September 2022 - Page 8 of 19 - Dr. Ware Technology Services

How companies manipulate you online – and what the FTC is doing to protect you

by Scott Muniz | Sep 21, 2022 | Security

This article was originally posted by the FTC. See the original article here.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Automating complex tax scenarios with enhanced Tax Calculation capabilities

by Contributed | Sep 20, 2022 | Dynamics 365, Microsoft 365, Technology

This article is contributed. See the original author and article here.

Financial management is in the midst of a transformative moment. The global operating environment of business today is increasingly complex and prone to turbulence from numerous sources. New business models are disrupting the status quo and challenging the idea of how products and services are delivered and experienced. Finance leaders are assuming greater responsibilities in their organizations and often doing so with smaller team footprints than would have been imaginable a decade ago.

Staying on top of local laws and regulations in several countries is resource-intensive and challenging. Not only do individual countries and regions have their own regulations, but these rules are continuously changing, making compliance a perpetual task that requires close attention. Technology-enabled digital transformation is at the forefront of the tools available to finance leaders who must do more with less. This blog focuses on how Microsoft’s enhanced Tax Calculation capabilities help automate complex tax scenarios and deliver more scalable and easy-to-adopt tax solutions to our customers.

For a general refresher of the Tax Calculation enhancements available in Microsoft Dynamics 365, be sure to visit our previous blog post.

Empowering global financial excellence

Ernst & Young Global Limited (EY) is one of the largest professional services firms in the world. One of the ways that EY engages with clients is as advisors and system implementers of tax technology. To better understand how Tax Calculation helps organizations scale financial excellence, let’s look at how EY helps its clients quickly deploy highly adaptable tax solutions for their businesses.

“Tax requirements are only getting more complex. Adding flexible and scalable no-code/low-code Tax Calculation capabilities to an already powerful ERP solution, such as Microsoft Dynamics 365, is definitely compelling functionality.”

Greg Hari, Director, Indirect Tax Transformation at EY

Client challenges

In part, one of EY’s clients faced challenges related to significant technical tax complexity across an extensive global footprint. The client’s small finance team was responsible for operating many business scenarios and handling a vast range of transactions.

To effectively manage complex global operations like these from a tax perspective, the business required a solution with the flexibility to scale to support its worldwide footprint and mirror its distinctive corporate structure. At the same time, the solution had to handle today’s unique tax complexities so that the in-house finance team could easily maintain business expertise to operate in all the territories they’re currently in today and allow for future expansion and ever-changing tax regulations.

Traditionally, clients selecting or implementing an enterprise resource planning (ERP) solution in these situations often require an external tax engine to perform tax determination and calculation or frequently end up with a sub-optimal determination solution. And indeed, this was the assumption and potential concern of EY’s client in this circumstance. However, as EY worked with the client during discovery, it explained the features and benefits of the native out-of-the-box Tax Calculation functionality included in Dynamics 365 Finance, which ultimately gave the client assurance over the tax determination that could be delivered.

“A new tax calculation service as a native component of Dynamics 365 was one of the key factors that helped Microsoft cater for the client’s complex requirements. It also gives us ahigh degree of confidence in recommending the solution because we understand it can be configured to meet bespoke requirements without significant coding or expensive customizations.”

Greg Hari, Director, Indirect Tax Transformation at EY

EY successfully supported the client through the implementation and go-live process earlier this year.

Automating complex tax scenarios

The Tax Calculation enhancements to Dynamics 365 released last year have been helping our customers to automate complex tax scenarios that required costly customizations before. Some of the complex scenarios that our customers have successfully enabled while deploying the new Tax Calculation capabilities include:

Transfer price model and limited risk distributor
Consignment warehouses with multiple VAT registrations
EU triangulation transactions
EU VAT on margin
EU distance selling
US origin-based and destination-based sales tax
Tax deductibility by the usage of the goods and services

Organizations can more effectively streamline and automate tax determination and calculation by leveraging our enhanced no-code/low-code tax calculation functionality, which is part of Globalization Studio within Dynamics 365. This can create significant advantages as it allows companies greater functionality to handle more complex enterprise-level scenarios while also reducing some of the maintenance burden and associated risk, even with a relatively small team. It also allows users to easily customize the solution to suit future needs as tax regulations evolve and businesses scale.

A scalable and robust tax calculation service allows both enterprise and small organizations to support and maintain a very effective tax calculation solution in-house.

Greg Hari, Director, Indirect Tax Transformation at EY

The Globalization Studio capabilities offer more than effective tax determination and calculation. Also included are no-code/low-code globalization tools and services and out-of-the-box content for electronic invoicing, tax audit and regulatory reporting, country-specific payment formats, business documents, and more. The combination of these easy-to-use and flexible services and the out-of-the-box content, extended by partners, allows users to operate our solution in more than 200 countries/regions and meet multiple tax compliance requirements and local business practice requirements.

What’s next?

Are you an existing Dynamics 365 user who would like to use the Tax Calculation capabilities in your organization? If so, you can get started today by visiting the Tax Calculation overview documentation.

