When Microsoft Messaging Looks Secure but Isn’t — Exchange Server, Hybrid and Microsoft 365 Security with Thomas Stensitzki [MVP]

1
00:00:00,000 --> 00:00:04,400
Yeah, welcome back to the Amcet65 show podcast.

2
00:00:04,400 --> 00:00:10,160
Today we are going deep into one of the most critical and often underestimated

3
00:00:10,160 --> 00:00:15,120
areas of the Microsoft ecosystem, messaging security.

4
00:00:15,120 --> 00:00:20,680
E-Mats remain one of the most important systems in every organization.

5
00:00:20,680 --> 00:00:25,120
It carries business decisions, financial information, customer,

6
00:00:25,120 --> 00:00:30,400
data, credentials, contracts and sometimes the entry-history of a company

7
00:00:30,400 --> 00:00:35,200
communication. Yet many Microsoft messaging environments look

8
00:00:35,200 --> 00:00:41,360
secure on the surface, will still contain serious weakness,

9
00:00:41,360 --> 00:00:45,920
amnesty, yeah, my today's guest is Tomasz Dynitski.

10
00:00:45,920 --> 00:00:50,240
Tomasz is the principal technology consultant and owner of the

11
00:00:50,240 --> 00:00:55,920
Branky course, GmbH in Koga G, where he specialised in enterprise,

12
00:00:55,920 --> 00:01:00,240
consulting and training for Microsoft Exchange, Microsoft 65 and hybrid

13
00:01:00,240 --> 00:01:04,880
collaboration environments. He has been Microsoft MVP for Microsoft

14
00:01:04,880 --> 00:01:10,400
C-65 and experienced since 2018 and holds some of the most advanced

15
00:01:10,400 --> 00:01:14,000
messaging certification Microsoft have ever offered,

16
00:01:14,000 --> 00:01:19,440
including Microsoft's certificate solution, master messaging and Microsoft

17
00:01:19,440 --> 00:01:25,200
certificate master of Exchange Server. Tomasz has more than 25 years of experience

18
00:01:25,200 --> 00:01:29,920
working with Exchange Server, Hybrid Envoyaments, Microsoft 65 and enterprise

19
00:01:29,920 --> 00:01:35,200
messaging architectures. He is also Microsoft Certificate Trainer,

20
00:01:35,200 --> 00:01:39,680
form of NCT Community Lead, author of several books including Exchange

21
00:01:39,680 --> 00:01:43,920
Server, the Sandbook for Adness Art 1, speaker at events such

22
00:01:43,920 --> 00:01:51,920
Exchange Summit, Expept Live, Scottish Summit and the host of Exchange

23
00:01:51,920 --> 00:01:56,560
Unplugged Podcast. Today we will discuss the risk that administrators often

24
00:01:56,560 --> 00:02:01,440
underestimate it's different between one premise, hybrid and cloud

25
00:02:01,440 --> 00:02:05,280
only messaging, Exchange Online Security identity, Mailflow,

26
00:02:05,280 --> 00:02:09,120
Auditification, Operation of the mistakes and what organizations need to

27
00:02:09,120 --> 00:02:13,120
understand before it's too late. Tomasz, welcome, beauty show.

28
00:02:13,120 --> 00:02:18,080
I hope I have nothing to forget. Well, okay, it's a pleasure

29
00:02:18,080 --> 00:02:23,120
being on the show. That's quite an introduction. So actually I haven't listened to such

30
00:02:23,120 --> 00:02:27,920
introduction for quite some time. So I thought, oh yeah, so that's just

31
00:02:27,920 --> 00:02:37,200
definitely describes I'm old. Yeah, you say you're old. You are working for more

32
00:02:37,200 --> 00:02:42,560
than 25 years in the Microsoft Acro system, especially in the Microsoft

33
00:02:42,560 --> 00:02:48,480
messaging technology. What organly attract you to exchange it? Enterprise

34
00:02:48,480 --> 00:02:54,320
messaging? Well, so we do have a limit for this episode, don't we?

35
00:02:54,320 --> 00:03:02,880
To put it right, so I started working with Exchange Server, more or less

36
00:03:02,880 --> 00:03:06,480
I was just going to show you about 2000, yeah, in the time from of the

37
00:03:06,480 --> 00:03:12,080
early 2000s and for whatever reason, I stayed with this and

38
00:03:12,080 --> 00:03:16,400
I started working with the Microsoft and the technology field of Microsoft

39
00:03:16,400 --> 00:03:22,160
as a generalist. So I even did some stuff on the dark side of the moon. So I worked

40
00:03:22,160 --> 00:03:28,560
as a programmer as well. But then I made a choice to focus on Exchange

41
00:03:28,560 --> 00:03:33,600
to being a specialist and even back then I had to make a decision between the

42
00:03:33,600 --> 00:03:38,320
red and the blue pills. So it should be it was either SharePoint

43
00:03:38,320 --> 00:03:46,240
or Exchange and Exchange 1 for various reasons. That's why, you know,

44
00:03:46,240 --> 00:03:54,080
but it's I think that exchange and emails even though that it's already quite

45
00:03:54,080 --> 00:03:59,280
often been said that email is dead nobody's going to use email but this is

46
00:03:59,280 --> 00:04:02,480
simply not the case.

47
00:04:04,480 --> 00:04:10,560
Yeah, I think when I have the chance, I don't make so so much intro,

48
00:04:10,560 --> 00:04:16,640
I get the try to get a little bit deep dive. What are the the main security

49
00:04:16,640 --> 00:04:22,320
difference between Exchange Server on-prem, Exchange Online and

50
00:04:22,320 --> 00:04:28,640
yeah, Hybrid deployments? So let me start with the letter because

51
00:04:28,640 --> 00:04:33,360
so Exchange Hybrid is nothing less than just a logical configuration

52
00:04:33,360 --> 00:04:39,200
or between the two. So your on-premises Exchange organization and your

53
00:04:39,200 --> 00:04:45,360
Exchange Online tenant are from a logical perspective being configured to work

54
00:04:45,360 --> 00:04:49,280
as a single entity so to speak. So they trust each other

55
00:04:49,280 --> 00:04:55,760
even though that your that both environments are literally hundreds of kilometers

56
00:04:55,760 --> 00:05:01,120
apart. But your expectation is when you use Exchange Online

57
00:05:01,120 --> 00:05:05,760
that any email being sent from on-prem shows up as an internal email and vice

58
00:05:05,760 --> 00:05:13,440
versa. So and this is the tricky part on where Microsoft has quite strict

59
00:05:13,440 --> 00:05:20,400
configuration defaults to make that happen and this is the Hybrid configuration for

60
00:05:20,400 --> 00:05:26,880
Mailflow in that case. And yeah, you know, sometimes you see

61
00:05:26,880 --> 00:05:32,400
not so good and sometimes you see well performing the environments.

62
00:05:32,400 --> 00:05:38,800
What would I often see is or I think many many of the organizations I see

63
00:05:38,800 --> 00:05:43,840
they move to the Microsoft 365 because they believe the cloud automatically solves

64
00:05:43,840 --> 00:05:50,320
the security problem. A problem they they show me hey here stands it's secure

65
00:05:50,320 --> 00:05:56,240
on the website. We make it. Which which problem do Microsoft solve?

66
00:05:56,240 --> 00:06:00,240
And which remains the customer's responsibility?

67
00:06:00,240 --> 00:06:08,720
Well, first of all, it doesn't solve any problems

68
00:06:08,720 --> 00:06:13,280
right out of the box. You can compare the if you set up your

69
00:06:13,280 --> 00:06:18,480
new tenant and you get your first Exchange Online license into that tenant,

70
00:06:18,480 --> 00:06:25,600
you get an instance of Exchange which technically you can compare with

71
00:06:25,600 --> 00:06:29,680
just doing a simple default setup of Exchange Server. So it comes with

72
00:06:29,680 --> 00:06:36,640
default settings. Yes, it works. So there's quite a low

73
00:06:36,640 --> 00:06:41,040
barrier to use it to start using email with Exchange Online.

74
00:06:41,040 --> 00:06:46,080
But nevertheless all the communication flow, all the transport pipelines, all the

75
00:06:46,080 --> 00:06:50,480
transport configuration for anti spam, anti mailware, anti fishing, and what's the

76
00:06:50,480 --> 00:06:56,880
however you can think of runs in default and you still have to

77
00:06:56,880 --> 00:07:02,800
tweak and configure depending on your needs. So that's the general message from

78
00:07:02,800 --> 00:07:06,080
Microsoft. Here you go. Here's a switch on and you can use email

79
00:07:06,080 --> 00:07:13,440
but you have to configure it depending on your needs.

