Articles, Blog

How the Microsoft Security Score API can help increase your security posture

October 20, 2019


– Thanks, everyone. My name is Zahid Saeed. I am part of the center of
excellence in Microsoft, and today I would like
to talk about Secure API. I tried to fit in this full title here, but that’s how it looks like. So in this session, we
will do a couple of things. What is Secure Score API? And then I have a partner solution, one partner also Istanbul, how they leverage it with their customers. I would like to talk about that. So before that, I talk
about Secure Score API. It’s really important to
know about Secure Score. What is Secure Score? One of my colleague, he did the session in the
morning about Secure Score, but I just wanna give you
a little bit high level what it is, and then I will
talk about the Secure Score API. So in the Secure Score
actually, it gives you a score. It gives a score of the
organization current security, Microsoft security settings. It gives you inside, what
is your score looks like, and what controls have you implemented. By the way, anyone here in the audience, are you, have you seen
the Secure Score before? No. You have seen it, good. So I will give a little
bit demo on that as well. So, what it does, it tells
you what is your score, and how you can enable it better to reach it to a optimum level. But the same time, we wanna make sure that your prog-days are balanced between your productivity and
your security environment. So you are meeting your
security requirements based on your Secure Score. So let’s, give me a
little bit demo on that. And then we will talk
about the Secure Score API. So here, if you look there, so each tenant has a score
associated with that. So right now as you see here, this tenant has a 122
Secure Score out of 365. So what does this mean is that it has certain control enabled, and you can make it more secure. For example here, here is a slider. If you want to make it bigger, it gonna give you score make you better, but the same time, you
have more actions now here. Maybe enable MFA for global admins and all of this kind of stuff. So that’s the Secure
Score at a high level, but as I said, this session
is not about Secure Score. This session is more about the API, that Secure Score leverage, and I will talk about that,
how you can use that API. So going back here, so what’s a Secure Score API? What it does is it exports
the information for your tools within your organization or the workflows. What our Secure Score
has, all the information like what kind of, maybe
tools you have implemented, what alerts, and all the information is. And then it helps you to send it to your SIM kind of environment. That we call mostly SIM. And I will give you, the good thing is, first in this section, I will talk about the API, and the next, I have a
partner from Microsoft who has implemented that, step-by-step, how they leverage it. And if you like to know more
about this, the blog is here. So what does Secure Score API does, it holds the data for 90 days. So within the programming interface, you have integer one to nine. You can pull up the
information from Secure Score whether you need for 30
days, 40 days, or 90 days. So based on that, you can do that. Some of the information,
why to collect this data? It helps you to monitor and
report on your Secure Score in our reporting tools. We talk about that. It also provides you kind of baseline of your security environment
that where it should be, where you feel it has failed. And then it helps you to integrate with your SIM or caspy environment
for the Secure Score API. So the whole idea from the API is that what I will then,
from the Secure Score, pull up data from there, and then visualize all the environment. It is done for multiple customers, because you saw the Secure
Score for one tenant only. But just imagine if you’re a partner, and if you have maybe 400 customers. So you don’t need to go
one-by-one in each tenant and wants to pull up the Secure Score. So you need to find a way that you can pull up all of them together. So let’s talk about that, how it was done. So this is, the MacroNet is
the partner, as I was saying, out of Istanbul. And what they did is, they have these internal user API’s, and here they are using from
Microsoft Azure exchange and all of that. And we have here Secure Score automation. That’s what they come up. So they did a integration
with their CRM system. That’s the whole idea, how you can integrate
with their CRM Solution. So if we go a little bit further, so what it does is this is more kinda MacroNet CRM Solution, the CRM there. And you can easily find a customer there that you find, okay, this
is the number of customers. You wanna search from those customers. And then you say, okay, I
find the name of the customer, and know I want to go to a
dashboard of the customer. So what happens is that customer, from, as a partner, let’s assume you’re managing
500 customers altogether. And you have a dashboard, and where you can see each customer name, and you get that data from there. And here, you have some
licenses, for example, different. The dashboard shows you a
ticket, subscription, licenses, and all that information here. And one thing we have is Secure Score. So this is, everything was
created by the partner, through the coding. So they did it by themself. It’s not like a Microsoft product. So just wanna make sure
that how they leverage it. Yeah, so here it’s talking
about a Secure Score. So, now they want to
automate this Secure Score, and there are two ways for this. One is they can schedule
it for three days, or maybe they wanna run
it after three days, five days, seven days, to
pull up all that information, or they can it run it right away. So they can decide, we
wanna run the information and get the Secure Score
right away for that tenant, particular tenant from the customer. Okay, so let’s go a little bit further. So once the assessment is done, then you can see the Secure Score, which you saw in that tenant. Now when a customer is
away from the partner they say, this is your score. That’s what they are telling
to the customer there. And here, let’s go back a little bit. And then they want to send
this email automatically to the customer that you
have this Secure Score, and what you need to do. As I was saying, the whole idea is to do
the automation in general, and scale the solution from
one customer to 500,000, 1500. So once they have it, results to the customer to send via email. So what happens is the,
this is kind of template. Again, it’s in the Turkish language. Sorry ’bout that. But I put there something
in English there too. So once the customer
receives the notification, they click on show my Secure Score. So they don’t need to go to that site. They have the portal which
they are using already. They just go there, and
look at the Secure Score. So all the customers sign
on to the CRM portal. So now they are switching it. They can use their Microsoft credentials. That’s how they build
up the portal for them. And here, if you see that now the customer is looking at that. They feel like, I have this
score, and this is the trend, which is, you can see
how the Secure Score went from here to there. Now normally, the
customer can also ask you, “Why my score is going up and down? “What’s going on?” So what’s the trend? So in Secure Score, it is
