Microsoft Identity Manager online resources (#MIM2016)

1. Quick note on Microsoft Learn & Docs
2. Microsoft news and announcements
   1. Microsoft Product support lifecycle
   2. Feeds
3. Official documentation – Microsoft
   1. Getting prepared
   2. Best practices
   3. Deployment documentation
   4. MIM for developers
   5. MIM reference material
4. Github
   1. (Microsoft) MIM Configuration Documenter
   2. (Microsoft) Workflow Activity Library (WAL)
   3. MIM projects
5. Microsoft Community
   1. Forums (Active)
   2. Microsoft Answers
   3. Forums (Achive)
   4. Technet blogs archive
   5. Experts Exchange
   6. Microsoft Wiki
      1. FIM/MIM related content (check the tags)
      2. ILM/FIM/MIM article overview
      3. ILM/FIM/MIM Troubleshooting
   7. The FIM/MIM geek blogs & posts…
6. Social Media
   1. Facebook
   2. Twitter
7. Books
   1. Online Companion guide for MIM 2016 book
8. Visio Stencils
9. Archives
   1. Microsoft Learn – previous versions

Quick note on Microsoft Learn & Docs

A while ago Microsoft moved from Docs (Docs.microsoft.com) to Learn (Learn.microsoft.com), but still some older information might point to the Docs links. In case the redirect fails, replace the docs prefix in the URL to learn an try again.
If it still fails, Bing it and let me know.

Microsoft news and announcements

• https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016
• https://support.microsoft.com/en-US/search/results?query=microsoft+identity+manager&isEnrichedQuery=false
• https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/version-history
• https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/microsoft-identity-manager-2016-connector-version-history

Microsoft Product support lifecycle

https://docs.microsoft.com/en-us/lifecycle/products/?terms=Identity

Feeds

• https://support.microsoft.com/en-us/rss-feed-picker
• Atom: https://support.microsoft.com/en-us/feed/atom/953e6581-605c-e03f-3595-5f98899c1d1d
• RSS: https://support.microsoft.com/en-us/feed/rss/953e6581-605c-e03f-3595-5f98899c1d1d

Official documentation – Microsoft

• Microsoft Learn- MIM landing page: https://learn.microsoft.com/en-us/microsoft-identity-manager
• Microsoft Identity Manager 2016 news and updates: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016
• Version History: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/version-history

Getting prepared

Supported platforms: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-supported-platforms

Best practices

https://learn.microsoft.com/en-us/microsoft-identity-manager/mim-best-practices

Deployment documentation

• Capacity planning: https://learn.microsoft.com/en-us/microsoft-identity-manager/capacity-planning-guide
• Deploy and use: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-deploy
• Deprecated features: https://learn.microsoft.com/en-us/microsoft-identity-manager/microsoft-identity-manager-2016-deprecated-features

MIM for developers

• •Microsoft Identity Manager 2016 developer reference: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/microsoft-identity-manager-2016-developer-reference
• •Microsoft Identity Manager Cmdlets Reference: https://learn.microsoft.com/en-us/powershell/microsoft-identity-manager/overview?view=idm-ps-2016sp1

MIM reference material

• Developer reference: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/microsoft-identity-manager-2016-developer-reference
• Functions reference: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/mim2016-functions-reference
• Management agent run error codes: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/maerrorcodes
• RCDC configuration XML: https://learn.microsoft.com/en-us/microsoft-identity-manager/reference/rcd-configuration-xml-reference

Github

(Microsoft) MIM Configuration Documenter

https://github.com/microsoft/MIMConfigDocumenter

(Microsoft) Workflow Activity Library (WAL)

https://github.com/microsoft/MIMWAL

MIM projects

https://github.com/search?q=mim2016

Microsoft Community

Forums (Active)

• Tech Community : https://techcommunity.microsoft.com/

• Microsoft Learn – Q&A : https://learn.microsoft.com/en-us/answers/search.html?type=question%20OR%20idea%20OR%20kbentry%20OR%20answer%20OR%20topic%20OR%20user&redirect=search%2Fsearch&sort=relevance&q=identity%20manager

Microsoft Answers

• •Microsoft Answers: https://answers.microsoft.com/en-us/search/search?SearchTerm=MIM%202016
• •FIM 2010: https://answers.microsoft.com/en-us/search/search?SearchTerm=FIM%202010

Forums (Achive)

• (archive) Technet forum FIM/MIM: https://social.technet.microsoft.com/Forums/en-US/home?forum=ilm2&filter=alllanguages
• (archive) Technet Forum ILM 2007: https://social.technet.microsoft.com/Forums/en-US/home?forum=identitylifecyclemanager&filter=alllanguages

Technet blogs archive

Technet blogs archive: https://learn.microsoft.com/en-us/archive/blogs/

• https://learn.microsoft.com/en-us/archive/blogs/iamsupport/
• https://learn.microsoft.com/en-us/archive/blogs/connector_space/
• https://learn.microsoft.com/en-us/archive/blogs/identitymanagement/
• https://learn.microsoft.com/en-us/archive/blogs/idaguys/
• https://learn.microsoft.com/en-us/archive/blogs/imex/

Experts Exchange

• Experts Exchange: https://www.experts-exchange.com/searchResults.jsp?searchTerms=MIM2016

Microsoft Wiki

• Microsoft Wiki: https://social.technet.microsoft.com/wiki
• Short URL: https://aka.ms/wiki

FIM/MIM related content (check the tags)

• MIM: https://social.technet.microsoft.com/wiki/tags/MIM/default.aspx
• https://social.technet.microsoft.com/wiki/tags/MIM+2016/default.aspx
• https://social.technet.microsoft.com/wiki/tags/MIM+2016/default.aspx
• https://social.technet.microsoft.com/wiki/tags/FIM/default.aspx
• https://social.technet.microsoft.com/wiki/tags/FIM+2010/default.aspx

ILM/FIM/MIM article overview

https://social.technet.microsoft.com/wiki/contents/articles/3610.fim-2010-mim-2016-related-wiki-articles.aspx

ILM/FIM/MIM Troubleshooting

https://social.technet.microsoft.com/wiki/contents/articles/3610.fim-2010-mim-2016-related-wiki-articles.aspx#FIM_Troubleshooting_Article

The FIM/MIM geek blogs & posts…

Below you’ll find some interesting and helpful articles and posts (some of the are old/archived… But still valid for MIM too.)