80
00:07:13,440 --> 00:07:18,080
This what did you think is hybrid Exchange? Inherently more

81
00:07:18,080 --> 00:07:26,000
complicated for security perspective or is it the Exchange on-prem?

82
00:07:26,000 --> 00:07:35,120
First of all, I'd say it's not complicated. It gets complicated and in this case I

83
00:07:35,120 --> 00:07:40,320
need to throw the ball over to the network team, to the firewall team, and

84
00:07:40,320 --> 00:07:47,120
everyone else being responsible for network security. So when it comes to

85
00:07:47,120 --> 00:07:55,680
having the possibility to use the standard default configuration for let's say

86
00:07:55,680 --> 00:07:59,680
a full classic hybrid which requires that your Exchange Service publish to the

87
00:07:59,680 --> 00:08:05,360
Internet using a reverse proxy. So when I say default, I already

88
00:08:05,360 --> 00:08:12,720
refer to security standard defaults. You do not expose your on-premises

89
00:08:12,720 --> 00:08:17,600
Exchange server to the Internet without any kind of reverse proxy in front of it.

90
00:08:17,600 --> 00:08:22,320
But that's standard for let's say decades now. So,

91
00:08:22,320 --> 00:08:34,800
Natheles, if you do not have any special security network requirements,

92
00:08:34,800 --> 00:08:41,360
normally a hybrid setup and sorry for any consultant charging

93
00:08:41,360 --> 00:08:45,760
more time year at default hybrid configuration between Exchange server and

94
00:08:45,760 --> 00:08:52,320
Exchange Online can be configured and put into a production in a day.

95
00:08:52,320 --> 00:08:56,640
But this is normally definitely true for lab environments,

96
00:08:56,640 --> 00:09:02,640
but the music, you know, all of this comes when you see an on-premises environment

97
00:09:02,640 --> 00:09:11,280
on a customer side. Classic customer environments do not run like a lab setup.

98
00:09:11,280 --> 00:09:17,600
So they have, you know, the security teams, the network teams, each of those teams

99
00:09:17,600 --> 00:09:25,280
has different views on how to configure things the best to their knowledge.

100
00:09:25,280 --> 00:09:31,760
Right? And this is where normally or not normally at say, sometimes there's

101
00:09:31,760 --> 00:09:36,240
slightly some tension between the Exchange Messaging team and the Security

102
00:09:36,240 --> 00:09:44,880
Network of people. And what will you say, how important is identity security

103
00:09:44,880 --> 00:09:53,520
compared with traditional email security controls? So I'd say identity security comes first.

104
00:09:53,520 --> 00:10:01,040
So you do have to protect the identity of each user, even though

105
00:10:01,040 --> 00:10:07,200
regardless if it's a real person, so a human being or if it's a technical service

106
00:10:07,200 --> 00:10:12,400
account, whatever, these are all the same identities requiring the very same

107
00:10:12,400 --> 00:10:18,720
identity protection mechanisms in place. Right? So you should not think about having

108
00:10:18,720 --> 00:10:25,920
a vehicle security idea for some kind of a room or service account, whatever you can

109
00:10:25,920 --> 00:10:34,640
think of. Right? And which roles, which administrative roles are especially

110
00:10:34,640 --> 00:10:42,080
associative in the Exchange Online? So we do have the the Exchange Administrator

111
00:10:42,080 --> 00:10:49,120
role that comes from an Android perspective. So Exchange Online,

112
00:10:49,120 --> 00:10:55,200
even though that it's based on the on-premises product, but it has been forked quite a few years ago,

113
00:10:55,200 --> 00:11:02,560
but nevertheless, Exchange Online uses in turnies, so-called role-based access control,

114
00:11:02,560 --> 00:11:09,360
the AeroBug role model, which is pretty specific to provide access to certain

115
00:11:09,360 --> 00:11:14,400
functionality within Exchange, but from an identity protection perspective. And in this case,

116
00:11:14,400 --> 00:11:20,640
we talk about EntraID. We do have the Exchange Administrator, which is more

117
00:11:20,640 --> 00:11:26,800
as the goal and key to configure anything messaging related. So we do have recipient management,

118
00:11:26,800 --> 00:11:36,160
which is our help desk, so that help desk role, which allows certain base functionality

119
00:11:36,160 --> 00:11:43,520
to exchange recipients objects, but we are focusing on Exchange Admins and if you do have

120
00:11:43,520 --> 00:11:50,160
license, the privileged identity management, so PIM, you should definitely configure your

121
00:11:50,160 --> 00:12:01,200
Exchange Amendment using PIM because it's about just having administrative access to your tenant

122
00:12:01,200 --> 00:12:10,560
when you need it. And how should children organizations especially manage

123
00:12:11,680 --> 00:12:21,840
emergency or break glass accounts? We talk about break glass accounts. First of all, you should still

124
00:12:21,840 --> 00:12:29,040
have a, for example, a phyto-key in place. So the days are over, if you simply use

125
00:12:29,040 --> 00:12:38,480
on or disable MFA for break glass accounts and use such a, what kind of 256 character-long,

126
00:12:38,480 --> 00:12:45,440
complicated password, which no one is capable of entering, and it's printed on some kind of

127
00:12:45,440 --> 00:12:53,440
emergency, emergency cheat, which is in a locker where nobody has a key. Now these days,

128
00:12:53,440 --> 00:13:00,720
the break glass account should have a phyto-key, should be secured by a phyto-key. So I do not use

129
00:13:00,720 --> 00:13:07,840
some kind of MFA, for example, using a personal Microsoft Authenticator, which is used by

130
00:13:07,840 --> 00:13:16,000
Administrator A, but Administrator A, as you can think, is on vacation when that emergency happens.

131
00:13:16,000 --> 00:13:28,960
So, but yeah, I think a little bit, do you say the MFA protection, is it enough to protect

132
00:13:28,960 --> 00:13:39,680
that specific access, or did we need more or something other? Okay, so when it comes to

133
00:13:39,680 --> 00:13:46,880
accessing a tenant by default, as long as I do have the proper credentials, I can access that

134
00:13:46,880 --> 00:13:53,760
very tenant from anywhere in the world. So you need to think, or start thinking about,

135
00:13:55,280 --> 00:14:05,760
how sensitive is information in my M365 tenant? Shall I reduce access to their tenant for

136
00:14:05,760 --> 00:14:13,520
administrative logins to certain countries, to certain regions, maybe to a well-known IP address,

137
00:14:13,520 --> 00:14:23,600
so that administrative access is only possible from our headquarters, or from subsidiaries,

138
00:14:23,600 --> 00:14:30,800
whatever you can think of. But as you already mentioned, brakeless accounts, you should always

139
00:14:30,800 --> 00:14:38,960
think and plan for the unthinkable. So, how do you access your tenant if you have configured

140
00:14:38,960 --> 00:14:44,880
that only access from your headquarters, but for whatever reason your headquarters is trucked by

141
00:14:44,880 --> 00:14:52,160
disaster? So, no network or intake access from that very headquarters is possible. So, how do you

142
00:14:52,160 --> 00:15:01,360
access your tenant in that case? So, it's quite a scenario or multiple scenarios you have to think of.

143
00:15:01,360 --> 00:15:09,040
What I think about is the dangers of using a Legend-C,

144
00:15:09,040 --> 00:15:15,680
Identifications, or all the management methods. So, my question is, how should companies deal with

145
00:15:15,680 --> 00:15:22,480
old applications that still require basic authentication or a Legend-C SMTP?

146
00:15:22,480 --> 00:15:30,160
Okay, don't use it. So, it's a simple answer, but it's not a simple answer that fits, you know,

147
00:15:30,160 --> 00:15:37,440
or everybody needs it. But if your applications, in the case we are talking about soft applications,

148
00:15:37,440 --> 00:15:42,560
or even hardware devices about whatever you can think of, so anything that can or want to send

149
00:15:42,560 --> 00:15:53,280
an email, and it's not capable of using modern authentication methods. So, we therefore cannot

150
00:15:53,280 --> 00:16:00,720
directly connect and authenticate to exchange online, you should definitely consider

151
00:16:00,720 --> 00:16:09,600
keeping an on-premises relaying host in place, simplifying your network infrastructure so that

152
00:16:09,600 --> 00:16:18,000
the connectivity of such applications then connects to your on-premises relay SMTP server,

153
00:16:18,000 --> 00:16:26,480
quote-unquote, and exchange. And then transfer the authentication

154
00:16:26,480 --> 00:16:36,320
misses or even the SMTP routing on a more secure manner for the relay system towards exchange

155
00:16:36,320 --> 00:16:46,000
online. Yeah, I think, yeah, identity attack path is heck out famous.

