Download as PDF, PPTX
Cloud App Security Customer Presentation.pdf
- 1. MICROSOFT CLOUD APP SECURITY SebastienMolendijk Senior Program Manager
- 2.
- 3. Enterprise-class technology Secure identitiesto reach zero trust Identity & access management Security management Strengthen your security posture with insights and guidance Threat protection Help stop damaging attacks with integrated and automated security Locate and classify information anywhere it lives Information protection Infrastructure security
- 4.
- 5.
- 6. CLOUD ACCESS SECURITYBROKERS 01
- 7. Cloud services requirea new approach to security
- 8. Top CASB usecases Office 365 Salesforce Azure Box AWS Dropbox Facebook Twitter YouTube
- 9. MICROSOFT CLOUD APPSECURITY 02
- 11.
- 12. DISCOVERING AND ASSESSINGTHE RISK OF SHADOW IT 03
- 13. Shadow IT managementlifecycle
- 14. Discovery of ShadowIT across SaaS, IaaS and PaaS Discover cloud usage across all locations (HQ, Branches, Remote..) Understand the risk of your SaaS apps Risk assessment for 16,000+ cloud apps based on 70+ security and compliance risk factors Analyze usage patterns Understand the usage patterns and identify high risk volume users by understanding traffic data, top users and IP addresses, app categories Block risky and unsanctioned apps Using native and programmatic integration with leading SWG and Proxies Continuous monitoring Be alerted when new, risky or high- volume apps are discovered CloudAppDiscovery
- 15. DISCOVERY ARCHITECTURE WITHMICROSOFT DEFENDER ATP Firewall / Proxy Log collector User IP address Machine Microsoft Cloud App Security portal Endpoints Shadow IT Microsoft Defender ATP
- 16. CloudDiscoverywith Microsoft DefenderATP Native, endpoint-based Discoveryof Shadow IT Discovery of cloud apps beyond the corporate network from any Windows 10 machine Single-click enablement Machine-based Discovery Deep dive investigation in Windows Defender ATP
- 17. 1-click deployment withMicrosoft Defender ATP
- 18. User education whenattempting to access a non-trusted app
- 19. User education whenattempting to access a non-trusted app
- 20. User education whenattempting to access a non-trusted app
- 21. Shadow IT Discoveryfor IaaS and PaaS services
- 22. Shadow IT Discoveryfor IaaS and PaaS services – Drill down
- 23. Deployment method Automatic log upload Checkbox deployment Supported platforms Device-based Discovery Off-network Discovery Inlineblocking of apps Deployment Complexity Log file (Snapshot report) No No Any No No No Medium Log collector Yes No Any No No No Medium Windows Defender ATP Yes Yes Windows, Mac coming in 2019 Yes Yes H1 2019 Low Zscaler Yes No Any No Yes Yes Low iboss Yes No Any No Yes Yes Low Shadow IT Discovery deployment options
- 24.
- 25.
- 27. Protect your filesand data in the cloud Data is ubiquitous and you need to make it accessible and collaborative, while safeguarding it Understand your data and exposure in the cloud Classify and protect your data no matter where it’s stored Monitor, investigate and remediate violations • Connect your apps via our API-based App Connectors • Visibility into sharing level, collaborators and classification labels • Quantify over-sharing exposure, external- and compliance risks • Govern data in the cloud with granular DLP policies • Leverage Microsoft’s IP capabilities for classification • Extend on-prem DLP solutions • Automatically protect and encrypt your data using Azure Information Protection • Create policies to generate alerts and trigger automatic governance actions • Identify policy violations • Investigate incidents and related activities • Quarantine files, remove permissions and notify users
- 28. Create policies togenerate alerts and trigger automatic governance actions Be notified to identify and investigate policy violations and related activities Automatically remediate with built-in actions incl. notify owner, notify admin, make private, quarantine, etc. Automatically label and protect existing sensitive information and when new files are uploaded Detectandremediate overexposed filesand anomalies
- 29. Unified labelling withMicrosoft Information Protection - streamlined experience across O365 DLP, AIP and MCAS 90 built-in, sensitive information types you can choose from Custom sensitive information types using Regex, keywords and large dictionary Leverage Microsoft or 3rd party DLP engines for classification Leverage AIP labels KeyDifferentiators via MicrosoftInformation Protection approach
- 30.