just like our credit report. It’s keep on changing, based
on the things which we do. So if you have implemented maybe MFA, multi-factor authentication, and the new admin came in for that, maybe you have not implemented yet. So your Secure Score will go down. So based on that, you can see the trend. You can talk to them. The other thing they did is gamification. The partner did it. They said, if you will keep
on improving your score, we give you incentive. We give you a discount on your services. So they said, you will
see your credit here. You can use it all the time, any time. So that was another incentive. Very innovative partner,
I would say, in Istanbul, they like to leverage this. So they see their current
Secure Score here, what it is. And it was run on this day. And then they have here, no, again, automation, right? Just imagine how creative they were. From there, they said, if you
wanna activate the feature right now, from here, you can do it. And if you feel it’s more complex, and you want to send me a proposal, so that gives you an option. And then you’d say, we gonna give you… Yeah, they will get that. We talk about this here. So our credits would’ve
benefited and it should be here. Anytime, what I just wanna make sure. The other thing, request proposal. So it might be a little
bit more in their budget. It’s not working for them. Maybe thousands of dollars
they need for this. So they can send a proposal based on whatever the
Secure Score they have. The implementation is there. So they get the proposal. Selects the request for proposal. So it’s all automation by the way. You’re seeing the steps, but it’s automatically
happening on the background. So switching to MacroNet CRM, once they send it, here they see waiting
proposal from the customer. Now the partner account manager
has the visibility on that and seeing what is
happening with my proposal. So once they receive it, then they say, okay, I
have sent proposal out just with one click, they did it. And just, I wanna make sure I have this. And then, this is the information. The quantity is this. I am going you discount. This is kind of template for the proposal, which is going today to the customer. They can accept it right away. If it’s more money, they said,
yes, we wanna give you that. And here, they can, again, see, once they accept the
proposal, are they accepted? No, they will see we added
the licenses for them. Initially, when you saw
there, in the dashboard, there was licenses. There were different, kinda in dashboard there
were different features. So here, they can see, okay
I bought hundred licenses, now they are activated,
and it’s working there. So all of this they did in the automation. And now they can, again, see
their credit, how much it was, going back to Secure Score report. What is the next step? Let’s assume they said,
we want to, we got it, so what’s the next step? Are you guys familiar with the GDPR? So that’s another journey. So they wanna make sure
give customer incentive, and tell them, you don’t know you gonna be more compliant
if your score will be better. So now they are talking about the GDPR. And they also automate this
assessment for the GDPR. So what they did is they
asking different questions. You have advanced set protection, MDM. So all of these steps,
what they have here, it’s enabling them to be
compliant for that GDPR. So they started with a Secure Score, and then they enabled certain features. They automated that. And now here, the next step they are doing is making sure they have
that, the GDPR journey there. So in different steps, they are talking about, first, let’s assess what
is required to be compliant with GDPR within your environment. And the second step they are going is, maybe which product from
Microsoft can help you to be compliant there. And then they are also running
their own frame checks. So again, they have more tools there, if they wanna scan the
customer environment for the GDPR-enabled features
there which are required, and the tools are there. So they ask the questions about
the GDPR from the customer, and based on the answer, they
are providing them a road map. So what features you need
to become more compliant from the Secure Score to the GDPR journey. So how the partner is doing now, all of building this
application, which they did, I would say in the last month. Now the next step for this partner is they are providing me they have about 500 of existing customer where they can run this
automation for the Secure Score, and providing them as a managed services. That’s what they are doing. So they are also getting so many requests from other partners, that can you white label
the service for us? So they have their CRM package, and they are enabling it to make sure they are giving them as a
service to other partner. And the phase three for them is to automate more and more feature. You saw Microsoft released
Security Graph API. So the next step, they are thinking, how they gonna integrate
this API with this. And gives them more visibility on that. So I talk to their developer, who developed all this application. I was in Istanbul, I think a month ago. So I asked them how you use
it, how things were done. So these were the things they said. Which API is being used. Rest API for Secure Score. That, they used authentication method. I have couple of, maybe
links I will share with you that you can review it, if you are interested to automate it, or you are interested to
work with the partner. It could be possible. For the PowerShell, how they
did it, they just start there. And how you can run Secure
Score on behalf of CSP partners. That was another question. They said, if you have multiple customers, how you can do it. So they just start with Azure AD first, and then, they use the API there. Watch the database they are
using as your SQL database, how you visualize the data. So they used Bootstrap command
here to make it happen. And what kind of development methodology they are using there. So we are doing rapid deployments. All of this information I got from them, from the partner, their side. So let me just share with you, one thing here, so at least… So this is the Secure Score API. I have the link in the deck. And here you can see,
if you are interested, of integrating Secure
Score API by yourself. So these are the steps,
one-by-one, that you can use. The different methods if the
customer wants to provide you password and user name, then
you can use this method. The second one, if you
wanna use totally automate, use a web service, you can do that. And then you have all those
steps which are mentioned here. And here is also a demo available, if you are interested on that. And this is step-by-step instruction, if you wanna use a service-to-service, using client credentials
for multiple customers, or if you wanna use, if you wanna have a credentials
from the customer and do it. So that is another possibility. Step-by-step instruction
is available there. So with that, I think
that’s it from my side. And I would love you guys to
fill the survey for the RSA. And now I am open for questions. If there are any questions
about Secure Score API, Secure Score, or anything,
I am happy to answer, and I will also be available
here after this session. Good? Okay. Thank you so much for your time. Thank you.

No Comments

Leave a Reply