156
00:16:46,000 --> 00:16:53,040
Absolutely. Can you walk us through a realistic attack path that begins with a compromised

157
00:16:53,040 --> 00:16:57,360
user count and yeah, eventually affects the messaging environment?

158
00:16:58,720 --> 00:17:09,120
Well, coming from a messaging background, I'd say, the simple attack start with a malicious email

159
00:17:09,120 --> 00:17:19,920
doesn't it? So, and the funny thing is that as long as you use HTML and colder emails, which we are

160
00:17:19,920 --> 00:17:26,320
mostly used because we like to have proper smileys in our email bodies.

161
00:17:26,800 --> 00:17:37,200
This such an email is not or has to be rendered by your email client, so by audio. So, and

162
00:17:37,200 --> 00:17:46,800
a such an email body as in each HTML can contain active content, so some kinds of scripts and such,

163
00:17:47,680 --> 00:18:00,080
which can already contain malicious URLs. And as soon as such an email is not being filtered by your

164
00:18:00,080 --> 00:18:07,680
anti-mailware, anti-fishing or anti-spam solutions, which it showed. So, I just make it more

165
00:18:07,680 --> 00:18:15,360
to have an advertisement in this place, watch out for a proper email security solution.

166
00:18:17,520 --> 00:18:26,160
Well, the code exit being executed does not necessarily mean that the user opening or just having

167
00:18:26,160 --> 00:18:30,560
an email in preview notices that something is going to happen.

168
00:18:30,560 --> 00:18:40,640
All right, so maybe there's some kind of automaticaling that starts to download additional

169
00:18:40,640 --> 00:18:50,160
malicious code because the URL itself did not look such malicious to the scanners, therefore it passed

170
00:18:50,160 --> 00:18:58,560
the scanning mechanism. So, it then passes, downloads the, finally, with the malicious code and

171
00:18:58,560 --> 00:19:05,440
whatever that happens. It's like a key logger or whatever you can think of. And then it fetches

172
00:19:05,440 --> 00:19:13,760
your credentials. Then there are multiple ways in how to fetch credentials either by having a

173
00:19:13,760 --> 00:19:20,720
key logger in place or by fetching already cash credentials out of the memory. And

174
00:19:20,720 --> 00:19:30,080
say, one of the bad things is if you use your daily user account, which you use for classic office

175
00:19:30,080 --> 00:19:36,160
communication, is the very same account which you use for your administrative work. So,

176
00:19:36,160 --> 00:19:45,200
if you're single, you're one account, you thus have additional privileges against, for example,

177
00:19:45,200 --> 00:19:50,560
the on-premises environment, like a, yeah, my default account is a domain administrator, which it

178
00:19:50,560 --> 00:19:59,200
shouldn't. Or, for example, for the cloud perspective, I, let's say, I am, have the permanent assignment

179
00:19:59,200 --> 00:20:08,880
of as a global administrator in the cloud. No, it shouldn't. So, it's a bad idea. Well, the attack path,

180
00:20:08,880 --> 00:20:18,720
in that case, is too low, right? Not too already gain action or do something on that very same day

181
00:20:18,720 --> 00:20:26,160
when you open that email. Maybe the code simply passes your credential information. Let's say,

182
00:20:26,160 --> 00:20:33,840
your current active or of token over to a, to a malicious third party and they start trying to use

183
00:20:33,840 --> 00:20:39,760
that very same authentication token, which is valid at that very moment from a different location.

184
00:20:39,760 --> 00:20:47,280
And in that case, we have, we need, what do we have to hope that, Entra, you know, sees that, oh, wait,

185
00:20:47,280 --> 00:20:55,520
you could just, um, worked or access the system from Berlin. And then in the very same second,

186
00:20:55,520 --> 00:21:02,560
I do have a very authenticated access from the other side of the world, which can't happen,

187
00:21:02,560 --> 00:21:12,720
it can be so that Entra then blocks such an authentication attempt. Is there any, I say,

188
00:21:12,720 --> 00:21:21,600
all of the events that we are security teams, a detection tool? Yep. So actually,

189
00:21:23,040 --> 00:21:31,440
the slightly depends on, if you're having the, a proper, entry ideal licensing in place. So, um,

190
00:21:31,440 --> 00:21:38,160
the events themselves are being locked, but it depends on your license, for example, if there's

191
00:21:38,160 --> 00:21:44,800
an automatic action in place for it. Let's say, if there's a suspicious logon attempt,

192
00:21:44,800 --> 00:21:52,240
Entra can force you to revalidate your credentials within the digital MFA as an example.

193
00:21:53,120 --> 00:21:58,240
Right. But it is definitely, uh, visible in the sign-in, sign-in logs.

194
00:21:58,240 --> 00:22:07,680
So, and you can see the reason, for example, why a log in fail. So let's say it comes from an already

195
00:22:07,680 --> 00:22:14,640
known malicious IP address. Um, it's being blocked because it looks like some kind of a instant,

196
00:22:14,640 --> 00:22:18,800
uh, let's see, let's see, correct term, something with, um,

197
00:22:20,640 --> 00:22:25,680
some kind of a, you know, um, travel situation, which is simply not possible. So,

198
00:22:25,680 --> 00:22:31,120
impossible travel as an example, right? So, just five minutes between log in from Germany and

199
00:22:31,120 --> 00:22:37,360
the next one from South Africa. In that case, Entra would say, nah, we are not ready yet. So,

200
00:22:37,360 --> 00:22:43,200
this is currently not a, uh, a later approach, which is a tricky thing, for example, if you use

201
00:22:43,200 --> 00:22:51,280
the very same account, let's say on, uh, in your office network, but you are connected via the

202
00:22:51,280 --> 00:22:58,640
band or into a data center, which is located in a different geography. And in that case, you log in

203
00:22:58,640 --> 00:23:04,160
comes a valid log in comes from a totally different region. So you do have to watch out, for example,

204
00:23:04,160 --> 00:23:09,840
adjusting any kind of automated log in, um, audits.

205
00:23:13,120 --> 00:23:18,960
So, uh, I think over here, we are running a little bit out of time, but, uh, yeah, uh, I see,

206
00:23:18,960 --> 00:23:24,640
I have so many questions. So, so, and we are on your way here and really want to talk about, uh, let's

207
00:23:24,640 --> 00:23:31,200
just talk about the mail flow. Why is understanding the complete mail pass is so important?

208
00:23:31,200 --> 00:23:41,440
Um, first of all, because SMTP as a protocol from the ATEs of the last century is such a tolerant

209
00:23:41,440 --> 00:23:52,640
protocol. You can, so SMTP routing allows you to do, um, very horrific things, right? So you can

210
00:23:52,640 --> 00:24:00,000
do whatever you want to route, uh, emails. And if you have to, for example, do you have to know

211
00:24:00,000 --> 00:24:08,000
where is my entry point for, uh, internet, mails as an example? So do you start your, uh, inbound

212
00:24:08,000 --> 00:24:17,040
emails on premises using a gateway or a multiple gateways in the parameter network, for example,

213
00:24:17,040 --> 00:24:24,640
before they reach exchange. And then, uh, if you are an enterprise, you might have multiple exchange

214
00:24:24,640 --> 00:24:31,280
database, available groups across multiple regions. So the email is being routed.

215
00:24:32,720 --> 00:24:39,680
Wherever it is needed and then out of sudden it needs to be routed, um, to exchange online, so to a

216
00:24:39,680 --> 00:24:47,760
totally different routing address. And then it has to pass again, a protection layer because

217
00:24:47,760 --> 00:24:53,680
even in hybrid, the message will pass through the shared online protection stack and, uh, partially

218
00:24:53,680 --> 00:25:00,160
through the Fender before it's finally being delivered two year, um, to the mailbox to the final

219
00:25:00,160 --> 00:25:10,000
recipients mailbox. And on its way from entering the SMTP gateway of the company until it reaches

220
00:25:10,000 --> 00:25:19,440
the final recipients mailbox, each hop, each connector has a different settings that might interfere

221
00:25:19,440 --> 00:25:29,760
with the proper delivery of that email. Even if it's message size, content, uh, conversion, whatever.

