Episode 04 – Microsoft Security Maturity Assessment

Podcast Guest Introductions

Charlotte
Hi, and welcome to the latest podcast episode.

Today, I’m here with two cybersecurity professionals who help higher education institutions enhance and uplift their cybersecurity.

And what we’re gonna be talking about is a Microsoft 365 security maturity assessment, that has a special focus on higher education because, obviously, they face very unique challenges in that area.

And we’re really gonna provide some good practical insights and information so that people can take away actions from this podcast. So if you’re a higher education institution looking to maximize your Microsoft security, then you’re in the right place. But before we jump into it, why don’t you guys introduce yourselves?

Andy Le Grice
Thanks, Charlotte. Nice to be here. My name’s Andy Le Grice. I’m the security practice lead, and I work to ensure that we help our clients improve their cybersecurity maturity.

Brilliant. Ben?

Ben Simpson
Thank you very much. Yeah. My name is Ben Simpson. I’m a Microsoft security lead, and I work to carry out these assessments, build these assessments, and provide the findings back to the customer.

Charlotte
Brilliant. So we should get some really good insights today. I’m quite interested in this. So, Andy, let’s start with you.

So how does a Microsoft security assessment work? Let’s start at the beginning. You know? How does it address those particularly unique challenges for higher education?

Andy Le Grice
Yeah. So a good question to start us on. So, you’re right to say that there are some unique challenges for higher education institutes.

Perhaps one of the biggest is the fact that cybersecurity and the academic principles of openness are not really a good match. They’re a bit like oil and water, really. But we’re very conscious of this. So when we go about our security assessments and the Microsoft security assessment in particular, we know that we can’t always, implement strict controls, but we can certainly ensure that there’s telemetry in place to support the detection and response to any malicious activity that may take place.

So trying to trying to marry cybersecurity controls in an open distributed environment is an obvious challenge.

And the second is the fact that universities in particular are resource constrained in terms of time. So cybersecurity professionals’ time in universities is pretty thin on the on the ground. And from a financial perspective, there aren’t always the resources to ensure that all of the controls that may be required are in place. So a key reason that we do these security assessments is to uncover what’s already been invested in and make best use of what’s there.

Charlotte
So I so I guess, from a resources point of view, cybersecurity is actually quite a big topic, isn’t it? And there’s lots of different areas that it covers. So that further constrains that resource that they have available because they don’t need all those skills all the time, and it would probably cost a fortune to have them.

Andy Le Grice
Absolutely. And it’s a very competitive market, and the threat landscape is certainly not shrinking. Yeah. There are more and more opportunities for the for the threat actors and therefore more and more consideration required to keep those institutions safe.

Charlotte
Well, and especially because you’ve got a balance, like you said, if, you know, if it’s quite an open environment, and you’ve got a lot of different people involved in that from the students to the faculty and all of those different Absolutely. Spaces.

Andy Le Grice
And there’s an acceptance that the insider threat is perhaps more acute within universities than many other organizations in the sector.

Charlotte
So that’s like phishing, you know, email phishing and users just clicking on malicious files without meaning to or accidentally sharing information outside of the environment?

Andy Le Grice
Absolutely.

Ben Simpson
Yeah. And as part of that as well, you’ve got the social engineering side of things as well. Mhmm. I was on a, course a couple of weeks ago around the CIS controls. One of the founders of CIS is a CISO for Virginia Tech.

And the way that he laid it out was his campus is like a museum. He expects people to come in. He expects people to try and, you know, mess with the artwork or vandalize things and things like that. But you have certain controls in place to stop them from doing that. You’ve got, you know, covers that come down in front of in front of patents. You’ve got security guards.

Charlotte
Mhmm.

Ben Simpson
Things like that is exactly the same in the Microsoft world, but it’s just technical controls done within a portal, done within you know, behind the scenes. So when someone does try to do that, they’re caught, oh, you can you’ve got something in place to be able to battle it and combat it.