In alphabetic order (on last name)

• Bob Bradley: https://idm4real.com/
• Blain Checkly: https://identityminded.wordpress.com/
• Jorge de Almeida Pinto (MVP): https://jorgequestforknowledge.wordpress.com/
• Soren Granfeldt: https://github.com/sorengranfeldt
• Antony Ho (Microsoft) : https://learn.microsoft.com/en-us/archive/blogs/aho/
• Jeff Ingalls (https://ingallsdesigns.com/),
• Borys Majewski (http://idarchitect.net/)
• Ryan Newington (https://twitter.com/RyanLNewington): https://lithnet.io/products/mim
• Kent Nordstrom: https://konab.com/blog/
• Darren Robinson: https://blog.darrenjrobinson.com/identity-manager-management-agents/
• Carol Wapshere: https://www.wapshere.com/missmiis/rcdc-memberof-list
• …

Social Media

Facebook

• https://www.facebook.com/groups/MicrosoftIdentityManager/

Twitter

• https://twitter.com/search?q=%23MIM2016
• https://twitter.com/hashtag/fim2010r2

Books

• https://www.davidplundell.com/fim-best-practices-volume-1
• https://www.packtpub.com/product/microsoft-identity-manager-2016-handbook/9781785283925
• https://konab.com/fim-2010-r2-book/

Online Companion guide for MIM 2016 book

• https://social.technet.microsoft.com/wiki/contents/articles/34993.microsoft-identity-manager-2016-handbook-online-companion-guide.aspx

Visio Stencils

https://github.com/PeterGeelen/Microsoft-Identity-Manager/tree/main/FIM-MIM%20stencils

Archives

Microsoft Learn – previous versions

https://learn.microsoft.com/en-us/previous-versions/windows/desktop/forefront-2010/ee652263(v=vs.100)

10x times thank you for your support! #mvpbuzz

If you’re in my community and professional network you must have witnessed a wave of Microsoft MVP #mvpbuzz announcements and notifications, early july on the various social media, Twitter, LinkedIN, blogs… a bit later than usual this year.

I was part of it, but due to personal reasons and summer vacation early July, I only had time till now to process it…

Certainly this year is a special year for me, a lot of things have changed professionally.
And when another special award disk dropped in the mail box just a few days ago, I can proudly announce that I’m honored to be awarded the Microsoft MVP award for the 10th time.
You work hard for it, hope for it, but never know if you have met the tough expectations.

[If you want to know more about the Microsoft MVP award, check this page on the MVP site. It’s a reward for a select expert community with great passion for Microsoft technologies, for all community efforts for last year.]

Honestly, it’s not about these white and blue glass disks, but appreciation for the passion and effort in the Microsoft community, to be recognized for the passion in Microsoft Security, more specifically Identity & Access.

And I certainly welcome the program change where the group of MVP “Enterprise Mobility” now moved to MVP Security, which aligns better with reality, what I stand for.

But I could never have achieved this with the great help and support of you, my audience.
So want to thank you, more than 10x for this.

Thank you!

Note-to-self: #DPIA for cloud – reference material (focus on #Microsoft cloud)

In interesting set of reference material, that is regularly coming back in data protection, cybersecurity and information security discussions I lately had with peers and colleagues.
May you can use it too…

Feel free to provide some feedback yourself, if you know additional pointers I should add.

You know where to find me.

Change history

2022-04-27 14:00: Added EDPB announcement to references section

Governmental DPIAs

Netherlands

2018-12-06: DPIA on Microsoft Office 2016 & 365

https://iapp.org/news/a/dutch-government-commissioned-dpia-on-microsoft-office-pro-plus/

Direct download of PDF:

Click to access DPIA+Microsoft+Office+2016+and+365+-+20191105.pdf

2022-02-22: DPIA on Microsoft Office 365

https://www.dataguidance.com/news/netherlands-dutch-government-publishes-dpia-microsoft

Press release by Dutch Government:

2022-02-21 https://www.rijksoverheid.nl/documenten/publicaties/2022/02/21/public-dpia-teams-onedrive-sharepoint-and-azure-ad

Publication of DPIA by Dutch Government

2022-02-21 : https://www.rijksoverheid.nl/documenten/publicaties/2022/02/21/public-dpia-teams-onedrive-sharepoint-and-azure-ad

Source: Beltug news https://www.beltug.be/news/7430/Dutch_government_publishes_DPIA_and_DTIA_for_Microsoft/

2022-02: The Dutch Ministry of Justice and Security requested an analysis of US legislation in relation to the GDPR and Schrems II by GreenburgTraurig.

Switzerland

In a recent article (In French) by ICT journal, the Canton of Zurich published a

https://www.ictjournal.ch/articles/2022-04-26/comment-le-canton-de-zurich-a-estime-le-risque-de-passer-sur-le-cloud-de

Research

Researchgate

Data Protection Impact Assessment (DPIA) for Cloud-Based Health Organizations

https://www.researchgate.net/publication/349882283_Data_Protection_Impact_Assessment_DPIA_for_Cloud-Based_Health_Organizations

Guidelines

CNIL

https://www.cnil.fr/en/tag/Privacy+Impact+Assessment+(PIA)

https://www.cnil.fr/en/guidelines-dpia

IAPP

https://iapp.org/news/a/guidance-for-a-cloud-migration-privacy-impact-assessment/

Templates

IAPP

https://iapp.org/resources/article/transfer-impact-assessment-templates/

Referring to:

IAPP Templates

• Cloud Computing: Risk Assessment of Lawful Access By Foreign Authorities
• EU SCC Transfer Impact Assessment (TIA)

Supplier references

Microsoft

Data Protection Impact Assessment for the GDPR

2021-11-17: https://docs.microsoft.com/en-us/compliance/regulatory/gdpr-data-protection-impact-assessments

Data Protection Impact Assessments: Guidance for Data Controllers Using Microsoft Professional Services

Part 1: Determining whether a DPIA is needed

https://docs.microsoft.com/en-us/compliance/regulatory/gdpr-dpia-prof-services?view=o365-worldwide#part-1–determining-whether-a-dpia-is-needed

Part 2: Contents of a DPIA

https://docs.microsoft.com/en-us/compliance/regulatory/gdpr-dpia-prof-services?view=o365-worldwide#part-2-contents-of-a-dpia

Download Customizable DPIA document

https://www.microsoft.com/en-us/download/details.aspx?id=102398

(more to come, this article will be updated with additional references when necessary)

Other relevant references

EDPB (European Data Protection Board)

Launch of coordinated enforcement on use of cloud by public sector

https://edpb.europa.eu/news/news/2022/launch-coordinated-enforcement-use-cloud-public-sector_en

#ICYMI, check these online fully accessible + freely downloadable ISO standards, relevant for information security, privacy & data protection

#ICYMI, In case you missed it.

Online freely accessible ISO standards

In the midst of the #COVID19 corona pandemic, the ISO (International Organization for Standardization) has unlocked free reading access to a bunch of relevant standards, including

• ISO 22301:2019, Security and resilience – Business continuity management systems –Requirements
• ISO 22316:2017, Security and resilience – Organizational resilience – Principles and attributes
• ISO 22320:2018, Security and resilience – Emergency management – Guidelines for incident management
• ISO 31000:2018, Risk management – Guidelines
• ISO 13485:2016, Medical devices — Quality management systems – Requirements for regulatory purposes

The general access page with all online, fully accessible standards can be found here: https://www.iso.org/covid19.

Important note:

• these standards are available online, but not downloadable (for legitimate downloads you need to purchase your copy in the ISO shop or with your national standards organisation)
• there is no guarantee for continued free access once the Covid pandemic is over, if ever. That’s the sole discretion of the ISO, of course.

Freely downloadable ISO standards

Next to the (temporary) free online access, there is also a set of standards you can download for free, no payment required.
See here: https://standards.iso.org/ittf/PubliclyAvailableStandards/

Short url to bookmark: https://ffwd2.me/FreeISO.

