The Complete Course from ExamCollection industry leading experts to help you prepare and provides the full 360 solution for self prep including SC-900: Microsoft Security, Compliance, and Identity Fundamentals Certification Video Training Course, Practice Test Questions and Answers, Study Guide & Exam Dumps.

Module 2 Describe the concepts & capabilities of Microsoft identity and access

1. Describe Identity Concepts – Introduction

Everyone and every device has an identity that can be used to gain access to resources. Identity is the way in which people and things are identified on your corporate network and in the cloud. Being certain about who or what is accessing your organization's data and other resources is a fundamental part of securing your environment, and this is known as identity and access management. This is made up of two key steps, authentication and authorization of identities. In the subsequent lessons, we'll learn about the concept of identity as a security perimeter. You'll also understand the differences between authentication and authorization, and in the end, you'll be able to relate various identity services. Let's get started with the common identity attacks that we have in the world today.

2. Common Identity Attacks

Some of the most common types of security threats that organisations face today are identity attacks. Identity attacks are designed to steal the credentials used to validate or authenticate that someone or something is who they claim them to be. The result of that is identity theft. We need to know about different kinds of attacks that are employed for the purposes of identity theft. These thefts include but are not limited to password-based attacks. And then there's fishing as well. Most organisations today are spending a lot of time dealing with phishing attacks, specifically spear phishing. So if these terminologies like password-based attacks and phishing are new to you, let's get into it and try to understand what they actually mean. Password-based Attacks Password-based attacks include password-spraying attacks and brute-force attacks. A password spray attack attempts to match your username against a list of weak passwords. A brute force attack will try several different passwords against one or more accounts, sometimes using dictionaries of commonly used passwords. Now when a user has assigned a weak password to their account, the hacker will find a match and gain access to that account. What is phishing? A phishing attack is when a hacker sends an email that appears to be from a reputable source. The email contains a credible story, such as a security breach, or probably instructs the user to sign in and change their password. So instead of going to a legitimate website, the user is directed to a scammer's website where they enter their username and password, and that's the end of it. The hacker has now captured the user's identity and their password. Although many phishing scam emails are badly written and easy to identify, when users are really busy or they are tired, they make mistakes, and at that time they are more easily deceived. As hackers' techniques become more sophisticated, their phishing emails become more and more difficult to identify. So that means that attackers are able to craft an email that looks like it has come from a legitimate company. Spear phishing is also a variant of a phishing attack where hackers build databases of information about users. Now, this information is then used to create highly credible emails. The email may appear to come from someone within your organisation who is requesting information. Although careful scrutiny might uncover the fraud, users might not read it carefully enough and send the requested information, or probably even log onto the website, before they realise it is fraud. This is called spear phishing because it is highly targeted at specific individuals. Now, to protect against all types of identity attacks, what you need are robust identity security and monitoring techniques. Azure Active Directory has certain features within a module called "identity protection," which have risk detections and will cause any unidentified suspicious actions related to the user accounts to be blocked immediately. So there are two types of risks in Azure AD identity protection. There is a user risk and a sign-in risk. What's the user's risk? A user risk represents the probability that a given identity or account is compromised. What is the probability of that user being compromised? That is user risk, whereas sign-in risk represents the probability that a given authentication request is not authorised by the identity owner. So I hope these concepts are clear for you when it comes to password-based attacks or phishing or spearphishing and what Active Directory has to do to prevent them, specifically when it comes to user risk and sign-in risk. OK, so that's all for now. In the next lesson, let's go ahead and chat about identity as the primary security perimeter. Thanks for watching so far, and I'll see you in the next lesson.

3. Identity As a Security perimeter

If we believe we are secure because you have a network, we will be living in an illusionary world. Perimeter attacks today are networkless in a way that they are not controlled by the network perimeter. Trying to secure identities is not an easy task. The best IT organisations have lots of logs and can potentially use that information for threat hunting to look for anomalous activities in a modern IT environment. There are remote workers, third-party vendors, distributed offices, and deployments from mobile as well as from the cloud. The classic perimeter no longer exists. Instead, the fundamental unit of access is identity. In the cloud, and specifically when accessing SaaS-based services, identity is everything. With an identity, which is essentially your username and password or access credentials, a user or device can get access to a service, and if the same thing is in the hands of an attacker, the same identity grants the same level of access time and again, breach after breach. The modern attack cycle, particularly in the cloud, starts with identities. Attackers seek to get access to that identity and then pave their way through the resources, discovering credentials, discovering other identities, and then granting themselves more and more access to get what they want. Identity in the cloud-native era is not just about a simple Microsoft Active Directory implementation. In the cloud era, it's about APIs, which are the gatekeepers of access. Since it's a network-less perimeter, identity is the entirety of a data since it's a network less perimeter.I'm just trying to stress the point that digital collaboration has changed. Employees and partners now expect to be able to collaborate and access organisational resources from anywhere, on any device, and without sacrificing productivity. In addition, there has been an acceleration in the number of people working from home these days. Enterprise security needs to adapt to its new reality. The security perimeter can no longer be justly viewed as an on-premise network. It extends to several other things like SaaS applications, which are critical for business workloads and may be hosted outside the corporate network. Think about bringing your own device. Personal devices used by employees to access corporate resources while working from home should also be considered unmanaged devices used by your partners or customers when interacting with corporate data or collaborating with employees, which must also be kept within security boundaries. There's a lot said and done with IoT devices. IoT devices installed throughout your corporate network and inside your customers' locations must also be in the eyes of the security team. This just tells us that the traditional perimeter-based security model is no longer enough. Identity has now become the new security perimeter. This enables organisations to secure their assets. But what do we mean by an identity? Well, an identity is how someone or something can be verified and authenticated to be who they say they are. An identity may be associated with a user, an application, a device, or something else. to understand about identities. Further, we need to think about the four pillars of identities, which are administration, authentication, authorization, and auditing. Talking about this in this particular section would be overkill. So let's talk about this in the next lesson. Thanks for watching so far, and I'll see you in the next lesson.

