Featured Blog

Microsoft Defender ATP: Remediate Apps Using MEM

John_Barbare — Mon, 24 Aug 2020 21:00:00 PDT

Introduction

This is John Barbare and I am a Sr Customer Engineer at Microsoft focusing on all things in the Cybersecurity space. In this blog I will walk you through the steps of navigating through the Microsoft Defender Advanced Threat Protection (ATP) portal to see how prone your organization is from an attack or breach from an application perspective. After viewing the different sections, we will see how to remediate and decrease your overall attack surface using Microsoft Endpoint Manager (MEM) so your organization’s security posture will be at a level that your CIO/CISO will be comfortable with. Without further hesitation, let’s get started and jump right into all things Microsoft Defender ATP and MEM.

Licensing requirements

Microsoft Defender ATP licensing requirements:

Windows 10 Enterprise E5
Windows 10 Education A5
Microsoft 365 E5 (M365 E5) which includes Windows 10 Enterprise E5
Microsoft 365 E5 Security
Microsoft 365 A5 (M365 A5)

More information can be found here.

Microsoft Defender ATP for US Government Community Cloud High (GCC High) customers, built in the US Azure Government environment, uses the same underlying technologies as Microsoft Defender ATP in Azure Commercial. This offering is currently available to US Office 365 GCC High customers and is based on the same prevention, detection, investigation, and remediation as the commercial version.

If you currently use Configuration Manager, you also get Microsoft Intune/MEM to co-manage your Windows devices. For other platforms, such as iOS/iPadOS and Android, then you will need a separate license. In most scenarios, Microsoft 365 may be the best option, as it gives you MEM and Office 365. For more information, see Microsoft 365. More information on licensing and changes with licensing for co-management in MEM can be found here.

Prerequisites to use MEM with Microsoft Defender ATP

Deploy a device configuration policy with a profile type of Microsoft Defender ATP (Windows 10 Desktop) to devices that will have risk assessed by ATP.

Login into Security Center – Microsoft Defender ATP Portal

Navigate to Microsoft Defender Security Center and login with your credentials at https://securitycenter.windows.com/

Navigate to Settings and then Advanced features. Make sure Microsoft Secure Score and Microsoft Intune connection are turned to on.

Advanced Settings

Threat and Vulnerability Management

Go to the Threat & Vulnerability Management tab on the left and then click on Dashboard. This dashboard gives your organization an overall picture of the entire security posture broken down into three main categories.

Exposure Score - Reflects how vulnerable your organization is to cybersecurity threats. Depending on the level of the score it will show you if you are less or more vulnerable to attacks. Several factors affect your organization's exposure score: weaknesses discovered in your devices, likelihood of your devices to be breached, value of the devices to your organization, and relevant alerts discovered with your devices. The goal is to lower the exposure score of your organization to be more secure.
Secure Score for Devices – Reflects how your endpoints are more resilient from cybersecurity threat attacks. It reflects the collective security configuration state of your devices across five categories which include Application, Operating system, Network, Accounts, and Security controls. You can select any of the corresponding colored horizontal bars and it will take you to the Security recommendation page. The goal is to remediate the related security configuration issues to increase your score for devices.
Device exposure distribution - Reflects how many devices are exposed based on their exposure level. You can select a slice in the doughnut chart to go to the Devices list page and view the affected device names, exposure level, risk level, and other details such as domain, operating system platform, its health state, when it was last seen, and any tags that are assigned.

TVM Dashboard to access any exposures in your environment

The column on the far right, Top security recommendations, shows the top five software that is impacting your organization from a threat standpoint. They are sorted and prioritized based on your organization's risk exposure and the urgency that it requires. This includes both Microsoft software and third-party installations across your entire organization.

Active Threats and Vulnerabilities

Next, we will click on the Software inventory tab which is located three tabs below the Dashboard. From here, you will see the complete list of every piece of software that is installed in your organization. Click on the Weaknesses tab twice to rank the number of software weaknesses in order from greatest to least. The number of weaknesses corresponds to the number of Common Vulnerabilities and Exposures (CVE). CVE is a list of entries that each contain an identification number, a description, and a minimum of at least one public reference for known cybersecurity vulnerabilities. Under the Threats column, you can click on any icon that is displayed as a red bug to give you threat insights into a likely breach scenario in your environment. The Exposed devices column displays the total number of exposed devices the piece of vulnerable software is installed on. The Impact displays a graph over time with a corresponding score. The lower exposure score means the devices are less vulnerable from exploitation.

Complete software inventory and any known threats to your environment

For a fine-grained list of all the CVEs for a piece of software, click on the name of the actual software and then Discovered vulnerabilities to see each CVE associated with the software version.

Review how many CVEs are associated with an application

Remediation

The next step, we will perform a full remediation based off the security recommendations in the previous section. MEM will be used to update the software which will be selected in the next steps.

Select the Security recommendations tab and then click on the piece of software you want to remediate. We will be updating Microsoft Edge Chromium for this task and we will select it.

A fly out screen will display and on the bottom you can expand the number of exposed and installed devices to see the full list. Next, we will click on the Remediation options button.

