If you have M365 licenses (forget which level), Entra ID supports OIDC and SAML and you can use its MFA functions. Something to keep in mind if you don’t want to spend money on Okta
this post was submitted on 21 Apr 2024
20 points (100.0% liked)
cybersecurity
3376 readers
4 users here now
An umbrella community for all things cybersecurity / infosec. News, research, questions, are all welcome!
Community Rules
- Be kind
- Limit promotional activities
- Non-cybersecurity posts should be redirected to other communities within infosec.pub.
Enjoy!
founded 2 years ago
MODERATORS
I also recommend this. EntraID is pretty handy and it was a fairly painless experience to get everyone using the Microsoft authenticator app on their phone for MFA. SSO via a registered app in Azure is just an added bonus.
Our typical user reaction is something like "Oh, like my banking app?" when we enroll them in MFA
Didn't know that. I'll look into it if we do.
You can also do SAML with Google Workspace as an Identity Provider
The right solution for you will depend a lot on your existing infrastructure.
Are you a Microsoft/Azure/O365 shop? Google Workspace? Do you have graphics people working on Apple devices? OT? Do you have self-hosted infra? All cloud? Hybrid? How complex is the environment you need to protect? Are you trying to allow remote users to access your company environment, or is everyone logging in to on-prem workstations?
Depending on the answers, you might be better off working on whitelisting the applications you need to run (with Applocker or Airlock) and setting up good protection for your high value data rather than trying to get an integrated 2FA solution in place.
Google Workspace but all Windows laptops. No Apple devices, OT, or self-hosted infra. Hybrid, I guess.
As a startup it's a very simple business operation and there's no security protocol to speak of at the moment. We just use a dozen sass apps and I don't think we're ready for any full-on enterprise level security services.
OK, Workspace (web-hosted) business environment on Windows systems. You should probably use Google's built-in 2FA enforcement for access to your business stuff. It will be the easiest to implement and manage (and I think it should be free? it should just be a setting that you turn on). Also consider implementing Chrome Enterprise as a requirement for accessing your business apps, it will give you more control and if you're using Workspace then the integration should be smooth. If your business needs expand beyond Google services, you might look at Island.
Are the laptops on Windows Enterprise? or Professional? Do you have any domain management for them? Or are they off-the-shelf with Home/OEM installs?
In any case, Applocker is built-in and free. With this you can restrict the laptops to only executing the applications that your business needs - if everything is accessed through Chrome, then it's really simple, nothing else needs to run and if an employee has a specific extra need (Photoshop or CAD or QuickBooks or w/e) you can handle that on a case-by-case basis. If you have domain management then it's easy to enforce Applocker on all the laptops, if not you'll have to do each one manually, but it's worth it because it will prevent a lot of nonsense. If your business expands and you outgrow the functionality of Applocker, consider Airlock Digital. Otherwise you can mostly leave the OS security to Windows Defender, and maybe pay for the business service or look at Crowdstrike if you need EDR features or something like that.
A big question is, where is your data? Is all of it in Workspace? Or do individual employees have pieces of it sitting on their hard drives? What happens if one of those hard drives crashes and you lose the employee's work? Are those laptops going home with them? Are they on home/shared/public networks? What if a laptop gets stolen, or lost in airport luggage? Can you remotely lock that device out of your environment? Is the data on it encrypted? As a startup, your business is your information, whatever form that takes. You need to get tracking on where your most sensitive bits of information are (customer lists, proprietary design/code/concept/etc, high-value assets, licenses/certifications/contracts, financial records, employee PII, anything that could end your business if you lost it), how they're stored and how they're used, and that is much more important than 2FA login. If possible, implement Bitlocker on the laptops. Maybe learn to use filesystemwatcher if you have sensitive files living on the Windows laptops. And start figuring out a backup plan (even if everything important is done in Workspace, keeping all of your data in Workspace doesn't count as a backup plan).
I would highly recommend that you develop a security plan based on something like the NIST Cybersecurity Framework (this is a quickstart guide aimed at small businesses with little to no existing security planning). Don't buy any fancy security products yet. Sit down and plan your security in a systematic way, and that will help expose your actual needs and blind spots. Plan to have a plan. Business continuity is the goal.
Finally, some useful information sources:
- SANS Stormcast - 10-minute daily podcast with alerts about current threats
- Risky.biz - weekly cybersecurity news podcast and interviews with industry professionals
- Security Now - weekly cybersecurity news with deep dives into security topics
Thanks for the thorough reply! I'll look through all the links especially the NIST doc.
SSO can be afforded by more than just cloud services. Look into OpenLDAP.
The replacement cost for user devices isn't high, for you it's zero. At most it's your time helping them reprovision the token. Or to the cost of a temporary other token, which you could keep stocked.
I set up MFA some years ago with yubikeys and authlite to protect AD, it wasn't that expensive. We also did 365 auth to the Microsoft app on personal phones. We didn't have any complaints there, but if we did we would have issued a token or something.
Assuming they replace their own phone you mean? There's also productivity loss that we'd like to avoid. Temporary token stocked in what way?
I'm not familiar with AD so I'll have to do some more research into it.
It depends on what you're protecting and how. The token might be a yubikey or RSA token, for example. Whatever is supported by your MFA product. It could even be an old loaner cell phone with no cell service if the only method is an app.
You can get yubikeys fairly cheap. They are great
Another option could be password less. Basically use Microsoft authenticator app to insert a code that popped up in the screen. Need both devices in order to sign in. If all users already have work phones and work laptops it's pretty reasonable setup in a Microsoft shop.