222
00:25:29,760 --> 00:25:37,120
That's why as an exchange administrator, you have to have a full understanding, a full view

223
00:25:37,120 --> 00:25:46,160
of your various, um, yeah, as a TP route. It's not just a single, there's definitely never a single

224
00:25:46,160 --> 00:25:56,160
line from the left to the right of a visual diagram. Yeah, interesting. There are also, I think, uh,

225
00:25:56,880 --> 00:26:02,640
how, how, how, what was I, I don't know, the right word for, for, for this package, but there are

226
00:26:02,640 --> 00:26:12,560
SPF, D Kim and, and, right, what is this services tools, I don't know, but the right word for,

227
00:26:12,560 --> 00:26:17,680
what did they do and how did they work and, you know, roll that, the, so,

228
00:26:17,680 --> 00:26:26,000
the, let's start with the SPF, which is already 15 years and older, so this is a policy framework,

229
00:26:26,000 --> 00:26:35,120
and then we have the, uh, domain, uh, key thing and the DMACC, so the reporting around, let's say,

230
00:26:35,120 --> 00:26:42,960
what's going to happen if SPF and they can fail. But all of the three are mechanisms not to protect

231
00:26:42,960 --> 00:26:53,760
me or my infrastructure for receiving emails, but, uh, I do configure these things for my domain,

232
00:26:53,760 --> 00:27:04,560
for sending emails, so, um, SPF, uh, describes the allowed hosts either my name or my IP address,

233
00:27:04,560 --> 00:27:14,160
that are allowed to send as my company domain. Say, so the SPF record of controls.com states,

234
00:27:14,160 --> 00:27:23,360
for example, the IP addresses of my sending, uh, on-premises servers, uh, they do include a reference

235
00:27:24,000 --> 00:27:29,680
to the, um, external third party marketing infrastructure that say, well, I, I, I, do,

236
00:27:29,680 --> 00:27:37,200
that I use to send newsletters because I do want that clients receive my newsletter

237
00:27:37,200 --> 00:27:42,880
with my company name and then my company email address because it's a corporate identity thing,

238
00:27:42,880 --> 00:27:49,600
right? Marketing, uh, only works, uh, if my marketing emails are being received as a control,

239
00:27:49,600 --> 00:27:58,560
so common, not as gmail.com as an example. And the receiving side then can check the SPF record,

240
00:27:58,560 --> 00:28:06,720
or normally these days they do, if the email is being, uh, or trying to be delivered from valid hosts.

241
00:28:06,720 --> 00:28:14,720
And I say, uh, one, one configuration of the SPF says, okay, if there is a failure in the mid,

242
00:28:14,720 --> 00:28:21,760
so there's a mismatch between the sending host and the SPF record, I, at the honor of the domain

243
00:28:21,760 --> 00:28:29,520
because it's a DNS record, I say, hey, receiving server, how should you, shall you, you know,

244
00:28:29,520 --> 00:28:38,720
react to this? You can either be very strict, so do not accept it. You can then either say, um,

245
00:28:38,720 --> 00:28:48,400
yeah, accept it, but you may flag it as, um, spam, so it's being received, uh, it's the receiving side,

246
00:28:48,400 --> 00:28:54,560
accepts that message, but delivers us to the inter-recipient, for example, with a, uh,

247
00:28:54,560 --> 00:29:00,960
some not spam confidence level slightly higher. So it might be spam and might be not take a look,

248
00:29:01,520 --> 00:29:09,600
de-recipient, right? Or you can say, it simply ignored, which is more or less here,

249
00:29:09,600 --> 00:29:14,960
like not having any kind of things, right? And then,

250
00:29:14,960 --> 00:29:23,280
but why some organizations implement these technologies, but they are still, yeah,

251
00:29:23,280 --> 00:29:35,520
remaining valuable to do spoofing, right? So because the larger general email providers, like, uh,

252
00:29:35,520 --> 00:29:47,520
Gmail and other ones, um, tend to not accept emails if the sending domain does not have any of those

253
00:29:47,520 --> 00:29:54,240
DNS entries in their zone. So they do check if there is a spare record, if there is a demarc record,

254
00:29:54,240 --> 00:30:02,000
uh, and such. So, and some companies, especially, let's say, small and medium-sized businesses,

255
00:30:02,000 --> 00:30:13,760
um, how should I phrase it? Um, simply edit the required DNS records to the company DNS zones,

256
00:30:14,800 --> 00:30:22,960
but the configured values, more or less state, I don't care except anything, right? Except from

257
00:30:22,960 --> 00:30:34,320
any sending IP, which is not good. It's like having none. So this, so this case, especially the demarc

258
00:30:34,320 --> 00:30:44,080
records, so the demarc record describes, uh, or defines a policy, uh, which might or might be not

259
00:30:44,080 --> 00:30:56,480
being, um, recognized by the receiving party. And it describes what to do if SPF or DKM or SPF and DK

260
00:30:56,480 --> 00:31:10,240
money, those fails. And the least risky policy is none. So do nothing. So this is more or less like,

261
00:31:10,240 --> 00:31:21,600
you know, a floodgate for allowing SPF from wherever. And, um, yeah, the other one would, the next level

262
00:31:21,600 --> 00:31:28,960
would then be Quarantine and the third option is a reject. And I think they are pretty safe explaining,

263
00:31:28,960 --> 00:31:37,360
but nevertheless, this is just what I say as the owner of a domain, how a receiving party should

264
00:31:37,360 --> 00:31:45,520
react. It does not define, uh, explicitly that the receiving party definitely reacts like I wanted

265
00:31:45,520 --> 00:31:50,880
to because there's something called like the administrative override. So a receiving party can say,

266
00:31:50,880 --> 00:32:02,160
yeah, um, our policy is to accept all of the emails because we do not want to, um, lose any

267
00:32:02,160 --> 00:32:09,200
possible email from our clients just, you know, to, uh, miss any kind of a contract or an order or

268
00:32:09,200 --> 00:32:16,240
whatever the reason is. And they can simply override what you said or what you couldn't figure it

269
00:32:16,240 --> 00:32:27,360
for your domain. So there's no guarantee. Um, I think we have this, this people made to people,

270
00:32:27,360 --> 00:32:35,200
but what happened when I say a marketing platform ticket system CRM platforms or other tasks or

271
00:32:35,200 --> 00:32:48,000
AI services, a set mail on, on behalf of the company. Um, my recommendation is you subdomains.

272
00:32:48,960 --> 00:32:59,120
So such services, any of those mentioned, such services should never send emails like directly as,

273
00:32:59,120 --> 00:33:06,960
let's say, at contoso.com as a sending address. They should send as ad use letter dot contoso.com,

274
00:33:06,960 --> 00:33:17,920
right? At, uh, CRM dot contoso.com because in that case, you can, it helps you to identify, um,

275
00:33:17,920 --> 00:33:27,840
the sending environments. And it helps you to, for example, define dedicated SPF and, uh,

276
00:33:27,840 --> 00:33:36,160
the payment on demarc, uh, values for such subdomains. Uh, so there's no requirement that you must

277
00:33:36,160 --> 00:33:43,680
configure those, but you can, which provides a different opportunity because it's simply to control

278
00:33:45,360 --> 00:33:57,600
the sending system is more granular. And, um, what, I think, I think, may, may, make, I think a little bit

279
00:33:57,600 --> 00:34:08,400
about, um, a company that calls you right, Thomas, uh, our emails get, gets, moved by using the connozco,

280
00:34:09,440 --> 00:34:17,360
consorto domain, or what's your, or, where's the gays you process here? And that case, I

281
00:34:17,360 --> 00:34:24,960
definitely would, uh, prefer to see if there is a demarc policy in place because with the demarc policy,

282
00:34:24,960 --> 00:34:31,280
you not only define the, uh, the policy, you know, if, uh, messages have to be rejected or

283
00:34:31,280 --> 00:34:41,680
quarantined, but you define an email address where sending systems, uh, send a so-called demarc report

284
00:34:41,680 --> 00:34:50,960
to because normally I do not know as a company, which other systems in the world use or send emails

285
00:34:50,960 --> 00:34:58,720
using my email address. But with a demarc entry, um, having that so-called, uh, uh,

286
00:34:58,720 --> 00:35:05,200
a Rua, the Rua, and an email address, which is the email address for aggregated demarc reports.

