Include IPv6 in Azure AD policies
Criminals of the world would love to know that they don't have to deal with MFA if they phish you while you're in the office. Now we've taken that option away
amy
211 posts
Conclusions from reading threat analyst reports
Despite criminal masterminds and "security researchers" always coming up with the next greatest tool for causing financial damage to our businesses and economy, there are patterns.
Ransomware prevention, not defense
Defense implies a reactionary approach. Prevention set the scene where ransomware can't get you in the first place.
Setup up automated investigation and response
Many vendors call this Endpoint Detection and Response (EDR) or Extended Detection and Response (XDR). Microsoft calls it Defender for Business.
How to manage Office updates with Microsoft 365
It's one of the least known and used portal in the entire Microsoft 365 suite. Too bad, because it contains some configuration and automation gems. Let's see how we use it to automate Office updates.
Protect accounting firms from spreading malware via uploaded tax documents
Fortunately, Defender protects against this when configured correctly. In addition to the Defender for Endpoint sensor installation, Attack Surface Reduction rules and certain anti-virus configurations should also be deployed
Configure security settings for Edge
The Chrome version of Edge has a full set of Group Policy and Intune configuration options that can enhance security.
Avoid PlugX malware
Once these two items have been set the ability of PlugX to take advantage of innocent people should be thwarted.
Disrupting Qakbot
All it took was an email attachment policy, a little hardening of Microsoft Office and the configuration of the built-in anti-virus software
How to isolate a device using Defender
let's say that you've come across a situation, and you want to remove a device from the network - remotely, while you investigate. Interestingly this device, need not be enrolled in Defender for Business. It can an unmanaged device to
How to prevent weak MFA session token theft
Microsoft recently published an analysis of the techniques used by one popular phishing-as-a-service provider. We'll take that analysis and implement a solution based upon it
Blocking malicious activity – too many email updates
I often get asked how we manage networks without an RMM tool and I always reply that we take full advantage and make use of what Microsoft has to offer. This type of rule is an example of that philosophy.