Block That Flow – Device Code Flow in Microsoft Entra ID

As you read this, I’m at the Xchange Security Conference in Dallas, and I learned something yesterday that I must share to protect your data. I will need to work with you to block device code flow in Microsoft Entra ID. In simple terms, it’s disabling a code system that’s similar to how you match a code on two devices when signing into Netflix.

Device code flow is typically used to sign into accounts on devices such as smart TVs or IoT devices. You enter the short code displayed on the device into a separate device, such as your smartphone or computer, to complete the authentication process.

It’s super convenient, but it also poses security risks, particularly related to phishing attacks. Attackers can exploit this flow to gain unauthorized access to accounts without needing to steal credentials directly. It’s especially critical to prevent phishing attacks.

Microsoft advises organizations to block device code flow unless absolutely necessary. This should help mitigate the risk of phishing attacks. At the same time, we will need to help you implement conditional access policies to control and restrict the use of device code flow. This includes specifying when and where it can be used.

We can tailor conditional access policies based on factors such as user location, device status, and risk assessments. This allows you to enforce specific security measures that align with your needs and compliance requirements. This approach enhances security by ensuring that only authorized users can access sensitive information.

Some of things we’ll discuss with you are:

  1. Determining which users or groups need specific access controls based on their roles or functions.
  2. Setting conditions based on the factors mentioned above. For example, you might require MFA for users accessing data from untrusted locations.
  3. Choosing the appropriate access controls, such as blocking access, requiring MFA, or enforcing device compliance.
  4. Testing all of your policies in a report-only mode to assess their impact without affecting users.
  5. Continuously monitoring the effectiveness of the policies and make adjustments as necessary based on user feedback and security incidents.

Call us – 973-433-6676 – or email us to discuss how to block the flow and develop access control policies for your specific needs.

Travel Tip for Getting Email

We found a problem – and a solution – for getting your email without interruption while traveling internationally. The problem has to do with various countries’ rules on blocking IP addresses and how they interact with Starlink systems.

The problem came up during our last cruise when Danit couldn’t access her mail. Then I couldn’t get my email, nor could I access my Cloud PC, which I heavily depend on. Naturally, that raised our response level.

The problems are that countries can block IP addresses, which include your email providers’ addresses, for various reasons related to censorship, copyright infringement, and national security. This blocking can prevent access to specific websites or content deemed inappropriate or harmful according to local laws and cultural norms. This can include blocking sites related to unauthorized gambling, child abuse material, or copyright infringement.

IP address blocking can restrict access to specific websites or online content based on geographic location, often leading to unintended consequences such as blocking legitimate services. While it may seem arbitrary, IP address blocking is a strategic measure aimed at enhancing security and managing online behavior. There are ways to work around these blocks, but they require a lot of steps, all based on the specifics of each country. It’s painful for many users.

In addition to local internet providers in all countries, Starlink provides high-speed, reliable internet access in remote or underserved areas where traditional broadband is unavailable or unreliable, such as on a cruise ship or a remote resort. Starlink does not have the capability to block specific IP addresses. Instead, it uses a system of Carrier Grade Network Address Translation (CGNAT) to manage IP addresses.

For customers needing specific connections, Starlink offers an optional public IP configuration. This is available for certain plans, such as Priority, Mobile Priority, and Maritime services. Again, this is a complicated system for most people.

However, all is not lost. We’ve developed a solution: Starlink exception lists tailored to locations and dates. Using AI and some other tools, we can create Starlink exception lists that have IP address exceptions for specific locations and specific dates. The lists can cover itineraries and help you gain access to your email and websites you need while you travel.

To learn more about how this solution can work for you and to set up lists, call us – 973-433-6676 – or email us to discuss your needs and what you’ll need to know to use your list.

Temperatures and Computer Prices Rising More This Summer

Three factors are contributing to this summer’s rise in computer prices: AI, security, and chip shortages. The times call for cool, calculated thinking about the technology you have and what you need.

AI has upped the ante considerably because it’s so necessary for many business applications. AI is also a necessity to run all the security measures needed to combat the increasingly complex technologies used by hackers to get into any system.

The rapid expansion of AI continues to create a significant demand for memory chips, particularly DRAM chips, and that has led to a supply/demand imbalance that still persists. In turn, prices for memory chips have surged, affecting the overall cost of consumer electronics, including computers. Apple had been trying to hold the line on its prices, but it just raised them.

Your bottom line is that a $3,000 price tag for computers is coming. And if you have computers that are more than three years old, they may not cut it. To provide adequate performance for today’s business environment, an AI-ready computer must be able to perform at least 40 trillion operations per second (TOPS) just for basic operations. That jumps to 80 TOPS for more intensive AI tasks and ensures that a computer can handle advanced applications and workloads for next-generation AI software and features.

