Advice Request Would there be interest in a NIST security template for Microsoft 365?

[Stenographers]

Working through NIST compliance on my personal 365 tenant for practice. Once I get it up to snuff, I'm thinking I'll use Microsoft 365 Desired State Configuration powershell to make some templates people can apply to their own Microsoft tenants to accelerate their compliance journey. Would there be any interest on this forum for that once I have it done?

 

[Andrezj]

To run, DSC requires PowerShell remoting to be enabled. Not the safest configuration. A "stop-gap" counter-measure might be to block the WSMan service port(s).

There are already DSC templates for security on GitHub, plus online discussions:

posh-dsc-windows-hardening/CIS_Windows10_v181.ps1 at master · NVISOsecurity/posh-dsc-windows-hardening

Windows OS Hardening with PowerShell DSC . Contribute to NVISOsecurity/posh-dsc-windows-hardening development by creating an account on GitHub.

github.com

Windows Server Hardening with PowerShell DSC

Operating system hardening is the process of improving the security of a default OS installation to minimize the attack surface that can be exploited by an attacker. But doing this manually on each…

blog.nviso.eu

 

[Malleable]

Working through NIST compliance on my personal 365 tenant for practice. Once I get it up to snuff, I'm thinking I'll use Microsoft 365 Desired State Configuration powershell to make some templates people can apply to their own Microsoft tenants to accelerate their compliance journey. Would there be any interest on this forum for that once I have it done?

Is this in a controlled unclassified information setting? Just curious.

 

[Stenographers]

Is this in a controlled unclassified information setting? Just curious.

Yes, that is correct. Although I don't actually have any controlled information on this tenant. It is just my personal one, not a tenant in production somewhere.

 

[Stenographers]

To run, DSC requires PowerShell remoting to be enabled. Not the safest configuration. A "stop-gap" counter-measure might be to block the WSMan service port(s).

There are already DSC templates for security on GitHub, plus online discussions:

posh-dsc-windows-hardening/CIS_Windows10_v181.ps1 at master · NVISOsecurity/posh-dsc-windows-hardening

Windows OS Hardening with PowerShell DSC . Contribute to NVISOsecurity/posh-dsc-windows-hardening development by creating an account on GitHub.

github.com

Windows Server Hardening with PowerShell DSC

Operating system hardening is the process of improving the security of a default OS installation to minimize the attack surface that can be exploited by an attacker. But doing this manually on each…

blog.nviso.eu

So this is actually different than Powershell DSC. This is DSC for Microsoft 365, configuring things like conditional access and Exchange online transport rules for example. It isn't something that would be ran against a Windows server and doesn't require any PS remoting of any machines.

 

[Andrezj]

So this is actually different than Powershell DSC. This is DSC for Microsoft 365, configuring things like conditional access and Exchange online transport rules for example. It isn't something that would be ran against a Windows server and doesn't require any PS remoting of any machines.

Microsoft365 DSC runs "on top" of DSC for Windows; there are not separate versions of the underlying DSC. All DSC modules run on DSC for Windows. For DSC to run, PowerShell remoting must be enabled.

Get started with Desired State Configuration (DSC) for Windows - PowerShell

This topic explains how to get started using PowerShell Desired State Configuration (DSC) for Windows.

learn.microsoft.com

"

• Microsoft365DSC provides automation for the deployment, configuration, and monitoring of Microsoft 365 tenants via PowerShell DSC.

"

Manage Microsoft 365 Tenant Configuration with Azure DevOps - Azure Architecture Center

Find out how to use Microsoft365DSC and Azure DevOps to manage changes that service administrators make to Microsoft 365 tenant configurations.

learn.microsoft.com