Posts

Can’t wait to integrate ChatGPT into your business processes? …actually, here’s exactly why you should wait!

ChatGPT for business

You can’t escape it. It’s all over the news and social media about this sudden wave of improvements in LLM (Large Language Models) or as most people know them at the moment Chat-GPT! 

Every large tech firm is rushing to integrate these technologies into their products with Microsoft launching co-pilot and Bing with Chat-GPT integration. Google is launching AI lead improvements to Workspace and Facebook accidentally leaked the source code to their LLM. 🤦‍♂️

With all of this going on you would expect that these products are at least secure and pose no risk to the users, businesses or the general public. And while I am wholly in favour of improvement to AI and ML, we must consider the risks these LLM pose as they begin to become part of everyday life. 

What are you talking about?

I should start by covering what an LLM is. Well in the words of Nvidia “A large language model, or LLM, is a deep learning algorithm that can recognise, summarise, translate, predict and generate text and other content based on knowledge gained from massive datasets.” To most of us what this means is that a system can take input in human language, not machine code or programming language and can then complete these instructions. Now, this can be as simple as how do you bake a cake. Or you can ask it to write an application that will convert files to pdf and upload them to an FTP server based on the IP address x.x.x.x and write an output file for me to show completion, in C++. The LLM will then go away, compute the question against the information it has been “taught” and will then come back with an answer.

chatgpt plus

 There are a few things we should all be aware of with LLMs as they stand today, these limitations are present but not always obvious. 

  • LLMs are driven by the dataset they have and may have complete blind spots to events if they occur post the data set provided, i.e Chat GPT (GPT-3) is based on a data set from 2021. So if you ask it about the F1 teams for 2023, it will either throw an error or will simply give you information it “generates” from the information it has been fed.
  • LLMs can therefore “hallucinate” facts and give you a completely incorrect answer if it doesn’t know the facts or if the algorithm works itself into a situation where it believes it has the right information.
  • LLMs are power-hungry. They need huge amounts of computing power and data to train and operate the systems.
  • LLMs can be very biased and can often be tricked into providing answers by using leading questions making them unreliable.
  • The largest risk is that they can be coxed into creating toxic content and are prone to injections actions.

Therefore the biggest question remains what is the risk of introducing an LLM into your business workflow? 

With the way that LLMs work they learn from data sets. Therefore, the potential risk is that your business data inside applications like Outlook, Word, Teams or Google Workspace is being used to help develop the LLM and you don’t have direct control over where the data goes. Now, this is bound to be addressed over time but these companies will 100% need access to your data to move these models forward so limiting its scope will have an impact on how they develop and grow. Microsoft and Google will want to get as much data as possible. 

As such you need to be careful to read the Terms of Use and Privacy Policy of any LLM you use. 

Other Risks

This one is scary, and it increases as more organisations introduce LLMs into the core workflow, is that queries stored online may be hacked, leaked, stolen or more likely accidentally made publicly accessible. Because of this, there is a huge risk of exposing potentially user-identifiable information or business-related information. 

We should be aware of the misuses risk that also comes from LLM with the chance they will be used to generate more convincing phishing emails, or even teach attackers better ways to convince users to enter into risky behaviour. 

openai

The final risk that we should be aware of is that the operator of the LLM is later acquired by a company that may be a direct rival to yours, or by an organisation with a different approach to privacy than when you signed up for the platform and therefore puts your business at risk. 

As such the NCSC recommends

  • not to include sensitive information in queries to public LLMs
  • not to submit queries to public LLMs that would lead to issues were they made public

At this point, Planet IT’s recommendation is not to integrate the new features from Microsoft and Google into your business workflow. Certainly not until proper security and data controls have been implemented by these companies and the risk of your business data being used as sample material to teach the LLMs is fully understood. These are emerging technologies, and as we continue to see change at Planet IT we are monitoring everything very carefully to understand how it will affect the security and data compliance of your business. 

