Microsoft Secure Score

[JazzFlute]

Does anyone religiously go through Microsoft Secure Score in Microsoft Defender Admin and address all the actions available if you have the correct licenses?

 

I'm also working on improving my Secure Schools Cyber Score which i believe is linked with DFE recommendations.

 

Just wondered what others are doing as its a lot of tasks when you add them all up.

[robyholmes]

You just have to keep in mind that it's both a 'Best Practice' and a 'You need to buy X to be secure'. So yes it's good to review it, but you have to check if some of things needing a licence could be done another way, without needing for fork out for that licence (Be that free software or service, third party paid solution, or just covered by a internal school policy).

[psydii]

religiously? no. but best-effort, when I have time, and when I know it wont break things? yeah. 

 

Caveat - many people here have to maintain a mandated security posture which may require a more "religious" approach.

 

That said, when talking with people who have seen many many orgs in this context, they are reasonably impressed that we've done as much as we have. If you have on-prem AD, having your day-to-day workstation, server and domain admin accounts in the Protected Users group, and all web services behind what ever Azure App Proxy is called these days are the big ones.  Azure ATP is also considered a win, particularly if you action the items it puts up on the security score dashboard. Client firewalls also apparently is something of a win though I've been doing that for over a decade so it wasn't an action item on the dashboard.

[pete]

You might get more mileage out of the Zero Trust Assessment docs/tool: 

 

https://techcommunity.microsoft.com/blog/microsoft-security-blog/the-microsoft-zero-trust-assessment-helping-you-operationalize-the-hardening-of-/4468729

 

https://learn.microsoft.com/en-gb/security/zero-trust/assessment/overview

 

Microsoft also sent an email round about migrating some (all?) of the secure score bumpf to Baseline Security mode which does (or shortly will) live at: 

Microsoft 365 admin center > Settings > Org Settings > Security & Privacy > Baseline Security Mode.

 

....until someone at Microsoft needs to rearrange it again to justify their employment.

[Roberto]

I’d suggest using it as a guide- take the time to understand what the items being scored are actually saying and then produce a measured response/ plan of action, rather than blindly chasing a number.

 

microsoft’s gamification of security is all well and good for getting you interested, but make sure you’re not missing something vital in your security posture that isn’t measured by secure score because you’re busy trying to make a number go up.

[JazzFlute]

9 hours ago, Roberto said:

I’d suggest using it as a guide- take the time to understand what the items being scored are actually saying and then produce a measured response/ plan of action, rather than blindly chasing a number.

 

microsoft’s gamification of security is all well and good for getting you interested, but make sure you’re not missing something vital in your security posture that isn’t measured by secure score because you’re busy trying to make a number go up.

 

agree with this as so easy to chase a score to "show" or "prove" to SLT/Heads that you are implementing the right recommendations and keeping your tenant secure as with the cyber security essentials they are now all made aware of they are all of a sudden interested where as I'd be happy if teachers locked there classroom computers when they leave them unattended for starters!

[pete]

6 hours ago, JazzFlute said:

 

where as I'd be happy if teachers locked there classroom computers when they leave them unattended for starters!

 

Dear Headteacher, 

 

I would like a pony for my dept.  I will call them Geoff.  I will hug them and kiss them and feed them only the best carrots.  Geoff and I will spend the summer holidays having marvellous adventures together that I will then use as assembly topics until my nickname among the students is "enumclaw" and there's a safeguarding investigation.*

 

Lots of love from Teacher who didn't lock their computer

 

(left as a draft and then lock the screen)

 

*Do not Google enumclaw on a work device, especially in conjunction with equines.

[psydii]

I've seen worse business cases presented.