- If you're using SIMM or XDR solutions today
to manage breaches after they've happened,
today, I'll show you what you can do
to prevent incident and breaches before they happen
with Microsoft's new Security Exposure Management
capabilities in Microsoft Defender,
which not only helps you proactively assess
your security posture, put the right defenses in place
to mitigate threats and track your progress over time,
but it also identifies attack entry points
and even maps out potential attack paths,
importantly, giving you visibility into the blast radius
of critical choke points
leading to multiple high-value assets,
so that you can close them down before they get exploited.
It addresses the complexity you might be facing today
where your security perimeter
and the vulnerability points across your infrastructure
are continually expanding.
From the network boundary with on-prem resources,
the device endpoints connecting to it,
anything from laptops, smartphones, or IoT devices
and even new device types, the increasing number
of cloud apps in use, distributed data stores, certificates
and domains along with potentially multiple cloud
infrastructures with multiple identity services.
And then, of course,
the introduction of less secure networks
as people work remotely, as they access resources.
At each layer of defense, you're probably using dozens
of security tools from multiple vendors to harden each part
of your infrastructure against different attack vectors.
These may be siloed or, at best, loosely integrated,
making it difficult to find and prioritized security gaps.
Where relevant, you might also prioritize software fixes
to address CVEs and deploy them as soon as you can.
In short, you're having to make sense of
and coordinate your threat exposure
across these different tools,
and this, in turn, can increase your risk.
And that's what Security Exposure Management
will increasingly solve for.
It unifies data and signals
from the tools you're using today,
starting with solutions from Microsoft,
and we'll be adding additional connectors over time
for non-Microsoft tools to proactively harden your security
before attacks happen.
Let me show you how this works, starting with knowing
what you have in place to understand
and quantify your attack surface exposure.
This is the Security Exposure Management experience
in the Microsoft Defender portal.
I can see my assets at a glance with Onboarded,
Discovered, Internet-facing devices,
and Cloud resources and more.
There are also key initiatives
that your organization has selected to work on.
I'll dive into that more in a moment.
Next, in Security Metrics,
I see a few key data-driven indicators
of specific high-value vulnerabilities and security controls
and their current values against targets.
We also show you the distribution of exposed asset types
and their exposure levels as well as recent security events
and changes that have occurred in your environment.
So we give you a 360-degree view
of your organization's security posture in one place.
Because you can't fix everything at once,
it's important to prioritize where to focus your efforts.
Security Exposure Management helps with that too.
First, let's go back
to our most important business critical data
and sensitive information.
In order to prioritize them, you have to discover
and identify them, and we make it easy for you
with a set of predefined classifications
of common critical assets.
And then you can define your own custom classifications
and have the tool automatically mark them as critical.
Now, let's go back and look at the initiatives
important to your organization.
Exposure Management provides a list of initiatives
for you to choose from.
This is a curated and continuously evolving list
with threat actor groups, common workloads
and trending attack types.
For now, I'll choose Octo Tempest.
If you haven't heard about them,
they typically use broad social engineering campaigns
to compromise credentials
and gain access to private networks.
I can see the all-up score at the top,
which is a measure of how strong our posture
is for this particular initiative.
It's at 78%, which is better than our target of 67,
along with security metrics, critical assets, and more.
For this initiative, we're going to assign Jane
as the owner since she's responsible for new
or evolving threat actors.
As an initiative owner,
you can receive automatic emails detailing updates
to any initiative you own, when there's a drift
in the protection level.
In fact, let's play that out.
You can see an example of the email
that Jane would receive in this event.
In this case, there's a 20% decrease in our protection
against Octo Tempest, which can be investigated further.
As you click in, you're taking directly
to Exposure Management,
and now, you can see a connection to one
of the tracked security metrics for Internet-facing devices,
which has dropped significantly.
And by clicking in further on that metrics,
you can see a high-level view of the details.
On the right, there's also an Insight
highlighting three new attack paths
that have opened up based on the device
now being Internet-facing.
The approach with bottling attack paths
goes beyond just remediation of isolated security findings,
like the discovered Internet-facing endpoint.
Instead, as I'll show you,
it gives you a detailed visual mapping
of the potential lateral movements
an attacker can make along with impacted users, devices,
and resource entities that can be used as an entry point.
So let's look at that experience.
From the list of attack paths,
you can now get details for each one.
I'll choose this one at the top
with the highest criticality.
The visual tells part of the story
and kind of resembles the stops on a subway line
where the Internet exposed device is the starting station
and the critical assets is the end of the line,
which all the lateral movements
or stops in between to get there.
These are the resources and assets
that an attacker might reach with a well-crafted attack.
In fact, this server, IRL5 device,
in the middle is important.
The double blue circle means that it's a choke point.
These are like subway hubs
that connect to other destinations.
When I expand this view by selecting Show blast radius,
you'll see why it's a choke point.
It provides the attacker with additional attack paths
to other even more critical assets,
which are circled in gold,
which means if you can shut the hub down,
you can close many attack paths.
So now, if I take a closer look at this choke point,
on the right, I can see more details about this device,
and from there, I can see recommended actions
for remediation.
This is where we now can mobilize our vulnerability
and posture management teams
to prioritize remediating this choke point
to close down multiple attack paths.
And if we fast forward in time
and go back into the initiative, we can check the impact
of our remediation and you'll see our protection level
against Octo Tempest has increased from its dip
of 58% back to a healthy state of 70,
which is, again, above our target.
And this is just one example.
Secure Exposure Management
will continuously monitor your threat exposure
and help you improve your security posture,
so you can stop attacks before they happen.
To sign up for the preview,
go to aka.ms/ExposureManagementpreview.
And for more information,
check out aka.ms/ExposureManagementdocs
and keep watching Microsoft Mechanics
for the latest tech updates.
Make sure you subscribe and thank you for watching.