Tag: Office365

Keeping the Lights On: Business Continuity for Office 365

Published on by Dave BranscomeLeave a comment

Early in my career at Microsoft, I worked in Microsoft Consulting Services, supporting organizations looking to deploy Exchange 2007 and 2010 in their on-premises environments. During those engagements, the bulk of the conversations focused on availability and disaster recovery concepts for Exchange – things like CCR, SCR and building out the DAG to ensure performance and database availability during an outage – whether it was a disk outage, a server outage, a network outage or a datacenter outage.

Those were fun days. And by “fun”, I mean “I’m glad those days are over”.

It’s never a fun day when you have to tell a customer that they CAN have 99.999% availability (of course – who DOESN’T want five 9’s of availability??) for their email service, but it will probably cost them all the money they make in a year to get it.

Back then, BPOS (Business Productivity Online Service) wasn’t really on the radar for most organizations outside of some larger corporate and government customers.

Then on June 28, 2011, Microsoft announced the release of Office 365 – and the ballgame changed. In the years since then, Office 365 has become a hugely popular service, providing online services to tens of thousands of customers and millions of users.

As a result, more businesses are using Office 365 for their business-critical information. This, of course, is great for our customers, because they get access to a fantastic online service, but it requires a high degree of trust on the part of customers that Microsoft is doing everything possible to preserve the confidentiality, integrity and availability of their data.

A large part of that means that Microsoft must ensure that the impact of natural disasters, power outages, human attacks, and so on are mitigated as much as possible. I recently heard a talk given that dealt with how Microsoft builds our datacenters and account for all sorts of disasters – earthquakes, floods, undersea cable cuts – even mitigations for a meteorite hitting Redmond!

It was an intriguing discussion and it’s good to hear the stories of datacenter survivability in our online services, but the truth is, customers want and need more than stories. This is evidenced by the fact that the contracts that are drawn up for Office 365 inevitably contain requirements related to defining Microsoft’s business continuity methodology.

Our enterprise customers, particularly those from regulated industries, are routinely required to perform business continuity testing to demonstrate that they are taking the steps necessary to keep their services up and running when some form of outage or disaster occurs.

The dynamics change somewhat when a customer moves to Office 365, however. These same customers now must assess the risk of outsourcing their services to a supplier, since the business continuity plans of that supplier directly impact the customer’s adherence to the regulations as well. In the case of Office 365, Microsoft is the outsourced supplier of services, so Microsoft’s Office 365 business continuity plans become very relevant.

Let’s take a simple example:

A customer named Contoso-Med has a large on-premises infrastructure. If business continuity testing were being done in-house by Contoso-Med and they failed the test, they would be held responsible for making the necessary corrections to their processes and procedures.

Now, just because Contoso-Med has moved those same business processes and data to Office 365, they are not absolved of the responsibility to ensure that the services meet the business continuity standards defined by regulators. They must still have a way of validating that Microsoft’s business continuity processes meet the standards defined by the regulations.

However, since Contoso-Med doesn’t get to sit in and offer comments on Microsoft’s internal business continuity tests, they must have another way of confirming that they are compliant with the regulations.

First…a Definition

Before I go much further, I want to clarify something.

There are several concepts that often get intermingled and, at times, used interchangeably: high availability, service resilience, disaster recovery and business continuity. We won’t dig into details on each of these concepts but suffice it to say they all have at their core the desire to keep services running for a business when something goes wrong. However, “business continuity and disaster recovery” from Microsoft’s perspective means that Microsoft will address the recovery and continuity of critical business functions, business system software, hardware, IT infrastructure services and data required to maintain an acceptable level of operations during an incident.

To accomplish that, the Microsoft Online Service Terms (http://go.microsoft.com/?linkid=9840733),which is sometimes referred to as simply the OST, currently states the following regarding business continuity:

  • Microsoft maintains emergency and contingency plans for the facilities in which Microsoft information systems that process Customer Data are located
  • Microsoft’s redundant storage and its procedures for recovering data are designed to attempt to reconstruct Customer Data in its original or last-replicated state from before the time it was lost or destroyed

 

Nice Definition. But How Do You Do It?

I’ve referenced the Service Trust portal in a few other blog posts and described how it can help you track things like your organization’s compliance for NIST, HIPAA or GDPR. It’s also a good resource for understanding other efforts that factor into the equation of whether Microsoft’s services can be trusted by their customers and partners.

A large part of achieving that level of trust relates to how we set up the physical infrastructure of the services.

To be clear, Microsoft online services are always on, running in an active/active configuration with resilience at the service level across multiple data centers. Microsoft has designed the online services to anticipate, plan for, and address failures at the hardware, network, and datacenter levels. Over time, we have built intelligence into our products to allow us to address failures at the application layer rather than at the datacenter layer, which would mean relying on third-party hardware.

As a result, Microsoft is able to deliver significantly higher availability and reliability for Office 365 than most customers are able to achieve in their own environments, usually at a much lower cost. The datacenters operate with high redundancy and the online services are delivering against the financially backed service level agreement of 99.9%.

The Office 365 core reliability design principles include:

  • Redundancy is built into every layer: Physical redundancy (through the use of multiple disk, network cards, redundant servers, geographical sites, and datacenters); data redundancy (constant replication of data across datacenters); and functional redundancy (the ability for customers to work offline when network connectivity is interrupted or inconsistent).
  • Resiliency: We achieve service resiliency using active load balancing and dynamic prioritization of tasks based on current loads. Additionally, we are constantly performing recovery testing across failure domains, and exercising both automated failover and manual switchover to healthy resources.
  • Distributed functionality of component services: Component services of Office 365 are distributed across datacenters and regions to help limit the scope and impact of a failure in one area and to simplify all aspects of maintenance and deployment, diagnostics, repair and recovery.
  • Continuous monitoring: Our services are being actively monitored 24×7, with extensive recovery and diagnostic tools to drive automated and manual recovery of the service.
  • Simplification: Managing a global, online service is complex. To drive predictability, we use standardized components and processes, wherever possible. A loose coupling among the software components results in a less complex deployment and maintenance. Lastly, a change management process that goes through progressive stages from scope to validation before being deployed worldwide helps ensure predictable behaviors.
  • Human backup: Automation and technology are critical to success, but ultimately, its people who make the most critical decisions during a failure, outage or disaster scenario. The online services are staffed with 24/7 on-call support to provide rapid response and information collection towards problem resolution.