Check the interesting ISO standards (from the information security point of view) below

ISO27000 (Information security)

The ISO27001 vocabulary

ISO/IEC 27000:2018 EN – FR

5th

Information technology — Security techniques — Information security management systems — Overview and vocabulary

ISO/IEC JTC 1/SC 27

Privacy Framework (ISO29100)

ISO/IEC 29100:2011 EN – FR

1st

Information technology — Security techniques — Privacy framework

ISO/IEC JTC 1/SC 27

Cloud Computing Reference architecture

SO/IEC 17788:2014 EN	1st	Information technology — Cloud computing — Overview and vocabulary	ISO/IEC JTC 1/SC 38
ISO/IEC 17789:2014 EN	1st	Information technology — Cloud computing — Reference architecture	ISO/IEC JTC 1/SC 38

Cloud computing vocabulary

ISO/IEC 22123-1:2021 EN

1st

Information technology — Cloud computing — Part 1: Vocabulary

ISO/IEC JTC 1/SC 38

Cloud computing policy development

ISO/IEC TR 22678:2019 EN

1st

Information technology — Cloud computing — Guidance for policy development

ISO/IEC JTC 1/SC 38

Cloud Computing SLAs

ISO/IEC 19086-1:2016 EN	1st	Information technology — Cloud computing — Service level agreement (SLA) framework — Part 1: Overview and concepts	ISO/IEC JTC 1/SC 38
ISO/IEC 19086-2:2018 EN	1st	Cloud computing — Service level agreement (SLA) framework — Part 2: Metric model	ISO/IEC JTC 1/SC 38

Common Criteria (ISO 15408)

ISO/IEC 15408-1:2009 EN – FR	3rd	Information technology — Security techniques — Evaluation criteria for IT security — Part 1: Introduction and general model	ISO/IEC JTC 1/SC 27
ISO/IEC 15408-2:2008 EN – FR	3rd	Information technology — Security techniques — Evaluation criteria for IT security — Part 2: Security functional components	ISO/IEC JTC 1/SC 27
ISO/IEC 15408-3:2008 EN – FR	3rd	Information technology — Security techniques — Evaluation criteria for IT security — Part 3: Security assurance components	ISO/IEC JTC 1/SC 27

Identity management

ISO/IEC 24760-1:2019 EN – FR

2nd

IT Security and Privacy — A framework for identity management — Part 1: Terminology and concepts

ISO/IEC JTC 1/SC 27

Note-to-self: CIS Controls v8 (2021-05)

No need to pay with your privacy to bypass the registration wall… (no need to accept cookies either)

CIS Controls v8 PDF

https://learn.cisecurity.org/l/799323/2021-05-18/47qgs

CIS Controls v8 Excel

https://learn.cisecurity.org/l/799323/2021-05-18/47qgv

v8 Change Log

https://learn.cisecurity.org/l/799323/2021-05-18/47qgz

Also available

Translations

Italian, Portuguese, Japanese, Spanish:

https://learn.cisecurity.org/control-download

Whatsapp security dichttimmeren: stap voor stap (NL)

English version here: https://identityunderground.wordpress.com/2021/06/07/whatsapp-security-lockdown-step-by-step/

Gebruik je WhatsApp, of overweeg je om het te gebruiken (of ben je uitgenodigd door contacten)?

Dan kan de onderstaande checklist je stap-per-stap in detail uitleggen om

• te evalueren of het de moeite waard is om WhatsApp te gebruiken, en
• de beveiliging van je WhatsApp dicht te timmeren, om zo veilig mogelijk te blijven als je Whatsapp wil gebruiken.

Download dit article

At the end of this article, you can also find the download link for an offline version of this article.

Als je echt om privacy geeft en het is van het grootste belang…

Zoals hieronder uitgelegd, kun je WhatsApp zeker beveiligen, maar ze hebben nog steeds je gegevens en metadata en ze definiëren de regels waarmee WhatsApp de show uitvoert. En dat kan veranderen, wanneer ze maar willen.

En je moet weten dat WhatsApp eigendom is van en wordt beheerd door Facebook. En Facebook heeft al bewezen dat ze een echt slechte reputatie hebben als het gaat om privacy …

Als je echt niet wilt toegeven qua privacy, kijk dan eens naar alternatieven die niet zijn gebouwd door bedrijven die geld verdienen met je persoonlijke gegevens… (zie einde van dit artikel).

Het is aan jou om te beslissen welk risico je wilt nemen. Als je het gebruik van WhatsApp en je privacy wilt afwegen tegen de best mogelijke beveiliging, lees dan verder.

Als je om privacy geeft en toch Whatsapp wilt gebruiken

End-to-end encryptie

Het goede nieuws is dat WhatsApp een end-to-end encryptie gebruikt.

En hoewel Facebook of andere partijen mogelijk niet meeluisteren met uw gesprekken, kunnen de contactgegevens, de metagegevens (de gegevens over uw gesprekken) worden onderschept en eigendom zijn van / worden beheerd door Facebook / WhatsApp.

Verder is het belangrijk om te weten dat encryptie NIET van toepassing is op de WhatsApp back-ups.

Zoals hieronder wordt uitgelegd, kunt u dus overwegen whatsApp-back-up uit te schakelen om uw gegevens te beschermen.

En als je er toch voor wilt kiezen om WhatsApp te gebruiken, kun je de privacy en beveiliging in alle lagen van de applicatie beter vergrendelen.

Algemene beveiligingsregels

Minimaliseer uw gegevens

Over het algemeen is het altijd slim om uw gegevens in de applicatie te minimaliseren.

• Geef geen persoonsgegevens weg
• houd uw profielgegevens tot het minimum dat nodig is

Ga naar het WhatsApp status tabblad (rechts naast chats)

en klik vervolgens op “Instellingen” (Settings)

Ook, heel belangrijk, beperk het delen van persoonlijke gegevens, er is een specifieke set opties in het gedeelte Privacy.

• uw profiel alleen delen met vertrouwde contactpersonen
• De publicatie van
  • “laatst gezien” tijdstempel
  • profielfoto
  • status
  • groepen
  • live locatie
  • …

Stel voor elk van deze opties de juiste keuze in om delen uit te schakelen.

Kies “Alleen delen met…” (Only Share with…) > geen contactpersonen selecteren (of enkel een beperkte set vertrouwde contactpersonen)

Resultaat

Zorg er ook voor dat u het “Vingerafdrukslot” (Fingerprint lock) inschakelt, indien beschikbaar op uw smartphone.

Koperstip: voor de volgende smartphoneaankoop moet u rekening houden met de beschikbaarheid van een vingerafdrukscanner op uw telefoon.

Houd de app up-to-date

Werk uw apps continu bij, incl. WhatsApp, naar de nieuwste versie, om ervoor te zorgen dat alle beveiligingsfouten of beveiligingsproblemen meteen worden opgelost.

De meeste beveiligingsinbreuken of hacks richten zich specifiek op verouderde software.

Hoe u uw WhatsApp-beveiliging kunt vergrendelen, de controlelijst

Zonder beveiligingsconfiguratie is het vrij eenvoudig om een WhatsApp-account te kapen, omdat de eerste registratie alleen is gebaseerd op mobiele nummerregistratie en / of sms (kort bericht).

Dit maakt de eerste WhatsApp-gebruiker extreem gevoelig voor accountovername. Wees niet het volgende slachtoffer en vergrendel WhatsApp vanaf het eerste gebruik.

