --> 01:03:46,640
fire round, to the end of it normally in every, every round, is it okay? Okay, um, yeah, it's, ah,
503
01:03:46,640 --> 01:03:51,680
I asked the question, you give a short answer, so exchange server, exchange online.
504
01:03:51,680 --> 01:03:53,680
Exchange server.
505
01:03:53,680 --> 01:03:58,080
Hybrid, temporary, fast or a long term architecture?
506
01:03:58,080 --> 01:04:00,320
Long term architecture.
507
01:04:00,320 --> 01:04:02,960
Power shell or portal?
508
01:04:02,960 --> 01:04:04,960
Power shell.
509
01:04:04,960 --> 01:04:06,880
Always.
510
01:04:08,240 --> 01:04:14,880
London is famous for for the big band and, um, the parents is famous for the,
511
01:04:14,880 --> 01:04:17,360
Eiffel Tower, what's Hucleof in famous for?
512
01:04:17,360 --> 01:04:27,040
Um, again, so Hucleof is definitely famous for a TV online shopping center, which does have,
513
01:04:27,040 --> 01:04:30,320
it's a Germany distribution center there.
514
01:04:30,320 --> 01:04:33,280
Not naming the TV channel.
515
01:04:33,280 --> 01:04:37,680
The most underrated security controller.
516
01:04:38,000 --> 01:04:41,360
Oh, you said quick, huh?
517
01:04:41,360 --> 01:04:47,520
Um, save links.
518
01:04:47,520 --> 01:04:53,520
Um, most dangerous default setting.
519
01:04:53,520 --> 01:05:02,080
The default domain in your M365 tent.
520
01:05:04,480 --> 01:05:09,120
Um, what do you say is the most overrated security metric?
521
01:05:09,120 --> 01:05:13,040
The most overrated you said.
522
01:05:13,040 --> 01:05:19,920
Oh, oh, that's a tricky one.
523
01:05:19,920 --> 01:05:22,080
Next question.
524
01:05:22,080 --> 01:05:28,720
Okay, if Satya Dadaia called you and said Thomas, you get all the money and the resources
525
01:05:28,720 --> 01:05:30,800
for Microsoft, you, you, you need.
526
01:05:30,800 --> 01:05:33,440
What feature will you be about, please, change?
527
01:05:33,440 --> 01:05:36,480
Uh, do you want to give you an exchange server?
528
01:05:36,480 --> 01:05:40,880
Uh, I would have definitely, uh, two things, sorry for that Satya.
529
01:05:40,880 --> 01:05:49,360
Um, it's on the one hand, a, uh, DK implementation, uh, for exchange server.
530
01:05:49,360 --> 01:05:58,800
And an automatic automated certificate exchange, watching out for the short-time server certificate
531
01:05:58,800 --> 01:06:05,280
lifetimes, built in into the product. Okay, then the last one, uh, who showed I
532
01:06:05,280 --> 01:06:07,520
and why next and what question should I ask?
533
01:06:07,520 --> 01:06:18,560
Um, did you already talk to Manfred Haber?
534
01:06:18,560 --> 01:06:24,960
No. Um, yeah, so I think Manfred Haber is the right one to choose and because he, uh,
535
01:06:24,960 --> 01:06:33,200
provides, uh, infrastructure for, uh, a service server and ACS, um, infrastructure for hybrid.
536
01:06:33,200 --> 01:06:36,800
So, the same question on hybrid stuff.
537
01:06:36,800 --> 01:06:42,080
So is it either, uh, as a, as a local or anything in between?
538
01:06:42,080 --> 01:06:49,760
Oh, okay, cool. So, yeah, um, then my final question is, uh, Thomas, if you leave all of
539
01:06:49,760 --> 01:06:54,880
us with one clear principle about secure and exchange servers, hybrid environments and microsys,
540
01:06:54,880 --> 01:06:57,200
the five messaging, what will it be?
541
01:06:57,200 --> 01:07:05,200
Um, stay up to date, follow the, uh, exchange product group log, patch your exchange servers if you
542
01:07:05,200 --> 01:07:14,240
have any and watch out for default changes, uh, and just the last one, remember the duplication of
543
01:07:14,240 --> 01:07:21,440
exchange web services, exchange online. Okay, then, Thomas, thank you for joining me on the
544
01:07:21,440 --> 01:07:26,080
um, 65 podcast and sharing such, uh, yeah, detailed and practical look into Microsoft
545
01:07:26,080 --> 01:07:31,440
messaging security. Yeah, you're experiencing across the exchange server, hybrid environments,
546
01:07:31,440 --> 01:07:36,000
exchange online enterprise architecture training and incident group boards gives the,
547
01:07:36,000 --> 01:07:42,640
our list does a unique perspective on the, uh, topic that almost, yeah, affects every organization.
548
01:07:42,640 --> 01:07:43,840
They, let's use emails.
549
01:07:46,160 --> 01:07:52,800
The key messages from today's conversion is key, Microsoft's messaging platforms can be powerful
550
01:07:52,800 --> 01:07:58,560
and secure, but security does not happen automatically. It depends on identity protection.
551
01:07:58,560 --> 01:08:04,320
Correct configuration, secure mail flow, continuous monitoring, strong operational process
552
01:08:04,320 --> 01:08:12,000
and clear understanding of their responsible sits. Yeah, you can learn more about Thomas if you
553
01:08:12,000 --> 01:08:18,480
look at his company, uh, website, thank you, us and his, uh, block and his YouTube channel and also
554
01:08:18,480 --> 01:08:25,440
the exchange, um, like podcast. Yeah, we will include all the links in the show notes on the um,
555
01:08:25,440 --> 01:08:33,200
65 podcast page. Yeah, if you enjoy these episodes, please subscribe to the um 65 show podcast,
556
01:08:33,200 --> 01:08:38,400
share with your colleagues and yeah, let us review here. It's, it's very important for us,
557
01:08:38,400 --> 01:08:46,320
small, uh, podcast tools and yeah, Thomas, thank you again for for joining us, uh, or me today
558
01:08:46,320 --> 01:08:51,440
and every listener, keep learning, keep questioning your defaults and keep building
559
01:08:51,440 --> 01:08:57,360
safer Microsoft environments. So see you in the next episode on the MCC35 podcast to show or
560
01:08:57,360 --> 01:09:03,040
on the exchange. I'd like to. Thanks for having me.