Your first week with Qorionix

This is the list we would work through if we were sitting in your office. It is ordered by how much risk each item removes for the amount of disruption it causes, which is not the same as the order the console presents things in. If you only do the first three, you will still have removed most of the risk that is realistically available to you this month.

Nothing here needs a security specialist. Items one to five need somebody who can sign in to Microsoft 365 as an administrator. Items six and seven need you specifically, because they are business decisions rather than technical ones.

The eight items

1. 1

   Connect Microsoft 365 and read the report

   One consent, read-only to begin with, and about ten minutes of your attention. The report names your actual administrators, your actual applications, your actual devices and your actual risky sign-ins. Almost every firm we onboard finds at least one thing here they did not know: a former employee still holding a licence, an application nobody remembers approving, a mailbox with forwarding switched on. Start with the critical findings, because they name real people. See Connect Microsoft 365 and Reading your posture report.

2. 2

   Fix the administrators who have no second factor

   Your report will list them by name. Microsoft's own published data puts the reduction in account-compromise risk above 99% once a second factor is enrolled, and enrolment is about two minutes per person. In a firm of fourteen people you probably have two to four administrator accounts, so this is ten minutes of work for the largest single risk reduction on the list. The procedure is in Set up two-factor authentication.

3. 3

   Separate the admin accounts from daily email

   About ten minutes per person. The problem is not that your practice manager is an administrator; it is that the same account reads email, opens attachments and browses the web all day, and administrator rights are attached to it the whole time. Give each administrator a second, licence-light account used only for administration, remove the admin role from the everyday account, and stop signing in to email with the admin one. This is the change that most reliably turns a successful phishing email into a survivable incident. See Admin accounts used for daily email.

4. 4

   Create an emergency access account and put it in a safe

   One account, a long unique password, and its own second factor enrolled on a device you keep somewhere safe. Enrolling it also hands you ten one-time recovery codes — print those and put them in the same safe as the device, rather than relying on either alone; see Recovery codes. It is excluded from the conditional access rules you are about to tighten, and it is used for nothing else, ever. Every organisation that has locked itself out of its own tenant did so by securing everything properly and leaving no way back in. Ten minutes now, and you will hope never to touch it. See Set up two-factor authentication for the full enrolment procedure.

5. 5

   Block the old sign-in methods that cannot present a second factor

   Legacy authentication protocols pre-date multi-factor authentication and cannot ask for a second factor, which makes every one of them a way around the work you did in item two. Blocking them is the single highest-value hardening change left. It will break something. Do not skip to this item: find out what first. Your posture report lists which accounts and which client applications have used legacy sign-in in the recent past, so you can ring those people before you make the change rather than after.

6. 6

   Answer the two questions only you can answer

   First: which three or four machines or systems would stop the business if they went down on a Monday morning? Not the ones that are technically interesting — the ones that stop invoices going out and client work happening. Second: who gets contacted out of hours, on what number, and who is the fallback when that person is on holiday? Nobody can derive either answer from your logs. Both change how we prioritise and route everything else, and both take about fifteen minutes of thought.

7. 7

   Switch on unified audit logging and connect the log source

   This one we do automatically as part of the Microsoft 365 connection. The reason it appears on the list is that you should understand what it buys you: without it, the record of who did what in your tenant does not exist to be searched later. Audit logging is what makes an incident explainable after the fact and what makes an evidence bundle possible at all. Check the source shows as connected and healthy, and if it does not, see When a check cannot run.

8. 8

   Leave behavioural detection alone for a fortnight

   The detections that learn what is normal for your business need five to fourteen days of your real traffic before their output is worth acting on. During that period some of them will be quiet and some will be noisy, and neither tells you anything. Do not tune them, do not switch them off, and do not judge the product on them. That is a property of the data, not of the software, and nobody can compress it.

What each item costs you

Realistic figures for a firm of about fourteen people. The disruption column is the one worth planning around.

What item five is going to break

Being specific about this is more useful than a warning. In a small professional-services firm, the things that stop working when legacy sign-in is blocked are almost always from this list:

• A multifunction printer or scanner that emails scans to people. Older devices authenticate to the mail server with a username and password over a protocol that cannot do a second factor. This is the most common casualty by a wide margin.
• An old desktop mail client on a machine nobody has updated in years, often on the one PC running the practice software that cannot be touched.
• A line-of-business or bookkeeping application that sends email using a mailbox's credentials.
• A phone set up manually years ago with server names typed in by hand rather than configured automatically.

Every one of these has a fix, and none of the fixes is exotic: reconfigure the device to use modern authentication, or move it to a dedicated send path that does not rely on a user's password. What you must not do is discover the breakage on a Friday afternoon by having your scanner go silent with no idea why.

Four terms worth knowing

Second factor

Something you have in addition to something you know. In practice a six-digit code from an app on your phone. It is what makes a stolen password insufficient on its own.

Legacy authentication

Older sign-in protocols that pre-date multi-factor authentication and cannot ask for a second factor. Anything still using them is a documented route around your other controls.

Emergency access account

Sometimes called a break-glass account. One deliberately excluded, deliberately unused, deliberately well-protected account that exists so that a mistake in your own access rules cannot lock you out of fixing it.

Baseline

What the platform has learned to treat as normal for your business: who signs in from where, at what times, and doing what. Detections that depend on a baseline are only as good as the period they have had to build one, which is why item eight is to wait.

What not to do this week

Three tempting activities that will cost you the week and return very little.

• Do not write a security policy yet. A policy that describes controls you have not implemented is a liability, not an asset. Implement items one to five, then write the policy that describes what you actually did.
• Do not switch detections off because they are noisy in week one. A rule you disabled in week two is worth nothing in month six, and you will not remember why it is off. If something is genuinely wrong, say so through How to get help and we will look at the rule.
• Do not deploy endpoint sensors to every machine on day one. Do the identity work first. It is cheaper, it is less disruptive, and identity is where the overwhelming majority of incidents at your size begin.

What a good end of week looks like

By Friday you should be able to state, without checking, that every administrator in your firm has a second factor, that no administrator reads email with an admin account, that your emergency access account exists with its second factor enrolled on a device in your safe, that more than one person can reset another administrator's second factor, and that you know which four systems would stop the business. That is a materially different position from the one you were in on Monday, and it was achieved in well under a day of actual work.

What you should not expect by Friday is a quiet, tuned alert queue. That arrives in week three, after the baseline has formed. Set the expectation with whoever asked you to do this, so that a normal settling period does not get read as a problem.

1. What Qorionix does, and what it does not — read this if you have not, so your expectations for the week are calibrated.
2. Connect Microsoft 365 — item one, and the only one with a hard dependency on us.
3. What to do when an alert arrives — worth reading before you need it, which is the only time anyone ever reads it.