O365Con19 - What Do You Mean 90 days Isn't Enough - Paul Hunt
•
1 j'aime•264 vues
Office 365 & SharePoint Connect 2019 Session
Recommandé
Recommandé
Contenu connexe
Similaire à O365Con19 - What Do You Mean 90 days Isn't Enough - Paul Hunt
Similaire à O365Con19 - What Do You Mean 90 days Isn't Enough - Paul Hunt (20)
Plus de NCCOMMS
Plus de NCCOMMS (20)
Dernier
Dernier (20)
O365Con19 - What Do You Mean 90 days Isn't Enough - Paul Hunt
- 1. Paul Hunt - MVP What do you mean 90 days audit isn’t enough?
- 3. Who am I?
- 4. Who am I?
- 5. Agenda • Why do we need Audit? • What do we get out of the box? • What can I do with the Microsoft Stack? • What can I build myself? • What Third parties can do this for me?
- 6. What’s the point of auditing? “If I were to run, I’d run as a republican. They’re the dumbest group of voters in the country. They believe anything on Fox News. I could lie and they’d still eat it up. I bet my numbers would be terrific” Donald Trump – People Magazine 1988
- 7. What’s the point of auditing? • People magazine keep every copy of every magazine that has been printed. • There was no record of a 1998 interview. • No article printed in the 80s or 90s contain mention of the Republican party in articles about Donald Trump.
- 8. When King Leonidas and the 300 Spartans took on the Persian army at the battle of Thermopylae, they believed that they could hold their ground due to the mountain’s impenetrable walls. What’s the point of auditing?
- 9. They forgot about the goat paths! The Persian army snuck in behind their defences and surrounded them, defeating the Spartans. What’s the point of auditing?
- 10. Employee behaviours and needs are potentially your goat paths. • Demand for agility • Lack of awareness • Phishing e-mails • Unsecured networks • Poor storage of sensitive data • Malicious attack What’s the point of auditing?
- 11. But we can help to protect against a lot of this!
- 12. Assume Breach!
- 14. Sobering stats UK Gov – Cyber Security Breaches Survey 2018 123 days.
- 15. 123 days.
- 16. O365 Log Retention Period 90 Days Retention
- 17. O365 Log Retention Period 90 Days Retention 365 Days Retention
- 18. **Assuming mailbox auditing is enabled!
- 19. *Azure logs have lower latency for AD logs!
- 20. What’s wrong with Office 365 auditing?
- 21. Do What are the options?
- 22. • Doing nothing – Out of the box audit • D.I.Y – using the Management Activity API • Azure Log Analytics • Additional services MCAS & Sentinel • Third Party Options What are the options?
- 24. DIY – Extracting data using APIs http://bit.ly/O365ManagementAPI
- 25. DIY – Extracting data using APIs
- 28. Microsoft Azure Options http://bit.ly/Office365ManagementSolution •But easier to configure in Azure Sentinel! • One click..ish • And free ingestion of Office 365 data!
- 32. Vendor O365 Audit Log (via API) Azure events via Event Hub On-prem / Cloud ✓ ✓ ✓ ✓ ✓ ✓ ✓ Third Party Options
- 33. Transvault
- 34. Syskit – Security Manager
- 36. Third Party – Considerations
- 37. Closing thoughts….. Just how important is retention to you?
- 38. 123 days.
- 39. System Log Type Retention Period Office 365 Audit log 90 days* Azure AD Audit log Sign-ins Azure MFA usage 30 days** Azure Identity Protection User at Risk Risky Sign-ins 30 days (AAD P1)** 90 days (AAD P2) Log Analytics Any streamed logs 30-730 days*** Azure Sentinel (Preview) Office 365 (Some!) Azure AD Azure IP Others… Driven by log analytics*** Cloud App Security Activity Log Discovery Data Alerts 180 days 90 days 180 days Transvault Office 365 1-3 Years**** Hubstor Office 365/Azure Event Hub Unlimited IBM/Splunk Office 365/Azure Event Hub Not known. Syskit Office 365 Unlimited