These elements exist for all the online services – Azure, Office 365, Dynamics, and so on.

But how are they leveraged during business continuity testing?

Each service team tests their contingency plans at least annually to determine the plan’s effectiveness and the service team’s readiness to execute the plan. The frequency and depth of testing is linked to a confidence level which is different for each of the online services. Confidence levels indicate the confidence and predictability of a service’s ability to recover.

For details on the confidence levels and testing frequencies for Exchange Online, SharePoint Online and OneDrive for Business, etc… please refer to the most recent ECBM Plan Validation Report available on the Office 365 Service Trust Portal.

BC/DR Plan Validation Report – FY19 Q1

A new reporting process has been developed in response to Microsoft Online Services customer expectations regarding our business continuity plan validation activities. The reporting process is designed to provide additional transparency into Microsoft’s Enterprise Business Continuity Management (EBCM) program operations.

The report will be published quarterly for the immediately preceding quarter and will be made available on the Service Trust Portal (STP). Each report will provide details from recent validations and control testing against selected online services.

For example, the FY19 Q1 report, which is posted on the Service Trust Portal (ECBM Testing Validation Report: FY19 Q1), includes information related to 9 selected online services across Office 365, Azure and Dynamics, with the testing dates and testing outcomes for each of the selected services.

The current report only covers a subset of Microsoft cloud services, and we are committed to continuously improving this reporting process.

If you have any questions or feedback related to the content of the reporting, you can send an email to the Office 365 CXP team at cxprad@microsoft.com.

Additional Business Continuity resources are available on the Trust Center , Service Trust Portal, Compliance Manager and TechNet

  1. Azure SOC II audit report:  The Azure SOC II report  discusses business continuity (BC) starting on page 59 of the report, and the auditor confirms no exceptions noted for BC control testing on page 95.
  2. Azure SOC Bridge Letter Oct-Dec 2018 : The Azure SOC Bridge letter confirms that there have been no material changes to the system of internal control that would impact the conclusions reached in the SOC 1 type 2 and SOC 2 type 2 audit assessment reports.
  3. Global Data Centers provides insights into Microsoft’s framework for datacenter Threat, Vulnerability and Risk Assessments (TVRA)
  4. Office 365 Core – SSAE 18 SOC 2 Report 9-30-2018: Similar to the Azure  365 SOC II audit report (dated 10/1/2017 through 9/30/2018) discusses Microsoft’s position on business continuity (BC) in Section V, page 71 and the auditor confirms no exceptions noted for the CA-50 control test on page 66.
  5. Office 365 SOC Bridge Letter Q4 2018 : SOC Bridge letter confirming no material changes to the system of internal control provided by Office 365 that would impact the conclusions reached in the SOC 1 type 2 and SOC 2 type 2 audit assessment reports.
  6. Compliance Manager’s Office 365 NIST 800-53 control mapping provides positive (PASS) results for all 51 Business Continuity Disaster Recovery (BCDR)-related controls within Microsoft Managed Controls section, under Contingency Planning. For example, the Exchange Online Recovery Time  Objective and Recovery Point Objective (EXO RPO/RTO) metrics are tested by the third-party auditor per NIST 800-53 control ID CP2(3). Other workloads, such as SharePoint Online, were also audited and discussed in the same control section.
  7. ISO-22301  This business continuity certification has been awarded to Microsoft Azure, Microsoft Azure Government, Microsoft Cloud App Security, Microsoft Intune, and Microsoft Power BI. This is a special one. Microsoft is the first (and currently the ONLY) hyperscale cloud service provider to receive the ISO 22301 certification, which is specifically targeted at business continuity management. That’s right. Google doesn’t have it. Amazon Web Services doesn’t have it. Just Microsoft.
  8. The Office 365 Service Health TechNet article provides useful information and insights related to Microsoft’s notification policy and post-incident review processes
  9. The Exchange Online (EXO) High Availability TechNet article outlines how continuous and multiple EXO replication in geographically dispersed data centers ensures data restoration capability in the wake of messaging infrastructure failure
  10. Microsoft’s Office 365 Data Resiliency Overview outlines ways Microsoft has built redundancy directly into our cloud services, moving away from complex physical infrastructure toward intelligent software to build data resiliency
  11. Microsoft’s current SLA commitments for online services
  12. Current worldwide up times are reported on Office 365 Trust Center Operations Transparency
  13. Azure SLAs and uptime reports are found on Azure Support

As you can see, there are a lot of places where you can find information related to business continuity, service resilience and related topics for Office 365.

This type of information is very useful for partners and customers who need to understand how Microsoft “keeps the lights on” with its Office 365 service and ensures that customers are able to meet regulatory standards, even if their data is in the cloud.

 

Secure Your Office 365 Tenant – By Attacking It (Part 2)

Published on by Dave Branscome2 Comments

By David Branscome

 

In my previous post (https://blogs.technet.microsoft.com/cloudyhappypeople/2018/04/04/secure-your-office-365-tenant-by-attacking-it ), I showed you how to use the Office 365 Attack Simulator to set up the Password Spray and Brute Force Password (Dictionary) Attacks.

What we often find, though, is that spear phishing campaigns are extremely successful in organizations and are often the very first point of entry for the bad guys.

Just for clarity, there are “phishing” campaigns and there are “spear phishing” campaigns.

A phishing campaign is typically an email sent out to a wide number of organizations, with no specific target in mind. They are usually generic in nature and are taking the approach of “spreading a wide net” in hopes of getting one of the recipients to click on a URL or open an attachment in the email. Think of the email campaigns you’ve likely seen where a prince from a foreign country promises you $30 million if you’ll click on this link and give him your bank account information. The sender doesn’t particularly care WHO gets the email, as long as SOMEBODY clicks on the links.

On the other hand, a spear phishing campaign is much more targeted. In a spear phishing campaign, the attacker has a specific organization they are trying to compromise – perhaps even a specific individual. Maybe they want to compromise the CFO’s account so that they can fraudulently authorize money transfers from the organization by sending an email that appears to be coming from the CFO. Or maybe they want to compromise a highly-privileged IT admin’s email account so that the attacker can send an email asking users to browse to a fake password reset page and harvest user passwords. The intent with a spear phishing campaign is to make the email look very legitimate so that the recipients aren’t suspicious – or perhaps they even feel obligated to do as instructed.

