Thomas Schmidt
🏢 TDC Erhverv🇩🇰 Denmark
Tests authored
- ORCA.108.1DNS Records have been set up to support DKIM.
- ORCA.118.1Domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
- ORCA.118.2Domains are not being allow listed in an unsafe manner in Transport Rules.
- ORCA.118.3Your own domains are not being allow listed in an unsafe manner in Anti-Spam Policies.
- ORCA.118.4Your own domains are not being allow listed in an unsafe manner in Transport Rules.
- ORCA.120.1Zero Hour Autopurge Enabled for Phish.
- ORCA.120.2Zero Hour Autopurge Enabled for Malware.
- ORCA.120.3Zero Hour Autopurge Enabled for Spam.
- ORCA.189.2Safe Links is not bypassed.
- ORCA.233.1Domains are pointed directly at EOP or enhanced filtering is configured on all default connectors.
Also contributed to
- CIS.M365.1.2.1(L2) Ensure that only organizationally managed/approved public groups exist
- CIS.M365.1.2.2(L1) Ensure sign-in to shared mailboxes is blocked
- CIS.M365.2.1.3(L1) Ensure notifications for internal users sending malware is Enabled
- CIS.M365.2.1.4(L2) Ensure the highest-priority Safe Attachments policy is enabled
- CIS.M365.2.1.6(L1) Ensure Exchange Online Spam Policies are set to notify administrators
- CIS.M365.2.1.7(L1) Ensure that an anti-phishing policy has been created
- CIS.M365.3.1.1(L1) Ensure Microsoft 365 audit log search is Enabled
- CISA.MS.AAD.3.3If Microsoft Authenticator is enabled, it SHALL be configured to show login context information.
- CISA.MS.AAD.7.1A minimum of two users and a maximum of eight users SHALL be provisioned with the Global Administrator role.
- CISA.MS.AAD.7.2Privileged users SHALL be provisioned with finer-grained roles instead of Global Administrator.
- CISA.MS.AAD.7.3Privileged users SHALL be provisioned cloud-only accounts separate from an on-premises directory or other federated identity providers.
- CISA.MS.EXO.8.1A DLP solution SHALL be used.
- CISA.MS.EXO.8.2The DLP solution SHALL protect personally identifiable information (PII) and sensitive information, as defined by the agency.
- CISA.MS.EXO.9.4Alternatively chosen filtering solutions SHOULD offer services comparable to Microsoft Defender's Common Attachment Filter.
- CISA.MS.EXO.14.1A spam filter SHALL be enabled.
- CISA.MS.EXO.14.2Spam and high confidence spam SHALL be moved to either the junk email folder or the quarantine folder.
- CISA.MS.EXO.14.3Allowed domains SHALL NOT be added to inbound anti-spam protection policies.
- CISA.MS.EXO.14.4If a third-party party filtering solution is used, the solution SHOULD offer services comparable to the native spam filtering offered by Microsoft.
- CISA.MS.EXO.15.1URL comparison with a block-list SHOULD be enabled.
- CISA.MS.EXO.15.2Direct download links SHOULD be scanned for malware.
- CISA.MS.EXO.15.3User click tracking SHOULD be enabled.
- CISA.MS.EXO.16.1Alerts SHALL be enabled.
- CISA.MS.EXO.16.2Alerts SHOULD be sent to a monitored address or incorporated into a security information and event management (SIEM) system.
- CISA.MS.EXO.17.3Audit logs SHALL be maintained for at least the minimum duration dictated by OMB M-21-31 (Appendix C).
- MT.1005All Conditional Access policies are configured to exclude at least one emergency/break glass account or group.
- MT.1008At least one Conditional Access policy is configured to require MFA for Azure management.
- MT.1019At least one Conditional Access policy is configured to enable application enforced restrictions.
- MT.1024Entra recommendations should be completed.
- MT.1025No external user with permanent role assignment on Control Plane.
- MT.1026No hybrid user with permanent role assignment on Control Plane.
- MT.1027No Service Principal with Client Secret and permanent role assignment on Control Plane.
- MT.1028No user with mailbox and permanent role assignment on Control Plane.
- MT.1029Stale accounts are not assigned to privileged roles.
- MT.1030Eligible role assignments on Control Plane are in use by administrators.
- MT.1031Privileged role on Control Plane are managed by PIM only.
- MT.1032Limited number of Global Admins are assigned.
- MT.1035All security groups assigned to Conditional Access Policies should be protected by RMAU.
- MT.1036All excluded objects should have a fallback include in another policy.
- MT.1038Conditional Access policies should not include or exclude deleted groups.
- MT.1052At least one Conditional Access policy is targeting the Device Code authentication flow.
- MT.1058Exchange application access policies must be configured.
- MT.1059Microsoft Defender for Identity health issues should be resolved
- MT.1061Device registration MFA control conflicts with Conditional Access policies.