More information from the NCSC can be found here : https://www.ncsc.gov.uk/blog-post/chatgpt-and-large-language-models-whats-the-risk

If you want to talk to one of our experts about how we can help you with your security and understanding of LLM then please call 01235 433900 or you can email [email protected] or if you would like to speak to me directly you can reach out to me via DM or at [email protected].

IMPORTANT!!

This article was NOT written by ChatGPT. It was written by this ChapJPD (James Peter Dell)

Cloud Security Assessment Checklist: Protecting Your Business in the Cloud

cloud security checklist

Just because your data is in the cloud, that doesn’t mean it’s secure.
What???

I know many people believe that because they use Microsoft Azure, AWS or GCP, and big tech have their own security measures in place, that means you are safe, right? It doesn’t!!

In order to protect your sensitive information and comply with industry regulations, you need to perform a comprehensive security assessment of your cloud infrastructure.

Here is our recommended cloud security assessment checklist to help you ensure that your cloud environment is secure:

Access Management

Access management is one of the most critical components of cloud security. You need to ensure that only authorized users have access to sensitive information and systems. This can be achieved through the implementation of strong authentication methods such as multi-factor authentication, the use of secure password policies and even better, biometric authentication.
Additionally, it’s important to regularly review and audit your access logs to detect any unauthorised access attempts.

MFA

Directory Service

Directory services play a crucial role in cloud security by providing centralised authentication and authorisation for your cloud environment. A robust directory service will allow you to manage user accounts, passwords, and permissions in a secure and scalable manner. Ensure that your directory service is properly configured and that it integrates seamlessly with your access management solution.

Data Loss Prevention and Backup Policies

Data loss prevention is critical in protecting your sensitive information in the cloud. Implement a comprehensive data loss prevention strategy that includes the use of encryption, data backups, and disaster recovery solutions. Ensure that your data backup policies are regularly tested and updated to ensure that your data can be recovered in the event of an unexpected outage or disaster.

Rely on a Security Team

This is key. A dedicated security team is essential for ensuring the security of your cloud environment. This team should be responsible for the implementation and management of your cloud security solutions, as well as for performing regular security assessments and audits. Whether in-house or outsourced, make sure that your security team has the necessary skills and experience to keep your cloud environment secure.

Encryption

Encryption is an essential component of cloud security. Encryption can protect your sensitive information from unauthorised access, even if it falls into the wrong hands. Ensure that your data is encrypted both at rest and in transit, and that your encryption keys are properly managed and protected.

security updates

Security Updates

Often overlooked, updates are critical for keeping your cloud environment secure. Regularly update your cloud infrastructure and security solutions to ensure that you are protected against the latest threats. Stay up-to-date with the latest security news and vulnerabilities to ensure that you are prepared for any potential security incidents.

Monitoring

Regularly monitor your cloud environment to detect any security incidents or threats. Ensure that you have the necessary tools and processes in place to quickly respond to any security incidents, and that your security team is properly trained and equipped to handle them.

In conclusion, the cloud is an essential component of modern business, but it also presents a unique set of security challenges. By following this cloud security assessment checklist, you can ensure that your cloud environment is secure and that your sensitive information is protected. Keep this checklist handy and regularly assess your cloud security to ensure that you are always protected.

Ignorance is not bliss. Why Are Some Businesses So Reluctant To Embrace The Cloud?

Why are businesses so reluctant to adopt the cloud?

Cloud computing is the future of business. I argue that it is very much the present too. The cloud benefits organisations to become more agile, efficient, and cost-effective.

But why are some companies still hesitant to join the party?

Is it the cost? Is it a lack of understanding?

Ok, Let’s call out the elephant in the room: security and privacy concerns.

Yes, security breaches make headlines, but the truth is that cloud providers have heavily invested in security measures.

This includes encryption, firewalls, and multi-factor authentication. However, many businesses are still sceptical about the effectiveness of these measures and worry that their data could be vulnerable to cyberattacks.