What Do I Need?

As you can imagine, setting up a spear-phishing campaign takes a little more finesse than a brute force password attack.

First, decide WHO the sender of the spear phishing email will be. Maybe it’s HR requesting that you log in and update your benefits information. Or perhaps it’s the IT group asking everyone to confirm their credentials on a portal they recently set up.

Next, decide WHO you want to target with the campaign. It may be the entire organization, but keeping a low profile as an attacker also has its advantages.

You’ll probably want to use a realistic HTML email format so that it looks legitimate. The Attack Simulator actually provides two sample templates for you, as we’ll see below. Using the sample templates makes the campaign very easy to set up, but as you get more comfortable using the Attack Simulator, you will likely want to craft your own email to look more like it’s coming from your organization.

That should be enough to get us started.

Launching a Spear Phishing Attack

In the Attack Simulator console, click on “Launch Attack”.

 

At the Provide a name to the campaign page, choose your own name, or click on “Use template”. If you click on “Use template” you will see two template options to choose from. I’ve chosen “Prize Giveaway” below:

 

Next, select the users you want to “phish”. You can select individual users or groups.

 

 

On the next page, if you’ve selected a template, all the details will be filled in for you. One important value to note here is the Phishing Login server URL. Select one of the phishing login servers from the drop down. This is the way the attack simulator is able to track who has clicked on the URL in the email and provides reporting.

Note that the URL’s for the phishing login servers are NOT actually bad sites. They are sites set up specifically for the purposes of this tool’s functioning.

 

 

In the Email body form, you can customize the default email. Make sure that you have a variable ${username} so that the email looks like it was sent directly to the end user.

 

 

Click Confirm, and the Attack Simulator will send the email out to the end users you specified.

Next, I opened the Administrator email account that I targeted and saw this:

 

 

Notice that it customized the email to the MOD Administrator account in the body of the email.

If I click on the URL (which points to the http://portal.prizesforall.com URL we highlighted earlier) I get sent to a website that looks like this.

 

Finally, if I click on the reporting area of the Attack Simulator, I can see who has clicked on the link and when.

 

 

Okay. But seriously…would you really have clicked on that URL?

Probably not.

So how do you make it a little more sophisticated?

Let’s create a more realistic attack.

In this attack we will use the Payroll Update template, which is very similar to what you might actually see in many corporate environments.  You can also create your own HTML email using your organization’s branding and formatting.

 

 

I’ll again target the MOD Administrator because he seems like a good target, since he’s the O365 global admin (and seems to be somewhat gullible).

In this situation though, instead of sending from what appears to be an external email address (prizes@prizesforall.com, used in the previous attack) I’m going to pose as someone the user might actually know. It could be the head of HR or Finance or the CEO. I’ll use the actual email address of that person so that it resolves correctly.

Notice that this templates uses a different phishing login server URL from the drop down. You’ll see why in a second.

In the Email body page, we’ve got a much more realistic looking email.

It should be noted, though, that if you make the email look ABSOLUTELY PERFECT and people click on the URL, what have they learned? It’s best to provide a clue in the email that a careful user would notice and recognize as a problem. Maybe send the official HR email from someone who isn’t actually in HR, or leave off a footer in the email that identifies it as an official HR email. Whatever it is, there should be something that you can use to train users to look out for.

So if you read the email template below carefully, you’ll see some grammatical errors and misspellings that should be a “red flag” to a careful user.

 

 

Again, you Confirm the settings for the attack and the attack launches.

Going to the MOD Administrator’s mailbox….that’s much more realistic, wouldn’t you say?

 

 

When I click on the “Update Your Account Details” link, I get sent to this page, where I’m asked to provide a username and password, which of course, I dutifully provide:

 

 

Notice, however, that the URL at the top of the page is the portal.payrolltooling.com website – even thought the page itself looks like a Microsoft login page. Many attacks will mimic a “trusted site” to harvest credentials in this manner. When you’re testing you can use any email address (legitimate or not) and any password for testing – it isn’t actually authenticating anything.

Once I enter some credentials, I am directed to the page below, which lets me know I’ve been “spear phished” and provides some hints about identifying these kind of attacks in the future:

 

 

And finally, in the reporting, I see that my administrator was successfully spear phished.

 

The Value of Attack Simulations

This is all interesting (and a little bit fun) but what does it really teach us? The objective is that once we know what sort of attacks our users are vulnerable to (password or phishing are the two highlighted by this tool), then we can provide training to help enhance our security posture. Many of the ransomware attacks that are blanketing the news lately started as phishing campaigns.

If we can take steps to ensure that our users are better equipped to identify suspicious email, and help them select passwords that aren’t easily compromised, we help improve the organization’s security posture.

 

 

 

 

 

Secure Your Office 365 Tenant – By Attacking It (Part 1)

Published on by Dave BranscomeLeave a comment

By David Branscome

I’ve been waiting several months for this day to arrive. The Office 365 Attack Simulator is LIVE!

If you log into your Office 365 E5 tenant with the Threat Intelligence licensing, it shows up here in the Security & Compliance portal.

When you click on it, the first thing it will tell you is that there are some things you need to set up before you can run an actual attack. There’s a link that says, “Set up now” (in the yellow box shown below). After you click that link, it says the setup is complete, but you’ll have to wait a little while before running an attack. (I only had to wait about 10 minutes when I set it up)

 

It also reminds you that you need to have MFA (multi-factor authentication) set up on your tenant in order to run an attack. This makes a lot of sense, since you want to ensure that anyone who runs the attack is a “good guy” on your network.

To set up MFA, follow the steps here:

Go to the Office 365 Admin Center

Go to Users> Active users.

Choose More> Setup Azure multi-factor auth

 

Find the people who you want to enable for MFA. In this case, I’m only enabling the admin account on my demo tenant.

Select the check box next to the people you want to enable for MFA.

On the right, under quick steps, you’ll see Enable and Manage user settings.

Choose Enable.