Whatsapp tweestapsverificatie (2FA) of multifactorauthenticatie (MFA) inschakelen

Allereerst moet je MFA inschakelen, het is een must.

Wanneer je 2FA / MFA inschakelt op de WhatsApp-instellingen, voorkom je dat iemand anders gewoon je telefoonnummer of WhatsApp-account kan overnemen.

Gebruik de sterke authenticatie van je telefoon

E-mailadres registreren voor je account

Een pincode instellen

Houd er rekening mee dat de pincode in WhatsApp geen inlogmethode is, maar een herstel- / herinstallatiefunctie.

Meer info: https://faq.whatsapp.com/android/security-and-privacy/adding-a-password/?lang=en

Maar u kunt de smartphonebeveiliging gebruiken om toegang tot toepassingen in te schakelen.

Het wordt sterk aangeraden om 2FA of MFA (multifactorauthenticatie, zoals uitgelegd in eerdere paragrafen) in te schakelen.

Whatsapp-tweestaps- of multifactorauthenticatie inschakelen

Gebruik telefoon sterke authenticatie

Vingerafdruk

Binnen de privacy-instellingen vindt u de optie “Vingerafdrukvergrendeling” (als uw smartphone de vingerafdrukscanner aan boord heeft).

Ga naar Instellingen > Account > Privacy om de vingerafdrukvergrendeling in te schakelen

Selecteer vervolgens de laatste optie (Vingerafdrukvergrendeling)

In dit vingerafdrukvergrendelingsmenu kunt u de ontgrendeling inschakelen en de time-outperiode kiezen. Hou het kort.

(Misschien is “meteen”/”immediately” een beetje lastig, zet ‘m dan op 1 minuut bijvoorbeeld…)

De beveiligingsmeldingen inschakelen

In de account settings

er is een beveiligingsoptie

Zorg ervoor dat u de optie “Beveiligingsmeldingen weergeven” inschakelt.

Dit zorgt ervoor dat u meldingen ontvangt wanneer de beveiligingscode van uw contacten verandert.

De privacy-instellingen vergrendelen

Verwijder overbodige persoonsgegevens uit uw profiel

Er is niet veel informatie die u zelf aan uw profiel kunt toevoegen.

Houd het tot het strikte minimum, en ik stel ook voor om geen persoonlijke foto toe te voegen, maar eerder een algemene foto.

Schakel in de privacyinstellingen alle publicatie van uw profielgegevens uit.

Locatietracking stoppen

Een belangrijke optie in de vorige lijst is ook het uitschakelen van locatietracking (“Live locatie”).

Back-up uitschakelen

Hoewel WhatsApp end-to-end-codering gebruikt voor zijn berichten, wordt de codering niet gehandhaafd wanneer de gegevens in de back-up worden opgeslagen

Als u zich echt zorgen maakt over privacy en beveiliging, schakelt u de back-up uit.

Trouwens, als u het verlopen van het bericht activeert, is de back-up toch overbodig…

Select de “Chats” optie

Kies in de chatoptie de optie “Chat back-up”

In de Google drive settings (tenminste voor Android devices), selecteer “Backup to Google Drive” en selecteer dan “Nooit/Never”.

Berichtvervaltijd inschakelen (berichten verdwijnen)

Als u het verlopen van berichten wilt inschakelen, moet u dit instellen op accountniveau van uw contactpersoon of op groepsniveau

Er is geen algemene beveiligingsinstelling en u kunt deze ook niet instellen op berichtniveau.

Waarschuwing

Houd er rekening mee dat het verdwijnen van berichten in WhatsApp enkele problemen kan hebben: https://www.androidauthority.com/whatsapp-disappearing-messages-feature-1173692/

Op contactniveau

Berichtvervaltijd op groepsniveau inschakelen

You can set the same options on group level too.

It’s highly suggested to enable these group options, and make sure information is not kept longer as needed.

Andere operationele beveiligingstaken

Verouderde leden uit groepen verwijderen

Het is heel belangrijk om groepen die u beheert te bewaken en overbodige leden zo snel mogelijk te verwijderen.

Zo voorkom je dat er gegevens ‘lekken’ naar deelnemers die die informatie niet nodig hebben.

Groepen verlaten die u niet meer gebruikt

Controleer groepen waarvan u lid bent en sluit deze groepen af/afsluit deze groepen als u ze niet meer nodig hebt, als u geen informatie meer wilt delen of als u niet wilt dat leden uw informatie/berichten zien.

Zo voorkomt u dat u gegevens ‘lekt’ naar deelnemers om u te zien of te volgen.

Verzoek om toegang tot gegevens

Als je de informatie wilt controleren die WhatsApp over je weet, kun je een kopie van die infromation aanvragen

Ga naar je accountinstellingen

En klik vervolgens op de optie “Informatie aanvragen”

Overweeg om andere tools te gebruiken, enkele alternatieven

Source:

• https://www.makeuseof.com/tag/forget-whatsapp-6-secure-communication-apps-youve-probably-never-heard/

Als je echt niet wilt toegeven aan privacy, kijk dan eens naar alternatieven die niet zijn gebouwd door bedrijven die geld verdienen met je persoonlijke gegevens…

• Signal (free) (https://signal.org/)
• Threema (which has versions… check https://threema.ch/en)

Referenties

Whatsapp

• WhatsApp Security: https://www.whatsapp.com/security/
• About end-to-end encryption: https://faq.whatsapp.com/general/security-and-privacy/end-to-end-encryption/?lang=en
• https://www.whatsapp.com/safety
• WhatsApp Encryption Overview: http://www.cdn.whatsapp.net/security/WhatsApp-Security-Whitepaper.pdf
• WhatsApp Stolen Accounts: https://faq.whatsapp.com/general/account-and-profile/stolen-accounts/?lang=en

Jezelf beschermen tegen WhatsApp-hacks

• https://www.csa.gov.sg/singcert/advisories/ad-2020-007

Uw gestolen account herstellen

• https://www.thequint.com/tech-and-auto/tech-news/whatsapp-account-hacked-here-is-how-you-can-recover
• https://indianexpress.com/article/technology/social/whatsapp-account-stolen-hacked-how-to-recover-6470640/

Andere bronnen – aanvullende referenties die je kan raadplegen

• https://www.theverge.com/2020/1/23/21068815/whatsapp-two-factor-authentication-how-to-security-privacy-hacking-pin-backup
• https://learn.tibcert.org/knowledge-base/best-practices-to-make-whatsapp-more-secure-and-private/
• https://www.wired.co.uk/article/whatsapp-privacy-security-settings
• https://www.forbes.com/sites/zakdoffman/2020/11/29/stop-using-dangerous-whatsapp-settings-on-apple-iphone-and-google-android/
• https://www.howtogeek.com/658977/how-to-secure-your-whatsapp-account/
• 8 Tips to Make WhatsApp More Secure and Private: https://www.makeuseof.com/tag/whatsapp-secure-tips/

Download

Dit artikel in het Nederlands kan je in PDF downloaden via deze link:

https://identityunderground.files.wordpress.com/2021/06/whatsapp-security-lockdown-step-by-step-nl-v1.pdf

Whatsapp security lockdown step-by-step

(NL versie vind je hier: https://identityunderground.wordpress.com/2021/06/07/whatsapp-security-dichttimmeren-stap-voor-stapnl/)

Are you using WhatsApp, or considering (or invited to, by contacts)?

