Yesterday is history. Tomorrow is a mystery.
Cloud Solutions Engineer at Contoso. Hacktive Directory admin.
Posts don't represent my employer(s).
Nov 8 • 7 tweets • 3 min read
IAM = Identity AND ACCESS management.
When you use a CASB, you are delegating ACCESS management to the CASB.
What is a CASB?
- Sanctioning (determining ACCESS to apps)
- ACCESS management (a component of IAM)
- Session management (Data in Motion DLP)
- Labeling data and determining ACCESS
- UEBA (threat policies)
- Governance (monitoring and actioning API and app deprecation and determining risk)
- SSPM (SaaS Posture Management)
When you have a CASB AND you are using it, you have delegated ACCESS management (of IAM) to the CASB.
How is this achieved? Oauth.
For those who like pictures, we are talking about here:
Sep 14 • 9 tweets • 2 min read
Let's play a game: How do you hold an M365 tenant hostage?
So, the attacker got Global Admin. Let's play scorched earth.
1. Lock out all the admins except yourself with CAPs. 2. Change all the client secrets and certs+keys. 3. Block everyone from using Exchange, Sharepoint, and Teams with CAPs. 4. Enable customer lockbox 5. Configure all the sensitivity labels with BYOK :p 6. Unassign all Enterprise applications and revoke API permissions :p 7. Disable any B2B trusts 8. In all the admin centers, remove all admin roles not in Entra.