So, I’m going to call the cloud providers out on this. Just because your data is stored on the cloud, and despite their valiant efforts, the reality is that you still need 3 party security solutions in place to safeguard your business data. But any responsible IT manager or business leader will appreciate this is a modern business need anyway.

Another reason for the reluctance to adopt cloud computing is privacy. Many businesses are concerned about the privacy of their data, particularly in light of recent privacy scandals. They worry that their confidential information could be accessed by unauthorised third parties, either by accident or through malicious intent.

But it’s not just security and privacy holding companies back. Many simply don’t understand the cloud. And that’s understandable. But ignorance is not bliss in the digital age. The businesses that seize the cloud advantage will leave their competition in the dust. Access to cutting-edge tech, scalability, and improved collaboration – the benefits of the cloud are too good to pass up.

So, to the companies still on the fence about cloud computing: don’t be left behind. Embrace the future and take your business to the next level.

Cloud computing is the answer to your digital needs – embrace it and thrive.

WEBINAR RECAP: Ransomware in the real world. Is your IT Department ready to be attacked?

Ransomware in the real world

Last week, we hosted a Webinar to ask businesses if their IT department is really ready for a ransomware attack.

Over 50% of businesses will be victim of Ransomware in 2022, and the average bill to rectify an attack, considering downtime, people time, device cost, network cost, lost opportunity, ransom paid, and more… will be over £1.3m!

Did you miss it? Or would you like to watch it again? Well, the good news is that we recorded it and you can check it out here:

 

Your Questions, Answered.

A sign of a good webinar is the quality of the questions asked at the end. We had too many questions to be able to answer them all in the time allowed so James and Kosta have answered anything we didn’t have time for during the session.

Remember, if you you would like to find out more about Sophos MTR, have any questions around cybersecurity or need advice for your IT team, please reach out to James directly, [email protected], or call one of the team 01235 433900

 

What about false positives within Powershell and ps1 files, repositories like PSGet, NuGet etc – these constantly get flagged in our org with Defender Endpoint!

We would suggest if these are trusted internal tools they should be excluded from Scanning based on their HASH values or path. If these are dynamic libraries then in Sophos central we would create a policy for staff allowed to use these system tools and restrict all other user access to these tools.

 

How much Sophos will be responsible in case of a Ransomware attack?

If your business only has the Sophos Endpoint products, firewalls or email products in the case of an attack Sophos will provide remote support but hold no responsibility as the configuration and management of the platform is the responsibility of the business. However if the MTR service is in use then the business does have a level of protection from Sophos and the remediation services are covered under your contract.

 

How do we get the board to take cybersecurity seriously? We’ve covered the basics in terms of controls, but anytime I try to increase budget to add additional controls – it gets pushed back.

The best option to get senior management / board to take ownership of cyber security and cyber insurance is to use the scare factor of examples like our cyber victim where all senior management, directors and the board where removed from their posts under gross negligence as part of the work that took place to recover the business. Many of these have struggled to get new roles following the merger of the business because of the legacy association with such a large scale failure.

Michael Davey

What are the biggest cybersecurity threats right now?

The biggest threat remains ransomware and this continues to appear in different forms and flavours but ultimately the goal remains the same and that is to disrupt system usage.

 

Am I spending enough, appropriately on information security-related tools and controls? (Is there a network security or information security tool I should buy?)

There is no golden figure for how much to spend on protection but what you need to do is take a risk based assessment on what protection you have in place and make sure you are covering the full stack and have a solution in place for every risk in the system.

 

Not convinced that cyber insurance provides any real cover

Cyber Insurance is only going to work for you and your business if you have the right tools in place to protect the business in the first place as with car insurance they wont pay out if you are negligent , it is up to you and your business to make sure you have the correct protection in place.

 

Who would you recommend in terms of cyber security insurance providers?

We don’t directly recommend providers.

Cybersecurity health check

If you have someone in your team who is a disgruntled Employee and may be leaving the company and they leave a logic bomb on your network without you knowing it would Cyber Security Insurance cover this or would it then be void as its happened within your own team? What would be the legal response to this?

