Downloaded 13 times
Webinar Mastering Microsoft Security von Baggenstos
- 1. Microsoft Security - soschützen Sie Ihr Unternehmen 16. August 2023
- 3.
- 4. Themen • Heutiges Bedrohungs-Umfeld •Microsoft 365 Security sowie Azure Security (Compliance / Datenschutzgesetz) • Best Practices bei der Einführung und dem Betrieb von Sicherheitslösungen • Fragen (im Chat) & Antworten
- 5. Durch das Webinarführen… Martin Janisch Partner Technology Strategist Sven Heeb Consulting, Projektleitung Othmar Frey Sales Director
- 6. Classified as MicrosoftConfidential Security Webinar Martin Janisch Partner Technology Strategist 16.08.2023
- 7. Classified as MicrosoftConfidential Attack surface is expanding due to hybrid work Rapid acceleration and increasing sophistication of cybercrime Rising cost of cybersecurity risk mitigation and remediation The increasingly complex state of cybersecurity
- 8. Relevance Ransomware: https://aka.ms/CISOWorkshop Zero-days: Breaching services on aper job basis: Exploit kits: Loads (compromised device): Spearphishing services: Compromised accounts: Denial of Service: Highest average price Most Common Passwords 2023 - Is Yours on the List? | CyberNews, based on 15.212 B from publicly leaked data breaches; last accessed on May 11th, 2023
- 9. Are SMB customers subjectto attacks? “No one is interested in my data anyhow.” • Over 620 million ransomware attacks happened in 2021 globally. 1 • Of all ransomware attacks on enterprises in 2020, 55 percent hit businesses with fewer than 100 employees, while an entire 75 percent of attacks were on companies making less than $50 million in revenue. 2 • In fact, on average, victims of ransomware only recover around 65 percent of stolen data. 3 • “However, it’s safe to say that any business that uses a computer system is at risk.” 4 • Average cost of a SMB data breach in 120K$ in 2018 5 Fact check • Ransomware hackers might not be not interested in SMB customer data – but the SMB customers are. If their data is encrypted/lost, they will incur damage and cost immediately. • Hackers are interested in money – and Ransomware-as-a-Service kits allow for highly automized attacks of 10.000s of victims simultaneously and easily. • For public sector/sensitive data, data is often no longer encrypted anymore – but rather used to threat making data public. • Access to SMB customers cloud service accounts may allow hackers to spin up crypto mining VMs – causing $100.000s of damage in days Explaining the risk for SMB customers
- 10. The phishing threatlandscape The State of Cybercrime 710 million phishing emails blocked per week. 531,000 Unique phishing URLs hosted outside of Microsoft taken down at the direction of our Digital Crimes Unit. 1hr 12m The median time it takes for an attacker to access your private data if you fall victim to a phishing email. 1hr 42m The median time for an attacker to begin moving laterally within your corporate network once a device is compromised. Phishing emails with Ethereum wallet addresses Business email compromise themes (January-June 2022) Phishing page impersonating a Microsoft login with dynamic content
- 11. Classified as MicrosoftConfidential Relevance ‘Time between Black Friday and Christmas favourable for Threat Actors Threat Actors are Already Building Phishing Pages to Target Holiday Shoppers (cybersixgill.com) ‘Tis the Season for Online Shopping and Phishing Scams | Trustwave’ Evidence: >15 cases in Switzerland within the last 12 months; e.g. 2 Cryptojacking (28k in half a day, 464k in a few days in ACR) 1 Tenant Lockout Local data shows that still, ~35 % (latest data even 47%!) of Azure Subscriptions do not have MFA turned on for Owner / Administrator roles in Switzerland Threat actor groups like ‘Conti’ have company-like character MFA activation 65% 35% Yes No Avg. Secure Score Conti ransomware leak shows group operates like a normal tech company (cnbc.com)
- 12. Classified as MicrosoftConfidential ‘staggering 85% of 6,700 global security practitioners say their companies do not have a cybersecurity posture robust enough to defend against risks relating to hybrid work.’
