Coming up, a look at the operations management suite security an audit solution
which provides deep and actionable insight into the security of your hybrid cloud environment.
We'll explore how it helps you to understand the security state of your resources
and identify vulnerabilities.
And, detect active threats and quickly investigate malicious activities.
Microsoft Mechanics
I'm joined by Principal program manager, Sarah Fender. Welcome.
Good to be here.
Now when people think of the operations management suite
they think of it as the operational hope for their entire environment
across Windows, Linux, public cloud and private cloud.
Enabling them to utilize log analytics, automation
backups, site recovery and also security.
Right, and we've heard from a lot of you
that increasingly operations and security management go hand in hand.
So we've added some new capabilities to OMS
which makes it even easier for you to manage security across your hybrid IT environments.
So, how does it work?
Well the OMS security solution collects and analyzes security data from your resources
wherever they reside to provide security insights.
So this helps you to identify potential security issues
and take action quickly.
Cool, so can we take a look at some of those insights?
Absolutely.
So we're in the operations management suite portal
now we're just going to jump right into the security solution.
Let's look at data for the last seven days.
So here we can assess the security of a variety of different controls.
We refer to these the security domains.
So for example we can see if anti-malware software is deployed and kept up to date.
If systems have any missing or critical security updates
which can create vulnerability to make them easy target for attackers.
Information that inbound and outbound network communications.
And if we wanted to learn more about any of these we just simply click in.
So for example if we look at the identity and access domain
we can see here for example if failed login attempts exceed the norm
certainly looks like what's happening here.
We can see which systems are being targeted
and also which user accounts are being used.
This might help us to identify a dictionary based attack.
Ok cool.
So one other thing I want to show you is this new baseline assessment feature.
So working with industry partners including the US and UK Defense departments
and many many others.
Microsoft defines and publishes a set of recommended security baselines
for Windows servers.
And these base lines are what people will be familiar with from windows server security baseline?
Absolutely. Right.
Now OMS is assessing the security of your servers against the set of base lines
and if it sees any mismatches or any vulnerabilities that surfaces those
They're prioritized for you here.
And we can click into view more information about this specific rule.
So in this case we see that there's a rule relative to audit policy.
And if we expand this view here we can see that the expected results for that to be turned on.
But, it's not configured at all for this particular computer.
So is there a way that the system surfaces to you things that you need to take action on?
Yes, so notable issues helps you identify areas that require your attention across
all of these different domains.
And issues are prioritized so you know where to focus first.
And most of these rules are built in
but you can also create your own custom rule.
So for example if you wanted to keep a close eye on login attempts using your CEOs credentials
you could do that.
So we've created a custom notable issue for that here.
That's great for highlighting vulnerabilities we can take action on
but what about active threats? Are those flagged as well?
Yes absolutely.
One of the more exciting new capabilities is threat intelligence
which enables you to see network communications to and from malicious IP addresses.
Here we're comparing network traffic to global threat intelligence from Microsoft.
In this case, at least partially sourced from our a Digital crimes unite.
Nice. Okay.
You can now visualize the source of these attacks by geography.
and you can click in to get additional insights.
So here we can see that this traffic was associated with a known botnet.
And, another instance here we see darknet.
So these orange arrows indicate inbound communication attempts.
But, what's really alarming is this red outbound communication that we see.
So this indicates that one of these computers is communicating with the known bad actor
who could be executing commands on this system or exfiltrating data.
So what's next? Once an attack has been identified how do we start to remediate?
Let's start by investigating a bit.
So you might want to look at other activities that were occurring on this particular computer.
Using the powerful search there?
Absolutely.
And then we can also narrow that search based on the time frame.
So if we wanted to look at just those events that occurred at the same time
or close to the same time as the outbound traffic we saw earlier.
So we can narrow that time window here.
So there's a lot of different kinds of security alerts are available.
We can see different activity types and who's signed in
and look at in particular at who has been accessing this computer during that time frame.
So this particular account looks suspicious.
It's Joseph Benson, That doesn't match my company account naming policy.
So let's see what else Joseph Benson has been accessing.
Your choosing a simple search query here
but, you could create a much more complex search query if you wanted to?
Absolutely, so I'm going to group the results here by computer.
And I can see at a glance that he's been accessing a number of different computers
including one that contains PII, so definitely not good.
So based on this inside I could take further action
so I might want to block this particular user account
or block traffic out to that known bad IP address.
Ok, so if you're an admin and you've already got our OMS set up and running
how do I get started with the security and audit solution?
You can simply add the security solution from the OMS solutions gallery.
So let's take a look at that.
You can see there are lots of different solutions that are available
and I think they're adding new ones virtually every week
So just find the security solution and click on it.
And for new users you'll have an option to add it here.
Ok, so I don't need to deploy any additional management or infrastructure service on prem
to take advantage of this functionality?
If you're already using OMS to manage these servers there's really nothing extra for you to do.
So in summary you get the benefit of integrated operations and security?
That's it.
So, how does somebody get started?
If you're already using OMS you can simply add the security solution as we just saw.
And, if you're not already using OMS you can use the link below to sign up for a free trial.
Great, thanks.
And keep watching Microsoft Mechanics for the latest tech updates.
Thanks for watching and bye for now.
Microsoft Mechanics
www.microsoft.com/mechanics