4. Four Pillars of Identity

Identities can empower your users. Identities enable you to take control. Identities enable you to plan for the future. The whole concept of identity spans across an entire environment. just so that organisations need to think about identity broadly. There are four fundamental pillars of identity that organisations need to consider when creating an identity infrastructure. The organisations need to have processes in place, technologies in place to manage those entities, and also policies for managing these digital identities and controlling how these identities can be used to access the resources. Microsoft defines identity through four distinct but interconnected pillars. They are administration, authentication, authorization, and auditing. There are number of definitionswhen it comes to administration. In the context of this discussion, we define administration as being about creating an accurate view of a user's identity with a goal of being centralised and mapping to a computer's identity as well. Now, just because the view of a user's identity is centralised doesn't mean that there's only one view. The reason for this is that the nature of a user's or computer's identity can change based on the context. For example, a user's identity might be one thing between 9:00 a.m. and 5:00 p.m. and quite different during non-business hours. In a similar fashion, think about a device. So the nature of device identity might be different based on location, on who the currently logged-in user is, or on the ever-changing state of the device's security status or configuration. We can have a centralised view of an identity without realising the object's identity is in flux. So when we think about the attributes and entitlements associated with that identity, the concept will change. So administration is about the lifecycle management of a user, right? from the creation and management of identities for users, devices, and the related services. So as an administrator, you manage how and under what circumstances the characteristics of irate users can be changed. It could be created, updated, or deleted, and this falls under the lifecycle management of administration. Now, when it comes to authentication, the authentication pillar tells the story of how much assurance for a particular identity is enough. In other words, how much does an IT system need to know about an individual's identity in order to have sufficient proof that they really are who they say they are? Now, they are very complex authentication pillars, and this can be further broken down into three sections. There's authentication strength, authentication delegation, and end-user experience. But in this pillar, authentication is all about how much assurance for a particular identity is enough. So it involves the act of challenging a party for legitimate credentials. Authentication is sometimes shortened to authent. The next one is the authorization pillar. The authorization pillar is about enabling an application or a resource to make the best decision possible. In other words, authorization means processing the incoming identity data in order to decide what an identity should be able to do within that application that it wants access to. The authorization mechanism can be very application-specific and built into the application, or sometimes it's completely abstracted from the application as well. SharePoint is a great example of an application with a strong built-in authorization capability. So this particular authorization pillar is about processing the incoming identity data to determine the level of access an authenticated person needs. Authorization is sometimes shortened to AuthZ. The next one is the auditing pillar. The most commonly overlooked pillar in almost every identity solution is an auditing component. The most likely reason for this is the complexity and anomality of the problem. The most difficult issue to deal with is related to the fact that there is log data in multiple locations. So the logs are available in Web Service Logs. There are event logs, custom logs, and an ever-increasing number and types of logs. So, like cloud computing, logging has become ubiquitous, and the size of problems will grow in the coming cloud computing era. As a result, there are many different types of logs. You have to now consider how difficult or easy it is for you to harvest, process, and filter that data. So this pillar auditing pillar is about tracking whodoes what, who does when, where and how. Auditing includes having in-depth reporting, alerts, and governance of identities. Addressing each of these four pillars is key to a comprehensive and robust ironic access control solution. moving on to the next section. Now we're just talking about modern authentication and the role of an identity provider. and that's coming up next. And thanks for watching so far, and I'll see you in the next lesson.

5. Modern Authentication and the role of Identity provider

Modern authentication is an umbrella term for authentication and authorization methods. At the centre of modern authentication is the role of the identity provider. Now, we know that authentication and authorization methods are happening between your clients' laptops, phones, and servers, and that happens with the web applications too. Now, what is an identity provider doing here? An identity provider is responsible for creating, maintaining, and managing the identity information while providing the authentication, authorization, and auditing services. With modern authentication, all services, including all authentication services, are provided by a central identity provider. The information that is used to authenticate the user with the server is stored and managed centrally by the identity provider. With a central identity provider, organisations can establish authentication and authorization policies, monitor user behavior, identify suspicious activities, and also reduce malicious activities. In a client-server scenario using modern authentication, the client communicates with the identity provider by providing an identity that can be authenticated. Once the identity has been verified (which could be an auer or an application), the identity provider issues a security token, which the client sends to the server. The server validates the security token through something called a trust relationship with the identity provider. By using this security token and the information that is contained within it, the user or application can gain access to required resources on the server. Now, in this scenario, the token and the information contained in the token are stored and managed by the identity provider. The centralised identity provider is providing the authentication service. The identity provider is also called an IDP, and sometimes the application in the cloud is called a relying party. Microsoft Azure Active Directory is an example of a cloud-based identity provider or IDP as well. There are other examples of IDPs across the world, and they are Twitter, Google, Amazon, LinkedIn, and GitHub. We need to understand the concept of federation services that enable single sign-on, and we're going to do that in the next lesson. Thanks for watching so far, and I will see you in the next lesson.