We can help you navigate the price/performance balance by looking at your computers and your computing needs. Based on how your business or organization uses computers, we can help you determine which units are most in need of performance upgrades and develop a plan to redeploy your units. This can maximize the efficiency of your total complement of computers while – hopefully – reducing the number of new units you need to purchase. We can combine our assessment with a security audit to shore up weaknesses in your system.

Call us – 973-433-6676 – or email us to set up an appointment to discuss your needs and options, including a plan for the next few years to help your long-term budgeting.

Take Your Seat

I save every client email because when you contact me with a problem, I can see what related problems you’ve had and find a solution faster. I have good rules to file every email, but there are still lots and lots of messages to manage. I’m not a programmer, but I developed a routine using Copilot to make my email searches more efficient.

Admittedly, it took some doing to develop my system, and it took some refining to get it to where I wanted it to be. The key for me – and for just about all users – was knowing the right questions to ask Copilot to get the desired outcome.

I use Outlook just like most of you to manage my email, and I need to manage my messages across several email addresses and services, such as my own domain and providers such as Gmail. Outlook can search every email address you have, but it doesn’t always show you every message – which means the message you need is hiding somewhere.

Using the AI power of Copilot, I was able to write a routine to handle detailed email searches meeting numerous criteria. The beauty of AI is that I could write them in English, not code, and get answers back in English. That helped me refine my search instructions by asking Copilot more questions.

However, there are two caveats.

The first caveat is that you need to understand how computer programming works (just like you understand how your car works but don’t necessarily know how to fix it). Computers are extremely anal, so you must ask exact questions. AI doesn’t do a good job – yet – of reading your mind. If you’re too general, you’ll get vague answers.

In my case, I had to use a combination of AI and some manual steps before being able to tell the software how I wanted my email stored and how to develop new routines for storage going forward. I have been able to cut my search time dramatically to provide you with better service.

The second caveat is that you need to invest in a license (or seat in tech jargon), to get the most out of Copilot – or just about any AI engine. The free versions just have the power to create the routines that can really make a difference. Licensing can run $20 to $30 per seat, so you need to know who in your organization needs the capability of Copilot and has the ability to use it.

Going in, you can be assured that Microsoft is aware of your privacy concerns and doesn’t use your data to train its AI models. Microsoft 365 Copilot complies with privacy regulations such as the General Data Protection Regulation (GDPR), and security measures are in place regardless of whether you have a Pro license.

We can help you with the entire Copilot process. Call us – 973-433-6676 – or email us to discuss what you need Copilot to do, writing instructions for Copilot, determining the number of seats you’ll need and training the people who will occupy those seats.

Cameras, Audio and NVRs

Businesses and homeowners are turning to the latest video and sound recording systems to improve their security systems. But as news reports show, even the most sophisticated systems can be defeated by knocking them off Wi-Fi networks. You can regain your edge by putting your cameras and sound recording devices on an NVR – network video recorder – system.

An NVR is a specialized computer system designed to record video from IP cameras over a network. It serves as a central hub for video surveillance, enabling storage and remote viewing of footage. Because it works on a hard-wired ethernet network instead of Wi-Fi, you can harden your system security and still have it work across multiple networks and any devices that can access the internet.

What we like about NVRs is that they avoid Wi-Fi networks, which can be the weakest links in any communications/security system. As long as there is power to the hub – to which cameras and microphones are connected – your system remains fully functional.

A number of security systems use DVRs to record, process and save collected images. NVRs offer several key advantages:

  • They handle video that is already encoded by the cameras, which allows for efficient storage and management. Video quality is up to 4K.
  • Video can be recorded to various storage devices, including hard drives, USB flash drives, and memory cards.
  • Users can access recorded footage remotely via smartphones or PCs, enhancing surveillance capabilities and use features such as video analytics, motion detection, and remote configuration.
  • Power over Ethernet (PoE) can simplify installation by providing power and data through a single cable.
  • They continue to record images even if your internet service goes out.

When you add it all up, NVRs are increasingly preferable to DVRs for modern surveillance systems because of their efficiency, scalability, and advanced capabilities. However, installing and configuring an NVR is not a DIY project. Hardware installation requires a trained professional, and an IT specialist can configure your system based on your needs and your tech setup.

We can help you decide if an NVR is right for you, help you select a system that meets your needs, recommend an installer and then configure your system for maximum effectiveness. Call us – 973-433-6676 – or email us to learn more about NVR technology and schedule an appointment to get into the specifics of your needs.

Know Your Dongle Specs

Dongles are a fact of life. We want smaller, lighter-weight computers, especially when we travel, but we don’t want to sacrifice capability. Plugging a dongle with multiple ports into our device can increase the number of tools we can use but not knowing how the ports are labeled can cost you efficiency.