Or, if you are looking for a solution to optimize across subsidiaries, acquire new companies, or expand internationally and are interested in learning more about the tools to streamline processes, increase compliance, and strategically grow your business globally, we invite you to take a guided tour of Microsoft Dynamics 365 Finance.

The post Automating complex tax scenarios with enhanced Tax Calculation capabilities appeared first on Microsoft Dynamics 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.

Windows 11, version 22H2 Security baseline

by Contributed | Sep 20, 2022 | Technology

This article is contributed. See the original author and article here.

Microsoft is pleased to announce the release of the security baseline package for Windows 11, version 22H2!

Please download the content from the Microsoft Security Compliance Toolkit, test the recommended configurations, and customize / implement as appropriate.

This release includes numerous changes to further assist in the security of enterprise customers. Changes have been made for additional protections around hardware and driver security, credential theft, printers, DNS, and account lockout.

Kernel Mode Hardware Enforced Stack Protection

A new feature has been added to the setting located in SystemDevice GuardTurn On Virtualization Based Security called Kernel Mode Hardware Enforced Stack Protection. This new setting is applicable to Windows 11, version 22H2 and above, and provides additional security enhancement for kernel code.

Notes:

This was first discussed in a blog post back in March of 2020 (Understanding Hardware-enforced Stack Protection – Microsoft Tech Community).

There is a hardware dependency for this new feature that requires Intel Tiger Lake and beyond or AMD Zen3 and beyond.

This setting has a dependency on HVCI (Virtualization Based Protection of Code Integrity). There shouldn’t be any issues as long as enterprises are following the baselines but, if the organization deviates from HVCI, then Kernel Mode Hardware Enforced Stack Protection cannot be enabled.

In enforcement mode, the security baseline configures this setting to Enabled.

Important: If the hardware platform does not support it, then no enforcements are enabled.

While compatibility concerns are unlikely, customers are encouraged to test compatibility to ensure an incompatible driver doesn’t lead to instability.

Additional documentation on this feature is pending. For preliminary documentation, see the Developer Guidance for Hardware-enforced Stack Protection – Microsoft Tech Community blog post.

Enhanced Phishing Protection

New in Windows 11, version 22H2, are a set of features to better protect enterprise users who still rely on a username and password for Windows authentication.

These new features, located in Windows ComponentsWindows Defender SmartScreenEnhanced Phishing Protection, ensure that enterprise credentials cannot be used for malicious or unintended purposes. Related user activity is logged in the Microsoft Defender for Endpoint portal.

Because this is an end-user option, the security baseline enforces enablement of the service (the Service Enabled setting) to ensure that the enterprise credentials used in the system are appropriately monitored and audited.

Based on Microsoft Defender SmartScreen’s robust security infrastructure, when a user enters their credentials into a known phishing or malicious site, the service alerts the user as illustrated below. In this scenario, the setting Notify Malicious is set to Enabled.

Should an enterprise user re-use their corporate credentials in another application or website, a notification is displayed and logged, as illustrated below. In this scenario, the setting Notify Password Reuse is set to Enabled.

Should the user decide to save their passwords in Notepad, WordPad, or other Office applications, this activity is logged with Microsoft Defender for Endpoint and the user is notified of the activity, as illustrated below. In this scenario, the setting Notify Unsafe App is set to Enabled.

Depending on your userbase, incoming support calls may question why the prompts are occurring. Microsoft advises that organizations inform security personnel and end users about the feature and how it helps keep credentials protected.

Printers

It is critical to continue to protect enterprise customers in print scenarios. With Windows 11, version 22H2, several new settings under Administrative TemplatesPrinters are enabled to further protect enterprises, including the following:

Support for RedirectionGuard is added to the print service. RedirectionGuard is a security measure that prevents the use of non-administratively created redirection primitives from being followed within a given process. The setting Configure Redirection Guard is now Enabled as part of the baseline.

Historically, Named Pipes were allowed with Print Spoolers. The use of TCP for the settings Configure RPC connection and Configure RPC listener is now enforced.

Configure RPC over TCP port ensures that the incoming and outgoing connections default to a dynamic TCP port.

Note: This setting typically requires a boundary (firewall) change to allow for a successful connection.

Manage processing of queue-specific files (also called CopyFilesPolicy) was first introduced as a registry key in response to CVE-2021-36958 in September of 2021. This setting allows standard color profile processing using the inbox mscms.dll executable and nothing else. The security baseline is to configure this setting to Enabled with the option of Limit queue-specific files to color profiles.

Limit print driver installation to Administrators was introduced to the security baselines as part of the SecGuide.ADMX before an inbox policy was available. This policy is now contained within the OS, and the MS Security Guide setting is deprecated. However, since both settings write to the same location, the configured values still appear in both locations. The explanatory text in the MS Security Guide is updated to point users to the new location.