- 13. 25.6billion attempts to hijackenterprise customer accounts detected and blocked by Microsoft from Jan – Dec 2021. Identity & Access Management Trends & Challenges Identity is the New Battleground, Cyber Signals, February 2022 80% of attacks involve identity-based techniques
- 14. Zero Trust Attend a2-day event for Partners: Security Through the Lens of Zero Trust here. The training is also available On-demand. Zero Trust Guidance Center | Microsoft Learn Verify explicitly Use least privilege access Assume breach Always authenticate and authorize based on all available data points. Limit user access with Just-In-Time and Just- Enough-Access (JIT/JEA), risk-based adaptive policies, and data protection. Minimize blast radius and segment access. Verify end-to-end encryption and use analytics to get visibility, drive threat detection, and improve defenses.
- 15. Classified as MicrosoftConfidential Visibility across your entire organization Secure your end users Secure your infrastructure
- 16. Classified as MicrosoftConfidential Microsoft 365 Defender Microsoft Defender for Cloud Visibility Automation AI Data connectors Security analytics Threat intelligence Modernize your SOC with Microsoft Sentinel Optimize security operations with cloud-native SIEM powered by AI and automation
- 17. Classified as MicrosoftConfidential Microsoft Sentinel Microsoft 365 Defender Microsoft Defender for Cloud Endpoints Identities Cloud apps Email Docs IoT Protect end-user environments with XDR Stop attacks and coordinate response across digital assets
- 18. Classified as MicrosoftConfidential Microsoft Sentinel Microsoft 365 Defender Microsoft Defender for Cloud SQL/Storage Server VMs Containers Network Industrial IoT Azure App Services Secure multi-cloud environments with XDR Use industry-leading threat intelligence and XDR capabilities to stop threats
- 19. Classified as MicrosoftConfidential 8 3 18 21 7 Why is defense so difficult? SecOps professionals must protect…
- 20. Classified as MicrosoftConfidential End Point Attacks are crossing modalities Typical human-operated ransomware campaign Cloud apps
- 21. Classified as MicrosoftConfidential Protection across the entire kill chain With Microsoft SIEM and XDR Services stopped and backups deleted Files encrypted on additional hosts Browse to a website Phishing mail Open attachment Click a URL Command and Control User account is compromised Brute force account or use stolen account credentials Attacker compromises a privileged account Domain is compromised Attacker exfiltrates sensitive data Attacker collects reconnaissance and configuration data Email Endpoints Identities Workloads Exploitation and installation Cloud apps
- 22. Classified as MicrosoftConfidential End Point Protection across the entire kill chain With Microsoft SIEM and XDR Email Endpoints Identities Cloud apps Workloads Malware detection Safe links Safe attachments Endpoint Protection Platform (EPP) Endpoint Detection and Response (EDR) Verified ID Permissions management Privileged Access Management Identity threat detection and response Identity Protection Workload threat protection File share encryption Control access Protect data
- 23. Classified as MicrosoftConfidential November
- 24. Classified as MicrosoftConfidential
- 25. Risk assurance byphases Allows you to understand how Microsoft security controls are designed and operated by using online resources such as: • Service Trust Portal • Compliance Manager • Compliance Score, and • Secure Score All Microsoft controls have been certified by independent third-parties such following standards such as ISO 27001:2013, SOC 2, and FedRAMP (NIST SP800-53). By mapping your internal requirements against these frameworks, you will obtain 3rd Party Certification over the design and operation also of your controls. Further confidence over the operation of our controls may be obtained by engaging a fully independent third-party funded by you as a customer. For instance TruSight was founded by a consortium of leading financial service companies specifically for this purpose. Direct review of control evidences is only possible through direct audit engagements such as 1:1 and possibly group audits. Currently, audits through the Compliance Program are only available to Financial Services companies and organizations performing privacy (GDPR) assessments. 3rd Party Certification 2 Service Review & Education 1 External Attestation 3 Direct Audit Engagement 4 How Microsoft supports you in assessing & auditing our services Compliance Program Self-service Audit External
- 26. Microsoft Purview Comprehensive solutionsto help govern, protect and manage your data estate Understand & govern data Manage visibility and governance of data assets across your environment Safeguard data, wherever it lives Protect sensitive data across clouds, apps, and devices Improve risk & compliance posture Identify data risks and manage regulatory compliance requirements Microsoft ecosystem Support for multi-cloud, hybrid, SaaS data | Third-party/partner ecosystem
- 29.