Then the checklist below should provide you with detailed steps to

• consider if it’s worth using WhatsApp
• lock down the security of your WhatsApp to keep as secure as possible

Download this article

At the end of this article, you can also find the download link for an offline version of this article.

If you really care about privacy and it’s paramount…

As explained below you surely can lockdown WhatsApp, but they still have your data and metadata and they define the rules by which WhatsApp runs the show. And that can change, whenever they want.

And you should know that WhatsApp is owned and managed by Facebook.
And Facebook already has proven to maintain a really bad reputation when it comes down to privacy…

If you really do not want to give in on privacy, better check for alternatives that are not built by companies that make money with your personal data… (see end of this article).

It’s up to you to decide what risk you want to take. If you want to balance the use of WhatsApp and your privacy with the best possible security, continue to read.

If you care about privacy and still want to use Whatsapp

End-to-end encryption

The good news is, WhatsApp is using an end-to-end encryption.

And although Facebook or other parties might not listen in on your conversations, the contact data, the meta data (the data about your conversations) might be intercepted, and is owned/managed by Facebook/WhatsApp.

Furthermore it’s important to know that encryption DOES NOT apply to the WhatsApp backups.

So, as explained below, you might consider disabling WhatsApp backup to protect your data.

And if you still want to choose to use WhatsApp, better lock down the privacy and security in all layers of the application.

General security rules

Minimize your data

In general it’s always smart, to minimize your data in the application.

• Don’t give away personal data
• keep your profile data to the minimum needed

Go to the WhatsApp status tab

then click “Settings”

Also, very important, limit personal data sharing, there is a specific set of options in the Privacy section.

• only share your profile with trusted contacts
• Disable the publication of
  • “last seen” time stamp
  • profile photo
  • status
  • groups
  • live location
  • …

For each of these options set the right choice to disable sharing.

Choose “Only Share with…” > do not select any contacts (or a limited set of trusted contacts)

Result

Also make sure to enable the “Fingerprint lock” if available on your smartphone.

Buyers tip: for next smartphone purchase you must consider the availability of a fingerprint scanner on your phone.

Keep the app up to date

Continuously update your apps, incl. WhatsApp, to the latest version, to make sure that all security bugs or security issues are fixed right away.

Most of security breaches or hacks do specifically target outdated software.

How to lock down your WhatsApp security, the check list

Without security configuration it’s fairly easy to hijack a WhatsApp account, as the initial registration is only based on mobile number registration and/or SMS (short message).

This makes the initial WhatsApp user extremely sensitive to account take over. Don’t be the next victim, and lock down WhatsApp from the first use.

Enable Whatsapp Two-step (2FA) or multifactor authentication (MFA)

First of all you need to enable MFA, it’s a must.

When you enable 2FA/MFA on the WhatsApp settings, you avoid that someone else simply can take over your phone number or WhatsApp account.

Use phone strong authentication

Register email address to the account

Set a pin/password

Be aware that the PIN in WhatsApp is not a login method but a recovery/reinstallation feature.

More info: https://faq.whatsapp.com/android/security-and-privacy/adding-a-password/?lang=en

But you can use the smartphone security to enable application access security.

It’s strongly suggested to enable 2FA or MFA (multifactor authentication, as explained in previous paragraphs.

Enable Whatsapp Two-step or multifactor authentication

Use phone strong authentication

Finger print

Within the privacy settings, you can find the option “Fingerprint lock” (if your smartphone has the fingerprint scanner on board).

To enable the fingerprint lock, Go to Settings > Account > Privacy

Then select the last option (Fingerprint lock)

In this Fingerprint lock menu, you can enable the unlock and choose the time-out period. Keep it short.

(Maybe immediately is a bit inconvenient…)

Enable the security notifications

In the account settings

there is a security option

Make sure to enable the “Show Security notifications” option.

This will make sure you get notifications when the security code of your contacts change.

Lock down the privacy settings

Remove redundant personal data from your profile

There is not a lot of info you can add to your profile yourself.

Keep it to the strict minimum, and I also would suggest not to add a personal photo, but rather a general photo.

In the privacy settings, disable all publication of your profile data.

Stop location tracking

An important option in previous list is also to disable location tracking (“Live location”).

Disable backup

Although WhatsApp is using end-to-end encryption for it’s messaging, the encryption is not maintained when the data is stored in the backup

If you really are concerned about privacy and security, you disable the backup.

By the way, if you activate message expiration, the backup is redundant anyway…

Select the “Chats” option

In the chats option, choose the “Chat backup” option

In the Google drive settings (at least for Android devices), select “Backup to Google Drive” and then select “‘Never”.

Enable message expiration (disappearing messages)

To enable message expiration, you’ll need to set it on the account level of your contact or on group level

There is no general security setting, nor can you set it on the message level.

Warning

Please be aware that disappearing messages in WhatsApp might have some issues: https://www.androidauthority.com/whatsapp-disappearing-messages-feature-1173692/

On contact level

Enable message expiration on group level

You can set the same options on group level too.

It’s highly suggested to enable these group options, and make sure information is not kept longer as needed.

Other operational security tasks

Remove obsolete members from groups

It’s quite important to monitor groups you manage and remove redundant members as soon as possible.

This way you avoid ‘leaking’ data to participants who do not need that information.

Leave groups you don’t use anymore

Monitor groups you are member of, and you should quit/exit these groups if you do not need them anymore, or you do not want to share information anymore, or if you don’t want members to see your information/messages.

This way you avoid ‘leaking’ data to participants to see you or track you.

Data access request

If you want to check the information that WhatsApp knows about you, you can request a copy of that infromation

Go to your account settings

And then click the “Request Information option”

Consider to use other tools, some alternatives

Source:

• https://www.makeuseof.com/tag/forget-whatsapp-6-secure-communication-apps-youve-probably-never-heard/

If you really do not want to give in on privacy, better check for alternatives that are not built by companies that make money with your personal data…, like

• Signal (free) (https://signal.org/)
• Threema (which has versions… check https://threema.ch/en)

Reference

Whatsapp

• WhatsApp Security: https://www.whatsapp.com/security/
• About end-to-end encryption: https://faq.whatsapp.com/general/security-and-privacy/end-to-end-encryption/?lang=en
• https://www.whatsapp.com/safety
• WhatsApp Encryption Overview: http://www.cdn.whatsapp.net/security/WhatsApp-Security-Whitepaper.pdf
• WhatsApp Stolen Accounts: https://faq.whatsapp.com/general/account-and-profile/stolen-accounts/?lang=en

Protecting yourself from WhatsApp hacking

• https://www.csa.gov.sg/singcert/advisories/ad-2020-007

Recover your stolen account

• https://www.thequint.com/tech-and-auto/tech-news/whatsapp-account-hacked-here-is-how-you-can-recover
• https://indianexpress.com/article/technology/social/whatsapp-account-stolen-hacked-how-to-recover-6470640/

