Chatta subito con l'assistenza

Ottieni assistenza in tempo reale
Completa la registrazione

Accedi

Richiedi prezzo

Contatta il supporto vendite

Security Guardian Current - User Guide

Table of Contents

Introducing Quest Security Guardian

About On Demand About Security Guardian Access Control Functional Overview Configuring Additional Components

Using the Dashboard Tier Zero Objects

How Tier Zero Objects are Identified Tier Zero Objects List Viewing Tier Zero Object Details Adding Tier Zero Objects Manually

Removing Manually-Added Tier Zero Objects

Certifying Tier Zero Objects Protecting Tier Zero Objects Exporting the Tier Zero Objects List

Privileged Objects

Privileged Objects List Viewing Privileged Object Details Adding Privileged Objects Manually

Removing a Manually-added Privileged Object

Certifying Privileged Objects Exporting the Privileged Objects List

First Assessment Notification Email Built-in Assessments All Assessments List Discoveries and Vulnerabilities

Discoveries List Pre-Defined Active Directory Discoveries

Discovery for Credential Access Vulnerabilities Discovery for Defense Evasion Vulnerabilities Discovery for Discovery Vulnerabilities Discovery for Initial Access Vulnerabilities Discovery for Lateral Movement Vulnerabilities Discovery for Persistence Vulnerabilities Discovery for Privilege Escalation Vulnerabilities Discovery for Reconnaissance Vulnerabilities

Pre-Defined Entra ID Discoveries

Discovery for Entra ID Credential Access Vulnerabilities Discovery for Entra ID Discovery Vulnerabilities Discovery for Entra ID Initial Access Vulnerabilities Discovery for Entra ID Persistence Vulnerabilities Discovery for Entra ID Privilege Escalation Vulnerabilities

Creating a Discovery Viewing, Editing, and Deleting a Discovery

Creating an Assessment Viewing, Editing, and Deleting an Assessment Assessment Results

Viewing Detail for an Assessed Vulnerability

Investigating Findings

Investigating Tier Zero and Privileged Object Findings Investigating Hygiene and Detected Indicators

Muting Findings for Hygiene and Detected Indicators Dismissing Findings Viewing Finding History

Security Settings

Configuring a Forwarding Destination Managing Indicators

Muting and Unmuting Indicators

Managing Data Collections

Appendix - Security Guardian Indicator Details

Indicators by Severity Indicators by Source

Indicators from On Demand Audit Indicators from Security Guardian Assessments Indicators from Security Guardian and Protection for Tier Zero Objects

Discovery for Entra ID Discovery Vulnerabilities

The following table describes the vulnerabilities identified in the pre-defined Entra Discovery for Discovery.

Vulnerability Template

Vulnerability

Risk

What to find

User password last changed

Name:

Entra ID privileged role members whose passwords have not changed recently

Default Scope:

All Users

While it is not necessary to require mandatory periodic password resets, organizations should be aware of the password age of users that are members of Microsoft Entra built-in privileged roles.

Remediation:

Ensure that privileged role members have update their password to satisfy the organization’s password policy.

Users that are members of privileged roles that have not updated their password within last 90 days

NOTE: The number of days is editable.

Discovery for Entra ID Initial Access Vulnerabilities

The following table describes the vulnerabilities identified in the pre-defined Entra Discovery for Initial Access.