This is a very loaded question. In most cases, Cybersecurity Insurance will protect against this provided you have all other requirements in place. If however this disgruntled employee was part of your security team, that may raise questions around your employee vetting process and you may need to lean on your employee terms and conditions, specifically your computer misuse act should you need to follow up with legal proceedings.

 

Is the standard Sophos Endpoint not enough either?

We would recommend Sophos Intercept X as a minimum for protection in 2022.

 

Are there any courses that you would recommend for Cyber Security specialisation?

We would recommend you look at CISSP and then anything linked to business solutions you have in place.

 

Are the MTR team UK based?

Sophos MTR is a global follow the sun team. There is a UK team as part of this but to enable truly 24/7 support this is covered by a global team.

 

How do we get the board to take cybersecurity seriously? We’ve covered the basics in terms of controls, but anytime I try to increase budget to add additional controls – it gets pushed back.

The best option to get senior management / board to take ownership of cyber security and cyber insurance is to use the scare factor of examples like our cyber victim where all senior management, directors and the board where removed from their posts under gross negligence as part of the work that took place to recover the business. Many of these have struggled to get new roles following the merger of the business because of the legacy association with such a large scale failure

 

For us, the major deficiency we see today is not with attacks via known end points or servers but the chances of unknown devices being attached to our networks. This is an area which I feel very few companies or vendors are addressing well and cost effectively so I’d love to know if this is an area you guys both Planet and Sophos are investigating/investing in?

There are a number of NAC product’s that have surfaced over the years to try and fill this gap. What we are seeing the the solution for most business now is to terminate all VLAN’s on the firewall and use the synchronised security aspects of the Sophos XGS firewall to remove unwanted network traffic in controlled sectors, with only trusted devices being able to route traffic.

 

Is webinar recorded?

Yes, you can watch it here: https://youtu.be/qLPPw4kndy4

 

 

Webinar Recap: Microsoft New Commerce Experience – Big changes are coming!

Microsoft NCE changes

This week, we hosted a Live Webinar where we outlined the upcoming changes to how Microsoft sell their licences and it affects organisation of all kinds – what Microsoft are calling their New Commerce Experience (NCE).

🚨 As a Microsoft Gold Partner. we were one of the first in the UK to present this. We were so early in fact, that only a couple of short hours after the webinar, Microsoft announced that they will be pushing back the release date for New Commerce Experience from October 14 2021 to January 2022! 🚨

The reality is, that it is still happening. This just gives us a little more time to decide on the licences that best suit your organisation.

So please still watch the webinar recording below. All the information is still key to making the right decision for your business. To ask any specific questions about your situation, reach out to your Planet IT account manager or email [email protected].

On the webinar, our resident Accredited Microsoft Experts, James Dell & Adam Harrison covered:

✅ The price increases for CSP licences.

✅ Open licensing is moving to CSP. How will this affect you?

✅ How the Enterprise Agreement resizing will affect you.

✅ How CSP licensing terms are changing.

✅ How these changes effect your existing licensing

 

Did you miss it? Or would you like to watch it again? Well, the good news is that we recorded it and you can check it out here:

Your Questions, Answered.

We received lots of questions throughout the webinar and did our best to answer them. Watch the recording to see if your questions would be answered at the end, however if you have any more, please reach out to James himself on 01235 433900 or email directly: [email protected].

Remember to ask him about our Microsoft 365 health Checks!

 

 

 

 

Virtual Roundtable Recap: Facing and Overcoming IT Challenges In Education

Education IT Event

This week, our panel of special guests came together for an educational virtual round table event. Our panellists discussed the challenges they have faced in their education provider and how as IT professionals, they overcame these challenges.

We also opened the floor up to our selected guests so that the panel could try to help them with their challenges.

