#Microsoft Entra Private Access

[richardmhicks]

Microsoft Entra Global Secure Access

Last week Microsoft introduced new Security Service Edge (SSE) capabilities as part of the Microsoft Entra suite of technologies. Included in these announcements, Microsoft introduced the public preview of two new secure remote access technologies – Microsoft Entra Internet Access and Microsoft Entra Private Access. The latter of these will particularly interest Microsoft Always On VPN…

[systemtek]

What is Windows Hello for Business [RESOLVED]

Windows Hello is an advanced authentication technology designed to enable users to access their Windows devices using biometric data or a PIN, eliminating the reliance on conventional passwords. This system offers heightened security through resilient two-factor authentication, resistant to phishing attempts, and includes built-in safeguards against brute force attacks. Additionally, Windows Hello supports FIDO/WebAuthn, allowing users to utilize it for signing in to compatible websites, streamlining the management of multiple complex passwords. Windows Hello for Business serves as an expansion of Windows Hello, catering specifically to enterprise needs by delivering top-tier security and management features. This includes device attestation, certificate-based authentication, and the implementation of conditional access policies. Organizations can deploy policy settings to devices, ensuring they adhere to security standards and compliance requirements. Windows Hello for Business offers a multitude of advantages, including: - Enhanced Protection Against Credential Theft: - Significantly strengthens defenses against credential theft by requiring both the device and the corresponding biometric data or PIN for access. This dual-factor authentication approach increases the difficulty for unauthorized access without the user's awareness. - Phishing and Brute Force Attack Mitigation: - Eliminates vulnerabilities associated with passwords, effectively thwarting phishing and brute force attacks. By utilizing asymmetric credentials generated within the secure confines of Trusted Platform Modules (TPMs), it successfully prevents server breaches and replay attacks. - Simple and Convenient Authentication: - Provides users with a straightforward and convenient authentication method, reinforced by a PIN. This method is not only easily accessible but also secure, as Windows Hello incorporates built-in protection against brute force attempts, and the PIN never leaves the user's device. - Loss Prevention and Device Flexibility: - Ensures users always have access to a secure authentication method (PIN) without the risk of losing physical items like traditional tokens or cards. Moreover, the addition of biometric devices can be seamlessly integrated into a coordinated deployment or allocated to specific users based on organizational needs. Windows Hello for Business employs a robust two-factor authentication mechanism, merging a device-specific credential with a biometric or PIN gesture. This credential is intricately linked to your identity provider, such as Microsoft Entra ID or Active Directory, granting access to organizational applications, websites, and services. During the initial user provisioning phase, Windows Hello conducts a two-step verification process. Subsequently, the user configures Windows Hello on their device, selecting a gesture—either a biometric or a PIN. The user then provides this chosen gesture to validate their identity, and Windows utilizes Windows Hello to authenticate the user. Recognized as two-factor authentication, Windows Hello for Business aligns with the authentication factors of something you have, something you know, and something that's part of you. It encompasses two of these factors: something you have (the user's private key safeguarded by the device's security module) and something you know (your PIN). With compatible hardware, the user experience can be further enhanced by integrating biometrics. By leveraging biometrics, the authentication factor of something you know can be replaced by the factor of something that is part of you, with the added assurance that users can revert to the familiarity of the something you know factor if needed. Biometric Authentication with Windows Hello Windows Hello offers a robust and seamlessly integrated biometric authentication system, leveraging facial recognition or fingerprint matching for secure sign-ins. Employing specialized infrared (IR) cameras and sophisticated software, Windows Hello enhances accuracy while safeguarding against spoofing attempts. Leading hardware manufacturers now ship devices equipped with integrated cameras and fingerprint readers compatible with Windows Hello. On Windows Hello-enabled devices, a simple biometric gesture grants access to users' credentials through: - Facial Recognition: - Utilizes special cameras capable of infrared (IR) vision to distinguish between photographs or scans and live individuals reliably. Various vendors provide external cameras featuring this technology, while numerous laptop manufacturers integrate it into their devices. - Fingerprint Recognition: - Employs a capacitive fingerprint sensor to scan fingerprints, whether integrated into laptops, external devices, or USB keyboards. Most existing fingerprint readers, whether external or integrated, seamlessly work with Windows. - Iris Recognition: - Introduces a scan of the iris using cameras, with HoloLens 2 being the pioneering Microsoft device to incorporate an Iris scanner. Windows securely stores biometric data exclusively on the local device, ensuring that it does not roam or transmit to external servers. This localized storage approach prevents the creation of a single vulnerable point that attackers could exploit to pilfer biometric data. With Windows Hello, the biometric identification data remains confined to the device, offering a robust defense against unauthorized access. Further information https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/ Read the full article

[richardmhicks]

Microsoft Ignite 2024

The Microsoft Ignite conference will be held November 19-22, 2024, at the McCormick Place Conference Center in Chicago, IL. Ignite is the premier Microsoft event of the year and will be packed with many announcements about new products and technologies. Ignite is also a fantastic learning event with experts worldwide in attendance. Meet Up I’m excited to announce that Microsoft has invited me…

[richardmhicks]

Microsoft Security Service Edge Now Generally Available

A few weeks ago, Microsoft announced the general availability of its Security Service Edge (SSE) offering, Global Secure Access (GSA). GSA encompasses Entra Internet Access, a cloud-based Secure Web Gateway, and Entra Private Access, a Zero Trust Network Access (ZTNA) solution for accessing private data and applications on-premises. ZTNA vs. VPN Entra Private Access will be a compelling…

[richardmhicks]

Microsoft DirectAccess Formally Deprecated

Today, Microsoft has announced the formal deprecation of DirectAccess. Microsoft DirectAccess is a widely deployed enterprise secure remote access solution that provides seamless, transparent, always-on remote network connectivity for managed (domain-joined) Windows clients. First introduced in Windows Server 2008 R2, it’s been a popular solution with many advantages over ordinary VPN…

[richardmhicks]

Microsoft Entra Security Service Edge (SSE) on RunAs Radio

I recently had the opportunity to join my good friend Richard Campbell on the RunAs Radio podcast. During this episode, we discussed the new Microsoft Entra Security Service Edge (SSE). This new service offering includes Entra Internet Access, a cloud-based secure web gateway, and Entra Private Access, an identity-centric zero-trust network access (ZTNA) solution. Entra Private Access is in…