Kurt Shintaku's Blog

Deprecating NT LAN Manager (NTLM) has been a huge ask from our security community as it will strengthen user authentication, and so we are announcing that deprecation of NTLM is planned in the 2nd half of 2024 in Windows.

Why?

• No server authentication (read: can’t verify malicious authentication servers)
• Legacy MD4 encryption used for hashing password (read: weak & guessable)
• Password submitted not salted (read: offline crackable)
• Only supports password-based authentication (read: no certs, biometrics, MFA, FIDO, etc.)
• Bugs (read: vulnerabilities)

Read more at:

• New Windows 11 features strengthen security to address evolving cyberthreat landscape | Microsoft Security Blog
• We, Microsoft, are deprecating NTLM, and want to hear from you : r/sysadmin (reddit.com)
• The Evolution of Windows Authentication
  • The Evolution of Windows Authentication (Video)
  • The Evolution of Windows Authentication (Blog)
• BlueHat Oct 23. S18: Deprecating NTLM is Easy and Other Lies we Tell Ourselves

The SharePoint Add-In model in SharePoint Online has been retired as of November 27th 2023. Microsoft will be retiring the SharePoint Add-In extensibility model over the following timeline:

• SharePoint Add-Ins will stop working for new tenants as of November 1st, 2024
• SharePoint Add-Ins will stop working for existing tenants and will be fully retired as of April 2nd, 2026

This applies to all environments including Government Clouds and Department of Defense. For more details, visit:

• BLOG: SharePoint Add-In retirement in Microsoft 365
  https://aka.ms/retirement/addins/update
• ARTICLE: SharePoint Add-In retirement in Microsoft 365
  https://aka.ms/retirement/addins/support
• Modernization guidance for existing SharePoint Add-In model implementations in Microsoft 365
  https://aka.ms/retirement/addins/guidance
• Frequently Asked Questions
  https://aka.ms/retirement/addins/faq

If you’ve ever looked at the list of updates that Azure publishes, as well as the announcements & releases published on the ridiculous number of Azure blogs (Azure SQL, Azure Networking, Azure Apps, Azure Updates, Azure Integration Services, Azure Compute, Azure AI Services, +30 others), you know it can be overwhelming.

I personally don’t have the time to go through every update that’s published because on any given day, we can release 3-4 major features or services.

Enter Azure Updates from AzureCharts.

This is a concise list of updates that are sourced from the published Azure update list as well as the many, many dozens of blogs that officially support Azure from Microsoft.

• Updates are filterable by month, 11 categories and over 70 Azure-specific services.
• Data is subscribeable using RSS or exportable to CSV.

To view & subscribe to this Azure Updates list from AzureCharts, visit:

• https://aka.ms/az-updates

This is a great audio interview about the use value of AI in government from KQED, discussing:

✅ Reducing repetition to help with the overwhelming volume of work
✅ Rewriting content to make it easier to understand
✅ Reducing the volume of text in a regulation for comprehension
✅ Translating council meetings to extend community reach
✅ Identifying unsafe intersections that require attention

The interview features conversations with:

• Jason Elliott, deputy chief of staff to Governor Gavin Newsom
• Jennifer Pahlka, author, “Recoding America: Why Government Is Failing in the Digital Age and How We Can Do Better”; senior fellow, the Nisaken Center and the Federation of American Scientists
• Khaled Tawfik, chief information officer, Information Technology Department of the City of San Jose

Listen to the 55min recording here:

• “Generative AI is Coming to California’s Public Sector. What Now?” – KQED
  https://www.kqed.org/forum/2010101906001/generative-ai-is-coming-to-californias-public-sector-what-now

I stumbled upon an article that was written by a 3rd party that was interesting enough that I decided to share it. Written by Mahmoud Hassan of Avanade and backed with information from Microsoft Digital (our IT dept), it goes over real-world concerns about Teams Meeting transcriptions & Copilot for Microsoft 365.

The topics Mahmoud goes over relative to Microsoft’s own deployment & policies include:

• Microsoft’s own policies around Teams transcription
• Employee opt-out, alerts around recording
• Legal guidance sources
• Control over what can be recorded based on meeting classification
• Meeting content expiration
• etc.

Specific areas Mahmoud goes over that are interesting:

• “Explicit Recording Consent” in Teams Meetings
• The “Transcription only” Compliance Challenge in Teams Meetings
• Copilot in Teams Meetings *without* Transcription

Read the full article here:

• Copilot for Microsoft 365 – Copilot in Teams Meetings, Transcription & Enterprise Challenges
  https://www.linkedin.com/pulse/copilot-microsoft-365-teams-meetings-transcription-mahmoud-hassan-12z8f/

Microsoft Edge for Business is enhancing its defense against data leaks and vulnerabilities with two new capabilities:

• Screenshot prevention: Data exfiltration in the browser is a major concern for organizations due to financial, reputational and operational impact. Edge for Business will support screenshot prevention policies set across Microsoft 365, Microsoft Defender for Cloud Apps, Microsoft Intune Mobile Application Management and Microsoft Purview. Screenshot prevention policies will secure against data exfiltration in the browser by blocking the ability to take screenshots on pages labeled as sensitive or protected. Screenshot prevention will be generally available in the coming months.
• Easily stay up to date: Managed browser instances that are not up to date are at risk for exploitation through vulnerabilities, including zero-day attacks. The Edge management service will enable IT admins to see which devices have Edge instances that are out of date and at risk. It will also provide mitigating controls, such as forcing a browser restart to install updates, enabling automatic browser updates or enabling enhanced security mode for added protections. This capability will be in preview in the coming weeks.

Read more below:

• Blog: Microsoft Edge for Business: Revolutionizing your business with AI, security and productivity
• On Demand: Edge for Business: secure, productive, optimized for AI