 

 

 

In the dialog box that opens, choose enable multi-factor auth.

The Attacks

Spear Phishing

With a spear phishing attack, I’m sending an email to group of “high-value” users – maybe my IT admins, the CEO/CFO, the accounting office, or some other user group whose credentials I want to capture. The email I send contains a URL that will allow me to capture user credentials or some other sensitive data as part of the attack. When I set up this attack, it needs to look like it’s coming from a trusted entity in the organization. Maybe I’ll set it up to make it appear as though it’s coming from the IT Security group asking them to verify their credentials.

Brute Force Password (a.k.a., Dictionary Attack)

In this attack, I’m running an automated attack that just runs through a list of dictionary-type words that could be used as a password. It is going to use lots of well-known variations, such as using “$” for “s” and the number 0 for the letter O. If you thought Pa$$w0rd123 was going to cut it as a secure password on your Office 365 account, this attack will show you the error of your ways.

This type of attack is pretty lengthy in nature because there are thousands of potential guesses being made against each user account. The attack can be set up to vary in frequency (time between password guesses) and number of attempts.

It’s important to note that if a password is actually found to be successful, that password is NOT exposed to anyone – even the admin running the attack. The reporting simply indicates that the attack was successful against Bob@contoso.com, for example.

Password Spray Attack

A password spray attack is a little different from the brute force password attack, in that it allows the admin/attacker to define a password to use in the attack. These would typically be passwords that are meaningful in some way – not simply an attempt using hundreds, or thousands of guesses. The password you use could be something like the name of a football team mascot and the year they won a championship, or the name of a project that people in one department are working on. Whatever criteria you select, you define what password or passwords should be attempted and the frequency of the attempts.

Ready? Let’s go hunting…

Launching a Password Spray Attack

First, I’ll try the password spray attack. I’ve set up several accounts in my test tenant with passwords that are similar to the one I’ll attempt to exploit – which is Eagles2018!. Notice that, by most criteria, that’s a complex password – upper and lower case, alphanumeric and it includes a special character, but it’s also a fairly easily-guessed password, since the Philadelphia Eagles won the Super Bowl in 2018 (though it pains me to say that).

I’ve set up a couple users with that password to ensure I get some results.

I go to my Attack simulator and click on Launch Attack.

The first screen is where I name the attack.

 

 

Next, I select the users I want to target. Notice that I can select groups of users as well.

 

 

Now I manually enter the passwords I want to use in the attack.

 

 

Confirm the settings, click Finish and the attack will begin immediately.

If I go back to my Attack Simulator console, I can see the attack running.

 

 

After the attack completes, I see the users who have been compromised using the password.

(Yes, I’ve reset their passwords now, so don’t try and get clever.) 😊

Now I politely encourage ChristieC and IrvinS to change their password to help ensure their account security.

Launching a Brute Force Password (Dictionary Attack)

Again, I’ve set up a couple accounts with some pretty common password combinations (P@ssword123, P@ssw0rd!, etc..)

I walk through the configuration of the attack, which is very similar to the Password Spray attack setup.

 

I set up my target users as before, and then I choose the attack settings.

In this case, I uploaded a text file containing hundreds of dictionary passwords, but you can create a sampling of several passwords by entering them manually one at a time in the field above the Upload button.

 

As the attack runs, you’ll see something like the screenshot below. Remember, if you have a large number of users and a very large wordlist for the dictionary attack, this attack will run for quite some time as the simulator cycles through all the possible variations for each user.

 

And again, when the simulation is complete, you’ll want to caution DiegoS on his lack of good password hygiene.

In my second blog post, I’ll show you how to do a Spear Phishing Attack. These are the REALLY sneaky ones….

Stay tuned!

 

“Argh…My Skype for Business Recording Failed!!”

Published on by Dave Branscome1 Comment

By David Branscome

 

I recently received a call from a colleague who had been working on a two-hour Skype for Business meeting.

At the end of the call, she went into her Recording Manager to get the recorded meeting but saw that the recording for the meeting had failed. It was showing up as “0 bytes” in size.

When we browsed to C:Users%USERNAME%AppDataLocalMicrosoftCommunicatorRecording ManagerTemporary Recording Files we saw this:

So, we were pretty sure that the files were available, they just hadn’t been finalized at the end of the meeting into a single file. But how do you fix it?

Actually, the fix was pretty easy.

First, start a new Skype for Business meeting. It can be a meeting with just one person.

Once the meeting is started, share out your desktop.

Now start the recording.

 

Immediately afterward, pause the recording as shown below:

 

Go to the temporary recording files path:

C:Users%USERNAME%AppDataLocalMicrosoftCommunicatorRecording ManagerTemporary Recording Files and locate the folder with the temporary files for the RECORDING YOU JUST PAUSED. It should be easy to locate based on the time stamp.

Open that folder and delete all the files EXCEPT the file named lock.lock.

Next, go back to the C:UsersdabranAppDataLocalMicrosoftCommunicatorRecording ManagerTemporary Recording Files path and locate the folder for the FAILED recording. Again, you can use the timestamps on the files to ensure you have the right files. Select all the files in this folder and copy them using either CTRL-C or the Copy command

At this point, you should have all the files from the folder of the original FAILED Recording copied over into the folder for the NEW, paused recording.

Now, from your Skype for Business client, STOP the recording for the meeting you initiated earlier. This will start the process of combining all the files from the FAILED recording into a single, functional recording.

 

 

Go into your System Tray in the lower right corner and click on the Recording Manager icon and select “Open”

 

Ensure that the New recording is being compiled, as shown by the green progress bar.

 

 

In a few minutes (depending upon the length of the original meeting), your file should be completely recovered and ready to use!

The End of Support for Older TLS Versions in Office 365

Published on by Dave Branscome4 Comments

by David Branscome, with a callout to Joe Stocker at Patriot Consulting for the heads-up!

The SSL/POODLE Attack Explained

UPDATE: As per the support article listed here (https://support.microsoft.com/en-us/help/4057306/preparing-for-tls-1-2-in-office-365) We will be extending support for TLS 1.0/1.1 through October 31, 2018 in order to help ensure our customers are adequately prepared for the changes.

 

As most of you know, there was a significant vulnerability identified in the SSL 3.0 protocol back in 2014, named POODLE (Padded Oracle On Downgraded Legacy Encryption).