- 30. The odds are today’s4,000 72 mins 3.5M
- 31. Operated with simplenatural language queries
- 32. Classified as MicrosoftConfidential 140+3 Threat groups 65T4 Analyzing Threat signals daily 50% increase 37B4 Blocking email threats annually Serving billions of global customers, learning and predicting what’s next Monitoring 40+1 Nation state-groups Investing to improve and share knowledge, gain insights, and combat cybercrime $20B1 in the next 5 years 60% Up to savings, on average, over multi-vendor security solutions Keeping you secure, while saving you time and resources Trusted globally, protecting organizations’ multi-Cloud and multi-platform infrastructures customers have chosen Microsoft Security to protect their organizations partners in security ecosystem 860K4 15K1 Industry-leading security from Microsoft 1. Earnings Press Release, FY22 Q4. July 26, 2022, Microsoft Investor Relations 2. “Microsoft Digital Defense Report”. October 2021, Microsoft Security 3. Earnings Press Release, FY22 Q2. December 16, 2021, Microsoft Investor Relations 4. “Microsoft Security reaches another milestone—Comprehensive, customer-centric solutions drive results” blog – Microsoft Security
- 33. Classified as MicrosoftConfidential Best practices Sven Heeb
- 34. Best practices • SecureScore / Messbarkeit im Unternehmen • Vorstellung Produkte • Defender for Servers • Defender for Endpoint • Defender for Office365 • Defender for Endpoint Vulnerability Management • Beispiel Secure Score for Device / Exposure Score • Azure Sentinel (Monitoring)
- 35. Secure Score Allgemein Wasist Secure Score? (verschiedene Scores) Microsoft Secure Score ist ein Tool, das die Sicherheit der Einrichtung und Konfiguration Ihres Microsoft Tenant in einer einfachen Zahl ausdrückt. • Empfehlung Microsoft 65% und höher • Firmenziel Baggenstos 75 % bei Managed Service Wie erreichen wir bzw. was ist unser Ziel? • Secure Score Punkte: Absoluter Wert Abhängig von der eingesetzten Lizenzierung • M365 Business Premium, M365 E3/E5 oder weitere Lizenzen • Allgemeines Ziel: Technologische Weiterentwicklung fördern für Microsoft Produkte welche in der Baggenstos Produktematrix sind. • Doing: Wöchentlicher Abgleich (Endpoint, Messaging, Security usw.) innerhalb Core Team Baggenstos bestehend aus Fachspezialisten (Consultants, Engineers) • Managed Service Ziel: Technologische Weiterentwicklung der eingesetzten Produkte im Managed Service • Resultat: Massnahmenpakete erstellen via Ticketingsystem • Umsetzung: Iterative Implementierung Managed Service Kunden
- 36.
- 37. Worum geht es… • Microsoft Defender for Servers erweitert den Schutz auf Ihre Windows- und Linux-Computer, die in Azure, und lokal ausgeführt werden. Defender for Servers bietet weitere Features zum Schutz vor Bedrohungen. • Ist bereits auf jedem Server ab W2016 aktiv (Microsoft Defender Antivirus) aber aktiviert mit maximaler Komptabilität • Mit Defender for Server und entsprechender Konfiguration ist das Ziel maximale Security • Sie unterscheidet sich von den typischen signaturbasierten Anti-Malware-Lösungen, die es gibt, da sie Sensoren enthalten, um Verhaltenssignale von Betriebssystemen zu sammeln und zu verarbeiten, und maschinelles Lernen (KI) verwendet, um verdächtiges Verhalten zu erkennen. • Microsoft Defender Servers ist im gleichen Zug eine zentrale Sicherheitsplattform (Portal) für Endgeräte, die Unternehmen bei der Prävention, Erkennung, Untersuchung und Reaktion auf fortschrittliche Bedrohungen unterstützt.