One of the biggest inefficiencies of dongle use is that we don’t plug our power connection into the proper port. That means we run on battery power more than we want and waste the connection on something else, such as a thumb drive or external hard drive.

You can improve your life considerably if you plug the USB part of your power adapter into the power delivery port on your dongle. It’s usual indicated by a “bolt” symbol. That’s the simple part.

The more complicated part is that no two dongles are created equal. There are differences in how a hub manages and shares bandwidth between devices connected to it matters. You may have noticed that MacBooks and some Windows laptops that clone the MacBook design have two USB-C ports next to each other. Some dongle manufacturers take advantage of that by selling a hub that connects to both ports at once, and so it can share the bandwidth of both ports around.

It’s common for these hub devices to have a single upstream USB controller that handles bandwidth allocation between devices. If you have a USB 3.1 dongle – or hub – and have a faster USB 4 plug and device plugged into the dongle, you’ll only get the slower performance speed. It’s just like feeding a fire hydrant connection into a garden hose. The best solution is to get a dongle that matches your fastest port, such as a Thunderbolt dongle for a Thunderbolt port. Thunderbolt is a brand name for high-powered USB systems.

If you have a fast portable hard drive to connect to your computer or other device, the same principles apply. You need a dongle or hub that matches the speed of your device and the drive.

We can help you make sure your computers and devices are matched with a compatible dongle. Call us – 973-433-6676 – or email us with your computer’s specifications or the make and model of your computer. We can look at the specs and help you match up a suitable dongle. Don’t let it dangle.

ZTNA: Your Security Escort Service

So, here’s the problem that starts at your firewall: Your security setup grants permission to a credentialed user to access your system. The credentials have been authenticated by several methods, and the user is free to move about your apps and files. It’s an everyday occurrence with our mobile, hybrid work systems. But what happens when someone either fools your authentication system or decides to go rogue? ZTNA gives you the ability to follow every user everywhere in your system.

ZTNA stands for Zero Trust Network Access, and it’s based on the premise that you can’t trust any user with unfettered access to your entire system. The rationale for a business to use ZTNA goes back to a security breach at Target more than 12 years ago, when the personal and credit card information for some 40 million customers was compromised. It’s become a classic case study for cybersecurity.

In short, hackers exploited a vulnerability in the system of a third-party contractor, a mechanical engineering firm. Using stolen credentials, the attackers gained access to Target’s systems, where they deployed malware on the company’s point-of-sale (POS) devices. This allowed them to capture sensitive customer information without being detected for several weeks.

Granted, firewall security systems have become much stronger over time, but for most of them, you can access any part of a system once you get past the firewall. ZTNA technology never stops tracking any user as long as they’re inside the network.

  • It grants access only to specific applications and files based on system admin’s determination of each user’s need to know.
  • It assumes every access attempt is risky (zero trust).
  • It continuously monitors a user’s activity and verifies it.

In operation, ZTNA sets up one-to-one connections between users and the resources they need. It’s similar to two people who need to contact each other by exchanging phone numbers. But unlike two people exchanging numbers, ZTNA connections need to be re-verified and recreated periodically.

The technology is also device-based, which is critical in our hybrid work world of BYOD (Bring Your Own Device). ZTNA can incorporate the risk and security posture of devices as factors in access decisions. It does this by running software on the device itself (sort of like a license plate reader) or by analyzing network traffic to and from the device.

While there are variations of ZTNA technology, the bottom line is that the protection of your data – and your clients’ and customers’ data – is priceless. This is where we can help. Call us – 973-433-6676 – or email us to talk about your security needs, your workforce’s access needs and your administrative needs.

Standard or Premium? The Answer to the Question

Microsoft 365 is the app suite of choice for businesses, governmental agencies and institutions all over the world. It comes in two versions: Business Standard and Business Premium. The cost difference is $10 to $15 per month per user, which can be significant for larger organizations. Here’s why we think it’s a good investment: SECURITY.

The Premium version has four security features that the Standard version does not:

  • Microsoft Defender for Business provides advanced threat protection, helping to safeguard against malware and phishing attacks.
  • Intune for Device Management allows organizations to manage and secure devices, ensuring that only compliant devices can access company resources.
  • Azure AD Premium with Conditional Access offers granular access controls based on user identity and device compliance, enhancing security for sensitive data.
  • Advanced Compliance Tools include data loss prevention and message encryption, which help protect sensitive information and ensure compliance with regulations.