The problem was this: SSL 3.0 is basically an obsolete and insecure protocol. As a result, it has been, for the most part, replaced by its successors, TLS 1.0 and TLS 1.2. The way a client-server encryption negotiation sequence would typically work is that the client would contact a server, and through a handshake process, agree on the highest level of security over which they both can communicate. So, for example, a client makes a request to a server and says, “I’d like to use TLS 1.2 for our communication, but I can also use TLS 1.0, if you need to.” The server responds with, “I don’t speak TLS 1.2, but I do speak TLS 1.0, so let’s agree to use that.” They then use that downgraded protocol as their preferred encryption method. The downgrade sequence could ALSO downgrade the encryption to use SSL 3.0, if necessary.

However, even in situations where client and server both support the use of the newer security protocols, an attacker with access to some portion of the client-side communication could disrupt the network and force a downgrade to the SSL 3.0 encryption. This is typically referred to as a man-in-the-middle attack, because the attacker sits on the network between two parties and captures their communication stream. This is an altogether separate type of attack, unrelated to the POODLE vulnerability itself, and must be defended against using other methods.

Anyway, now that the attacker has successfully forced SSL 3.0 encryption to be used, and the attacker has access to the communication stream, the attacker can attempt the POODLE attack and get access to decrypted information between the client and the server.

When this vulnerability came out, there was a significant amount of work done worldwide to mitigate the impact and scope of the issue. The vulnerability in SSL 3.0 itself couldn’t be remediated because the issue was fundamental to the protocol itself. Because of this, the best solution for organizations was simply to disable support for SSL 3.0 in their applications and systems.

So That Was 3 Years Ago….

As described in the links at the bottom of this article, Microsoft still supports the use of TLS 1.0 and 1.1 for clients connecting to the Office 365 service. However, due to the potential for future downgrade attacks similar to the POODLE attack, Microsoft is recommending that dependencies on all security protocols older than TLS 1.2 be removed, wherever possible. This would include TLS 1.1/1.0 and SSL v3 and V2.

The problem here is that many operating systems and applications have a hardcoded protocol version to ensure interoperability or supportability. In Windows 8 and Windows Server 2012 and higher, the default protocol that is used is TLS 1.2 – which is good.

However, in Windows 7 and Windows 2008 R2, TLS 1.0 was the default protocol. In fact, TLS 1.1. and 1.2 were actually configured as “disabled”. See the table below:

 

 

As outlined in the article “Preparing for the mandatory use of TLS 1.2 in Office 365”, this is going to present a problem if your organization is still using Windows 7/Vista clients. Why?

Because on October 31, 2018, Microsoft Office 365 will be disabling support for TLS 1.0 and 1.1. This means that, starting on October 31, 2018, all client-server and browser-server combinations must use TLS 1.2 or later protocol versions to be able to connect without issues to Office 365 services. This may require certain client-server and browser-server combinations to be updated.

Our internal telemetry of client connections indicates that this shouldn’t be a problem for most organizations, since the majority are not using TLS 1.0 or 1.1, anyway. However, for the network you manage it’s probably a good idea not to simply assume everything will be great. 😊

As an example, if you’re using any on-premises infrastructure for hybrid scenarios or Active Directory Federation Services, make sure that these infrastructures can support both inbound and outbound connections that use TLS 1.2.

How Do I Know if I Need to Take Action?

A new IIS functionality makes it easier to find clients on Windows Server 2012 R2 and Windows Server 2016 that connect to the service by using weak security protocols.

https://cloudblogs.microsoft.com/microsoftsecure/2017/09/07/new-iis-functionality-to-help-identify-weak-tls-usage/

There are also some simple checks available from Qualys Labs to check browser compatibility – https://www.ssllabs.com/ssltest/viewMyClient.html as well as the certificate and encryption configuration on your servers with SSL certificates – https://www.ssllabs.com/ssltest/ .

Hopefully these checks will help you to ensure that your organization is ready when the change is made to the Office 365 services early next year.

Additional Resources

Preparing for the mandatory use of TLS 1.2 in Office 365

https://support.microsoft.com/en-us/help/4057306/preparing-for-tls-1-2-in-office-365

Solving the TLS 1.0 Problem

https://www.microsoft.com/en-us/download/confirmation.aspx?id=55266 

Disabling TLS 1.0/1.1 in Skype for Business Server 2015 – Part 1 and 2

https://blogs.technet.microsoft.com/nexthop/2018/04/18/disabling-tls-1-01-1-in-skype-for-business-server-2015-part-1/

https://blogs.technet.microsoft.com/nexthop/2018/04/18/disabling-tls-1-01-1-in-skype-for-business-server-2015-part-2/

Implementing TLS 1.2 Enforcement with SCOM

https://blogs.technet.microsoft.com/kevinholman/2018/05/06/implementing-tls-1-2-enforcement-with-scom/

Exchange Server TLS Guidance

https://blogs.technet.microsoft.com/exchange/2018/01/26/exchange-server-tls-guidance-part-1-getting-ready-for-tls-1-2/

https://blogs.technet.microsoft.com/exchange/2018/04/02/exchange-server-tls-guidance-part-2-enabling-tls-1-2-and-identifying-clients-not-using-it/

https://blogs.technet.microsoft.com/exchange/2018/05/23/exchange-server-tls-guidance-part-3-turning-off-tls-1-01-1/

Intune TLS Guidance

https://blogs.technet.microsoft.com/intunesupport/2018/06/05/intune-moving-to-tls-1-2-for-encryption/

Preparing for TLS 1.0/1.1 Deprecation – O365 Skype for Business

https://techcommunity.microsoft.com/t5/Skype-for-Business-Blog/Preparing-for-TLS-1-0-1-1-Deprecation-O365-Skype-for-Business/bc-p/223608

Microsoft Teams: Beyond the Basics

Published on by Dave Branscome3 Comments

In a previous blog post, I talked through the basics of setting up a Microsoft Team and showed you how Teams are related to Office365 Groups, SharePoint Online and Skype for Business Online.
Now I’d like to walk through some of the nitty-gritty details related to your Microsoft Teams deployment. A much more comprehensive set of information can be found in the “Practical Guidance for Microsoft Teams.docx” found at http://www.successwithteams.com, but this article will give you an overview of what you should have in mind as you start talking with your customers.

