WorkspaceAudit.com

[Olger]

I've been contacted by someone from AppsEDU inviting us to trial workspaceaudit.com. It looks interesting, but its a new product (AppsEDU has been rebranded from Appsevents, which has been a Google Edu partner (apparently) for 14 years prior).

Has anybody trialled workspaceaudit.com yet? If so, any feedback? 

[zdanenyc]

We provided some feedback when it was in Beta in a staging domain and it honestly was insightful! Dan and the team is great and seems very flexible in working with schools/districts to provide support and guidance. 

[NielsBrockmeier]

We have had the demo as a test and it definitely shows great insights, and it works great. I am really hoping we're getting the full version soon, once I can show this to my leadership team. 

[Dean_Mantz]

I have tested it and compared it to our actual audit conducted by another competitor. It seems to be very accurate and insightful. 

[Olger]

Thanks @Dean_Mantz, @NielsBrockmeier and @zdanenyc for the replies. I've signed up for a trial and am really impressed with the interface. The reports are good but the interactive UI provides a great overview of issues and makes it easy to fix or accept. 

I've decided this is something we definitely need and am about to sign up. Well worth the money as its near impossible to go through Workspace settings on a regular basis to determine whether there's anything needing attention. This keeps an eye on our environment and highlights when issues need attention.

The reports are great to showcase to management how well we are doing. 😄

[llennon]

There are a few companies that offer this service, some automated and some still do it by manually going over every setting you have in your domain.  As beneficial as it is to find the settings that may not be right, it is also nice to have validation of the ones that you do.

I get a security audit done every month on my internal network and twice a year on my external with PEN testing. It is as much for peace of mind as it is for info on what I need to repair.

I can not speak to AppsEDU and their particular audit, I Had one done years ago by Amplified IT when they were just starting them (was one of their proof of concept guinea pigs) and then I had one when they automated the process. BUT Amplified is now CDWG and I haven't gotten any of their services. 

[Olger]

Long overdue, we signed up for Workspace Audit at the start of the year and then life happened and we didn't get around to using it for a long time. I did set weekly scans from the beginning which reminded me we had the product. Few weeks ago I finally started seriously looking at it. And fixing issues.

In previous lives I've had one-off audits done for companies I worked for, but always found them overpriced for the service. Reviews were usually labor intensive which is why its pricey. But reviews are often done by a single or small group of people, so your depending on their skills and knowledge.

Workspace Audit on the other hand scans weekly (in our case) and tells me based on rulesets what it finds and what it thinks isn't right or needs attention. Some of our choices are deliberate and some are unintentional or made at a time when it made sense. It's consistent and any errors in the rules are no doubt eventually discovered and fixed. 

Discrepencies can be fixed or accepted, after which they don't count towards the score any more.

For us, it's peace of mind that someone is watching over our domain and informs us when something is less than optimal. 

We're working through the different items that need attention, and fixing what we need to.
This is definitely a keeper.
😄

[kaned]

We did a trial and found that this was a pretty useful tool.  We are also looking at subscribing to this service once the start of school winds down.

[alexgrutza]

Maybe a different type of "service" but CISA the Federal Agency here in the USA has a handy page for what they suggest as best practice (I don't believe automated scanning though maybe they've updated their stuff) https://github.com/cisagov/Scubagoggles they also have one for MS365

[Olger]

That's an interesting suggestion, I didn't know about this. However, looking into it, I would still choose WorkspaceAudit as they use multiple benchmarks incl Scuba. And Scuba is a python cli based tool which can be scheduled to do regular scans but then only provides text based reports. WorkspaceAudit has direct links to fix issues, and allows to accept risks so they don't show up every scan. Not sure how Scuba does that.

Scuba is Open Source, which is nice, but WorkspaceAudit is pretty. 😄 It also generates nice reports for management. All in all, I think its worth paying for a service like WorkspaceAudit, it covers more and guides you quite well.