When your organization works on a cloud platform, top of mind is security and integrity of data. Microsoft Azure and Office 365 are among the most significant business tools for boosting collaboration and productivity.
With more organizations modernizing to cloud solutions, business leaders are worried about data hosted in the cloud not being secure, especially as ransomware attacks increase. The concern surrounds Office 365 and Microsoft Azure applications with file storage and sharing. That’s because file sharing apps are known to be the most vulnerable to data exposure and malware insertion.
This becomes compounded, because moving sensitive data to the cloud means it’s no longer within the customer’s IT control.
Microsoft has made significant efforts to better secure an organization’s infrastructure and data. Azure and Office 365 are already tightly secure with three layers of security. These layers are baked into the platform from the start and require no specific activation or customization to implement.
Let’s investigate this below.
Defining Microsoft Secure Score
Secure Score helps organizations:
- Report on the current state of the organization’s security posture.
- Improve an organization’s security posture by providing discoverability, visibility, guidance and control.
- Compare an organization’s security with benchmarks and set up key performance indicators (KPIs).
With Secure Score, your organization can improve its security posture. By doing so, it’s less likely your organization will become the victim of a cyber attack or data breach.
This tool reviews how secure your Azure or Office 365 environment is. Then, it provides refinements that can further reduce your overall risk.
Your organization can gain access to robust visualizations of metrics and trends, integration with other Microsoft products, score comparisons with similar organizations, and much more. The score can also reflect when third-party solutions have addressed recommended actions.
How Do You Use Secure Score?
You’re given points for the following actions:
- Configuring recommended security features.
- Doing security-related tasks.
- Addressing the improvement action with a third-party application or software, or an alternate mitigation.
Secure Score doesn’t use “high,” “medium” and “low” as other tools do. Instead, its purpose is to help improve your organization’s security posture. It doesn’t measure a breach possibility. Instead, it gives you ways for your infrastructure to stay secure.
You are shown the full set of possible improvements for a product, regardless of license edition, subscription or plan. This way, you can understand security best practices and improve your score.
Your absolute security posture, represented by Secure Score, stays the same no matter what specific product licenses your organization bought. Keep in mind that security must be balanced with usability. And not every recommendation can work for your environment.
Because many organizations use Secure Score, Microsoft built a chart, which shows you how your security posture compares to other Azure and Office 365 subscribers.
Through it, Secure Score helps you better understand whether you have a precise security configuration. It also shares with you the security best practices for managing your Azure and Office 365 subscriptions.
This places key security-relevant features of Azure and Office 365 in one place. It allows you to define features you have adopted. And it enables you to close the shortfalls on your target score.
How Do You Start?
To get a Secure Score, start by logging in to your Microsoft 365’s Admin Center. Do so through a user who holds administrative roles, such as user admin or security admin. Select ‘Show All’ and then select ‘Security Center.’
How Does It Work?
In the Microsoft Secure Score overview page, view how points are divided between these groups and what points are available. You can also get a view of the total score, historical trend of your Secure Score with benchmark comparisons, and prioritized improvement actions that can be taken to improve your score.
Secure Score finds what services you’re using (Exchange, OneDrive, SharePoint, etc.). It reviews your settings and activities on a baseline set by Microsoft. Your score will show how you’re aligned with other users’ security best practices.
Microsoft Secure Score creates a full inventory of all the security configurations that reduce risk. Each control that reduces risk is calculated with points. Some controls are more effective and heavily weighted with more points. It’s measured by how they are implemented.
The points provide a snapshot of your Secure Score, as shown here in this product overview image:
This score is an overview of how secure your environment is. You can measure it in real time to track your progress. As you implement more controls, the score will improve accordingly. The Secure Score is updated once a day.
Your Score Summary
When you use Secure Score, your score is already calculated using the total of security controls that you have chosen.
Your Azure and Microsoft 365 Risk Assessment
Secure Score provides a total risk assessment. It gives you hyperlinks to risks you’re exposed to if you don’t follow the recommended actions.
Here’s an example in this product overview image, showing some of the scenarios and potential risks:
Compare Your Scores
From the summary page, you can get a glimpse of how your score compares to all Microsoft customers.
Time to Act
When you see your score, one of the first things you will want to do is figure out is how to improve it.
In this example, the product overview image shows the score based on an Office 365 configuration:
Your score can fall into a rating of Basic, Balanced or Aggressive.
The comparison bar chart is available on the ‘Overview’ tab. Hover over the chart to view the score and score opportunity.
Your organization will get an average score of other tenants in the same region, so long as there are at least five or more tenants with a similar organization size to yours for a comparison. The comparison data is anonymized, so you don’t know exactly which tenants are in the mix.
Realizing how each of these actions affects the users allows you to balance your organization’s productivity against security settings. Each action has further information, showing how security will be improved and what threats are represented, along with how it’s currently configured.
It will also show the points when using this action, as shown in this product overview image:
To more quickly help you find the information you need, Microsoft improvement actions are organized into groups:
- Identity (Azure Active Directory accounts and roles)
- Device (Microsoft Defender for Endpoint, known as Microsoft Secure Score for Devices)
- Apps (email and cloud apps, including Office 365 and Microsoft Defender for Cloud Apps)
Some actions will not be scored. This means, even if the corresponding actions are implemented, the Secure Score won’t increase. These actions are marked as Not Scored in the queue.
Metrics and Trends
With this, tracking and reporting of the score will be allowed over time.
The following graph shows the Secure Score in time for this product overview:
To complete the action, you have a few options:
- Select ‘Manage’ to go the configuration screen and make the change. You will then gain points for what the action is worth, visible in the fly out. Points generally take up to 24 hours to update.
- Select ‘Share’ to copy the direct link to the improvement action. You can also choose the platform for sharing the link to apps, such as Microsoft Outlook, Microsoft Teams or Microsoft Planner.
Conclusion
System Soft Technologies and Secure Score are here to help make sure you improve your organization’s infrastructure security.
Improve your Secure Score by configuring recommended security features or performing security-related tasks. Some actions can be scored for partial completion like enabling multi-factor authentication (MFA) for users.
Secure Score directly represents the Microsoft security services your organization uses. However, your security must be balanced with your usability. All security controls have a user impact component. Controls with low user impact will have little to no effect on your users’ day-to-day operations and activities.
Click over to the Microsoft 365 Defender portal. Check out your overall Microsoft Secure Score. You can review changes to your overall Secure Score by clicking on ‘View History.’ Then, choose a specific date to see which controls were enabled for that day and what points you earned for each one.
System Soft makes Azure and Microsoft 365 easy to use, so you can focus on your business. Reach out to the Cloud experts at System Soft to help secure your cloud environment.
In a later blog, I will discuss Microsoft Information Protection, which can help your organization prevent data leaks at the file level and control users from leaking your sensitive data. Read about it here.
About the Author: Don Bilbrey
Don Bilbrey serves as a Senior Cloud Solutions Architect at System Soft Technologies and has more than 22 years of experience in the IT industry and more than 12 years in cloud services. Don energetically manages the service delivery needs of large enterprise customers and is an expert in understanding client’s systems and storage solutions.