A Peek Under the Covers

Now, we’ve discussed some of the basics of Microsoft Teams, but it’s important to have a “big picture view” of the other components that will factor into your planning process.
First of all, as we noted previously, a Microsoft Team creates an Office365 Group. If you are the owner of an existing Office365 Group, you also have the ability to convert it over to a Microsoft Team. When the Group becomes a Team, the existing SharePoint and OneNote are automatically ported over to Teams. Keep in mind, though, that Groups must be private and they cannot have more than 600 members.

[Update: As of 8/17/2017 you can have up to 999 members in a Group. Thanks for the note, Kyle!]

[Update: As of 10/18/2017 you can have up to 2,500 members in a team. See release notes here: https://support.office.com/en-us/article/Release-notes-for-Microsoft-Teams-d7092a6d-c896-424c-b362-a472d5f105de#PickTab=Mobile_devices%5D

You can see where your Office365 Group is created in the Office365 Admin Portal, as seen below:

Office365 Office365 Groups uses identities that are stored in Azure Active Directory. This means that all authentication and authorization capabilities are managed by Azure AD. This makes it possible for you to use things like Multi-Factor Authentication (MFA) in Microsoft Teams, as well. That means that an organization can use any identity model supported by Office365, including the following:

  • Cloud Identity: In this model, a user is created and managed in Office 365 and stored in Azure Active Directory, and the password is verified by Azure Active Directory.
  • Synchronized Identity: In this model, the user identity is managed in an on-premises server, and the accounts and password hashes are synchronized to the cloud. The user enters the same password on-premises as they do in the cloud, and at sign-in the password is verified by Azure Active Directory. This model uses the Microsoft Azure Active Directory Connect Tool.
  • Federated Identity: This model requires a synchronized identity with the user password is verified by the on-premises identity provider. With this model, the password hash does not need to be synchronized to Azure AD, and Active Directory Federation Services (ADFS) or a third-party identity provider is used to authenticate users against the on-premises Active Directory.

Now let’s dig into the components of the Microsoft Team itself: each Team that you create contains multiple elements, including a SharePoint Online (SPO) site. Each channel that you create in Teams gets its own folder on this SPO site, and the permissions and file security options that are set in SPO are automatically reflected in Teams. This is the data that is shared across the members of the Team. To be clear, for this functionality to be available, you must be using SharePoint Online.

However, you can also have 1:1 conversations using private chat in Microsoft Teams. What if you share a file with someone in one of those chat sessions? Where is that data stored? The files associated with those private chat sessions are hosted in your OneDrive for Business, and the permissions are automatically granted to all participants in that specific private chat. The OneDrive for Business license is tied to the SharePoint Online license, so again, we have to have SharePoint Online enabled for this to work. In the screenshot below, you can see where OneDrive for Business files are made available in Teams.

When we create an Office365 Group, we also get an associated OneNote notebook for the Team, and sections are created in the notebook for each channel in that Team. Any security settings applied within OneNote automatically apply to Notes within Teams. So, as you see below, there is a notebook for the Graphic Design Institute, and then a section would be created in OneNote for the channels – Art and Media Festival, Content Staging, Future Ideas, and so on.

What may not be quite so obvious is that each Team also has an associated Exchange Online (EXO) mailbox. This mailbox is used to store information including the group mailbox and a common calendar for the Team. When a meeting is created in Teams, the invite is pushed to your Exchange Online mailbox, and the meetings created in EXO are synced to the Meetings tab in Microsoft Teams. The meetings that show up here in the “Meetings” area are the same ones that show up in your Outlook mailbox.

What’s interesting is that Microsoft Teams does not strictly REQUIRE users to have an Exchange Online mailbox. Unlike the SharePoint and OneDrive for Business components, which MUST be hosted online, you are able to deploy Teams with mailboxes hosted on-premises. There will, however, be a few caveats for users with on-premises mailboxes. This table, taken from the Planning Workshop for Microsoft Teams.pptx document highlights the restrictions.

When it comes to Microsoft Teams and Skype for Business, there is an important fact to consider during your planning and deployment. At this time, interoperability between Microsoft Teams and Skype for Business is available only for peer-to-peer (P2P) instant messaging. In other words, you cannot have a conference where some users are on Skype for Business and other users are leveraging Microsoft Teams in the same conference. Additionally, in order for a Microsoft Teams user to send an IM to a SfB user, the Microsoft Teams user must be homed in Skype for Business Online.

The Dreaded Licensing Discussion

Yes, I know. I hate talking about licensing, too. But as we’ve seen above, there are a lot of online components that provide the core functionality to Microsoft Teams, so there may be some confusion around which SKU’s are required to get the needed functionality.

As of this writing (May 2017) the Microsoft Teams Licensing Requirements are actually quite straightforward. They are as follows:

With these licenses, the core functionalities (chat-based workspace, and meetings with audio, video, and content group calling) of Microsoft Teams are available to all supported subscription plans. All the supported subscription plans are eligible for access to Microsoft Teams’ Web client, desktop clients, and mobile apps.
However, if the organization where you are deploying Microsoft Teams has specific information protection (security and compliance) requirements, these may dictate the use of a specific subscription plan in order to get the functionality needed – not just for Microsoft Teams – but for the overall Office 365 solution for the organization. For example, if a customer requires the ability to perform eDiscovery against SharePoint data or Exchange mailboxes, they may require an Enterprise SKU, rather than a Business SKU.

More bandwidth, more bandwidth….