Charlotte
So it’s really important then, isn’t it, to have an as well as the technical understanding is to have an understanding of how people behave Yeah. In that in that environment and in those different scenarios. I would imagine that’s quite interesting.

Ben Simpson
Yeah. Because it’s a publicly open campus for the most part. There’s especially research universities and things like that. They they invite people in. So you just need to have the safeguards and the controls in place Mhmm. To ensure that it’s done securely.

Charlotte
And the accessibility. Because I know as somebody goes and presents at different venues, trying to get on the Wi Fi to present something.

Ben Simpson
Yeah, exactly.

Charlotte
Can often be a bit of a barrier. So. Okay, so it’s so it’s a complex environment. There’s lots going on.

There’s lots of different people. There’s lots of different, open points in the fabric of that security layer. So why don’t, Andy, why don’t you walk us through how the assessment works? So from initial engagement to kind of final delivery, what how does that all work?

Andy Le Grice
Yeah. Okay. So, we typically get involved and see value or need for an assessment as part of a broader engagement with our with our client. So really, at that point, we’re looking to identify potential gaps or uncertainties or areas where there’s a lack of visibility or a lack of control.

And it is almost nailed on that every university, every higher education institute will have made a fairly significant investment in Microsoft security. So this is a really good place to start. Mhmm.

And and once we have access to the Microsoft environment, our tools, our processes, and experience, allow us to appropriately analyse the use of those Microsoft controls. So we look at Intune. We look at Defender.

We look at Purview. We look at, I’ve said Intune, haven’t I? We look at Exchange. And we look at T and SharePoint.

Yeah.

Charlotte
SharePoint is massive.

Andy Le Grice
What if I’ve forgotten then?

Ben Simpson
And it’s almost Entra is probably the only other one. But, yeah, Exactly. We we look across the whole estate.

Charlotte
To all those different portals that

Ben Simpson
Exactly.

People one of the main ones that comes to mind of being particularly neglected, especially in this space, is Purview. I mean, universities, are built on data. Right? Especially research universities, as I mentioned earlier.

Having those data loss protection policies in there, having document labelling so you can you know where things are and map out the data, I think that’s really important. But in our experience, we’ve seen a lot of a lot of universities not have the controls in place to be able to stop something like a data leak if it was to happen.

So

Charlotte
And is that like a deliberate data leak or an accidental one?

Ben Simpson
Both. So yeah. It it protects you from both sides of it, really. Purview’s got the data loss prevention side of it.

It’s it can be sort of done down to classifications. So if your document is labelled as finance or sensitive or important Mhmm. If you’re gonna send that out, it’ll ask you if you want to send that out. It might get held for an administrator to say, yeah.

Actually, that’s okay. They’ve spoke to me about that. That is some information that’s leaving our network, but we’re happy with that. We’ve accepted the risk because it needs to go to someone.

So, yeah, both, really.

Charlotte
And do you think it often gets missed because people don’t know that there’s that capability and the technology to have those kind of controls in, or they don’t have the skills internally to sort of understand what those processes should be?

Ben Simpson
Yeah. I think I think it’s a bit of both. So the skill gap is quite massive. I mean, early on in my career, I was I was a general technical consultant, and then I moved to specifically do Microsoft security, within the past three, four years.

So there is a lot of a lot of stuff that even I still figure out now that is it’s constantly evolving.

So I think it’s mainly the skills gap, but, also, people some people just don’t know what they get as part of an e five or an e five license and in this case.

Andy Le Grice
Yeah. There are a lot of very capable people in the industry in the sector.

It’s the time, that they just don’t have They’re spread too thin

Charlotte
Yeah. Often quite small teams, aren’t

Andy Le Grice
they?

Exactly. Mhmm. And also trying to keep on top of, the Microsoft services and the technologies as they evolve and how to best apply them to the institution as it evolves from an IT perspective is not necessarily straightforward.