Other sources – additional references you can check

• https://www.theverge.com/2020/1/23/21068815/whatsapp-two-factor-authentication-how-to-security-privacy-hacking-pin-backup
• https://learn.tibcert.org/knowledge-base/best-practices-to-make-whatsapp-more-secure-and-private/
• https://www.wired.co.uk/article/whatsapp-privacy-security-settings
• https://www.forbes.com/sites/zakdoffman/2020/11/29/stop-using-dangerous-whatsapp-settings-on-apple-iphone-and-google-android/
• https://www.howtogeek.com/658977/how-to-secure-your-whatsapp-account/
• 8 Tips to Make WhatsApp More Secure and Private: https://www.makeuseof.com/tag/whatsapp-secure-tips/

Download

The current article is available for download here: https://identityunderground.files.wordpress.com/2021/06/whatsapp-security-lockdown-step-by-step.pdf

Security & Privacy Life Hack: advantages of a personal mail alias

Table of Contents

• Introduction.
  • What’s the issue? .
• Implementing the mail alias .
  • What is a mail alias? .
  • Purchase a Custom domain name
  • Use the “+” mail alias
• Using dummy or temporary addresses against spam and registration wall
  • Your custom domain.
  • Temporary mail (when using your custom domain)
• Advantages
  • Keep your inbox clean : Mail filtering using simple mail rules
  • Securing internet logins
  • Detecting data breaches
  • On/Off Temporary mail (when using your custom domain)
  • One time use temporary mail domains
• Disadvantages
  • Custom domain management
  • If you cannot disable “+” aliases … .
  • Temporary mail domains blocked & open access
• Bonus: the “oh shit mail rule”
• Some useful references
  • Gmail
  • Microsoft Office 365 “+” alias
  • Yahoo
  • Other providers
  • Custom mail address RFC standard

Introduction

You’ve probably got one or more personal and professional mail addresses. Who doesn’t?

And you probably want to keep that mail address safe from spammers, scammers or data theft.

Althoug you primarily use mail to communicate (send/receive messages), many platforms also use your mail address for authentication.

Security remark: It’s not always the best option to use single sign-on with platforms like LinkedIn, Facebook, Microsoft Account, Google, …

What’s the security issue?

The main issue with single sign-on is: when your mail address is breached or hacked, the hacker can use the breached mailbox fairly easily to login to the linked platforms.

And from a practical point of view, if you use that single personal mail address to subscribe to newsletters or you use that mail address for downloads protected by a “registration” wall, you’ll quickly experience a mailbox overload because of ‘spam’, eh.. .sorry commercial messages you didn’t ask for.

Another issue is, you usually have only 1 (one) personal mail address available on your mail platform, certainly for enterprise systems, you can’t create other alternative mail addresses at free will. Unless you own the domain name, of course, but that’s rather possible for personal use or small companies…

And except for the mail overload, you’ll notice that many companies sell your mail address to address brokers. And even with the GDPR in place, many of these address brokers have bad habits to scrape mail addresses from the internet, incl. public sources, government sources…

So, the question is, how do you manage this, to protect your personal data, to protect mailbox overload and abuse of your mail address?

First option is using MFA to increase security and block illegal authentication.

But MFA does not stop mail abuse. The mail alias to the rescue!

Implementing the mail alias

What is a mail alias?

A mail alias is an alternative name for the master mailbox. Usually a mail alias is forwarding mail to the target mailbox.

In many cases, that mail alias can also be setup or used as a temporary name for the target mailbox. It’s pretty cumbersome or difficult to switch a master mailbox on or off when you need it.

Purchase a Custom domain name

The most interesting option is purchasing a custom domain name (by preference a short URL).

In most cases, local domain registrars can offer you a custom mail domain of choice for a few bucks a year. It’s worth the money, I promise. Further explanation below.

Just a practical hint: make sure to use a domain registrar that offers unlimited mail aliases.

When you control the mail domain, you can forward any mail alias of the custom domain to your mailbox (eg news@short.url to subscribe to newsletters and filter them in your mailbox in a subfolder for newsletters).

Furthermore, when you own a domain, you can enable/disable a mailbox or alias. Meaning: block mail reception without deleting the mail address (keep the address, but desactivate it.)

Using the “+” mail alias option

If purchasing a custom domain is not an option, you can check with your mail platform or mail administrator to use a “+” alias.

That’s format supported by the internet standards (RFC 5233: https://tools.ietf.org/html/rfc5233), that allows to extend a master mail address with receiver suffixes (BEFORE the @ sign), that still deliver the mail to the receiver. Google calls it “task based” variations of the mail address.

You’ll generally find it back on the internet as “+” aliases (“plus” aliases).

Some examples:

• firstname.lastname+download@yourdomain.url, or
• name+news@yourdomain.url

See the references section at the end of the article, for details how this “+” alias works for the well known mail platforms… Google, Microsoft, … and the major free mail providers support the plus-alias.

Using dummy or temporary addresses against spam and registration walls

I don’t know how you do it, but it frequently happens that I need to download a “free” white paper, which only seems to be free if you ‘pay’ with your contact details.

In most of the cases, they force you to “consent” with the requirement to send you marketing,… in GDPR terms it’s not considered consent if it’s forced… But essentially they force you to submit your personal data.

If you don’t want to disclose your data, just for that single download, or … if you want to avoid getting too much spam, what do you do?

One-time use, temporary mail domains (not your own domain)

First and easy option is to search the internet for “temp mail”, “temporary mail addresses” or “disposable mail“, … synonyms for one time use mails.

You use these addresses for quick use, one shot hit.

Samples:

• mailinator.com
• temp-mail.org
• guerillamail.com
• mail.tm
• many more…

Use your custom domain

An easier, but less free, but still cheap option, is to purchase your own custom domain (on the condition you can have multiple mailbox aliases).

The quick and dirty: create an alias like download@yourdomain.url, keep it disabled by default and only enable it when you need to receive a download link. Afterwards, disable it again.

In some cases you literally need to have a mail address just once. Eg, when you want to download a “free” white paper, many companies harvest your mail, put it in a CRM system and keep spamming you afterwards. It’s fairly difficult to escape the forced consent or registration.

Then you can use a temporary mail alias:

1. you enable an alias or dummy address,
2. register for the download with the alias/dummy,
3. then disable the alternative mail address again.

That way the address cannot be harvested for spam or marketing you don’t need. Easy.

(When a address broker tries to use the disabled alias, they will get an NDR, non-delivery report, and delete the invalid mail registration from their farm…)

Advantages

Keep your inbox clean : Mail filtering using simple mail rules

One the most prominent advantages of using aliases is that most of the mail clients can use the receiver address (or alias) to filter and manage incoming mail.

Based on the target receiver alias, you can set simple rules to move incoming mail from your inbox to another folder.

Basically an mail alias offers a simple mailbox optimization technique to make your life easy.

Securing internet logins

Another major advantage of aliases: use it as an alternative identifier for single sign-on.

Instead of logging in to multiple platforms with the same mail address, you better use 1 unique alias address per platform.

For example:

• linkedin@short.url for LinkedIn,
• facebook@short.url for facebook
• twitter@short.url for Twitter
• and so on…

Of course it’s quite important to use different passwords or authentication methods too (incl. MFA).

The main reasoning behind this approach is: if 1 login is breached or leaked, the other accounts are not impacted. If you don’t think you can manage this collection of passwords, there is one good tip: use a password manager to replace your memory.

Use a password manager anyway.

Detecting data breaches

When you use 1 mail address (alias) for every internet login, you can also trace very easily if a website is selling your data to partners, other companies or personal data brokers. You can simply see who sends mail, if that source domain is correctly linked to your alias… or not. If your login is used by unauthorized party you can initiate GDPR subject data access request to track how it got there (against both the original data controller and the secondary party).