With all these capabilities being hosted in Office365, you may be wondering about bandwidth requirements.
The group that has developed Microsoft Teams leverages a planning methodology that closely mirrors the Skype Operations Framework (SOF) planning process, which encompasses the Plan, Deliver and Operate phases. So, if you’re familiar with SOF, you’ll understand the process for a successful Teams rollout.
Part of that successful planning involves determining bandwidth requirements. Since we know that there is a Skype component to Teams, a logical question comes up: “How do I plan for Teams from a network capacity standpoint? Can I just use the Skype for Business Bandwidth Calculator and be good to go?”
Well, probably. But if your deployment of Teams is not very large or complicated, you can use the Microsoft Teams bandwidth calculator located here for network planning: http://aka.ms/bwcalc/

However, keep in mind that, in order to get an optimal experience with real time media within Microsoft Teams, you have to meet the typical networking requirements for running Skype for Business in Office 365, which may require more than just meeting bandwidth requirements. In other words, your planning is going to include things like ensuring the quality of your WiFi connections, allowing access to the necessary Office365 URLs and IP address ranges, bypassing proxies, and enabling split-tunnel VPN. So there may be circumstances where

It also means you need to meet the following requirements on the two critical network segments: Client to Microsoft Edge and Customer Edge to Microsoft Edge:

To test these values, we recommend that you leverage the Network Assessment Tool located here: https://www.microsoft.com/en-us/download/details.aspx?id=53885). This tool can be deployed on both the client PC directly, as well as a PC/laptop connected at the Customer Network Edge. Documentation for how to use the tool can be found here: Network Readiness Assessment. By running this Network Readiness Assessment tool, you can validate your network’s readiness to run real-time media applications, such as Microsoft Teams. If the tool indicates that there may be network issues that would impact the quality of the audio/video experience for your end users, you should recommend that the customer have an Advanced Network Readiness assessment performed by a partner with qualifications in that area.

Conclusion

Now we’ve taken a little bit of a deeper look into Microsoft Teams. It’s a great tool for group collaboration, and it’s really very easy to set up and deploy in an organization. Make sure to read all the planning documentation on the http://www.successwithteams.com website – and Happy Teaming!

Why I Love Microsoft Teams

Published on by Dave BranscomeLeave a comment

One of the great (and most challenging) things about working at Microsoft is the fact that we get to work on the latest, bleeding-edge stuff the company makes. In fact, we are encouraged to put each piece of software through its paces, using it in our daily life in what everyone at Microsoft refers to as “eating our own dogfood”. It’s fun to see the newest stuff first, but it can also be challenging to work with software that you have to “figure out” – products that seem to duplicate the capabilities of other products or overlap with other feature sets.

It was through that set of glasses that I started working with Microsoft Teams in my Office 365 test tenant. (For a brief overview of Microsoft Teams, check out the blog posts by Michael Panciroli or Mike Bosse.)

To begin with, Teams is activated at the tenant level of Office 365. The tenant admin just goes to the Office 365 Admin center, selects Settings –> Services & add-ins, and then clicks on Microsoft Teams in the main window.

Figure 1: Adding Microsoft Teams in Office365

From there, toggle the slider to On, and your users are ready to go.

Figure 2: Turning on Microsoft Teams

At this point, you can go to the web application at http://teams.microsoft.com and you’ll be prompted to create a new Team. Let’s walk through that process together:
First, I’ll give a name (Gizmo Gadgets Team) and a description to my Team and click “Create a team”.

Figure 3: Name your Team

Next, I can add people to my team. Note that I can add people individually, or I can add them as part of security groups or distribution lists.

Figure 4: Add Team members

Here’s where it started to get really cool for me….
Remember how I said there are sometimes areas where one piece of software overlaps another and you have to dig around and figure that out? Well, I just created a Microsoft Team named “Gizmo Gadgets Team”. Let’s now take a look at the Groups page in the Office 365 admin portal. What do we see?

Figure 5: Groups page

Okay, that’s nice. By creating a Microsoft Team, I’ve also created an Office 365 Group…
But now I’m left wondering “is this just a security group, a distribution group, or what?” I decided to check the admin mailbox and see if there is an actual Office 365 Group available. And there it is!

Figure 6: Gizmo Gadgets Office365 Group

Just like that, an Office365 Group named Gizmo Gadget Teams is created and available for me to use.
(It’s worth noting here that if I already had an Office365 Group of the same name, it would have offered to create a Team based on that existing group. That helps avoid duplication of names and creating confusion about where the team’s data is being stored.)

What does this mean for me?
Well, I know Office365 Groups have several capabilities associated with them – chat conversations, a shared calendar, file storage location, One Note and some other capabilities, as you can see from the Gizmo Gadgets Office365 Group page below.

Figure 7: Gizmo Gadgets Groups page

Okay, interesting enough…. but all the pieces still feel somewhat disconnected.
How is this Office365 Group linked back to my Microsoft Team of the same name?

In the same browser session, I go to http://teams.microsoft.com. I’m automatically logged in with my current browser credentials, and there I see my Gizmo Gadgets Team location as well. (I can also download the Microsoft Teams app from this location if I don’t want to use the web application.)

Figure 8: Gizmo Gadgets Microsoft Team

I’ll upload a couple documents to the Team site:

Figure 9: Upload Documents to Teams

Now, if I flip back over to the Office365 Gizmo Gadgets Group location, what do I see? Yep, the same documents are visible in my Office365 group location.
The Team and the Group are using the same back-end SharePoint location for document storage.

Figure 10: Documents Uploaded to Groups Location

Okay, so now I’m able to access the same set of documents from (1.) an Office365 Group named “Gizmo Gadgets Team”, (2.) the Microsoft Team named “Gizmo Gadgets Team” or (3.) directly from the common SharePoint location.

So now we have a common location for document storage. What else can we do?

Well, in Office365 Groups, you can create a Planner that can be used for managing resources, assigning tasks, tracking progress and so forth on a project.

Let’s connect the Gizmo Gadgets Planner in Office365 to the Gizmo Gadgets Team location.

In the Gizmo Gadgets Teams location, click on the “+” sign.

Figure 11: Adding Planner to Team

Now, select the Planner icon to add it as a tab in Teams. Notice I could also connect to my Office365 Group’s shared OneNote or an external website from here. I could also create an entire tab with just an Excel spreadsheet or a Word document, or maybe a really nice PowerBI dashboard.

Figure 12: Connecting the Planner to Teams

And just like that – I’ve added a tab for the Gizmo Gadgets Planner in Microsoft Teams – the same one that I can see in the Office365 Group!

Figure 13: Planner in Office365 Groups

Figure 14: Planner in Microsoft Teams

Now let’s look at the shared calendar in the Office365 Group. I created a Team Meeting in the Calendar tab.