Our panel included:

David Higgs, Security and Service Experience Centre Lead at Imperial College London

Mike Pearce, ICT Network Manager at St. Cuthbert’s Roman Catholic Academy Trust

Graham Rivers, ICT Network Manager Moulsford Prep School

James Dell, Head of Technical Architecture and Education specialist at Planet IT

 

Discussion Points included:

  • The challenges encountered when delivering IT solutions to their organisation
  • How our guests overcame these challenges and turned them into successes
  • New trends & technologies critical for educational IT in the next 12 months
  • The ever increasing threat of cyber attack
  • BYOD (Bring Your Own Device)
  • Hiring and building a team on a budget

 

Did you miss it? Or would you like to watch it again? Well, the good news is that we recorded it and you can check it out here:

Remember, if you you have any questions or challenges that you dafe in your Education IT career, then please reach out to James Dell and he would be more than happy to talk you through the solutions he found to any similar obstacles. Call 01235 433900 or email [email protected]

 

Internet Explorer is Dead – What you need to do now

Internet explorer

Internet explorer is finally coming to the end of its long slow walk to its grave. As of the 15th of June 2022, all devices not running an LTSC or Long Terms Servicing Channel version of Windows 10 or Windows Server will lose the application as part of the 15th of June update.

However, this is much larger than many would initially perceive. Many custom-built or 3rd Party applications use the IE framework to deliver content and allow users to interact with their platforms. The removal of internet explorer, which long advertised and overdue, will affect many businesses adversely.

To make your life a little easier there are actions you can complete now to engage the Microsoft Edge support for many of these legacy programs, and to make life easier, you can follow the steps on page 5 and 6 of this document, from Microsoft that will help you make your business Microsoft Edge ready.

Does It Matter?

For many of you, this won’t be an issue, but remember now is the time to be testing this; if you have any application that opens on IE11 session by default on Windows 10 or Windows Server, you need to ensure it runs in Microsoft Edge before the 15th or move the server/ desktop to the long-term servicing channel if you cannot support the application.

As a side note, it is worth noting that Office 365 and all Microsoft services will not support Internet Explorer from the 17th of August in any form, so while you can use IE on LSTC to support custom applications, you will struggle to use the product for anything outside of these products and Microsoft. Many other vendors are moving fast to drop Internet Explorer from their supported browsers lists.

If you have 3rd party applications which rely on Internet Explorer, now is the time to be reaching out to my team at Planet IT to start looking at how you move away as not only is this issue going to become worse but with no updated Internet Explorer is likely to be a source for vulnerabilities we see when scanning people’s networks.

If you want to talk to one of our team about how we can help you move away from Internet Explorer and associated 3rd party applications. Then please call 01235 433900 or you can email [email protected] or if you would like to speak to me directly, you can reach out to me via DM or at [email protected].

IE death

 

Education in Focus: Biggest IT Refresh Year Ever

Education IT

There comes a point in the academic year where exams ramp up, teachers, lectures and support staff are focused on getting student’s through their end of year exams and keeping the momentum up until the summer break.

Meanwhile in the cool dark of the server room, the IT Support teams across all academic settings are preparing for the calm before the storm.

This year, while we may not be seeing exams like we previously would, the IT Teams in our educational establishments are preparing for their busiest summer refreshes ever. The woes of 2020 are behind us and the shift to classroom learning returning for 2021/22, the push is on to make the infrastructure improvements that were put off during COVID.

Saying all that, budgets are likely to also be tighter than ever. So how can IT teams get the absolute most out of their IT projects?

To help we have put together 5 top tips for smashing your summer projects in 2021

Plan Early

When it comes to any form of IT project the further ahead you are planning the better chance of success you have, so start early!

Engage vendors and technology partners. Test the market and understand your options. If you are looking 6 months ahead of where you need to be, then when do you have to make the choice on the technology or the vendors you are going to use? Be armed with all the information you need so you can overcome the challenges the project throws at you.

School ITHave a contingency plan

As you begin to plan your project, look at the what if’s…

For example, if you are replacing a server infrastructure, what happens if the new servers fail? Or before you have moved the data, if the old servers fail, do you have a backup? Have you tested it?