- 38. Defender for Servers •Sie erhalten die Basiskonfiguration nach Baggenstos Baseline (Standard) • Integration Azure Arc für Onboarding Onpremis Server • Installation & Konfiguration Monitoring Agent • Bereitstellen & Konfiguration der GPO’s für Defender Capabilities in Windows • Onboarding (on-prem) Server in Defender for Cloud • Exclusions für Business Applikationen setzen (bei Bedarf) • Schulung Defender for Cloud • Mailnotification oder Anbindung Ticketingsystem für Alerting (Azure Sentinel) • Technische Features • Next-generation protection (Maschine Learning / Künstliche Intelligenz) • Attack surface reduction (Verringern der Angriffsfläche durch Regeln) • Implementation Microsoft Defender Best Practises • Centralized management (Security Portal) • Security reports • Lizenzvoraussetzungen: • Microsoft Defender for Servers (CHF 5.– pro Monat pro Server)
- 39.
- 40. Worum geht es… • Analog Server, es handelt sich grundsätzlich um das gleiche Produkt. (Microsoft Defender Antivirus) • Unterscheidung im Onboarding der Clients • Einfaches Onboarding via Intune Konfigurationsrichtlinen oder AD Gruppenrichtlinen • Intuitives Security Portal für eine Übersicht aller Clients analog Server • Alerting über Mail oder Ticketingsystem Anbindung (Azure Sentinel)
- 41. Defender for Endpoint •Sie erhalten die Basiskonfiguration nach Baggenstos Baseline (Standard) • Konfiguration & bereitstellen Intune Konfigurationsrichtlinien für Defender for Endpoint • Onboarding mit Microsoft Endpoint Manager (Intune) • Onboarding Clients • Monitoring & Anpassung an ihre Systeme & Business Applikationen • Mailnotification oder Anbindung Ticketinsystem für Alerting (Sentinel) • Technische Features • Er ist in Windows 10/11 eingebettet (kein zusätzlicher Agent muss bereitgestellt werden) • Unterstützung für Windows 7/8 und Nicht-Windows-Betriebssysteme wie Linux, macOS, Android und iOS • Anti-Manipulation • Endpunkt-Erkennung und -Reaktion (EDR) • Attack Surface reduction • Integration mit Microsoft Endpoint Manager • Schwachstellenanalyse • Suite-übergreifende Integrationen • Integrierte Datentrennung und RBAC • Tiefe Datensammlung (bis zu 6 Monate Datenspeicherung) • Native Integration mit Azure AD Conditional Access • Lizenzvoraussetzungen: • Microsoft Defender for Endpoint Plan 1 oder 2, Microsoft365 Business Premium (Defender for Business)
- 42.
- 43. Worum geht es… Was ist Vulnerability Management? (Schwachstellenmanagement) Das Vulnerability Management hat die Aufgaben die Verwundbarkeit in der IT- Infrastruktur eines Unternehmens zu identifizieren und zu beheben. Das Ziel ist die Reduzierung der Risiken für die IT-Systeme sowie die nachhaltige Verbesserung der gesamten Sicherheitsniveaus. Durch die Nutzung des Produktes priorisiert Defender Vulnerability Management schnell und kontinuierlich die größten Sicherheitsrisiken für Ihre kritischsten Ressourcen und bietet Sicherheitsempfehlungen zur Risikominderung. • Software (Aktualität sowie Bugfixing) • Browser Extensions • Zertifikate Fokus liegt auf Software Vulnerabilities sowie deren Bekämpfung.
- 44. Secure Score forDevice / Exposure Score Der Secure Score for Devices bzw. deren Empfehlungen kommen hauptsächlich vom Defender for Endpoint. Weitere Empfehlungen betreffen: • OS, Netzwerk, Accounts, Applikationen Secure Score for Devices Exposure Score (Defender for Endpoint) (Vulnerability Management) Empfohlener Wert Microsoft 65% und höher Ziele Baggenstos Microsoft 75% und höher Ziele Baggenstos Microsoft 20 % und tiefer Empfohlener Wert Microsoft 30 % und tiefer
- 45.