And when using a custom domain (or some “+” alias mail providers), you can simple disable or remove the mail alias, so it becomes useless for the perpetrators.

On/Off Temporary mail (when using your custom domain)

In some cases you literally need to have a mail address just once. Eg, when you want to download a “free” white paper, many companies harvest your mail, put it in a CRM system and keep spamming you afterwards. It’s fairly difficult to escape the forced consent or registration.

When you can use a temporary mail, you enable an alias or dummy address, register for the download with the alias/dummy, then disable the alternative mail address again. That way the address cannot be used for spam or marketing you don’t want. Easy.

One-time use temporary mail domains

First and easy option is to search the internet for “temp mail” or “temporary mail addresses”

You use these addresses for quick use, one shot hit. No hassle, no admin. Quick and dirty.

Some more advantages

You can also link your custom domain to shortener tools like bit.ly. This way you can manage your social media and easily track your popularity or maintain statistics on your articles and views. (For Bitly, search for “bitly custom domain”)

Disadvantages

Custom domain management

Managing your own custom domain might be cumbersome, depending how user friendly the management of aliases is. Certainly managing dynamic aliases for multiple users… can time consuming. Certainly if you have a large volume of mailboxes and/or aliases to manage.

But managing a custom domain for own personal use, for a few bucks a year, is really worth the time and money. 

If you cannot disable “+” aliases …

… then you might be in trouble, because you cannot stop the abuse once the senders have registered the alias in their mail system.
In many cases, you’ll need to unsubscribe or directly contact the platform owner and demand to remove your data, which can be cumbersome or time consuming… Or you need to excercise your right to be forgotten in the official way. (Ref. GDPR, …)

Temporary mail domains blocked & open access

The major disadvantage is that a lot of spam (eh sorry), marketing websites that offer these ‘free’ downloads, will recognize and block public temporary mail domains (like mailinator, guerilla mail, temp mail, …).

In most cases you’ll have to try a few options, as some of these temporary mail domains have alternative mail domain options, like dynamic domains not only hosting main on the master domain.

VERY IMPORANT SECURITY NOTICE: whatever mailbox you use on these temporary domains, anyone can read or access these mailboxes, so make sure nothing important or private is sent to these mailboxes.

Bonus: the “oh shit rule”

While I’ve been focusing on the security & data protection features of the mail alias, I still want to mention an important principle to protect your reputation: the “oh shit rule”.

The principle is simple: delay the sent articles with one or more minutes before the mails are actually sent to the receiver.

It gives you a bit of slack if you want to fix a mail, or in worst case scenario cancel the mail if you have second thoughts or regret sending the mail, to avoid embarrassment or being forced to search for a new job.

Some useful references

Below you’ll find some interesting articles on managing aliases on the well-known mail providers

Gmail

• Gmail “+” alias: https://support.google.com/a/users/answer/9308648
• Gmail variations: Dots don’t matter in Gmail addresses

Microsoft Office 365 “+” alias

• Plus Addressing in Exchange Online
• Exchange Online PowerShell V2 module

Yahoo

• https://help.yahoo.com/kb/create-edit-delete-disposable-email-addresses-yahoo-mail-sln28338.html

Other providers

Other providers, like Protonmail, … also provide the alias “+” option, sometimes by default. Carefully check if you can remove the “+” alias or not, in case the alias got listed by address brokers.

Custom mail address RFC standard

https://tools.ietf.org/html/rfc5233

BTW, did you know… that following the RFC standards, an email address is case sensitive. 😉

Excel Security and Not Excel security, that’s the question

Executive overview

Excel has various levels of protection.
Many people use worksheet protection.  This feature is designed as a simple blocker to avoid unwanted edits to your sheet. Users can open and use the file without the protection password.

By design, Excel sheet protection is NOT a security measure, to keep data secret or to hide IP or formulas from unauthorized parties. The worksheet protection password is fairly easy to remove as explained below.

If you want actual protection in your Excel sheet, you need to use the encryption feature, but then every user will be forced to enter a password to open the file.  Which is difficult from usability point of view. And you need to apply security for each user separately.

Applies to

This discussion actually applies to the latest version of Excel in the Office 365 version. Some options or features might not be available or might not apply to previous/older versions of MS office.

Introduction

If you spend a lot of time to build a smart calculations or data management solutions in Excel, it’s very likely that you want to protect your hard word, or the smart layout or the intelligence behind your calculations. Or simply avoid any accidents crippling the nice layout.

Most people will first think about worksheet protection to achieve this, but there are some more options.

Excel Security options

If you create or open an Excel sheet (in current version of Office 365), you can add security via the menu “FIle” then choose the “Info” option.

Then click the “Protect Workbook” option.

Worksheet protection

In short: Worksheet protection is not intended to be a security feature.

And that’s documented at: https://support.microsoft.com/office/protect-a-worksheet-3179efdb-1285-4d49-a9c3-f4ca36276de6

From the Microsoft support document, the security impact of the protection features is explained as (quote):

“Important: 

• Worksheet level protection is not intended as a security feature. It simply prevents users from modifying locked cells within the worksheet.
• Protecting a worksheet is not the same as protecting an Excel file or a workbook with a password. See below for more information:

• To lock your file so that other users can’t open it, see Protect an Excel file.
• To prevent users from adding, modifying, moving, copying, or hiding/unhiding sheets within a workbook, see Protect a workbook.
• To know the difference between protecting your Excel file, workbook, or a worksheet see Protection and security in Excel.“

Even with worksheet protection, the formulas are stored in the file as this is what allows you to later modify the formulas and for the cells to update their values. Because the file is not encrypted, a user could inspect the file contents to determine what the formulas are.

For advanced Excel users:

• There are mechanisms that allow you to remove formulas from the workbook while keeping the cell values the same. When this is done, these cell values no longer update as they no longer have a formula.
• If you want to strip out a formula that refers to another workbook, you can use the break link feature for external links (Data tab > Queries and Connections section > Edit Links > Break Link) – this keeps the current value of the cell and removes the formula referencing the external workbook.
• If you want to strip out a formula regardless of where it refers to, the easiest way to do this is to copy the cell and paste as value to the same cell.

Implementing worksheet protection

Implementing worksheet security using encryption

Managing cell security

Before you activate worksheet protection, you need to consider unblocking cells to allow edit when protection is activated. Right click the target cells, you want to leave unprotected.

In the cell format options, “Locked” is enabled by default. Uncheck if you want to edit after password lock.

Next, to activate worksheet protection, right click the worksheet tab (below) and click the Protect sheet option.

You  can select which kind of protection you need on the level of the sheet and cells.

You need to enter the password and then reconfirm, of course.

Now, when you try to edit the cells that are blocked, you’ll get an error.

The actual Excel security: sheet encryption

To implement actual security, you need to encrypt the file.
When you want to use encryption, go back to the file menu and workbook protection, as explained earlier.

Choose the encryption option

When you save the file and try to reopen it, you’ll get a password prompt.

In one of the next chapters below, I’ll show what happens with the file security, and if you can hack it… or not.

Hacking Excel worksheet protection

The actual reason for this article, is that the worksheet protection is NOT a security feature and more important, the worksheet protection can be broken in a matter of seconds.