- 31.
- 32. Context-aware session policies Controlaccess to cloud apps and sensitive data within apps based on user, location, device, and app SAML, Open ID Connect, & on- prem apps Support for Microsoft and non- Microsoft web apps, including on- prem apps onboarded via Azure AD App proxy Enforce granular monitoring & control for risky user sessions Data Exfiltration: • Block download, Apply AIP label on download • Block print • Block copy/cut • Block custom activities: (e.g., IMs with sensitive content) Data Infiltration: • Block upload • Block paste ConditionalAccessAppControl
- 33. Unique integration withAzure AD Conditional Access Selective routing to MCAS based on the session risk determined by Conditional Access to optimize end user productivity Simple deployment Built-in policies that can be configured directly within the Azure AD portal for an easy deployment. Control your on-prem apps With the same powerful real-time controls by integrating them with Azure AD Application Proxy Worldwide Azure datacenters infrastructure MCAS leverages Azure data centers across the world to optimize performance and user experience Keydifferentiators tooptimize theadminandenduser experience
- 34. Cloud apps &services
- 35. Exemplary use case Preventdownload of sensitive files from unmanaged device Config:Unmanaged Any app
- 36.
- 37. PROTECTING YOUR INFORMATIONIN REAL-TIME DEMO
- 38. THREAT PROTECTION INTHE CLOUD 04
- 39.
- 40. Detections across cloudapps and sessions ! ! !
- 42.
- 47. The challenge ofsecuring your environment The digital estate offers a very broad surface area that is difficult to secure Bad actors are using increasingly creative and sophisticated attacks Intelligent correlation and action on signals is difficult, time-consuming, and expensive
- 48. Identity Security –Covering your environment Cloud identity threats Azure AD Identity Protection On-premises identity threats Azure ATP Application sessions Microsoft Cloud App Security Azure AD & ADFS
- 49. On Premises Activities– via Azure ATP Cloud Activities – via Azure AD IP, Office 365 and MCAS
- 50.
- 51.
- 52. M365 UEBA -Overview
- 54.
- 55. Total user riskfor investigation priority – reflecting security alerts, abnormal activities and user impact User Investigation Priority
- 56.
- 57. Identify top users toinvestigate How abnormal is this user’s behavior?
- 58. User Investigation Priority Example: Userinvestigation priority distribution at a 200k+ employee organization 0 20000 40000 60000 80000 100000 120000 140000 160000 Number of Users Scores Users / Score Distribution
- 59. Identify abnormal activitiesby analyzing the behavior of users, peers and the entire organization • Login to devices • Access to on-premises resources • Remote connections to servers • Access to cloud applications • Usage of Share Point Online sites • User agent, location & ISP analytics • Mailbox behavior • Failed logins behavior
- 60. Suspicious Activity: howdoes it work? Suspicious Has this user accessed this server before? Is the ‘finance server’ accessed by many users in the organization? Do the peers of this user login to this server ? Normal Does this user have a usual pattern of logons to servers?
- 61. Investigation Priority Feedback True positives discovered: •compromised service account exposed resources, this was not detected by ATP products. filtering by activities with investigation priority helped sort and find compromised resources. • User was found to be compromised (custom policy inbox FW rule). When reviewed the case we noticed that the first activities by the adversary would have been flagged (by User agent+ISP)
- 62.
- 64.
- 65.
- 66.
- 67.
- 68.