- 46. Worum geht es… Microsoft Defender für Office 365 ist ein Sicherheitsdienst, der speziell für Office 365 entwickelt wurde und Schutz vor komplexen Bedrohungen wie Phishing, Schadsoftware, Spam und betrügerischen Business-E-Mails bietet. • Drei Produkte • Exchange Online Protection (Default Exchange Online) • Microsoft Defender for Office365 P1 • Microsoft Defender for Office365 P2 Office365
- 47. Was bringen dieeinzelnen Services? Exchange Online Protection Defender for Office365 Plan 1 + 2 Lizenzvoraussetzungen: Microsoft Defender Office365 Plan 1 + 2, Microsoft365 Business Premium
- 48. Microsoft Sentinel Sie erhaltendie Basiskonfiguration für Ihr erfolgreiches Alert Handling im Baggenstos Ticketsystem via Microsoft Sentinel • Integrierte Defender Produkte (Baggenstos Standard) • Microsoft Defender for Servers • Microsoft Defender Antivirus • Microsoft Defender Endpoint • Microsoft Defender for Office365
- 49. Zusammenfassung – dasWichtigste! Nutzen und konfigurieren Sie beim Einsatz von Microsoft Cloud Services die lizenzierten Security Komponenten. Überwachen und aktualisieren Sie stets die von Microsoft erweiterten Security Funktionen. Sensibilisieren Sie die Mitarbeitenden auf die möglichen Bedrohungen und Schulen Sie das Verhalten bei Unsicherheit.
- 50. Gefallen am Webinar? JetztNewsletter abonnieren und aktuell bleiben!
Editor's Notes
- #11 What is the most typical case of fraud in the cloud? It starts by stealing credentials, hackers target admin accounts without mfa, or breakglass accounts, sometimes breakglass accounts of a partner that gives them access to many customer subscriptions, or even mfa tokens stolen from an unmanaged device Next step is to look for a subscription, may be production, but they even prefer test/dev subscriptions because nobody is monitoring those ones Then they wait for the right time to start consuming resources, because they check for customer names, they analyze how to distribute the charge to get unnoticed, and then they deploy on a Friday evening so they have all the weekend to work without anyone watching them Phishing continues to be a preferred attack method as cybercriminals can acquire significant value from successfully stealing and selling access to stolen accounts. This year saw a significant increase in indiscriminate phishing and credential theft to gain information which is sold and used in targeted attacks such as ransomware, data exfiltration and extortion, and business email compromise, and also with attacks that will have a big impact on your side like cryptojacking: using your resources to do cryptomining activities. To illustrate the scale of phishing and the speed of compromise, we’ve included some stats in the report. This year we blocked an average of 710 million phishing emails per week. In addition to the URLs blocked by Defender for Office, our Digital Crimes Unit directed the takedown of 531,000 unique phishing URLs hosted outside of Microsoft. It takes just 1 hour and 12 minutes for an attacker to access your private data if you fall victim to a phishing email. And one 1 hour and 42 minutes is the median time for an attacker to begin moving laterally in your corporate network once the device is compromised. These last two data points come from Defender for Office (for malicious email/compromised identity activity), Azure Active Directory Identity Protection (for compromised identity events/alerts), Defender for Cloud Apps (for compromised identity data access events), M365D (for cross product correlation), and Defender for endpoint (for attack behavior alerts and events). Phishing emails with Ethereum wallet addresses Only a few days after the start of the war in Ukraine in late February 2022, the number of detected phishing emails containing Ethereum addresses encountered across enterprise customers increased dramatically. Total encounters peaked in the first week of March when half a million phishing emails contained an Ethereum wallet address. Prior to the start of the war, the number of Ethereum wallet addresses across other emails detected as phish was significantly less, averaging a few thousand emails per day. Business email compromise: Email phishing attacks against businesses for financial gain are collectively referred to as BEC attacks. Microsoft detects millions of BEC emails every month. BEC is the costliest financial cybercrime, with an estimated $2.4 billion USD in adjusted losses in 2021, representing more than 59 percent of the top five internet crime losses globally. BEC attackers normally attempt to start a conversation with potential victims to establish rapport. The introduction email, which we track as a BEC lure, represents close to 80 percent of detected BEC emails. Phishing impersonating a Microsoft login with dynamic content Microsoft accounts remain a top target for phishing operators, as evidenced by the numerous phishing landing pages which impersonate the Microsoft 365 login page. For example, phishers attempt to match the Microsoft login experience in their phish kits by generating a unique URL customized to the recipient. This URL points to a malicious webpage developed to harvest credentials, but a parameter in the URL will contain the specific recipient’s email address. Once the target navigates to the page, the phish kit will pre-populate user login data and a corporate logo customized to the email recipient, mirroring the appearance of the targeted company’s custom Microsoft 365 login page.