287
00:35:05,200 --> 00:35:16,320
I get an XML report, for example, from, GMX, or from Gmail, um, depending on the configuration I have,

288
00:35:16,320 --> 00:35:23,440
so on a daily basis, weekly basis, whatever I define, um, which I can, then, can analyze because I

289
00:35:23,440 --> 00:35:30,960
get an information from the third, from the, from other S&TP servers, from other email servers,

290
00:35:30,960 --> 00:35:42,240
who send mails with my controls, or.com email, uh, a, a, send valid emails, or, for example,

291
00:35:42,240 --> 00:35:50,160
send not so valid emails. And they are not very, there's a technical report,

292
00:35:50,160 --> 00:36:01,600
so I already said these are XML reports. I prefer to use the multiple demarc report, um, commercial

293
00:36:01,600 --> 00:36:10,400
demarc report engines out there, which then can automatically, uh, decipher such XML and make

294
00:36:10,400 --> 00:36:17,120
nice, fancy dashboard views, which are much more easy to consume and to analyze.

295
00:36:17,120 --> 00:36:23,280
And then you do have to find address. So, for example, if you do have, uh, a demarc policy,

296
00:36:23,280 --> 00:36:30,320
with a piece, a policy equals none, so there's no one over there, everyone can use it, because

297
00:36:30,320 --> 00:36:36,320
edits being received by anybody, like a valid email, because I said so anyone can send,

298
00:36:37,360 --> 00:36:43,520
right? So I then have to find you my SPF records, um, because there's a risk thing, especially

299
00:36:43,520 --> 00:36:50,080
about SPF records, because there is a little bit, uh, a technical defined limit of a maximum of

300
00:36:50,080 --> 00:36:59,440
10 so-called SPF lookups. So, for example, my SPF record is far too long and the important systems are,

301
00:36:59,440 --> 00:37:06,640
are on a lookup position, 11 or 12, they might, they won't be properly rendered by receiving party.

302
00:37:07,280 --> 00:37:15,920
So, SPF optimization is a tricky thing and, um, if you use multiples external Z-Services,

303
00:37:15,920 --> 00:37:23,040
it's a good thing to move those then to, uh, as mentioned, to subdomains, because then you have, um,

304
00:37:23,040 --> 00:37:24,720
much more options.

305
00:37:24,720 --> 00:37:34,960
Well, when I think a long time, we have this, this, this, pushing problems, why,

306
00:37:35,760 --> 00:37:42,160
why is still so effective all all these, these, these many years, I think we have all these,

307
00:37:42,160 --> 00:37:48,800
these modern security controls, we have to defend them. Why, why, there's a, why, I have no one

308
00:37:48,800 --> 00:38:03,040
found here a solution? Well, how should I phrase it? Um, phishing emails have gone, I've got

309
00:38:04,880 --> 00:38:13,760
excellent of the years, you know, in the very beginning, they were easy to identify, right, misspellings,

310
00:38:13,760 --> 00:38:21,440
um, whatever, it was a pretty obvious, this is not a professional email, but these days,

311
00:38:21,440 --> 00:38:34,240
um, the phishing emails look like a proper email from a delivery service because, for whatever reason,

312
00:38:34,240 --> 00:38:39,840
everybody of us, you know, is in need for, let's say, for, for watching our for such a notification,

313
00:38:39,840 --> 00:38:45,440
because we have something, you know, all that somewhere, and for whatever reason, yeah, and I'm

314
00:38:45,440 --> 00:38:51,920
writing for the notification emails of the, uh, the HL, and yeah, yeah, or whatever attracts me,

315
00:38:51,920 --> 00:39:03,360
right? And it's, it, to be honest, there are certain moments, so known then, where such emails,

316
00:39:03,360 --> 00:39:12,240
even, but say, nearly got me, but at the very end, because the easiest thing is to

317
00:39:12,240 --> 00:39:22,000
watch out for if you move your mouse over a hyperlink in such an email, how, what does the link say in

318
00:39:22,000 --> 00:39:30,160
the, um, mouse over so in the tooltook, uh, you, uh, because the easiest thing these days is to embed

319
00:39:30,160 --> 00:39:39,920
some kind of a very similar character, which looks similar, for example, like an O or a zero,

320
00:39:39,920 --> 00:39:45,600
but is a character from a different chassis or from a different language from a different

321
00:39:45,600 --> 00:39:53,360
low-cal, which in the very first moment, looks like, um, it is no, but it isn't, and therefore,

322
00:39:53,360 --> 00:40:00,880
the different domain, which routes me to a very good fancy company site for a delivery service,

323
00:40:00,880 --> 00:40:06,400
which looks with the very same, and then, yeah, um, me unsure, but uh, quickly please enter your

324
00:40:06,400 --> 00:40:13,680
credentials, um, because we do have to verify and out of a sudden, bong, you even, um, you know,

325
00:40:13,680 --> 00:40:21,840
gave your username, add valid password as you think, to a third party. And this can even happen,

326
00:40:22,560 --> 00:40:31,040
I had a very same situation, uh, just a few, let's say two or three months ago, where I received

327
00:40:31,040 --> 00:40:42,720
a one-drive sharing link, which was very well made. Even the website looked pretty good,

328
00:40:42,720 --> 00:40:49,680
but then I was a little, no, as always, even so, especially, called cancer, use cancer,

329
00:40:50,400 --> 00:40:57,120
at ass summaries, or, for example, just ask the sender of that email, did you send me that?

330
00:40:57,120 --> 00:41:04,960
Is there a real email? There is no need to access that very content in that very minute.

331
00:41:04,960 --> 00:41:10,160
Double check, if it, so, it looks or feels suspicious.

332
00:41:10,160 --> 00:41:18,000
Yeah, there was one attack, I really felt really funny, it is, or really, really creative, was the

333
00:41:18,000 --> 00:41:24,000
R& Microsoft, uh, they, they changed their N to the R& and it looks like it's more,

334
00:41:24,000 --> 00:41:29,840
this, this, this, I've, I've thought, thought this was, it was a really funny, funny, good idea.

335
00:41:29,840 --> 00:41:35,040
Yes, it was, because especially depending on the resolution of the device, especially, especially

336
00:41:35,040 --> 00:41:42,000
if you're, your mobile device, right, it simply looks like them, because just that final

337
00:41:43,120 --> 00:41:49,760
digit between the two characters, which you normally, you know, on a spot I've had this pay,

338
00:41:49,760 --> 00:41:59,440
you simply don't see. It was more, this was a really, really funny, uh, attack, father thing.

339
00:41:59,440 --> 00:42:06,880
But, uh, what, what, what role can, can Microsoft Defender, uh, I think Microsoft Defender

340
00:42:06,880 --> 00:42:14,000
for Office 365 play and preventing and investigating the text? I think the very, the most important

341
00:42:14,000 --> 00:42:23,760
functionality these days, I say is the, um, uh, saffering functionality. So that it does not only

342
00:42:23,760 --> 00:42:34,880
scan in hyperlinks while they are, uh, during the process of, um, delivering that email, but to

343
00:42:34,880 --> 00:42:42,240
rewrite the embedded email link to a saffering URL. So the very time that you click that link,

344
00:42:42,240 --> 00:42:48,080
you do not directly go to the final target, but you're being the redirected to the Defender

345
00:42:48,080 --> 00:42:59,360
saffering portal. Um, and again, depending on the configuration in your tenant, you can either,

346
00:42:59,360 --> 00:43:05,440
if it's malicious, you're, you journey to that website or to that target link ends here,

347
00:43:05,440 --> 00:43:12,000
right? Because it's being identified and the administrator configured the saffering functionality,

348
00:43:12,000 --> 00:43:21,600
you say, okay, uh, it's pretty suspicious. You can't move on to that link. Because when I say you

349
00:43:21,600 --> 00:43:26,560
have to configure it, because there's an option to allow the end user, the option to,

350
00:43:27,840 --> 00:43:33,040
all right, so to move on to the very target anyway, which, well,

351
00:43:33,040 --> 00:43:44,160
the words that I think of are not for the public, um, right? So when this is,

352
00:43:44,160 --> 00:43:52,800
it's important, and um, it's, it's, the, the, the, the information for the security teams. So

353
00:43:53,520 --> 00:43:58,560
Defender that case, because Defender has a dedicated portal, which even with your role as an

354
00:43:58,560 --> 00:44:05,440
exchange administrator and enter, you have access to alpha to the functionality of the Defender

355
00:44:05,440 --> 00:44:14,560
portal, which is messaging, uh, related, right? So it's not the case that you only have access to

356
00:44:14,560 --> 00:44:20,080
the exchange admin center as an exchange administrator, but you do have a, for example, access to the

357
00:44:20,080 --> 00:44:25,920
Defender portal and to the messaging security staffs for the messaging, uh, to the email explorer,

358
00:44:25,920 --> 00:44:33,840
to verify very granularly any, or each email that is being routed via, um, yeah, which went through

359
00:44:33,840 --> 00:44:43,280
Defender. You can analyze the attachments, links, whatever you need. And again, it's a licensing thing.

