Block That Flow – Device Code Flow in Microsoft Entra ID

As you read this, I’m at the Xchange Security Conference in Dallas, and I learned something yesterday that I must share to protect your data. I will need to work with you to block device code flow in Microsoft Entra ID. In simple terms, it’s disabling a code system that’s similar to how you match a code on two devices when signing into Netflix.

Device code flow is typically used to sign into accounts on devices such as smart TVs or IoT devices. You enter the short code displayed on the device into a separate device, such as your smartphone or computer, to complete the authentication process.

It’s super convenient, but it also poses security risks, particularly related to phishing attacks. Attackers can exploit this flow to gain unauthorized access to accounts without needing to steal credentials directly. It’s especially critical to prevent phishing attacks.

Microsoft advises organizations to block device code flow unless absolutely necessary. This should help mitigate the risk of phishing attacks. At the same time, we will need to help you implement conditional access policies to control and restrict the use of device code flow. This includes specifying when and where it can be used.

We can tailor conditional access policies based on factors such as user location, device status, and risk assessments. This allows you to enforce specific security measures that align with your needs and compliance requirements. This approach enhances security by ensuring that only authorized users can access sensitive information.

Some of things we’ll discuss with you are:

  1. Determining which users or groups need specific access controls based on their roles or functions.
  2. Setting conditions based on the factors mentioned above. For example, you might require MFA for users accessing data from untrusted locations.
  3. Choosing the appropriate access controls, such as blocking access, requiring MFA, or enforcing device compliance.
  4. Testing all of your policies in a report-only mode to assess their impact without affecting users.
  5. Continuously monitoring the effectiveness of the policies and make adjustments as necessary based on user feedback and security incidents.

Call us – 973-433-6676 – or email us to discuss how to block the flow and develop access control policies for your specific needs.

Travel Tip for Getting Email

We found a problem – and a solution – for getting your email without interruption while traveling internationally. The problem has to do with various countries’ rules on blocking IP addresses and how they interact with Starlink systems.

The problem came up during our last cruise when Danit couldn’t access her mail. Then I couldn’t get my email, nor could I access my Cloud PC, which I heavily depend on. Naturally, that raised our response level.

The problems are that countries can block IP addresses, which include your email providers’ addresses, for various reasons related to censorship, copyright infringement, and national security. This blocking can prevent access to specific websites or content deemed inappropriate or harmful according to local laws and cultural norms. This can include blocking sites related to unauthorized gambling, child abuse material, or copyright infringement.

IP address blocking can restrict access to specific websites or online content based on geographic location, often leading to unintended consequences such as blocking legitimate services. While it may seem arbitrary, IP address blocking is a strategic measure aimed at enhancing security and managing online behavior. There are ways to work around these blocks, but they require a lot of steps, all based on the specifics of each country. It’s painful for many users.

In addition to local internet providers in all countries, Starlink provides high-speed, reliable internet access in remote or underserved areas where traditional broadband is unavailable or unreliable, such as on a cruise ship or a remote resort. Starlink does not have the capability to block specific IP addresses. Instead, it uses a system of Carrier Grade Network Address Translation (CGNAT) to manage IP addresses.

For customers needing specific connections, Starlink offers an optional public IP configuration. This is available for certain plans, such as Priority, Mobile Priority, and Maritime services. Again, this is a complicated system for most people.

However, all is not lost. We’ve developed a solution: Starlink exception lists tailored to locations and dates. Using AI and some other tools, we can create Starlink exception lists that have IP address exceptions for specific locations and specific dates. The lists can cover itineraries and help you gain access to your email and websites you need while you travel.

To learn more about how this solution can work for you and to set up lists, call us – 973-433-6676 – or email us to discuss your needs and what you’ll need to know to use your list.

Temperatures and Computer Prices Rising More This Summer

Three factors are contributing to this summer’s rise in computer prices: AI, security, and chip shortages. The times call for cool, calculated thinking about the technology you have and what you need.

AI has upped the ante considerably because it’s so necessary for many business applications. AI is also a necessity to run all the security measures needed to combat the increasingly complex technologies used by hackers to get into any system.

The rapid expansion of AI continues to create a significant demand for memory chips, particularly DRAM chips, and that has led to a supply/demand imbalance that still persists. In turn, prices for memory chips have surged, affecting the overall cost of consumer electronics, including computers. Apple had been trying to hold the line on its prices, but it just raised them.

Your bottom line is that a $3,000 price tag for computers is coming. And if you have computers that are more than three years old, they may not cut it. To provide adequate performance for today’s business environment, an AI-ready computer must be able to perform at least 40 trillion operations per second (TOPS) just for basic operations. That jumps to 80 TOPS for more intensive AI tasks and ensures that a computer can handle advanced applications and workloads for next-generation AI software and features.

We can help you navigate the price/performance balance by looking at your computers and your computing needs. Based on how your business or organization uses computers, we can help you determine which units are most in need of performance upgrades and develop a plan to redeploy your units. This can maximize the efficiency of your total complement of computers while – hopefully – reducing the number of new units you need to purchase. We can combine our assessment with a security audit to shore up weaknesses in your system.

Call us – 973-433-6676 – or email us to set up an appointment to discuss your needs and options, including a plan for the next few years to help your long-term budgeting.