- #14 Let's start off with the why here and go through these trends + challenges we're seeing. [People don't own their identity data and don't really even understand where it is being used, regulations are increasing, we've already seen this with GDPR, and by next year 65% of the world will be covered by some kind of privacy regulation, and lastly the modern workplace is hybrid and we see that identity proofing processes are unsatisfactory for 82% of organizations. Digital identity is a prime target for cybercrime and ransomware attacks. Compromised or fraudulent credentials are a very real and critical threat to public and private organizations today. Today, your identity data is spread across countless entities and accounts, creating greater risks of fraud or breach. People once kept their valuable identity documents under lock and key. Plus, over 10 million people are stateless, and lack identity credentials. Companies are questioning whether it’s even worth it to capture and manage personally identifiable data. Pandemic and now hybrid work arrangements are a huge challenge to traditional identity verification process that tends to rely on the copies of physical documents (92% of orgs). Plus the Great Reshuffle - 4.5 million Americans resigned from their jobs in August 2021. 41% are considering leaving their employer.
- #15 So, how can we protect our customer subscriptions? We know that 98% of the attacks could be avoided by following the basic security hygiene. So, the first thing is protecting the identities, and one important strategy to protect them is to use Multifactor authentication. But this is not enough, we need to follow the zero trust principles. We must stop believing that everything behind our corporate firewall is safe, we always verify every request because we assume breach. And even when you have verified the request, the identity accessing a resource should only have the minimum rights to perform the task it has to do and just during the time it has to run the task, this applies to users but also to machine identities. Zero Trust is a security strategy. It is not a product or a service, but an approach in designing and implementing these security principles. We have special trainings for partners like this 2-day event for learning about Zero Trust, and a full Guidance Center on Microsoft learn, where you can learn all the concepts and have implementation guides for them. Are you applying Zero Trust? Have you regular conversations and trainings with your customers about these topics?
- #21 20
- #22 21
- #23 22
- #24 Note: Per Gartner publication policy, alterations to this slide are not allowed.
- #25 Note: Per Forrester publication policy, alterations to this slide are not allowed.
- #26 Level 1 Education & learning: STP Assess MS controls: Compliance Manager & STP (audit reports) Evaluate Customer controls: secure score & STP (whitepapers) Level 2: Independent Assurance Certifications (multiple) Level 3: External attestation 100% independent External party has done evidence review on behalf of banks Level 4: Directly observe control evidence Group audit for efficiency 1:1 Audit upon request
- #27 Introducing Microsoft Purview! To help organizations govern and protect data across their multi-cloud, multi-platform data environment, while meeting the compliance requirements they are subject to, we are announcing Microsoft Purview. Microsoft Purview is a comprehensive set of solutions to help govern, protect, and manage your data estate. Microsoft Purview unifies information protection, data governance, risk management, and compliance solutions so that customers can manage their data all from one place. Now, they can leverage that visibility across their environment to help close exposure gaps, simplify tasks through automation, stay up-to-date with regulatory requirements, and keep their most important asset, data, safe.
- #28 With Microsoft Purview we bring together compliance and data governance The risk and compliance portfolio joins with our unified data governance
- #29 Talk Track: When you enable Microsoft Priva, from the Microsoft Purview compliance portal, in less than 48 hours, you start to see insights around personal data sprawl for your organization - how much personal data exists in your organization, where it lives, how it moves etc – no configuration needed. In this example, it shows that this tenant has 1.7K items with personal data found. These insights are also dynamically updated as new data comes in, helping Admin keep a pulse over time Additionally on the dashboard, Admins can see this tile that summarizes the Privacy risks in their organization. There are 3 categories of privacy risks that are captured here, including Data minimization risk, which identifies personal data that has not been used for a long period of time and is just sitting around in your org Second, data overexposure risk, which identifies content with personal data that is being over shared, Third, cross-border transfer risk, which identifies personal data that is being transferred across boundaries – regional or department data transfer. This tile shows the total count of all such matches. Right from here Admins can drill down and inspect the violations This view has been extremely valuable for our customers who have deployed the solution. Most of them did not have this level of visibility and insights into their personal data risks. For some organizations this amount of personal data could be pretty significant to begin with. This view enables organizations to increase the awareness of privacy risks in their environment and take the right steps to make improvements
- #30 And it all comes together with Security Copilot at the heart of the Microsoft Security product portfolio.
