How to secure Microsoft 365 with app governance

For all its importance to modern business, the internet is still very much the Wild West it’s always been. Now, a new generation of cyberattacks goes beyond the traditional phishing or malware delivery, aiming to connect malicious applications to your cloud services. Once connected with legitimate credentials they siphon out valuable data or access your financial systems. And because they’ve been granted access by users, they’re very hard to stop once they’re inside your network.

Watching out for consent phishing

Part of the success of the attack is due to the fact that we’ve trained our users to click “yes” on application permissions consent screens. Initially a valuable way of protecting systems, consent screens have become background noise, and we click through to get on with our work. These new consent phishing attacks rely on the architecture of the popular OAuth 2.0 authorization protocol to delegate permissions from a user’s account, using them on your behalf.

This way the attacker is using Microsoft’s authentication service, not a fake one, to get authorization tokens that can then be used at any time to access data. The more privilege a user has the better, opening up access to your data and your APIs. There’s been significant growth in this attack vector in the last year, with data stolen without the attacker needing to know any passwords. Once in your network the attacking application can remain dormant for months, acting as a persistent threat scoping out targets for the next generation of phishes.

Attacking software is designed to look innocuous and innocent, mimicking common application or settings updates. Once launched they give users a familiar consent dialog, which is quickly clicked through. The application often takes broader permissions than you might expect, expecting no one to actually read the pop-up.

So how can you prevent malicious applications from using consent phishing? You could prevent users from downloading any and all applications, or you could implement a set of compliance tools to look for and manage suspicious apps.

SEE:
How to see who is trying to break into your Office 365 and what they’re trying to hack

(TechRepublic)

Certifying code with App Compliance

One option is Microsoft 365’s new App Compliance Program. It’s a way of identifying trusted application publishers, with three layers of verification: publisher verification, publisher attestation, and Microsoft 365 Certification.

Publisher verification is the lowest tier, designed to prove that the application publisher is a verified Microsoft Partner and that their account is associated with their application. Apps that get this level of verification are using OAuth 2.0 and OpenID Connect to work with the Microsoft Graph. They also need to be registered in Azure AD as multi-tenant.

This is the first thing to verify before allowing external applications to run in your network. It’s a base level of trust that applications need to pass, if they’re to get access to your Microsoft 365 environment. However, you shouldn’t let it stop users from downloading other applications; it’s more a way of providing an extra lock on the door of your data. Users will still be able to use applications that can access data on their PCs, so you shouldn’t treat it as a way to avoid maintaining any endpoint security you’re using.

Publisher attestation is the next tier. Here, publishers provide a consistent format list of the security and compliance information about their applications. They need to provide this data for any Microsoft 365 integrated web apps, alongside apps that integrate with the core Office 365 application suite. It’s important to note that there’s no verification of this data, so you’ll need to work out for yourself whether you trust a publisher and want to give its applications access to your Microsoft 365 environment.

If you want further assurance, you can look for applications that are certified by Microsoft, using its Microsoft 365 certification service. This extends attestation, adding a review by a third-party assessor.

SEE: Windows 10: Lists of vocal commands for speech recognition and dictation (free PDF) (TechRepublic)

Adding governance with Microsoft Cloud App Security

Looking for applications that are verified is only one part of the solution. The other is Microsoft’s recently launched app governance extensions to its Microsoft Cloud App Security service. This integrates with your Azure Active Directory and Microsoft 365 tools, applying new policies to your tenant. These include OAuth app reputation, OAuth Phishing Detection, and OAuth App Governance. MCAS is an add-on to most Office 365 and Microsoft 365 subscriptions, requiring an additional licence unless you’re using a Microsoft 365 E5 tenant.

You’ll need to set up appropriate app governance roles and assign them to accounts before enabling the service. Once running it provides an audit of all OAuth apps that use the Microsoft Graph APIs. As these are what malicious apps are likely to be using, it can give you a quick insight as to any unwanted apps, as well as useful tools that ask for too many permissions. Some features are machine learning based and require up to 90 days of telemetry, so you may not get all the data you need on first run.

Alerts help pinpoint urgent issues, and you can drill down into apps to get insights about them and what they’re using. Filters can narrow down queries, and you can save those queries for future use. You can then quickly disable unwanted apps from the dashboard, removing permissions and blocking access to the Microsoft Graph APIs. The details of an app let you see if it’s certified and view information from the publisher, along with what data (and how much) it has accessed, and what it’s uploading and downloading.

SEE:
<strong>Why Windows 11’s security is such a big deal</strong>

(TechRepublic)

The data in the MCAS app governance portal is enough to help you see your level of risk, focusing on applications with high- and over-privilege, as well as any alerts that have been generated based around the policies you’re already using. You can then look for spikes in data access, which might indicate a malicious app in action.

Using app governance policies in MCAS

MCAS app governance lets you create and apply policies that can help manage apps and reduce risk. Templates help you get started, with policies that generate alerts for apps that use a lot of data, that have too much privilege, or that aren’t certified. You can modify these, changing limits, or create a new custom policy. Rules include API access monitoring, the user who consented to use the app, and their role in the organization.

A template can take action on an app or only deliver an alert. Actions can include disabling apps, a quick way of stopping suspected malicious code from running. This can be overkill, but it’s worth considering if you’re running IT for a business that could be a target of malicious code. Just remember it can take up to 90 days to get all the data you need, so don’t rely on it as a compliance tool from day one.

Adding application policies to MCAS is a start, but it can’t be your only solution to consent-based phishing attacks. You’ll need to roll it out in parallel with user education, making it harder for bad actors to get past your users and reducing the risk of untrusted malware being installed in your network. The best defences are multi-layered, and using MCAS for application compliance, as well as looking for certified code, will go a long way to keeping your data safe.

Cybersecurity Insider Newsletter

Strengthen your organization’s IT security defenses by keeping abreast of the latest cybersecurity news, solutions, and best practices.
Delivered Tuesdays and Thursdays

Sign up today

Also see