360
00:44:44,800 --> 00:44:51,600
Yeah. So I recommend if, if you mean it's serious, or if you're serious, when it comes to

361
00:44:51,600 --> 00:45:01,600
email security, take definitely a look at the Defender P1 and P2 feature set and watch out for where

362
00:45:01,600 --> 00:45:10,480
Defender P1 and P2, uh, where's the part of any license plan? Sorry, example, it doesn't make any

363
00:45:10,480 --> 00:45:17,280
sense to license it on its own because, uh, you watch out or take a look at, uh, if it's, uh, for example,

364
00:45:17,280 --> 00:45:27,600
included in Microsoft 365, uh, E5, E3, depending on the functionality you want. Yes. It comes with a cost,

365
00:45:27,600 --> 00:45:33,440
but security comes always with a cost, right?

366
00:45:37,200 --> 00:45:45,760
Um, what I think about is, is a little bit, um, what, what role do is do is, I say, uh,

367
00:45:45,760 --> 00:45:52,240
infrastructure as a code play for, for, for, for, for, for exchange. Is that the topic?

368
00:45:52,240 --> 00:46:04,560
So, inf, uh, the, um, well,

369
00:46:06,160 --> 00:46:13,440
anything about having in now an API for, um, exchange, uh, let's say for Microsoft 365,

370
00:46:13,440 --> 00:46:19,520
in that case for parts of exchange online for Microsoft configuration API for M365,

371
00:46:19,520 --> 00:46:29,600
you definitely can, um, extract your, your current configuration and use that the, uh,

372
00:46:30,320 --> 00:46:40,640
code, quote unquote, so the export of configuration as a default set cell. If anyone changes

373
00:46:40,640 --> 00:46:46,240
the configuration using PowerShot or UI, some like any changes to your production environment,

374
00:46:46,240 --> 00:46:51,280
and then you'd have a data comparison between the configuration, which it should, how it should be,

375
00:46:51,280 --> 00:46:57,920
and see the difference compared to the products that you can then reverse such configurations

376
00:46:57,920 --> 00:47:03,440
because the configuration has to be done using the XML set and not the live configuration, the 10.

377
00:47:03,440 --> 00:47:14,560
All right. And, um, oh, I think, I'm not really sure if it's that, but I think so, because I,

378
00:47:14,560 --> 00:47:22,400
I think I can do the, the, the, I have, yeah, we have say PowerShell, we have, uh, the graph API,

379
00:47:22,400 --> 00:47:29,680
and we have now, we have mcp, did you think we have the new risk through these mcp on,

380
00:47:29,680 --> 00:47:31,840
from for the exchange out?

381
00:47:31,840 --> 00:47:46,160
Well, so mcp and anything that's, let's say, which is normally used by, uh, agents, connectors,

382
00:47:46,160 --> 00:47:55,760
and such, which normally targets only content, not the configuration itself. Right. And I

383
00:47:55,760 --> 00:48:08,800
can't say anything about, you know, about the future and what's going to be, but it's, in that case,

384
00:48:08,800 --> 00:48:18,240
more risky to you, for example, having, uh, wrongly configured permissions for any programmatic access to

385
00:48:18,240 --> 00:48:27,520
content, regardless of its sharepoint exchange, online or such, because exchange, online and sharepoint,

386
00:48:27,520 --> 00:48:37,920
uh, these two are the largest, let's say storage providers for the m365 space.

387
00:48:38,800 --> 00:48:46,880
Right. Because a very similar of all those, nice services that we use utilize,

388
00:48:46,880 --> 00:48:53,760
either of the two, so sharepoint or exchange as a storage engine for kind of files for stuff

389
00:48:53,760 --> 00:49:01,920
that you create as a user. And especially from an exchange perspective, your, nice and fancy

390
00:49:01,920 --> 00:49:10,560
inbox that you see in outlook is just a very small part of the folder structure of your inbox. So

391
00:49:10,560 --> 00:49:16,240
most of the folder structure of your exchange, online inbox is being hidden from you because it's

392
00:49:16,240 --> 00:49:29,280
only accessible via APIs. Anyway, um, yeah, uh, what I a little bit think about it's, we have these,

393
00:49:29,280 --> 00:49:38,240
uh, what is this called? I think Microsoft secure score. Yeah. Um, should organization use such

394
00:49:38,240 --> 00:49:47,120
tools as, as a primary security matter, or is it more, uh, yeah, it's green, it's fine. It's

395
00:49:47,120 --> 00:49:55,520
stuff. It's definitely not a one way street. So the secure score or even the compliance score that

396
00:49:55,520 --> 00:50:05,680
we have for the compliance portal are tools. They can help me as a, uh, as I'm illustrator, the owner

397
00:50:05,680 --> 00:50:12,960
of a tenant to make configuration decisions that Microsoft recommends to me. So if you take a

398
00:50:12,960 --> 00:50:20,240
complete close look at these things, uh, at both of the scores, um, they have always two sides.

399
00:50:20,240 --> 00:50:26,560
There's one that stuff Microsoft config is, which is normally 100% already because it's stuff that is

400
00:50:26,560 --> 00:50:31,520
configured by Microsoft in the environment in real infrastructure for you. And then there's

401
00:50:31,520 --> 00:50:36,320
the customer side, the stuff that I have to configure, which I have to make decisions on.

402
00:50:36,320 --> 00:50:44,880
So I don't have to make, um, educated decisions on. And the decisions to make,

403
00:50:45,600 --> 00:50:52,240
that's a funny part because secure score in that case is a, um, marketing vehicle because

404
00:50:52,240 --> 00:50:57,280
some things you can only configure if you do have a proper license in your tent.

405
00:50:57,280 --> 00:51:04,400
Right. So securing some stuff, let's, let's read so very little for my company. I do want to

406
00:51:04,400 --> 00:51:14,000
have this. Let's set, yeah, click here to start a trial. So watch out. So, um, but again, you

407
00:51:14,000 --> 00:51:20,720
do have to make an educated decision, um, on the required security functionality that you do want

408
00:51:20,720 --> 00:51:28,560
to enable disabled. So depending on what it's about, but again, it depends a proper licensing in your

409
00:51:28,560 --> 00:51:42,480
tent. Yeah. When, when we think, uh, all, all these, these topics, um, can we say how, how important

410
00:51:42,480 --> 00:51:48,560
is operational discipline compared with the individual security settings?

411
00:51:48,560 --> 00:52:01,760
Um, what do you mean by this? So just, um, yeah, we have these, I say, uh, I have my, my,

412
00:52:01,760 --> 00:52:09,040
my security settings, my individual stuff, I can click, I don't know, my, I don't know, uh, my

413
00:52:09,040 --> 00:52:16,480
defender, my, uh, I don't know what, what, all, all these, uh, as an end user, yeah, the end user,

414
00:52:16,480 --> 00:52:22,960
and, and how, our importance is the end user and how, uh, is, is the, yeah, say, the, the,

415
00:52:22,960 --> 00:52:31,360
what the company does on their side to, to, yeah, have an operational excellence or,

416
00:52:31,360 --> 00:52:39,360
operational discipline, it's always, you know, the tricky part is to find a proper balance on the

417
00:52:39,360 --> 00:52:48,560
one hand to keep the end users in a productive state so that I'm not going to limit them too much,

418
00:52:48,560 --> 00:52:56,400
but at the very same time, not opening too much or allowing the security level too much.