You’ll find a lot of password cracking tools, brute force password guessing or macro scripts to crack the passwords. Don’t bother if you simply want to remove the password protection.

The worksheet protection is embedded in the XLSX file, as XML. And you should consider the XLS sheet as a compressed/zipped dossier/file collection of config files containing the hashed password.

And that’s exactly the easy shortcut to remove the password, remove the password hash.
I won’t go in detail on the steps, but it’s about renaming the XLS file to zip, opening the zip, removing the pasword hash, saving the file, rename to XLS and open your sheets without password protection.

The method is explained over here: http://www.excelsupersite.com/how-to-remove-an-excel-spreadsheet-password-in-6-easy-steps/

Hacking encryption? (Nope!)

Using the XLS to Zip rename, you can inspect the file content of the encrypted file.

When you try the same technique, removing the encryption info…you’ll notice that the “EncryptionInfo” is not allowing to save. And you can’t remove the encryption (at least not this way, here we stop… )

When you try to remove the encryption tag, including the cipher and password hash, you’ll notice it won’t work.

Reporting security issues to Microsoft

If you think or suspect to have found a security issue in a Microsoft product, don’t hesitate to report it.

To report a vulnerability in a Microsoft product or service, got to the Microsoft Security Response Center (MSRC) website at : https://www.microsoft.com/msrc.

You can track the status of your report as the MSRC team will work with you to investigate and resolve the issue. Or confirm that a suspected behaviour is not a security issue, but a light-weight protection to avoid layout incidents.

Extended mapping of CIS Controls to ISO27001 security controls

Introduction

The CIS (Center for Information Security) Controls list is a very well known list of security measures to protect your environment against cyberattacks.
The Center for Information Security provides a handy XLS sheet for download to assist in your exercise.

Here is the link: https://www.cisecurity.org/controls/cis-controls-list/

Many companies use this controls list already, but also require to map their CIS security controls to ISO27001, for various reasons.

Implementing security controls with regards to the NIS directive, is one of them, eg when you’re implementing OT…

ISO27001 controls mapping

For that purpose the CIS provided a XLS mapping between the CIS controls and ISO27001.

You can download the sheet from the CIS website: https://learn.cisecurity.org/controls-sub-controls-mapping-to-ISO-v1.1.a

Security note for the security freaks, apparently the document is hosted on the pardot(dot)com Salesforce website, which might be blocked by Adlist domain blockers as it’s used for marketing campaigns, you might need to unblock it, or use Tor browser…)

Alternatively, it’s available from the CIS Workbench community at: https://workbench.cisecurity.org/files/2329 (registration might be needed to access the download)

FYI, the previous version (2019, v1) of the mapping had quite some gaps. Therefor I’ve submitted a suggestion for an updated CIS-ISO27001 mapping.
And after review, a new version (1.1) with updates has been published on the CIS workbench.

Direct download for version 1.1 available at: https://workbench.cisecurity.org/files/2329/download/3615

Still some gaps

You’ll notice that the update (1.1) version has still some gaps. And I’ll leave to the discretion of the CIS review work group to argument these gaps.

But I’m convinced you can map the CIS controls for 100% to ISO27001, in one way or another, meaning use ALL ISO27001 controls in certain extent (sometimes a subset, equally or a superset of it, combining controls.)

But the license for use of the CIS controls mapping does not allow redistribution of modified materials…

Disclaimer (the small print)

Here’s the License from the mapping file:

Their work (quote) “is licensed under a Creative Commons Attribution-Non Commercial-No Derivatives 4.0 International Public License (the link can be found at https://creativecommons.org/licenses/by-nc-nd/4.0/legalcode

To further clarify the Creative Commons license related to the CIS ControlsTM content, you are authorized to copy and redistribute the content as a framework for use by you, within your organization and outside of your organization for non-commercial purposes only, provided that (i) appropriate credit is given to CIS, and (ii) a link to the license is provided. Additionally, if you remix, transform or build upon the CIS Controls, you may not distribute the modified materials. Users of the CIS Controls framework are also required to refer to (http://www.cisecurity.org/controls/) when referring to the CIS Controls in order to ensure that users are employing the most up-to-date guidance. Commercial use of the CIS Controls is subject to the prior approval of CIS® (Center for Internet Security, Inc.).”

So I CANNOT distribute the XLS as modified material (Why not?).

Extending the mapping

If you still want to build an extended version of the mapping on your own, you download the 1.1 version and add these items to the list:

CIS section	Coverage	ISO27001 Control
2.2	=	A.12.5.1
2.5	=	A.8.1.1
2.8	small subset	A.12.5.1
2.10	small superset	A.9.4.1/A.8.2
3.1	small subset	A.12.6.1
3.2	small subset	A.12.6.1
3.4	small subset	A.12.6.1
3.5	small subset	A.12.6.1
3.6	small subset	A.12.6.1
4.1	small superset	A.8.1.1/A.9.2.3
6.5	small subset	A.12.4.1
6.6	small subset	A.12.4.1
6.8	small subset	A.12.4.1
7.3	small subset	A.12.2.1
7.5	small superset	A.8./A.13.1.1
7.6	small subset	A.13.1.1
8.3	small subset	A12.2.1
9.5	small subset	A.13.1.1
10.2	small subset	A.12.3.1
10.5	=	A.12.3.1
11.1	small subset	A.13.1.1
11.2	small subset	A.13.1.1
11.6	small subset	A.13.1.1
12.1	small subset	A.13.1.1
12.5	small subset	A.13.1.1
12.10	small subset	A.13.1.1
13.2	small subset	A.11.2.5
14.7	small subset	A.8.2.3
16.2	small subset	A.9.3.1
16.3	small subset	A.9.3.1
16.9	small subset	A.9.2.1
16.10	small subset	A.9.2.1
16.12	=	A.12.4.1
16.13	=	A.12.4.1
17.1	=	Clause 7.2
18.3	=	A.12.5.1
18.4	=	A.12.5.1
18.7	=	A.14.2.9
18.10	small subset	A.14.2.5
18.11	small subset	A.14.2.5
19.3	small subset	A16.1.1
19.6	small subset	A16.1.2
19.7	small subset	A16.1.1
19.8	small subset	A16.1.4
20.1	small subset	A18.2.3
20.2	small subset	A18.2.3
20.3	small subset	A18.2.3
20.4	small subset	A18.2.3
20.5	small subset	A18.2.3
20.6	small subset	A18.2.3
20.7	small subset	A18.2.3
20.8	small subset	A18.2.3

Planning for ISO Certification using CIS Controls?

When you look at it from a different angle and you would like to build a plan to certify your ISO27001 implementation, we need to turn around the mapping, and look for the gaps in the ISO27001 security controls AND CLAUSES, when doing the CIS control mapping.

And then you’ll notice the explicit difference in approach between CIS controls and ISO27001 controls.
CIS controls are focusing on technical implementation to harden your cybersecurity, while ISO27001 is a management system that needs these controls, but requires a management layer to support these technical controls. CIS controls are lacking this management layer.
If you compare both systems in a table the story gets clear:

The “red” areas require extra work to make it ISO27001 compliant.

And as always, if you have suggestions of feedback to improve this article, let me know, I’ll fix it on the fly.