- 69. Export alerts andactivities to your SIEM Better protect your cloud applications while maintaining your usual security workflow, automating security procedures and correlating between cloud-based and on-premises events Automate processes via API or PowerShell Create your own applications using programmatic access to Cloud App Security data and actions through REST API endpoints External DLP solution Integrate with existing DLP solutions to extend these controls to the cloud while preserving a consistent and unified policy across on-premises and cloud activities Security Workflow automation with Microsoft Flow Centralized alert automation and orchestration of custom workflows using the ecosystem of connectors in Microsoft Flow. Enables routing alerts to ticketing systems (e.g. ServiceNow), gather end user input for alert investigation, get approval from SOC operator to execute action or apply additional security controls Enterprise Integrations
- 70. Centralized alert automation andorchestration of custom workflows Automate the triage of alerts Enables an ecosystem of connectors in Microsoft Flow incl. >100 3rd party connectors such as Jira, ServiceNow, and DocuSign Out-of-the-box and custom workflow playbooks that work with the systems of your choice Predefined governance options when creating policies Automating Security WorkflowswithMSFlow
- 71. Open incident inticketing system & populate with alert attributes Request user input to provide context during alert investigation Get admin approval to execute remediation action
- 72.
- 73. Configuration steps • Createan API token in Microsoft Cloud App Security • Create a MCAS connection in Flow • Create a Flow starting with the Microsoft Cloud App Security Trigger • In the MCAS console, assign the Flow to a policy
- 74. 1. Route alertsto ticketing systems such as Jira or ServiceNow 2. Route alerts to different SOC teams based on geography of the user 3. Request input from a user's manager to triage alert 4. Request user input to decide how to triage an alert 5. Block unsanctioned apps on the firewall using CAS discovery alerts 6. Get admin approval to execute remediation action 7. Disable user in AAD and in on-prem Active Directory based on suspicious alerts 8. Remove malicious forwarding inbox rule in Exchange Online 9. Automatically dismiss “unusual location” alerts when a user has OOF message set to “On” 10. MCAS alert triggers antivirus scan in Microsoft Defender ATP Sample automation scenarios
- 75. Reach on-premises systemswith Azure Automation
- 76. Reach on-premises systemswith Hybrid Runbook Workers https://docs.microsoft.com/en-us/azure/automation/automation-hybrid-runbook-worker
- 77. SIEM integration andAutomating Security Workflows DEMO
- 78. External Admins • MCASis enabled for externally Managed Security Service Providers (MSSPs) to act as administrators • MSSPs can be assigned any of the available admin roles For MSSPs • Ability to provide services across multiple customer tenants • Ability to easily switch between tenants within the portal for MSSPs (See image) Managed Security Service Provider (MSSP)
- 79. SUMMARY & NEXTSTEPS 07
- 80.
- 81.
- 82. Top 10 CASBuse cases you should think about 1. Discover the cloud apps and services used in your organization 2. Assess the risk and compliance of all cloud apps 3. Govern access to discovered cloud apps and explore enterprise-ready alternatives 4. Discover OAuth apps with access to your environment 5. Gain visibility into all corporate data stored in the cloud apps and understand your exposure 6. Enforce DLP and compliance policies for sensitive data stored in your cloud apps 7. Protect data downloaded to unmanaged devices 8. Detect compromised user and admin accounts, and identify insider threats 9. Detect and remediate malware in your cloud apps 10. Audit the configuration of your IaaS environments
- 83. Next steps Sign upfor a Microsoft Cloud App Security Trial. Upload a log file from your network firewall or enable logging via Microsoft Defender ATP to discover Shadow IT in your network and assess the risks of detected cloud apps. Connect your Cloud Apps to Microsoft Cloud App Security to detect suspicious user activity and exposed sensitive data. Enable out-of-the-box anomaly detection policies and start detecting cloud threats in your environment. Continue with more advanced use cases across Information Protection, Compliance and more.
- 84.
- 85.