Download to read offline
More Related Content
Similar to Microsoft. Андрей Иванов. "Удивительное рядом - безопасность из облака"
Microsoft. Андрей Иванов. "Удивительное рядом - безопасность из облака"
- 1. Г. Казань 20 октября2016#CODEIB Андрей Иванов Cloud Security Lead Microsoft Удивительное рядом - безопасность из облака EMAIL andreyi@microsoft.com
- 2. Среднее количество дней присутствия злоумышленникаво взломанной системе до его обнаружения 200+ Дней с момента обнаружения вторжения до полного восстановления 80 Потери вследствие падения эффективности бизнеса и возможностей роста $3 Триллиона Средняя стоимость утечки данных (15% увеличение год к году) $3.5 Миллиона “НА СЕГОДНЯШНИЙ ДЕНЬ ЕСТЬ ДВА ТИПА КОРПОРАЦИЙ – ТЕ, КОГО УЖЕ ВЗЛОМАЛИ, И ТЕ КТО ЕЩЕ ПОКА НЕ ЗНАЕТ ОБ ЭТОМ” -JAMES COMEY, ДИРЕКТОР ФБР
- 3. HOW DO BREACHESOCCUR? Вирусы и уязвимости нулевого дня – не единственная проблема безопасности 99.9% Использованных атакующими уязвимостей, имели опубликованный CVE более года назад 46% Скомпрометированных систем не содержали каких-либо вирусов 50% Из тех, кто открывал письмо или вложение делали это в течение первого часа 23% Пользователей открывали фишинговые письма (11% открывали вложения) Эффективность фишинговых атак оставляют мало время для реакции
- 4. Хакеры стали хитрееи не ломятся напрямую
- 5.
- 7.
- 8.
- 10.
- 11.
- 15. Cloud Identity Provider Удаленный доступкак сервис Easily Publish your on-prem applications outside the corporate network Single sign on Utilize cloud Identity Provider as a central management point for all your apps
- 18.
- 19. Приложения и данные SaaS Единаясреда технологий безопасности платформы Microsoft Malware Protection Center Cyber Hunting Teams Security Response Center УстройстваИнфраструктура CERTs PaaS IaaS Identity (Учетные записи) INTELLIGENT SECURITY GRAPH Cyber Defense Operations Center Digital Crimes Unit Antivirus NetworkIndustry Partners
- 20. Identity Apps andData Devices Infra Protect. (Защита, противодействие угрозам) • Azure MFA • MIM2016 (PIM) • Azure PIM • Win10 (Hello for Business) • SCCM End-Point Protection • Azure Key Vault • Just enough administration • Local Administrator Password Solution • Win10 Information Protection • Azure AD App Proxy • AD RMS • Azure Information Protection • Azure Key Vault • Intune (MAM) • Azure Conditional Access • O365 ATP • O365 DLP • Windows Secure Boot • Intune (MDM) • SCCM • Device-based conditional Access • Bitlocker • Win10 Device Guard • AD Group Policies • WS 2016 Shielded VM • OMS Backup and Recovery • Win10 auto VPN • WS2016 Credential Guard, Remote • SCM • EMET Detect (Мониторинг и аналитика) • ATA • Azure AD premium reporting • Azure AD Identity Protection • OMS (Security and Compliance) • Azure Security Center • Win 10 Defender ATP • O365 ASM • Azure Cloud App Security • OMS (Application insight connector) • O365 ASM • Win 10 Defender ATP • Device health attestation • Azure Security Center • OMS (Security and Compliance) • SCOM (ACS) Response (Реагирование на инциденты) • OMS (automation) • Azure AD Identity Protection • Azure Security Center • O365 ASM • Azure Cloud App Security • O365 ATP • O365 Advanced eDiscovery • Intune MDM ( очистка устройства ) • Win10 IP (отзыв сертификата) • OMS (automation) • Azure Security Center
Editor's Notes
- #3 Скрытые косты – значительно увеличвают эту цифру We’re used to attackers directly targeting fortune 500s but now we’re seeing attacks on any vulnerable target. Those numbers are scary: It takes an enterprise more than 200 days to detect a security breach and, once you finally found them, it often takes a very long time to completely recover from that breach, often up to 80 days. Attackers can wreak havoc on a corporate network, stealing data, breaching privacy, and destroying the trust of customers. These attacks are incredibly expensive, and often come with a broader impact to a company’s reputation And there’s also enough data today quantify what the cost of breaches is. Note: Source 1 (HEADING): Cyber security is a CEO issue: http://www.mckinsey.com/insights/business_technology/why_senior_leaders_are_the_front_line_against_cyberattacks Siource 2: 243 days for attacker to be present: http://www.fireeye.com/news-events/press-releases/read/fireeye-releases-annual-mandiant-threat-report-on-advanced-targeted-attacks Source 3: 140 countries developing cyber weapons: Infosec Institue, “The Rise of Cyber Weapons and Relative Impact on Cyberspace” Source 4: $3 trillion in lost productivity: http://www.mckinsey.com/insights/business_technology/why_senior_leaders_are_the_front_line_against_cyberattacks Source 5: $3.5 million cost: http://www.ponemon.org/blog/ponemon-institute-releases-2014-cost-of-data-breach-global-analysis
- #4 Protecting our enterprise customers has never been more challenging. Security threats are increasingly brazen and highly sophisticated. Even with the best defense, sophisticated attackers are using social engineering, zero-day vulnerabilities, or even misconfigurations to break-in to their networks. Only 40% of attacks use malware as the means of carrying out attackers’ goals. The rest consists of adversarial activity that doesn’t use malware for which signatures can be written. The better way is to detect these attacks with behavioral analysis. It’s important to understand how those kind of breached occur, what techniques are being used and how end users help to let attackers on their machine: As the attackers’ approaches have evolved and become more sophisticated, so too must our approach to provide security to our enterprise customers. And, our customers agree, as 90% of surveyed IT Directors said they need a full-fledged advanced threat protection solution. Microsoft research Note: Ponemon Institute, “The Post Breach Boom”, 2013 Ponemon Institute, “2014 Global Report on Cost of Cyber Crime Source: Mandiant 2014 Threat Report
- #17 Cloud App Discovery https://appdiscovery.azure.com/