Remediation Options in MDATP

Notice for the description it states that submitting a remediation request creates an activity item, which can be used to monitor the remediation progress of this recommendation. It will not apply any changes to devices. Mitigation actions, on the other hand, will be applied immediately. Select the following items in the picture below and click submit.

Opening a ticket and due date

As soon as you select Submit, a pop up window will appear at the top stating a ticket was open.

Notification in MDATP

Seconds later, the gray bar will refresh to green stating a remediation ticket was created in Microsoft Defender ATP.

Notification in MDATP

Select the Remediation tab and you will see the actual ticket and the status inside Microsoft Defender ATP.

Ticket created in MDATP

Navigate to MEM and login with your credentials at https://endpoint.microsoft.com. Click on Endpoint Security and then Security Tasks.

You can see the task that was created and it is referred to as a “Security Task”.

Ticket created and cross synced in MEM

When selecting the task, which is pending for the Microsoft Edge Chromium update, you will see the following information for remediation. If an app is not a managed app, MEM can only provide detailed text instructions as seen in the below image. If the app is managed, MEM will provide instructions to download an updated version and provide a link to open the deployment for the app so that the updated files can be added to the deployment. The admin then remediates the task based on the guidance provided. The guidance varies depending on the type of remediation that's needed. When available, remediation guidance includes links that open relevant panes for configurations in MEM. After following the steps for the remediation to update the app, click accept.

Options to remediate app in MEM

Once accepted, it will sync back over to Microsoft Defender ATP and the Ticket status column will be updated with Completed (Intune).

App is remediated as shown in MDATP

Select the Completed (Intune) name and a fly out window will appear. Go ahead and select Mark as completed and the remediation activity will be resolved. This will update the secure score along with other metrics and security recommendations.

Marking application updated in MDATP

Conclusion

Thanks for taking the time to read this blog and I hope you had fun reading how to find current CVEs, software threats, possible breach activity, secure score, using the dashboard under Threat and Vulnerability Management, and to remediate and update apps using MEM. Once you start using MEM and Microsoft Defender ATP to create remediation tickets and update your apps you will find it more productive while also reducing your overall attack surface. On a finale note, Gartner just announced Microsoft as a Leader in its 2020 Magic Quadrant for Unified Endpoint Management. Read the article here. Hope to see you in my next blog and always protect your endpoints!

Thanks for reading and have a great Cybersecurity day!

Follow my Microsoft Security Blogs: http://aka.ms/JohnBarbare

References:

Microsoft Endpoint Manager

Microsoft Secure Score for Devices

Threat and Vulnerability Management

Use Intune to remediate vulnerabilities identified by Microsoft Defender ATP

Azure SQL Capacity Planning: Scenarios | Data Exposed

MarisaBrasile — Mon, 24 Aug 2020 16:55:52 PDT

Capacity planning plays a critical role in migrating an existing application or designing a new one. In the final part of this three-part series with Silvano Coriani, we'll review various Azure SQL capacity planning scenarios, as well as review best practices and recommendations on what to use when.

For an overview of Azure SQL Capacity planning, watch part one.

To learn about the differences between DTU and vCore, watch part two.

Watch on Data Exposed

Additional Resources:
Choose between the vCore and DTU purchasing models
vCore model overview
Service tiers in the DTU-based purchase model
Migrate Azure SQL Database from the DTU-based model to the vCore-based model
Query Performance Insight for Azure SQL Database
Troubleshoot with Intelligent Insights

View/share our latest episodes on Channel 9 and YouTube!

Known issue: Azure Sphere Memory Leak When Using TLS With libcurl

AzureSphereTeam — Mon, 24 Aug 2020 16:50:08 PDT

The 20.07 and 20.08 Update 1 versions of the Azure Sphere OS contain a bug that results in a memory leak for applications that use HTTPS connections via libcurl. This leak does not occur for HTTP (non-HTTPS) connections, Azure IoT C SDK connections, nor MQTT connections. Additionally, this leak does not occur when using the wolfSSL API directly to create a connection

The amount of data leaked is variable, depending on how the cURL handle is configured. We expect that it will be approximately tens of bytes leaked per HTTPS transaction.

The 20.09 OS release will include a fix for this bug. In the meantime, you can mitigate the problem by implementing a workaround.

Workaround

To work around this bug, disable the CURLOPT_SSL_SESSIONID_CACHE option when you create cURL handles. To do so, set the following option after cURL handle creation and once for each handle:

curl_easy_setopt(curlHandle, CURLOPT_SSL_SESSIONID_CACHE, 0);

For more details on how to do this, see CURLOPT_SSL_SESSIONID_CACHE explained in the cURL documentation.

This workaround will continue to work with the 20.09 release, but you may prefer to revert the workaround so that you can enable SSL session ID caching.

Solution

The fix for this will be part of the 20.09 release, and the fix will take effect whether the OS is delivered as an OTA update or via recovery. After the device has updated to 20.09, you can either revert applications that use the workaround to enable SSL session ID caching, or you can leave it disabled.