Figure 15: Shared Calendar item in Office365 Groups

As you’d expect, it shows up in the Conversations tab of the Office365 Group so that all members of the Group are aware of the meeting. But it’s also showing up in Teams in the Meetings tab.

Figure 16: Office 365 Groups view

Figure 17: Microsoft Teams Meetings tab view

Let’s have some more fun. Let’s have some conversations.
In Teams, right click on the Chat icon and select “New Chat”. Choose the person you want to chat with, and you’re all set.

Figure 18: New Chat

But wait…. what’s this?

Figure 19: Video and phone call icons

I can do a video call or regular phone call from inside Microsoft Teams? This feels a lot like……Skype for Business!! This is getting fun!
To be fair, you can’t do a video or PSTN call from inside the web app yet. You’ll have to download the Teams app to place calls, but that feature is coming. For now, I’ll download the app and try out the video call capability.

If someone initiates a phone call to me from within the Microsoft Teams app, this is what I see. (Obviously, I’m using the pre-built personas in my Office365 tenant.😊 )

Figure 20: Meeting phone call

If we do a video call, I can share my desktop from within Microsoft Teams, just like in a regular Skype for Business meeting!

Figure 21: Share desktop from Teams

This is interesting to me for a couple of reasons:

  1. Most of my meetings and 1:1 interactions during the day are via Skype for Business, which means that most of my daily team collaboration can get done here within Teams.
  2. Most of the stuff I produce (documents, presentations, etc…) are stored in either OneDrive or SharePoint, so I can easily access them all from within Teams, and I don’t have to save URL’s all over the place. In fact, I don’t even have to KNOW the URL’s.
  3. I can save my favorite websites in a Team and avoid having to bookmark them in a browser.

So really, the only time I actually need to leave the Teams application is to check my email. But let’s think about this for a moment: if I could get all my coworkers to chat, conduct meetings and share documents with me via Teams…the only reason I would need to check email is for external communications.
Now, there are studies that indicate that you may actually get LESS done if you’re checking email continually throughout the day. So if I work within Teams most of the day, and check my email once in the morning and once at the end of the day, it’s possible I could actually be more productive using Teams!
Give Microsoft Teams a try. I’m sure you’ll love it.
Watch for another blog post where I’ll discuss the integration with Yammer, Twitter and other forms of social media, as well as how you can use Bots in Teams to automate some tasks in Teams.
Microsoft Teams is going to be awesome!

When You Just Gotta Have a Lab

Published on by Dave BranscomeLeave a comment

I spend a lot of time working with partners and customers setting up and performing demos of new products.

In many cases, we are looking at features that are purely cloud-based – such as Skype for Business Cloud PBX or PSTN Conferencing. When that’s the case, I just go to the Office365 tenant that I have set up for my own testing and show everyone where things are configured or what features are available.

Every so often, though, I get asked to set up a demo using a somewhat more complex type of environment involving a set of virtual machines or some other cloud product like EMS.

I used to manually set up the lab virtual machines on my laptop, but I found a great new resource that lets me build the environment in Azure using a documented and scripted process.

It’s called the Cloud Adoption Test Lab Guides and they are located here: https://technet.microsoft.com/library/dn635308.aspx#O365

For example, if I needed to demonstrate how a highly-available SharePoint 2016 farm would be configured, I could use the guide found here, and it would walk me through building an Azure environment that looks like this:

There are a couple advantages to this approach:

  1. It frees up my laptop resources (VM’s tend to be storage hogs and I have a limited amount of CPU and RAM available for building out scenarios),
  2. I can access it from anywhere since the machines are in the Azure Cloud, and
  3. It gives me the chance to get more hands-on experience with Azure.

It’s a great option for those scenarios where you need to build a testing environment or as a way of demonstrating a product for customers.

The great thing is, you can build it in your own Azure environment so you always have a demo environment ready to go, or you can choose to build it in your customer’s Azure environment as a leave-behind for them to play with at their leisure. That also gives you the opportunity to talk to them about moving their existing on-premises workloads to Azure, or using Azure as a backup/recovery location, setting up test/dev environments in Azure and lots of other stuff.

The team that’s responsible for creating the Cloud Adoption Test Lab Guides is constantly creating new scenarios, so check back frequently to see which new scenarios they’ve created!

 

Skype for Business Client for Mac Goodness

Published on by Dave BranscomeLeave a comment
I love updates.

I actually get geekily excited when I get prompted to shut down Office while Click-to-Run updates my Office install. When it’s done, I can’t wait to see “what’s different”.

On Sunday, my TV prompted me to apply a software update, and I had to force myself to not run the update in the middle of the football game.

Heck, I even like seeing that I have updated antivirus definitions.

I know…I need to get out more.

So you can imagine my excitement when I saw the announcement about a new Skype for Business client for Mac. Working with partners and customers over the last year has been a rising crescendo of “When is the new Skype for Business Mac client going to be released?” – frequently followed by “I thought you said it was coming in <insert month here>”.

Well, it’s here now, and it’s beautiful!

https://www.microsoft.com/en-us/download/details.aspx?id=54108

Edge-to-edge video and fully immersive content sharing and viewing means that Mac users truly get a first class experience!

If you rushed out to order yourself a new MacBook Pro this week – first of all, you should have bought a SurfaceBook. But I’ll assume you need the new MacBook “for testing purposes”. The new MacBook runs the Sierra OS, which is supported with the new SfB Mac client, so – you’re good! (It’s also supported on El Capitan if you aren’t an “update-aholic”.) To get Outlook integration, you’ll need to have the Outlook for Mac build 15.27.

But wait…there’s MORE!

What makes it doubly exciting is that the Skype Operations Framework (SOF) got an update to go along with the Mac client update! If you haven’t yet familiarized yourself with the Skype Operations Framework, you should stop reading this right now and go check it out here: http://www.skypeoperationsframework.com

It’s a fantastic set of documentation and guides that help ensure that your Skype for Business deployment are successful. And it now includes guidance for planning and deploying the Skype for Business client to end users who prefer to use a Mac! There’s even a video training module that shows you the differences between the Mac and other clients and gives some troubleshooting guidance.

Yes, I love updates. And I love it when the updates allow me to pass along good news to our partners and customers – and this news is certainly welcome.

Enjoy the new Skype for Business client on your Mac!