So calling on a third party like ourselves to assist with that and accelerate that understanding that learning Mhmm.

And then being able to implement changes and controls with confidence

Charlotte
And quickly.

Andy Le Grice
Is where we see a lot of a lot of value.

Charlotte
Yeah. And that’s a huge amount of value, isn’t it?

If you think about how quickly the threat landscape evolves, you know, where there are new threat actors that come in and cause chaos and particularly, I guess, for higher education during periods like clearing, when there’s a lot going on and the team will be stretched particularly thin, sort of prepping for that, I would imagine is quite accurate.

Andy Le Grice
Yeah. Indeed. I mean, going back to your, going back to the original question, once we’ve done this analysis, we do work with our clients in pretty much real time, don’t we, to ensure that what we find is either addressed at that point or at least noted, and reported on.

So there’s an opportunity to make some immediate gains. Yeah.

And then when the report does go back, the written report, it is presented in a way that’s easy to digest, for senior management

Charlotte
Mhmm.

Andy Le Grice
And then easy to understand and act upon for the for the technical teams. And we talk about risk from a cybersecurity perspective, obviously.

But we also talk about the risk associated with the impact on the end user or groups of users

Charlotte
that changes.

You were talking about between making sure it’s secure, but then making sure that users have access to what they need.

Andy Le Grice
Indeed. Yeah. So, security should also be about ensuring we’re minimizing the friction for the for the end user.

Ben Simpson
Yeah. Absolutely. And also sort of nurturing that security culture. If you if you get a security team coming in and saying, we’re gonna do twenty things this month, that’s all great.

But if every all twenty of them, it impact the user in a negative way, they’re gonna have a sort of stigma towards security and think they’re just trying to get in the way of us doing our job. Mhmm. That’s exactly what we’re trying to avoid, trying to be there as an extra set of hands. As as Andy said, there is a lot of very talented people in the industry, but they often wear a lot of different hats, and they get pulled from pillar to post.

That’s where we’re looking to help in most cases.

Charlotte
Yeah. And that’s where your knowledge of the higher education sector must come in really use really handy because you understand their pressures, but also the pressures of the users.

So that balance seems quite critical,

Andy Le Grice
doesn’t it? I think empathy is really important

Charlotte
Yeah.

Andy Le Grice
Particularly in this in this sector because as we discussed already, it’s quite unique, the challenges that Yeah. That are faced.

Charlotte
Yeah. And I think reputation is really important that you raise that, Ben. I know I’m going off piste a little bit, so don’t panic. But, a relative of mine is involved is in an IT team in a in a university, and I know that can sometimes be an issue because they’re doing a really good job. Like you say, they’re really stretched.

Ben Simpson
Yeah.

Charlotte
And I guess to partner with somebody like you guys would give them such an advantage for that because they can focus on the thinking and kind of understanding what they need to prioritize.

Ben Simpson
Yeah. Absolutely. I mean, we’re looking to be an extension of the team. We’re not looking to just provide a report and Yeah.

You know, there you go. There’s your priorities. We want to be able to come in and help you with that and also just be as a sort of a, well, consultant, really, around all things Microsoft security to help you get to finalizing that report to starting from day one. Then a couple of years down the line, you’ve ticked off every box that we’ve initially looked at, and we’ve worked with you to implement those things as well.

Charlotte
And I think there’s also another impact, isn’t there, around sort of again, talking about that balance between the user and the security.

Obviously, there’s a lot being talked about at the moment about zero trust, for example. So and I know that’s something you’re really passionate about.

So how does this assessment help them with that as part of this process?

Andy Le Grice
So another good question. So I think the principles around zero trust are well understood now. So we’re looking to establish the trust that we have in the user and typically their device, of course.

And then we look to, assign the least privileged access to the service that they’re that they’re trying to trying to gain access to. And then, of course, we need to verify often, verify that trust. Nothing ensure nothing has changed to, maintain that connection to that service.