Developer Forum Moving from MSDN to Q&A

urban-eric — Mon, 24 Aug 2020 14:33:56 PDT

Bing Ads API Development forum on MSDN is now moving to Microsoft Q&A! We’ve listened to your feedback on how we can enhance the forum experience. Microsoft Q&A allows us to add new functionality and enables easier access to all the technical resources most useful to you, like Microsoft Docs and Microsoft Learn.

Now until September 8, 2020:

You can post any new questions on Microsoft Q&A or MSDN.

From September 8, 2020 until September 21, 2020:

New posts – Post any new questions in the Microsoft Advertising development forum’s new home on Microsoft Q&A. The MSDN forum will not allow any new questions.
Existing posts – Interact here with existing content, answer questions, provide comments, etc.

September 21, 2020 onwards:

The MSDN forum will be closed to all new and existing posts and all interactions will be in Microsoft Q&A.

Please start using Microsoft Q&A today! To make sure that we see your question, tag it with 'advertising-api'.

We are excited about moving to Microsoft Q&A and seeing you there. Learn More

Blue/Green Deployment with Azure Front Door

gamullen — Mon, 24 Aug 2020 14:15:25 PDT

Azure Front Door is a powerful global routing solution that provides high availability and performance acceleration, among other features, for HTTP/HTTPS applications. The end users of the application are automatically routed to the nearest Microsoft “Point of Presence” (POP), and from there across the Microsoft global networking fiber to either a backend in Azure, or to the best “exit” POP for external (“Custom Host”) backends.

Blue/Green

Blue/Green (or Canary) Deployment is a methodology to introduce application enhancements to a small subset of end users, and if all goes well, slowly increase the ratio until all users are on the new deployment. In case things do not go perfectly, it’s simple to just stop routing requests to the new buggy backend. This is a much safer way to introduce code changes than just suddenly pointing all users at the new enhancements.

Azure Front Door makes Blue/Green simple. This article will explain how.

Frontend

Azure Front Door provides a nice configuration tool called “Designer.” It allows you to easily connect your frontend(s), backend pool(s) and routing rule(s) together. You essentially go through the Designer when you create your Front Door, but then you can use it later for configuration changes. Here is what it might look like after completion:

The first step is to configure the frontend.

Azure Front Door Frontend Definition

The main item here as it relates to blue/green is “Session Affinity.” This determines whether the end user always gets routed to the same backend after first accessing the Front Door.

Whether or not you enable this depends on your application, and the type of enhancements being rolled out. If it’s a major revision you will likely want to enable Session Affinity, so that if the user is initially routed to the new codebase she will continue to use it. If the enhancement is relatively minor, for example involving a single page with no dependencies on other parts of the application, you could potentially leave this disabled. If in doubt, enable Session Affinity.

Backend Pools

This is where you configure the host(s) that will end up satisfying your users’ web requests.

In this example, I just chose two relatively-random public endpoints. You would configure your existing backend website and the new one under test. I divided requests between my two on a 75% to 25% split. You would likely send more traffic to the current website than the new one, and then likely direct more to the new one as it proves itself to be bug free.

Here is a screenshot of the definition of one of the two backends. Note the three parameters circled which, with one other, will be discussed in relation to how a configured backend gets chosen by Azure Front Door for a given request.

Azure Front Door Backend Definition

The following screenshot shows the two backends I configured as part of my backend pool. Note that the total of the “Weights” does not have to add up to 100 — I did that for clarity.

Azure Front Door Backend Pool Definition

Note that how much traffic gets routed to a given backend also depends on other parameters, which is discussed in excellent detail in this section.

For the purposes of a simple Blue/Green configuration, here is a summary on how you might configure these parameters.

Keep the backend under test disabled to start. Once you get all other parameters configured, you can enable it to start your Blue/Green testing.
The Priority of both backends should be the same. I recommend just leaving them at “1.”
As part of the Backend Pool configuration there is a section called “Load Balancing.” For the purposes of our discussion, the most important parameter here is “Latency sensitivity.” This value determines the highest number of milliseconds that a health probe can take for a given backend to be even considered for selection; setting it to zero disables the parameter entirely. I recommend you set it to a reasonably high value such as 500 (a half a second), meaning any backends responding in less than that time frame will be considered. The goal is to make sure both backends get used, as it’s possible they are in different data centers and present different latencies to the end user.

Backend Pool Latency Sensitivity

Any backends making it this far are finally selected based on weight.

Routing Rules

For the purposes of Blue/Green, the routing rules are relatively unimportant. What you select here depends more on how your web application works.

That said, consider enabling “Caching,” which in essence turns your Azure Front End into a Content Delivery Network (CDN). This will allow web content to be cached and delivered from the Front Door POP rather than the backend. The POP is closer, sometimes significantly closer, to the end user than the backend. This can dramatically improve application performance.

This documentation contains full details on Azure Front Door routing if your configuration starts to get more complex.

Conclusion

Configuring Blue/Green with Azure Front Door is relatively simple once you understand a few vital concepts. Give it a try!