By implementing a rock-solid contingency plan you are positioning yourselves in such a way that you can overcome whatever challenges come your way.

Choose a partner you can trust

Remember you are not in this alone.

Whatever the chosen project you are undertaking there are partners who will help you achieve the goals of your organisation. However not all partners are equal. Not all partners have the same approach.

Find a partner who has the certifications and accreditations with the vendors you want to work with, i.e Dell Gold Partner or Microsoft Gold Partner with certified engineers. Don’t settle for “the local firm” as 9 times out of 10 they will get out of their depth very quickly. They’ll can end up making the challenges of delivering IT in education much worse.

So, pick a partner you can trust, and you know when you’re up against it, will have your back!

Only choose best of breed technology and don’t settle for last generation.

Lots of companies see education as an opportunity to move stock which the corporate world no longer wants – for example, servers which are now end of sale or software which has been pushed into its last few operational years.

You should never settle for anything other than the best in breed technology for your establishment. If budgets constrain that, reduce the scope of the project or limit the technology used. Don’t settle for old, refurbished or reconditioned equipment just to hit a financial goal. In the long term, you will pay the price when the equipment cannot be serviced and needs replacing before the business has got the full value from the solution.

Maximise gains using operations leasing

When making purchases in education, you have a great opportunity to access low cost or even free finance offerings for all of your large purchases. So, leverage these deals to extend your budget.

Limit the capex spend and get the best solution you can and prevent the project delays of stretching upgrades over 2-3 years which really need to be done today.

Using these top tips, your organisations should be able to avoid the pitfalls of so many education providers in the past and make sure you take step in the right direction when making your upgrade this summer.

Just remember you are not alone. At Planet IT we have a team of specialists who can not only support you with the decision making and selection of new equipment, but can support with the role out, implementations and upgrades to your systems.

If you want to talk to one of our educational team about how we can help you with your summer projects then please call 01235 433900 or you can email [email protected] or if you would like to speak to me directly you can reach out to me via DM or at [email protected].

 

Backup Webinar Recap: The Uncomfortable Truths

Backup webinar recap

This week, we hosted a Live Webinar based all around the Uncomfortable Truths about your Backups.

Our resident Backup guru, Michael Davey was joined by Arcserve expert, Steve Butterfield and between them they covered

✅ Microsoft 365 data protection

✅ Immutable storage & Ransomware Protection

✅ How are you storing your data & the 3-2-1 rule

✅ Scaling your infrastructure with Backup & DR

✅ How to combat storage creep

 

Did you miss it? Or would you like to watch it again? Well, the good news is that we recorded it and you can check it out here:

Your Questions, Answered.

We received lots of questions throughout the webinar. Unfortunately we weren’t able to answer them all during the live session so we have compiled them all and asked Michael and Steve to answer them again.

Remember, if you you would like to find out more about backup in general or speak about your own backups specifically, get in reach out to your Planet IT account manager, call 01235 433900 or email [email protected]

 

Would cycled tapes not be immutable being out of the drive most of the time?

Tape and especially WORM tape were the original air-gapped / immutable storage

While out of the drive then tapes are largely immutable outside of extremes involving strong magnets, But you do have to put them in the libraries to use them which brings two issues,

1. They are available to be overwritten while in the library.

2. They require manual intervention to remove/replace.

However, definitely a big improvement over no airgap.

 

What is the licensing model? Is it based upon per user for 365 and per source TB for onsite storage?

Universal licensing which runs on your own hardware or VM covers all data sources including O365 and so is

licensed per TB of protected data, no limits on retention and can be any mix of Physical machines, Virtual machines and O365

Per user licensing is also available and may be of interest if you are adding it to existing Arcserve licensing.

Per user or per TB licensing is available from our cloud (SAS Offering )subject to a max of 100 users per TB for capacity based licensing )

 

The reason people do Full backups is because incremental backups all depend on the previous ones , isn’t that a disaster waiting to happen with incremental forever ?