Configure RPC packet level privacy setting for incoming connections has been added to SecGuide.ADMX as a result of CVE-2021-1678 and is set to Enabled as part of the baseline. The work of creating and deploying registry keys is now included in the security baseline until the setting becomes inbox to Windows.

DNS Hardening

The setting Configure DNS over HTTPS (DoH) name resolution, located under Administrative TemplatesNetworkDNS Client, was added as part of Windows 11 and Windows Server 2022. It is not yet part of the security baseline because it is too early to mandate encrypted DNS. Enterprises that wish to use encrypted DNS may take the following steps to implement it:

Deploy their own Secure DNS over HTTPS (DoH) server infrastructure, whether self-managed or provided by a vendor.

Configure Windows to use these DoH resolvers.

When DoH servers cannot be reached, enterprises may require their endpoints to hard fail using encryption should the threat model requires this activity.

Note: This requirement breaks scenarios such as captive portals, so it is not a recommended general practice.

The security baseline will adopt this setting in a future release. See Secure DNS Client over HTTPS (DoH) for additional information on DoH.

Configure NetBIOS settings

The setting Configure NetBIOS settings, located under Administrative TemplatesNetworkDNS Client, is configured to Enabled with a sub value of Disable NetBIOS name resolution on public networks. If applicable for your enterprise, optionally adjust this setting to Disable NetBIOS name resolution. In a future release of the security baseline, all name resolution over NetBIOS will be disabled.

Credential Theft Protection

Windows allows the use of custom security support providers and authentication providers to extend the authentication capabilities available during the login flow beyond those supported natively by Windows. These providers are loaded into Local Security Authority Subsystem Service (LSASS). Although they can provide a legitimate function, custom security packages can also be abused by attackers to gain persistence or to access and steal credentials stored in Windows. A new setting has been added to protect against this scenario:

The setting Allow Custom SSPs and APs to be loaded into LSASS, located under SystemLocal Security Authority, restricts the loading of custom security packages.

We recommend that you disable loading custom packages unless the custom package you are using is known.

Additional Local Security Authority (LSA) protection provides defense by running LSA as a protected process. LSA protection was first introduced in the Windows 8.1 security baseline, as part of the original Pass-the-Hash mitigations.

A new setting Configure LSASS to run as a protected process, located under SystemLocal Security Authority, is now included inbox with Windows 11, version 22H2.

The new setting is not backported. Therefore, all previous operating systems should continue to use the MS Security Guide setting LSA Protection, contained in SecGuide.ADMX. The security baseline continues to enforce the value of Enabled with UEFI Lock but does add a new configuration option that allows for LSA protection without UEFI lock. This brings it into parity with other features that support UEFI lock, like Credential Guard and Hypervisor-Protected Code Integrity, and allows more flexibility.

The legacy Multiple Provider Router (MPR) provides notifications to registered credential managers or network providers when there is a logon event or a password change event. MPR was created so that providers that need a user’s password can collect and store credentials. This functionality is used by legitimate applications, but it can also be abused by attackers to harvest logon credentials.

A new setting Enable MPR notifications for the system, located under Windows ComponentsWindows Logon Options is used to disable MPR notifications.

We recommend that you configure this setting to block password disclosure to providers.

Attack Surface Reduction

A new rule Block abuse of exploited vulnerable signed drivers is now included as part of the operating system baselines as part of the Microsoft Defender Antivirus GPO. This rule applies across both client and server and helps prevent an application from writing a vulnerable signed driver to disk.

For additional information, see the topic Attack surface reduction rules reference | Microsoft Docs.

Account Lockout Policies

A new policy Allow Administrator account lockout, located under Security SettingsAccount PoliciesAccount Lockout Policy is added to mitigate brute-force authentication attacks. The recommended values for the policies Account lockout duration and Reset account lockout counter after are adjusted to be consistent with the defaults for out-of-the-box Windows installations.

Existing Windows installations, including upgrades to Windows 11, version 22H2, have not configured by default the Allow Administrator account lockout or other account lockout policies.

Other Changes

Corrected in this release was a mismatch between the security baseline documentation and the accompanying Group Policy for Microsoft Defender Antivirus settings. The documentation stated that Windows ComponentsMicrosoft Defender AntivirusReal-time ProtectionTurn on behavior monitoring should be set to Enabled, but the actual GPO remained in a Not Configured state. This is corrected in this release.

Please let us know your thoughts by commenting on this post or through the Security Baseline Community.

Work safer and smarter with the Windows 11 2022 Update

by Contributed | Sep 20, 2022 | Business, Microsoft 365, Technology

This article is contributed. See the original author and article here.

Today, Microsoft announced the general availability of Windows 11 2022 Update, the first major update to the operating system that secures your hybrid work. This update includes some critically important new features designed to keep your organization safe in an ever-changing threat landscape without compromising the Windows experiences that help your employees collaborate and do their best work.

The post Work safer and smarter with the Windows 11 2022 Update appeared first on Microsoft 365 Blog.

Brought to you by Dr. Ware, Microsoft Office 365 Silver Partner, Charleston SC.