- #31 Security is a defining challenge of our times. The number of password attacks Microsoft detects has more than tripled in the last 12 months, from 1,287 per second to more than 4,000 per second And the median time for an attacker to access your private data if you fall victim to a phishing email is only 1 hour and 12 minutes. Defenders are simply outmatched. Attackers have more resources and don’t have to play by the same rules. Add to that a global shortage of 3.5 million skilled cybersecurity professionals, and it’s no wonder that security incidents have become an everyday o ccurrence in organizations of every size, in every industry, and in every part of the world. So security professionals are up to huge challenge – a challenge that we believe we can help solve with Security Copilot. Now, those are some jarring statistics. Net, net – the job is really tough. Let’s look at some specific challenges facing security analysts themselves now.
- #32 We’ve touched on this already, but one of the game changing aspects of this technology is that you can interact with it using natural language queries, the same way that you interact with your coworkers. Let’s take a look at what happens behind the scenes when you ask a natural language query because it may seem simple at face value but there is a lot of sophisticated processing and computation that’s taking place under the hood. Here’s a very simplified look at what happens behind the scenes. After the user submits a prompt the Security Copilot planner determines the context and builds the plan using the available skills that come with Security Copilot. It then executes the plan and gathers all the necessary content and data. Next it combines that data and context, formats the data, works out the response and then delivers that response. This can happen in just seconds. Once again this is a very simplified view, but I wanted to show you a little more on how it works. We’ve talked about the security-specific model a bit but let’s go a bit deeper there next.
- #36 Microsoft Defender for Cloud Secure score (Azure) https://learn.microsoft.com/en-us/azure/defender-for-cloud/secure-score-security-controls Microsoft 365 Defender - Microsoft Secure Score (M365) Microsoft Secure Score | Microsoft Learn Microsoft Secure Score for Devices (Exposure Score/Configuration Score) Microsoft Secure Score for Devices | Microsoft Learn
- #38 Microsoft Defender Exploit Guard Kontrollierter Ordnerzugriff (schützt zum Beispiel systemordner Reduzierung der Angriffsfläche (Sie kann zum Beispiel helfen, Office-, E-Mail- und skriptbasierte Malware zu stoppen) Folgend die Microsoft 365 Defender Security Empfehlungen, welche durch die oben genannten Group Policies konfiguriert werden: Microsoft Defender for Endpoint Detect and block potentially unwanted applications (PUA) Microsoft Defender Antivirus cloud protection Always-on protection Microsoft Defender SmartScreen (Wart vor verdächtigen Websites, schützt vor Phishing Websites, Führt Screening von Downloads durch Microsoft Security Compliance Toolkit (SCT)
- #39 Plan costs, understand Microsoft Sentinel pricing and billing | Microsoft Learn
- #41 Credential Guard ist ein Schutz, um auf dem System verwendete Passwörter zu schützen, da diese ansonsten zugänglich für Schadsoftware auf dem System sich befinden. Diese Passwörter werden isoliert, sodass ausschliesslich System-Software den Zugang hat. ASR ASR ist eine Sammlung von Regeln, die den Microsoft Defender steuern, um das Windows System sicherer zu machen, indem es folgende Verhalten beeinflusst resp. nicht zulässt: [5] Launching execuTabelle files and scripts that attempt to download or run files Running obfuscated or otherwise suspicious scripts Behaviors that apps do not usually occur during normal day-to-day work
- #49 https://learn.microsoft.com/en-us/azure/sentinel/overview
- #50 https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/categorizing-microsoft-alerts-across-data-sources-in-azure/ba-p/1503367