Vulnerability Template	Vulnerability	Risk	What to find
Entra ID tenant security defaults status	Name: Security defaults are enabled Default scope: N/A	Enabling security defaults is recommended for organizations that are using the free tier of Microsoft Entra ID licensing and want to increase their security posture. Organizations with premium Entra ID licensing should use Conditional Access polices for more granular control to achieve a higher security posture. Remediation If the organization is using the free tier of Microsoft Entra ID licensing, continue using security defaults. If the organization is using Microsoft Entra ID P1 or P2 licenses, continue using security defaults while the deployment of Conditional Access policies is planned. When security defaults are disabled, organizations should immediately enable Conditional Access policies to protect the organization. These policies should include at least those policies in the secure foundations category of Conditional Access templates. Organizations with Microsoft Entra ID P2 licenses that include Microsoft Entra ID Protection can expand on this list to include user and sign in risk-based policies to further strengthen the posture.	Entra ID tenants in scope that have security defaults enabled
Entra ID Guest account last used	Name: Entra ID guest user accounts that are inactive Default scope: All users	When external partners no longer access your tenant, the guest accounts may become stale and vulnerable to attack. Remediation: Review inactive guest users, block them from signing in, and delete them from the directory.	Entra ID user accounts in scope that were last used more than 90 days ago NOTE: The number of days is editable.
Entra ID Microsoft Authenticator number matching and additional contexts status	Name: Entra ID Microsoft Authenticator policy does not require geographic location and application name contexts for all users Default scope: All users	Microsoft has added features for strong multifactor authentication (MFA to help reduce MFA fatigue attacks and accidental MFA approvals. Remediation: In Authentication methods, enforce the use of Microsoft Authenticator passwordless push notifications with show geographic location context and show application name context.	Entra ID user accounts in scope that do not have the Microsoft Authenticator policy assigned with geographic location and application name enabled
Entra ID users synchronized from Active Directory status	Synchronized Active Directory user is assigned an Entra ID privileged role Default scope: All users NOTE: If no Active Directory collection is available, an Inconclusive message is returned.	Active Directory is considered less secure than Entra ID. By assigning an Entra ID Privileged role to a synchronized on-premises Active Directory user, attackers have a clear pathway to take over Entra ID if Active Directory is compromised. Remediation: Microsoft recommends using cloud-only accounts for Microsoft Entra ID privileged roles. Remove synchronized Active Directory user accounts from direct and indirect membership of privileged roles. Active Directory users that require privileged access to Entra ID should be provided with a separate cloud-only Entra ID account.	Entra ID users in scope that are synchronized Active Directory users
Entra ID User consent for applications setting	Name: Entra ID users are allowed to consent for all applications Default scope: All tenants selected at the time an Assessment is created	Before an application can access an organization's data, a user must grant the application permissions. Different permissions allow different levels of access. By default, all users are allowed to consent to applications for permissions that don't require administrator consent. To reduce the risk of malicious applications being granted access to the organization’s data by users, it is recommended that users can only consent to applications that have been published by a verified publisher. Remediation: Sign in to the Microsoft Entra admin center as a Global Administrator. Browse to Identity \| Applications \| Enterprise applications \| Consent and permissions \| User consent settings. Under User consent for applications, select “Allow user consent for apps from verified publishers, for selected permissions”. Alternatively, if appropriate, “Do not allow user consent” can be selected.	Entra ID tenants in scope that have “User consent for applications” set to allow user consent for apps
Entra ID Conditional Access Continuous Access Evaluation strictly enforce location	Name: Entra ID Conditional Access policies do not protect all users with strictly enforce location for Continuous Access Evaluation Default scope: All users	Strictly enforce location is an enforcement mode for Continuous Access Evaluation that is configured in Conditional Access policies. This mode provides protection by immediately stopping access if the IP address detected by the resource provider isn't allowed by Conditional Access policy. This option is the highest security setting for Continuous Access Evaluation. Remediation: Implementing strictly enforce location for Continuous Access Evaluation requires that administrators understand the routing of authentication and access requests in their network environment. Policies like this one should be tested with a subset of users and applied cautiously. The setting to strictly enforce location for Continuous Access Evaluation is located in “Session”, “Customize continuous access evaluation”, “Strictly enforce location policies”.	Entra ID user accounts in scope that do not have Continuous Access Evaluation strictly enforce location enabled in an assigned Conditional Access policy
Entra ID Conditional Access policy mfa status	Name: Entra ID Conditional Access policies do not protect all non-privileged users with multi-factor authentication (MFA) Default scope: All except Privileged users	Attackers frequently target end users. After attackers gain entry, additional access to privileged information can be requested for the exposed account. Attackers can also download other data such as the entire directory to do a phishing attack on the organization. Remediation: Improve protection by requiring multi-factor authentication (MFA) for all users. Enable a Conditional Access policy for the tenant that has: “Users” set to include “All users” and exclude emergency access or break-glass accounts. In “Target resources”, “Cloud apps” set to include “All cloud apps”. In “Access controls” “Grant”, set “Grant access” to “Require multifactor authentication” Organizations with Security Defaults enabled will enforce MFA for all users in some situations (based on factors such as location, device, role, and task) without requiring a Conditional Access policy. NOTE: Microsoft recommends excluding the following accounts from Conditional Access policies: Emergency access or break-glass accounts (to prevent tenant-wide account lockout) Service accounts and service principals (non-interactive accounts normally used by back-end services which cannot programmatically complete MFA).	Entra ID user accounts in scope that do not have require multi-factor authentication enabled in an assigned Conditional Access policy
Entra ID tenant on-premises synchronization time	Name: Synchronization with on-premises Active Directory is delayed Scope: All tenants selected at the time an Assessment is created NOTE: If no Active Directory collection is available, an Inconclusive message is returned.	Delays in synchronization with on-premises Active Directory can be due to misconfiguration or issues with the Microsoft Entra Connect server. Remediation: Login to Microsoft Entra Connect Health and review any potential sync errors.	Entra ID tenants in scope that have not synchronized with on-premises Active Directory in 12 hours.

