A very generic question. Do you have an idea in your mind, what you intend to do?
abcd ab01
ASKER
I'm very new to this tool.
what I want to achieve as a security analyst-
1. recommendations how to improve overall security by utilizing this tool
2. What the basic thing I will be doing with the Microsoft security admin console
3. how to recommend on incidents and threats
4. how to observe threat analytics
5. what would be my best approach in dealing with this tool everyday ?
or any other recommendations?
Jose Gabriel Ortega Castro
Hello there! Ty for the question, Either way is too big to solve it like that :)
So, some words... Microsoft 365 is a software as a service solution. That means, everything is more or less cloud based. You can subscribe for different services like Office, Exchange, SharePoint whatever. The software runs on microsoft servers and also your data is (can be) stored there. The opposite is a on premises solution, where you have your own servers and clients and everything is local.
The idea of such SaaS ist, that you do not have to take care about software installation, mainentance etc., you just book it. This way, you have less own devices.
The general security concern is, that cloud based services need a bit of confidence, as you put a lot of data on Microsoft server farms. On the other side, they are possibly able to invest much more time into security questions that you are able to do it yourself.
At the end you manage a SaaS Service similar to an on premises solution. The major difference is, that Microsoft offers web based tools like Microsoft Securtiy Admin console a lot of others, while you make something similar on your on premises environment using the server tools. As all hardware and software is managed by Microsoft, the access if more limited.
The base decision cloud vs. on premises is first at all a question, how many confidence you have into Microsoft and which security concerns you have according the data you manage. If you decide to use cloud based services, you have just to be aware, that there are people which are capable to see your data. So a lot of companies decides for a hybrid configuration, where parts of the data (esp. confidential data) stay locally while other services are offered by SaaS services. You can write books about all aspects of cloud based services, so this so far as base for additional questions.