419
00:52:57,040 --> 00:53:06,160
So it's not that easy because I see clients, uh, on each side, uh, so some of them are very, very

420
00:53:06,160 --> 00:53:15,360
restrictive. Uh, for example, hardening the end client system where you do not even see your C drive,

421
00:53:15,360 --> 00:53:24,240
right? And on the other side where, and users are simply, you know, um, yeah, you are a local

422
00:53:24,240 --> 00:53:29,040
administrator, uh, because it keeps it simple for our help desk because you can install your printer,

423
00:53:29,040 --> 00:53:35,120
whatever you want, uh, on your own. So there is not even a process in place. For example, I do have

424
00:53:35,120 --> 00:53:42,560
to request being administrator or having a administrative rights on my client for the next hour

425
00:53:42,560 --> 00:53:51,760
and providing a reason to do so. So, and anything in between, right? But it, it, normally, it depends on

426
00:53:51,760 --> 00:53:57,760
your business. It depends on the data you're working with. So if you're only the, uh, let's say, um,

427
00:53:57,760 --> 00:54:04,400
in the medical sector, or have any sensitive data, which is in the regulated, uh, section,

428
00:54:04,400 --> 00:54:12,720
yeah, it's not necessarily the best idea to move to the cloud as an example without any additional

429
00:54:12,720 --> 00:54:23,280
configuration in place. Um, I think what's, or my favorite topic is governance, uh, and compliance,

430
00:54:23,280 --> 00:54:30,960
and, uh, yeah, also we have the DLP topic. So, so how should we, or how should messaging security

431
00:54:30,960 --> 00:54:41,680
connect it with the governance and compliance? Um, but it comes to compliance, use M365 DLP policies,

432
00:54:41,680 --> 00:54:49,360
use, uh, pervious sensitivity labels, um, but do it in a very,

433
00:54:49,360 --> 00:55:01,200
well, thoughtful and plentiful manner, right? Because rolling out the label, uh, sensitivity

434
00:55:01,200 --> 00:55:10,400
labels rolling out to DLP policies and applying, um, such things to objects to files, to emails,

435
00:55:10,960 --> 00:55:17,920
to folders, to other storage containers is not something that you're going to change, uh, easily,

436
00:55:17,920 --> 00:55:29,040
as soon as it is a product of use, right? But use those, um, this functionality to protect your

437
00:55:29,040 --> 00:55:34,800
data because of the other, if good things about sensitivity labels is, that's a sensitivity label,

438
00:55:35,520 --> 00:55:44,720
are travel with the secured object, right? Yeah, if I put the label on a file, it stays with that file.

439
00:55:44,720 --> 00:55:51,840
Regardless if I do it, uh, attach it as a tuning email, if I proiled to you, why USB stick or whatever

440
00:55:51,840 --> 00:56:03,120
uploaded, wherever a label document is a label document. Do you think it? Um, it's interesting. I think

441
00:56:03,840 --> 00:56:10,880
actually, this is not the, these topics, but comes in my mind. What's when, when the, the, the baddest

442
00:56:10,880 --> 00:56:19,200
parts or bad things happens, you're totally compromised, um, okay, you have done your, your backup,

443
00:56:19,200 --> 00:56:25,920
but, uh, I think, yeah, you can have, I don't know, uh, the company, it's, it's really complex, so,

444
00:56:25,920 --> 00:56:32,000
they save their, their backups and they have their data in these backups, but they,

445
00:56:32,560 --> 00:56:39,200
all to lose their, their, their configuration, how can they, yeah, I don't know, uh, backup,

446
00:56:39,200 --> 00:56:44,480
their, their, their configuration, is there any best practice and, uh, show, they own, show,

447
00:56:44,480 --> 00:56:48,720
they use their best, their, the, the configuration parts, when they get hacked.

448
00:56:48,720 --> 00:56:57,920
Well, I think this is definitely, uh, first of all, thing that you have to get in contact with your

449
00:56:57,920 --> 00:57:05,120
clock provider, it just being hacked and, for example, even having lost your tenant, it's not only

450
00:57:05,120 --> 00:57:12,000
about the data, for example, but all the domains and all your identity domains in that very tenant.

451
00:57:12,000 --> 00:57:19,440
You know, how useful is a configuration for my contoso.com identity stuff when, uh, when I

452
00:57:19,440 --> 00:57:25,840
cannot use that contoso.com domain in a newly set up tenant, because the system, the

453
00:57:25,840 --> 00:57:29,760
abstracts, the files tells me when I do want to add that domain, nah, that domain is already

454
00:57:29,760 --> 00:57:33,680
registered with another tenant and, and I do not have access to that tenant anymore.

455
00:57:33,680 --> 00:57:41,520
So there's no simple and quick answer to that. But if your responsible, um,

456
00:57:41,520 --> 00:57:49,520
come, you do should have a business continuity, uh, option for such a scenario in place,

457
00:57:51,280 --> 00:57:59,840
because starting thinking about that situation in that very moment is not the best idea because

458
00:57:59,840 --> 00:58:10,880
it's quite a stressful situation. When I'm also from an interesting, what, what did you think about AI?

459
00:58:10,880 --> 00:58:16,960
How, how will AI change email security in the next few years? What, what did you think?

460
00:58:19,600 --> 00:58:31,680
email security, um, I think would benefit from it, but again, because yeah, all the malicious

461
00:58:31,680 --> 00:58:38,640
parties are going to use AI, you know, to identify, um, zero-day compromises of exchange server,

462
00:58:38,640 --> 00:58:45,040
and maybe all the stuff that might be still in place in exchange online, whatever, so, um,

463
00:58:45,840 --> 00:58:52,560
this is the, is one side on the other side, AI, yeah, it's a small,

464
00:58:52,560 --> 00:59:00,720
you know, if it's, is it AI, or is it just machine learning, well, how can we say, because,

465
00:59:00,720 --> 00:59:06,960
this is already learning how you work and how you, how you send emails, right?

466
00:59:09,760 --> 00:59:24,400
I think everything, if, if elves, uh, contains AI, but, maybe, um, yeah, um,

467
00:59:24,400 --> 00:59:34,560
you're, you're, what, what, what, what, what did you, I don't know, how I spelled it right,

468
00:59:35,760 --> 00:59:41,280
granny, cause is your, is your company? Yes, what, what, what did you do with, with, with your company,

469
00:59:41,280 --> 00:59:50,320
or what project working you on? So, um, I'm primarily, um, clients of all sizes, so it's,

470
00:59:50,320 --> 00:59:57,120
it's a small, medium-sized businesses, but even, uh, globally large enterprises, anything in between,

471
00:59:57,120 --> 01:00:04,320
happy to, you, you know, move their on premises environment to a currently supported state, so,

472
01:00:04,320 --> 01:00:09,280
there's quite a lot of work to do for upgrading exchange server infrastructure to exchange

473
01:00:09,280 --> 01:00:15,840
those subscription addition. Unbelievable, even though that exchange was 2016 and 2019 are out of

474
01:00:15,840 --> 01:00:22,560
support since October last year, but, ah, they're still out there, and I even saw it exchange

475
01:00:22,560 --> 01:00:30,960
over 2013 environment last week, so, yes, because they work, they, they do not stop, they run,

476
01:00:30,960 --> 01:00:38,240
so, you know, never change running system, period, and moving to exchange online in a supported

477
01:00:38,240 --> 01:00:43,280
manner, for example, using some kind of a hybrid configuration, this is the software I,

478
01:00:43,280 --> 01:00:49,040
where clients definitely need help, because each infrastructure and the possibilities to connect

479
01:00:49,040 --> 01:00:57,600
to exchange online, either for a single full migration, so moving all mailboxes to exchange

480
01:00:57,600 --> 01:01:07,040
online, then getting rid of, ah, on-prem, or for a, ah, full hybrid setup, because the environment will

481
01:01:07,040 --> 01:01:14,400
stay in a hybrid setup for, for ever, because for, well, some companies tend to say that, ah,

482
01:01:14,400 --> 01:01:20,240
some content, let's say, the sea level mailboxes remain on premises because there's highly sensitive

483
01:01:20,240 --> 01:01:26,640
content, and we do not trust the cloud providers, yadda, yadda, yadda, um, because they do not understand

484
01:01:26,640 --> 01:01:32,400
the content of sensitivity labels, but that's a different story. Um, so, and anything in between,

485
01:01:32,400 --> 01:01:40,240
and most companies already have some kind of a security flow, a gateway, a combination in place,