Discovery for Entra ID Persistence Vulnerabilities

The following table describes the vulnerabilities identified in the pre-defined Entra Discovery for Persistence.

Vulnerability Template

Vulnerability

Risk

What to find

Entra ID Conditional Access cloud application inclusion status

Name:

Entra ID cloud applications that are not included in a conditional access policy

Default scope:

All Applications

Conditional Access policies allow administrators to assign controls to specific applications. Administrators can choose from the list of applications or services that include built-in Microsoft applications and any Microsoft Entra integrated applications. Ensure at least one conditional access policy applies to each Cloud application in the organization.

Remediation:

Enable a Conditional Access policy for the tenant that has "Target resources" set to include any cloud application that are not currently included in a Conditional Access policy.

Entra ID Cloud applications in scope that are not included in a conditional access policy

Discovery for Entra ID Privilege Escalation Vulnerabilities

The following table describes the vulnerabilities identified in the pre-defined Entra ID Discovery for Privilege Escalation.

Vulnerability Template	Vulnerability	Risk	What to find
Number of Global Administrators	Name: More than recommended number of Global Administrators in the organization Default scope: N/A	Users who are assigned the Global Administrator role can read and modify almost every administrative setting in your Microsoft Entra organization. Microsoft recommends that you assign the Global Administrator role to fewer than five people in your organization. Remediation: Review the users assigned the Global Administrator role, determine the access required, and assign a more appropriate privileged role to the user.	Total number of Global Administrators in the organization is more than or equal to 5 NOTE: The number of Global Administrators is editable.
Entra ID Role with Guest members	Name: Guest accounts assigned to the Global Administrator role Default scope: N/A	Cyber-attackers use credential theft attacks to target administrator accounts and other privileged access to try to gain access to sensitive data. Remediation: Remove Guest accounts from the Global Administrator role. If the Guest account is the initial Microsoft account used when the Entra ID was first setup, replace the Microsoft account with an individual cloud-based or synchronized account.	Roles in scope that have more than 0 Guest accounts as members NOTE: The number of Guest accounts is editable.
Number of privileged role assignments	Name: More than recommended number of privileged role assignments Default Scope: N/A	Some roles include privileged permissions, such as the ability to update credentials. Since these roles can potentially lead to elevation of privilege, the use of these privileged role assignments should be limited to fewer than 10 in the organization. Remediation: Review the privileged role assignments and reduce the number of assignments by removing access to principals that do not require it. If all principals require the access, use role-assignable groups to manage the access to privileged roles.	Total number of privileged role assignments in the organization is more than or equal to 10 NOTE: The number of privileged role assignments is editable.
Entra ID Conditional Access Continuous Access Evaluation disabled status	Name: Entra ID Conditional Access policy configured to disable Continuous Access Evaluation for users Default scope: All users	Continuous access evaluation is auto enabled as part of the organization's Conditional Access policies. The key benefits of continuous access evaluation are: user termination or password change/reset user session revocation is enforced in near real time, network location change Conditional Access location policies are enforced in near real time, and token export to a machine outside of a trusted network can be prevented with Conditional Access location policies. Remediation: Any Conditional Access policy that has disabled continuous access evaluation should be reviewed to ensure there is a legitimate reason it was created. The setting to disable Continuous Access Evaluation is located in “Session”, “Customize continuous access evaluation”, “Disable”.	Entra ID user accounts in scope that are assigned a Conditional Access policy with Continuous Access Evaluation set todisabled

Related Documents

The document was helpful.

Seleziona valutazione

I easily found the information I needed.

Seleziona valutazione

© ALL RIGHTS RESERVED. Termini di utilizzo Privacy Cookie Preference Center