Our Incrementals act and restore like Full backups, they do not depend on any other incremental backup therefore one “Broken” incremental affects neither the incremental before or after it.

 

What is the most common security breach you see that can also impact backups?

I think Michael answered this but a stat for you from Sophos “The state of Ransomware 2021”

37% of the 5400 respondents surveyed were hit by Ransomware in the last year

Ransomware is still the major threat

 

 

A pretty bold statement was made “Completely Ransomware Safe” Can you back this claim with something factual?

Like Unsinkable ships, Completely ransomware safe is conditional on the type of attack i.e. Nothing is completely safe if Physical access is allowed for instance , however we believe that our Ransomware capability is the strongest and most complete in the industry and we are the only backup vendor to offer a Money Back Guarantee.

For 0365 backup only do we need an onsite appliance?

You have choice, You can purchase Arcserve UDP and have it protect O365 in the following ways

  1. An Appliance running on Prem or in hosted Colo
  2. Software running on your own hardware, VM or in your own public or private cloud instance
  3. Software as a service running from our Cloud based from our Datacentre in Manchester or AWS in London ( Other Geo’s are available )

While On-Prem may seem an odd choice to some for a cloud based service, do remember the 3-2-1 rule and the fact that even in the event of an Internet or Azure outage you could still access your data locally. The main thing is it is held elsewhere so we would always caution against any service backing up O365 which is hosted in Azure

 

 

What is Conditional Access, and why is it an essential part of your security posture?

Conditional Access

By now, you should be aware that the modern digital landscape is full of threat actors. That are always looking for any opportunity to find a weakness in a business’s security posture and then leverage this to gain unauthorised access to data for malicious reasons.

To protect against these attacks, we often look at antivirus and anti-ransomware technology and products like MFA or Two-factor authentication. The truth is that MFA is part of much larger protection that can be afforded a system through an approach known as Conditional Access.

How does Conditional Access work?

Conditional Access (CA) is the process of defining entry vectors and criteria; in its most simplistic form, consider CA to be a door that only opens if you are wearing the right clothes, have arrived in the right vehicle, and are holding your ID. In real terms, CA allows a business to define controls around what can be accessed by who, from where and under what circumstances.

I feel that conditional access is an underutilised part of any defence arsenal. This is partly due to a lack of understanding in the IT community about the technology and a misconception about its limitations. These beliefs and options come from a legacy of Software as a Service (SaaS) and on-premises infrastructure being integrated minimally, however with modern SaaS, IaaS, PaaS and on-prem working in a heavily integrated way. Conditional Access allows you to take advantage of the proper protection that can be afforded a system without comprise.

Is it widely used?

All the major SaaS, IaaS and PaaS vendors support conditional access, and an optimum way to deploy the technology is as such.

  • Limit access to login to Geo Locations that are trusted and used by the business
  • Allow internal networks or trusted networks to have fast passed authentication
  • Only allow data access from trusted and complaint enrolled devices
  • Require MFA in any location that is not inside a trusted network
  • Remove support for legacy authentication methods
  • Deploy true Single Sign-on across all platforms and devices
  • Limit access to the data and services a user needs based on the roles of that user
  • Only allow devices that have Antivirus and Anti-ransomware installed and up to date
  • Only enable devices that have the latest operating system updates
  • Integrate all systems into a single platform, use Conditional Access and MFA to protect the whole network, not just cloud services.

By undertaking this approach, you can reduce the attached surface of your infrastructure and protect data while not limiting your staff’s functionality by placing unwanted security barriers in place.

The diagram below shows how the conditional access approach works.

Conditional Access Explained

Conditional Access

Do you think your business could benefit from the technologies of conditional access? Do you want to know more? Then please reach out to a member of the Architecture team at Planet IT via [email protected] or call 01235 433900, and we can talk to you about the options available that work with your more comprehensive technologies.

Looking for a technology partner?
Let’s talk

  • This field is for validation purposes and should be left unchanged.