Microsoft have a lot of capability in this space. And as we’ve touched on already, the tools and the services are constantly evolving.

Charlotte
Mhmm.

Ben Simpson
And

Andy Le Grice
so there may be opportunities to accelerate the adoption of zero trust in some areas or extend it in others.

But equally as importantly, we know that Microsoft isn’t always the answer to everything. Mhmm. So we believe that there are other options to extend zero trust capability in conjunction with Microsoft. So how do we take best advantage of the tools that are available that the university may have invested in with other vendors alongside Microsoft.

Charlotte
Yeah. Because they might have other licenses that give them some of those capabilities.

Andy Le Grice
Absolutely.

And then we have a very real and a frequent opportunity to make the best of multiple vendors’ solutions through proper integration.

Yeah. So that’s an area that we work on quite frequently, especially when we’re talking about network vendors, and ensuring access to network connected services, as well as cloud providers. And how do we integrate everything with Microsoft and maintaining, that visibility and that control, and extending the use of zero trust. So Microsoft is certainly an anchor point in, from a zero trust perspective with some untapped, capability often, not always, but often Often. Yeah. Uncovered.

Charlotte
Must give them quite a belt and braces approach to security and one that is not necessarily fixed in a moment in time, but kind of naturally evolves with what they’re trying to achieve.

Ben Simpson
Yeah. Yeah. And and it kinda has to just with the amount of new things that come out from not just Microsoft. Every security vendor is always coming out with a shiny new toy, shiny new feature, and you need to decide whether that’s a good fit for your business or, in this case, university.

Charlotte
Yeah. Like, is it a sledgehammer, crack a nut?

Ben Simpson
Yeah. Exactly. Is it overkill is a lot of the stuff that we see. We can we can give you a solution or provide a solution for sometimes a lot less money, sometimes incorporating the tooling that you’ve already got to save you going out and picking something new up off the shelf.

Andy Le Grice
Well, that’s a good point, actually. So we worked with the university recently, and determined through the Microsoft assessment that they actually didn’t really need to renew a subscription that they had for, a service from a from another vendor. Yeah. So by, enabling a few features that haven’t been enabled from a Microsoft perspective and just tweaking the way that the organization, operated from a security perspective, we were able to save that organization a fair amount of money through a subscription that ultimately became unnecessary.

Charlotte
Yeah. Became redundant.

Andy Le Grice
But that only came to light through a combination of the assessment, and a broader conversation, off the back of the, of the report. So that was, that was really nice to see, actually.

Charlotte
Yeah. That is nice.

So there’s security benefits, there’s user benefits, and there’s the good old financial benefits, which

Andy Le Grice
everyone’s looking for.

Ever forget. No.

Ben Simpson
Yeah. We always keep a fine eye on that because it’s one of the main challenges as we’ve already said. If we can save you money, we’ll do it.

Charlotte
Definitely. And you were saying before we started recording about, another university that had uncovered a lack of antivirus.

Ben Simpson
Yeah. Yeah. So, one of the one of the assessments that we’ve done in the past couple of weeks, they had a really good setup. So everything was pretty in line with Microsoft best practices.

But going through that hundred and sixty point checklist that leaves sort of no stone unturned as such.

So

Charlotte
I can imagine.

Ben Simpson
It it we did find a couple of things. Mainly, there was, I think the number was around fifty five devices that didn’t have defender enrols and obviously had no, EDR or antivirus software on the machine at all. So those fifty odd devices were completely exposed.

And to see that in an in an environment that is so mature and already has gone on that security journey, it just shows that this assessment can help uncover things even if you’re doing a lot of good things.

Charlotte
Mhmm.

Ben Simpson
It’s just a good thing to have it’s sort of like an MOT every now and again, isn’t it? Just a quick check. Yeah. Yeah. And for the cost of the service as well, there’s a relatively low cost. Yeah. It’s it’s definitely worth doing.