486
01:01:40,240 --> 01:01:49,200
and then they need to have consultancy about, can we use it, ah, with exchange online, can we,

487
01:01:49,200 --> 01:01:54,320
how do we have our mailboxes, all of the, the entry, the, the, the, it was changed from on-prem

488
01:01:54,320 --> 01:02:03,840
to the exchange online and such, so, let's just stop it, so, ah, I do. Yeah. Cool, and, ah, you are also

489
01:02:03,840 --> 01:02:09,120
our podcast those with the exchange, um, plaque, um, plaque, what, what can listeners expect from

490
01:02:09,120 --> 01:02:17,920
your podcast? So the exchange, um, plaque, the podcast is a, ah, it's not, I do not publish on a regular

491
01:02:17,920 --> 01:02:24,240
basis, because it's about technical content, technical situations, stuff that you need to know,

492
01:02:24,240 --> 01:02:32,160
or that you don't want to have to watch out for, ah, and, and this stuff, and, ah, I do have, um,

493
01:02:32,160 --> 01:02:37,600
come time to time, I have guests, where we talk about their expertise, that they are sharing

494
01:02:37,600 --> 01:02:45,920
the knowledge, so, ah, I just had the, the upcoming episode I talk with, um, my team's end up about,

495
01:02:45,920 --> 01:02:52,240
well, about DMug and such, because since, ah, this year DMug is now an official standard, it's not

496
01:02:52,240 --> 01:03:00,080
just an, ah, proposal anymore. And, well, so exchange on plaque is focusing as you can guess,

497
01:03:00,080 --> 01:03:07,200
on exchange and messaging related to topics, so, and it's more or less seen in a combination,

498
01:03:07,200 --> 01:03:14,720
with the community project website for exchange, for it, it's pros.block, which is the other thing

499
01:03:14,720 --> 01:03:22,640
that I do, um, because I believe that we need to persist, exchange related knowledge,

500
01:03:22,640 --> 01:03:26,320
because I think it's vanishing, right?

501
01:03:26,320 --> 01:03:38,720
So, um, yeah, we have a little bit over the time, but I hope you have some time for the rapid

502
01:03:38,720 --> 01:03:46,640
fire round, to the end of it normally in every, every round, is it okay? Okay, um, yeah, it's, ah,

503
01:03:46,640 --> 01:03:51,680
I asked the question, you give a short answer, so exchange server, exchange online.

504
01:03:51,680 --> 01:03:53,680
Exchange server.

505
01:03:53,680 --> 01:03:58,080
Hybrid, temporary, fast or a long term architecture?

506
01:03:58,080 --> 01:04:00,320
Long term architecture.

507
01:04:00,320 --> 01:04:02,960
Power shell or portal?

508
01:04:02,960 --> 01:04:04,960
Power shell.

509
01:04:04,960 --> 01:04:06,880
Always.

510
01:04:08,240 --> 01:04:14,880
London is famous for for the big band and, um, the parents is famous for the,

511
01:04:14,880 --> 01:04:17,360
Eiffel Tower, what's Hucleof in famous for?

512
01:04:17,360 --> 01:04:27,040
Um, again, so Hucleof is definitely famous for a TV online shopping center, which does have,

513
01:04:27,040 --> 01:04:30,320
it's a Germany distribution center there.

514
01:04:30,320 --> 01:04:33,280
Not naming the TV channel.

515
01:04:33,280 --> 01:04:37,680
The most underrated security controller.

516
01:04:38,000 --> 01:04:41,360
Oh, you said quick, huh?

517
01:04:41,360 --> 01:04:47,520
Um, save links.

518
01:04:47,520 --> 01:04:53,520
Um, most dangerous default setting.

519
01:04:53,520 --> 01:05:02,080
The default domain in your M365 tent.

520
01:05:04,480 --> 01:05:09,120
Um, what do you say is the most overrated security metric?

521
01:05:09,120 --> 01:05:13,040
The most overrated you said.

522
01:05:13,040 --> 01:05:19,920
Oh, oh, that's a tricky one.

523
01:05:19,920 --> 01:05:22,080
Next question.

524
01:05:22,080 --> 01:05:28,720
Okay, if Satya Dadaia called you and said Thomas, you get all the money and the resources

525
01:05:28,720 --> 01:05:30,800
for Microsoft, you, you, you need.

526
01:05:30,800 --> 01:05:33,440
What feature will you be about, please, change?

527
01:05:33,440 --> 01:05:36,480
Uh, do you want to give you an exchange server?

528
01:05:36,480 --> 01:05:40,880
Uh, I would have definitely, uh, two things, sorry for that Satya.

529
01:05:40,880 --> 01:05:49,360
Um, it's on the one hand, a, uh, DK implementation, uh, for exchange server.

530
01:05:49,360 --> 01:05:58,800
And an automatic automated certificate exchange, watching out for the short-time server certificate

531
01:05:58,800 --> 01:06:05,280
lifetimes, built in into the product. Okay, then the last one, uh, who showed I

532
01:06:05,280 --> 01:06:07,520
and why next and what question should I ask?

533
01:06:07,520 --> 01:06:18,560
Um, did you already talk to Manfred Haber?

534
01:06:18,560 --> 01:06:24,960
No. Um, yeah, so I think Manfred Haber is the right one to choose and because he, uh,

535
01:06:24,960 --> 01:06:33,200
provides, uh, infrastructure for, uh, a service server and ACS, um, infrastructure for hybrid.

536
01:06:33,200 --> 01:06:36,800
So, the same question on hybrid stuff.

537
01:06:36,800 --> 01:06:42,080
So is it either, uh, as a, as a local or anything in between?

538
01:06:42,080 --> 01:06:49,760
Oh, okay, cool. So, yeah, um, then my final question is, uh, Thomas, if you leave all of

539
01:06:49,760 --> 01:06:54,880
us with one clear principle about secure and exchange servers, hybrid environments and microsys,

540
01:06:54,880 --> 01:06:57,200
the five messaging, what will it be?

541
01:06:57,200 --> 01:07:05,200
Um, stay up to date, follow the, uh, exchange product group log, patch your exchange servers if you

542
01:07:05,200 --> 01:07:14,240
have any and watch out for default changes, uh, and just the last one, remember the duplication of

543
01:07:14,240 --> 01:07:21,440
exchange web services, exchange online. Okay, then, Thomas, thank you for joining me on the

544
01:07:21,440 --> 01:07:26,080
um, 65 podcast and sharing such, uh, yeah, detailed and practical look into Microsoft

545
01:07:26,080 --> 01:07:31,440
messaging security. Yeah, you're experiencing across the exchange server, hybrid environments,

546
01:07:31,440 --> 01:07:36,000
exchange online enterprise architecture training and incident group boards gives the,

547
01:07:36,000 --> 01:07:42,640
our list does a unique perspective on the, uh, topic that almost, yeah, affects every organization.

548
01:07:42,640 --> 01:07:43,840
They, let's use emails.

549
01:07:46,160 --> 01:07:52,800
The key messages from today's conversion is key, Microsoft's messaging platforms can be powerful

550
01:07:52,800 --> 01:07:58,560
and secure, but security does not happen automatically. It depends on identity protection.

551
01:07:58,560 --> 01:08:04,320
Correct configuration, secure mail flow, continuous monitoring, strong operational process

552
01:08:04,320 --> 01:08:12,000
and clear understanding of their responsible sits. Yeah, you can learn more about Thomas if you

553
01:08:12,000 --> 01:08:18,480
look at his company, uh, website, thank you, us and his, uh, block and his YouTube channel and also

554
01:08:18,480 --> 01:08:25,440
the exchange, um, like podcast. Yeah, we will include all the links in the show notes on the um,

555
01:08:25,440 --> 01:08:33,200
65 podcast page. Yeah, if you enjoy these episodes, please subscribe to the um 65 show podcast,

556
01:08:33,200 --> 01:08:38,400
share with your colleagues and yeah, let us review here. It's, it's very important for us,

557
01:08:38,400 --> 01:08:46,320
small, uh, podcast tools and yeah, Thomas, thank you again for for joining us, uh, or me today

558
01:08:46,320 --> 01:08:51,440
and every listener, keep learning, keep questioning your defaults and keep building

559
01:08:51,440 --> 01:08:57,360
safer Microsoft environments. So see you in the next episode on the MCC35 podcast to show or

560
01:08:57,360 --> 01:09:03,040
on the exchange. I'd like to. Thanks for having me.