Premium is recommended for businesses or organizations with up to 300 users that require enhanced security and device management for:

  • Protecting sensitive data against threats like ransomware and phishing
  • Managing devices, especially for remote work
  • Compliance with regulations

Microsoft 365 Business Premium incorporates some principles of Zero Trust Network Access (ZTNA) such as identity verification to control access to applications and resources and continuous verification to verify user identities and device compliance before granting access.

If you have Microsoft 365 Business Premium deployed in your organization, you can always scale up to a full ZTNA program. You and the people in your organization will already be familiar with its principles, and that should ease the migration.

If you’re thinking about moving more of your technology to the cloud or if you want to strengthen your security with measures such as access control and device management, you should talk to us about moving up to Microsoft 365 Business Premium. We can configure it to meet the needs of your organization. Call us – 973-433-6676 – or email us to set up a conference.

Mac’s New ‘Mini’ is the Max

In our opinion, the new MacBook Neo punches so far above its weight for what’s considered an entry-level computer that it’s a real heavyweight for road-warrior business users.

As we wrote this issue of Technology Update, our Neo was on order, and we’re looking forward to getting it with great anticipation. We believe it will be the best device for making the most efficient use of Microsoft Cloud PC, and it will be highly cost-efficient, too.

Costing $599 to $699, it’s a full computer with the size advantages of a tablet – like the iPad – with a built-in keyboard and a high-resolution screen – 13-inch Liquid Retina with 2408 × 1506 resolution. Its A18 Pro chip is capable of handling everyday tasks such as web browsing, document creation, and media consumption. It is not intended for heavy workloads like professional video editing or gaming. Instead, it should be ideal for getting on the internet to access your apps and files and get to work.

The laptop includes:

  • Two USB-C ports (one supporting DisplayPort)
  • A headphone jack
  • Wi-Fi 6E and Bluetooth 6 for wireless connectivity

It comes with 8 GB of RAM and either 256 GB or 512 GB of storage. Both specs are above the entry levels for an iPad 11. It weighs 2.7 pounds and has a battery life of 16 hours. While it does weigh more than an iPad, the weight difference can get wiped out if you have a thick case and need to carry an external keyboard and mouse to try to emulate a computer.

The iPad’s high-resolution touchscreen and lighter weight may be better suited to those who don’t need full computer capabilities. But the Neo can run the full Microsoft 365 applications, and for me, at least, that’s the big winning factor. I was on the fence about it, but in talking with colleagues at various conferences, I was convinced to give it a shot.

We’ll have more about it once I have an opportunity to put it through its paces. In the meantime, we’re happy to talk to you about it and deploying it so that the Mac and Windows operating systems are in sync. Call us – 973-433-6676 – or email us to start the conversation.

COVID and the iPhone 6

We’re still feeling the effects of the COVID-19 pandemic six years ago in many aspects of our lives. When it came to technology, lots of businesses made huge investments to accommodate remote workplaces. If you haven’t made any investments in your technology since then, it’s like using an iPhone 6, which was released in 2014.

What’s the connection? It’s the speed of change. The iPhone 6 debuted 12 years ago. Think about how the performance of your current iPhone compares to an iPhone 6 – or any single-digit model. Remember, we’re up to iPhone 17.

Now, think about all the equipment you bought six years ago to meet the computing needs brought on by the COVID19 pandemic. In half the time that it took the “revolutionary” iPhone 6 to become a benchmark for obsolescence, your COVID-era technology is now obsolete.

Windows-based computing has advanced in four key areas since 2020, starting with the introduction of Windows 11 in 2021. It featured a new interface for improved windows management and productivity features such as Snap Layouts and virtual desktops to help you organize your workspace better.

But the big stuff was under the hood.

Windows 11 includes several security features like Microsoft Defender Antivirus, Trusted Platform Module (TPM) 2.0, and passwordless authentication options such as Windows Hello and Passkeys to protect against cyber threats. Administrator Protection is a new feature that adds an extra layer of security by requiring Windows Hello authentication for admin tasks, reducing the risk of unauthorized system changes.

Windows 11 also brought Microsoft Copilot: An embedded AI-powered tool to help with tasks like summarizing documents, drafting emails, and managing system settings. It also made possible Smart App Control that predicts which applications are safe to run, enhancing security. It was also much faster, making it better able to handle all the tasks we require for complex computing and cloud technology.

For today’s typical business needs, the minimum required specs for a Windows-based computer include an Intel 8th Generation or AMD Ryzen 3000 series processor, 16GB of RAM, and a 256GB SSD. It’s also essential to have the Windows 11 operating system to meet ever-evolving cybersecurity measures and the speed requirements to use cloud-computing effectively. In addition, Microsoft has ended support for Windows 10, and that system will no longer get security updates and bug fixes. Eventually, too, better-performing application software won’t work with it.

We can help you get your hardware up to date. Call us – 973-433-6676 – or email us for an audit.