Security Incident Overview — SOC Alert #INC-8092

🎯 Your 5 Challenge Missions:

1. Mission 1: Configure and deploy a Silent BitLocker 256-bit AES-XTS Encryption Policy with TPM key escrow to Entra ID.
2. Mission 2: Enforce Microsoft Defender Real-Time & Tamper Protection endpoint security baselines.
3. Mission 3: Configure Zero-Trust Conditional Access to block non-compliant devices from Microsoft 365 Exchange & Teams.
4. Mission 4: Run Intune Proactive Remediations to auto-remediate unencrypted drives across the fleet.
5. Mission 5: Re-evaluate compliance and restore 100% Fleet Zero-Trust Health to close the SOC incident.

Enterprise Standard: Silent BitLocker Policy Requirements

• Encryption Method: XTS-AES 256-bit for Operating System and Fixed Data Drives.
• Silent Enablement: Require device encryption without prompting standard end-users.
• Key Protector: TPM 2.0 Required (Prevent PIN prompting on standard corporate boot).
• Key Recovery Escrow: 48-digit Recovery Password must be backed up to Microsoft Entra ID.

Zero-Trust Antivirus Baseline

Ensure Real-Time Protection (RTP), Behavior Monitoring, Cloud-Delivered Protection, and Tamper Protection are strictly locked down against local admin interference.

Zero-Trust Principle: Never Trust, Always Verify

Block non-compliant endpoints from accessing Exchange Online, Teams, and SharePoint to prevent unencrypted device data leakage.

CIS Microsoft Intune Benchmark & NIST 800-171 Compliance

This challenge adheres to the following industry cybersecurity benchmarks:

• CIS Benchmark 2.3.1: Ensure 'BitLocker Drive Encryption' is configured for all OS and Fixed volumes.
• CIS Benchmark 2.3.2: Ensure 'Configure encryption method for operating system drives' is set to 'XTS-AES 256-bit'.
• NIST 800-171 Rev 2 (3.1.1): Limit system access to authorized devices with enforced compliance state.