A Vision for Shared, Central Intelligence to Ebb a Growing Flood o...

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Dan Plastina
A Vision for Shared, Central Intelligence
to Ebb a Growing Flood of Alerts
SPO3-...

Dan Plastina
Director, Threat Protection
Director, Information Protection
Microsoft
@DanPlastina and https://aka.ms/DanPla...

In the context of today,
who are ‘we’
Microsoft does more than sell software.
We also are:
a leading provider of cloud pla...

#RSAC

SIEMS
INTELLIGENCE
Signals growing far faster
than staffing; New sources
welcomed with a <sigh>
TI is acquired from
provid...

WHERE WE
NEED TO BE
SIEMS
INTELLIGENCE
DETECTION
YOU (WE) HAVE A PROBLEM
Must reduce busy work of
incident roll-up, respon...

CISOs prefer “We’re seeing
a pattern similar to a peer
org” vs “Oops”
EVENTS
SecOps want to review
the ‘needles’, not full...

WHERE WE
NEED TO BE
EVENTS
FEEDS
INCIDENTS
(LESS) OBVIOUS,
SECOND-ORDER
PROBLEMS
ML/AI should make the data
work for human...

WHAT IT
MEANS FOR YOU
#RSAC

THE END STATE
User log-ins
Malware
Attacks
Phishing
Denial of service
User accounts
Spam
Unauthorized data access
Data enc...

THE LANDSCAPE WE ARE
ASKED TO PROTECT
YOU ARE HERE

Lot of users with PCs and devices
Lot of servers/VMs
Some partners we collaborate with
Several SaaS apps
Many repositories...

CENTRALIZED INTELLIGENCE

THE SENSORS FABRIC WE DEPLOY
On Premises Directory
Services
(AD)
User/Entity Behavior
Analytics
(ATA)
User/Entity Behavior...

LOCALIZED INTELLIGENCE
On Premises Directory
Services
(AD)
User/Entity Behavior
Analytics
(ATA)
User/Entity Behavior
Analy...

ENTRUSTING THE FEW
Weaker Hub-and-spoke interconnection
Jack of all trades and thus an expert in none/few
Latent (non real...

#RSAC
DISTRIBUTING INTELLIGENCE
VIA THE GRAPH
Rich interconnection
Contextual Deductions
Near real time interactions
Impro...

#RSAC
Security
Consoles
Email / Team
Security Bots
Programmatic
Access
Advanced
Visualizations

SPECIALISTS PREFER SPECIAL TOOLING
#RSAC

SECOPS IS A SPECIALIST TOO
A console
• anchored in incident management
• to navigate ‘fused’ incidents in micrograph form
...

Security Bot | Microsoft Teams
• In-situ assistance for
tedious tasks.
• CC a Security bot on an
email to get an IP
addres...

• Extends Microsoft Graph
• Contributors to the graph (Detectors)
create securityDetection nodes
• Aggregated detections c...

#RSAC

• Re-examine your security posture
• Best of Breed vs Best of Suite
• Investigate SecOps inefficiencies
YOUR ROLE IN CHANG...

Where to learn more
about solutions mentioned today
• Active Directory
• Active Directory Federation Services
• Advanced T...

Thank you
aka.ms/danpl
#RSAC

#RSAC

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 27 Ad

View on Slideshare

1 of 27 Ad