Charlotte
Yeah. I know that. And that’s well, it goes back to that belt and braces, doesn’t it, that we were talking about?

Andy Le Grice
Yeah. We find one of the, one of the outcomes that is it’s a little bit harder to define, to capture, to quantify, I suppose, but there’s a definite sense of increased confidence following an assessment. So there’s as Ben’s alluded to, a lot of organizations do have a good implementation from a Microsoft perspective.

Well, it’s always room for improvement.

Charlotte
Yeah. Because it changes a lot too, doesn’t it?

Andy Le Grice
Totally. Totally.

But the confidence to have another pair of eyes to review, and maybe not rub a stamp, but certainly provide some very positive feedback

Charlotte
Yeah.

Andy Le Grice
Around the implementation and the security maturity from a Microsoft perspective. And then as discussed to talk about ways to improve that may not be directly relevant to Microsoft, but have come about through the assessment Yeah.

Really helps to mature and accelerate that maturity and confidence.

Charlotte
Sort of give them a nod to what they’ve achieved so far. So, actually, yes, a lot of what you’re doing is working. Small little tweak here, small little tweak there will get you to that belt and braces.

Ben Simpson
Yeah. And to the point as well that in the actual report that you’ll get at the end, there is a bit in there to say, you know, these are some of the points that you’ve done really well. We’re not here to just bash your whole environment. No. There is a lot of good implementations in place.

However, we found the following recommendations to be able to improve on that and build on it. Yeah. Because we’re not we’re not here to make anyone feel bad or anything like that.

Charlotte
So with that a hundred and sixty point assessment, I’m guessing we could be here for several hours talking about all of the different permutations and benefits and results that an organization or, education institution could achieve. But to wrap up, could you give us just a couple of pointers around what are some of those immediate benefits that something like this would unlock?

Ben Simpson
Yeah. Yeah. Absolutely. So I think one of the main benefits to come out of this assessment is really finding those gaps in your policy. So in almost every single assessment that we’ve done so far, we found, evidence of still users, still devices Mhmm.

Which doesn’t look too serious from the top level. It’s more of, you know yeah. There’s a couple of devices that are that are in there.

If someone was to get ahold of those devices, you don’t know what’s got what that device has access to, what information that the actual device has on it.

Charlotte
Supposed stored passwords and access to drives and documents.

Ben Simpson
Yeah. Exactly. So that is a security hole that you can you can fix really easily and you can automate for the future so that doesn’t happen again.

There’s also improving your visibility as well. So Intune is a is a really good way to understand where your devices are, what they look like, what level of patching that they’re at.

And it is really like the bottom level of security, but it’s really important to patch your devices.

So ensuring that your Intune environment is up to date and it’s getting all of the devices enrolled when they’re getting enrolled into your company resources is so important because then that enrols it into all of the security policies, all of the configuration policies, you know, any restrictions that you wanna overtime.

Charlotte
Quite foundational, isn’t it, I guess?

Ben Simpson
Yeah. Yeah. So I think that’s they’re the two I would say from the top is they’re the really quick wins.

And a lot of the time, you don’t have to do much more work to bring in to bring that in.

Andy Le Grice
Perfect. Yeah. I think one thing that I would add is that, what we often see is the output of the engagement being used as the foundations for a plan Yeah. For these teams who are so busy dealing with the day to day, keeping the lights on as people say. Mhmm. The report becomes a basis of a plan to improve security maturity. So that’s pretty valuable.

Charlotte
Very valuable. I think in anybody’s book, especially, like you say, when you haven’t got a lot of time to think and you and you’re trying to run around, and if you know you’re on a path, then that’s really valuable.

Well, thank you both. I really appreciate you both being here. It’s certainly been interesting for me. It’s always nice to dip into these little worlds that I’m not involved in on a day to day basis. But, yeah, thank you very much. I think that’s been really helpful. Thank you.

Thanks,

Ben Simpson
Charlotte.

Cheers.