Azure Sentinel Cybersecurity Maturity Model Certification (CMMC) Workbook
The Azure Sentinel CMMC Workbook provides a mechanism for viewing log queries aligned to CMMC controls across the Azure cloud including Microsoft security offerings, Office 365, Teams, Intune, Windows Virtual Desktop and many more. This workbook enables Security Architects, Engineers, SecOps Analysts, Managers, and IT Pros to gain situational awareness for the security posture of cloud workloads. There are also recommendations for selecting, designing, deploying, and configuring Microsoft offerings for alignment with respective CMMC requirements and practices. The workbook features 250+ control cards aligned to the 17 CMMC control families across all 5 maturity levels with selectable GUI buttons for navigation.CMMC Compliance with Azure Sentinel
Often the purpose of a Security Information & Event Management software product (SIEM) like Microsoft's Azure Sentinel can be misunderstood. In this blog, Azure Sentinel will be discussed in terms of capabilities and importance for CMMC compliance and an ideal cloud security strategy. Azure Sentinel became generally available on March 13, 2020, and charges for the service started April 1, 2020. Sentinel can pull log data at no cost for Incident Response from AWS CloudTrail, Azure Activity Logs, Office 365/Microsoft 365 Audit Logs (all SharePoint activity and Exchange admin activity) and alerts from Microsoft Threat Protection products (Azure Security Center, Office 365 ATP, Azure ATP, Microsoft Defender ATP, Microsoft Cloud App Security, Azure Information Protection).Microsoft Defender for Identity and CMMC Applications
With Microsoft Defender for Identity and the integration of Azure AD Identity Protection and Cloud App Security, monitoring and alerting can be applied for identities that span both on premises and in the cloud. Learn how Microsoft Defender for Identity uses adaptive built-in intelligence, giving you insights into suspicious activities and events, revealing the advanced threats, compromised users, and insider threats facing your organization. All of this and more can assist in meeting CMMC and DFARS requirements tied to NIST 800-171 / 53. In this video famed Microsoft Security Architect and speaker Matt Soseman (aka.ms/SosemanTV - 6K+ Subscribers) provides this excellent introduction to Microsoft Defender for Identity and how it addresses several key Practices and Domains within #CMMC.
What are the recommendation and procedures for flagging data as CUI and managing it?
In preparing for our CMMC Certification, as a company that is heavily uses SharePoint and Teams in the Office365 cloud environment -- what are the recommendations and procedures for flagging data as CUI and managing it?CMMC Recovery (RE) Domain Overview and Strategy
One of the key areas where the Cybersecurity Maturity Model Certification (CMMC) expands on NIST 800-171 is system recovery, specifically the ability to recover from any event that compromises the integrity and availability of data. Backups are called out in the Recovery (RE) Domain and include the requirement to backup all content, not just CUI and other critical content. Further, testing backups is now a requirement and likely to be validated during a CMMC assessment.Microsoft Teams in Office 365 GCC High - CMMC Considerations
The Department of Defense (DoD), its agencies and organizations, and supply chain - Defense Industrial Base (DIB) - have shied away from remote working and SaaS offerings in the cloud for understandable security concerns. However, times have changed. The workforce includes several new generational bands, technology has inhibited new possibilities, and cybersecurity products/tools are far more enhanced than 10 years previously. Additionally, threats to operational continuity like the recent COVID-19 pandemic are becoming an almost annual occurrence. Weather events, physical security threats, power outages, cyber attacks, and other external factors create scenarios where working from home or remotely becomes the best option for a group of users (if not the entire enterprise). Enter Microsoft Teams for Office 365 GCC High. Security and Compliance with Teams in Office 365 GCC High / Microsoft 365 GCC High (M365) Microsoft Teams US Government can meet many of the requirements in CMMC pertaining to information systems in the cloud. Much of which is met through overarching Office 365 security and products. For starters, the Identification and Authentication (IA) requirements (1.077, 2.078, 2.079, 2.080, 2.081, 2.082, 3.083, 3.084) are met in spades by properly configured Azure Active Directory and Multi Factor Authentication (MFA) within the Office 365 GCC High tenant. This of course extends to Microsoft Teams, as well as SharePoint and others.Why Microsoft Enterprise Mobility + Security (EMS) & ATP are Necessary for NIST Compliance
In a 2018 report provided by the National Defense Industrial Association (NDIA), researchers found companies “severely underestimate(d) the costs of becoming compliant by as much as a factor of 10”. The burden of compliance is significant yet important, and businesses are considering ways to secure their information systems without breaking the bank. One area of cost savings at first glance: email only users. These individuals will likely only need a corporate email, which would reasonably lead IT leadership to purchase an Exchange Only license and carry on. However, we advise contractors purchase Office 365 Advanced Threat Protection (ATP) and Enterprise Mobility + Security (EM+S) in addition to their Exchange license as a best practice for NIST 800-171 compliance. Without the proper understanding of NIST compliance requirements, it is easy to misinterpret the need for ATP & EM+S licensing. It is also reasonable to think consultants are trying to make a quick dollar by upselling. Assuming these individuals are not entirely self-serving, let’s dive into this a little more using a friendly campfire analogy. S’mores. Purchasing an Exchange Only license is like having a s’more without the marshmallow & the graham. The marshmallow & the graham are necessary for the security and protection of the chocolate. They are the quintessential vessels that encompass and bring cohesion to the s’more as a whole. S’more explanation below.
