this is Susan Bradley for CSO Online today I'm going to talk about Microsoft
threat protection you may have seen it recently in the news but Microsoft
threat protection isn't just one thing it's actually four things first off its
Microsoft defend their ATP advanced threat protection and you can think of
that as a super-duper antivirus as well as a cloud tracking system then it's
also Azure ATP which can be used to track threats and things on your domain
controllers Microsoft cloud app security which delves deep into cloud
applications into where users in your office use cloud pieces that they aren't
authorized to use and then of course the piece that probably most people are
aware of is the office 365 advanced threat protection I'll recommend that
you review the Microsoft 365 licensing guidance for security and compliance it
can be a little confusing to use Microsoft threat protection mainly
because sometimes it will open up a console or a view for everybody in your
office and you've only licensed some people in your office so obviously you
have to narrow the scope down in the console of exactly those people that are
licensed for the product not for everybody in in the office one of the
things I'm a fan of in the Microsoft Defender security center is this
Timeline feature and especially for heaven forbid if we should ever have
ransomware it shows you the actions that are going on inside your system and
because this is a cloud service obviously if worst case scenario a
ransomware attack has encrypted your devices and so you can't get into log
files all of this information is up in a cloud service that you can still look at
so if you need to come back in after the fact and go hey what happened what
attack really came through my system because these log files are up in the
cloud system you can come back and see what went on I'm also a huge fan of the
Center that's up on Microsoft Defender because it analyzes typical attacks and
how they might come into your system and give a step-by-step how these attacks
occur so it helps me and understand him in my environment what might be
happening and what might come in so this is what's called the the mitered attack
sequence and it shows you how trick bot came in and what protections you might
have along the way and I look at that and go hey do I have everything in place
to protect myself and remember you can sign up for a trial for the Microsoft
Defender advanced threat protection and you can come out here and go through
simulations and tutorials so obviously you don't want to infect your own
machine with ransomware or some kind of investigation attack but you can come
out here and get simulation files that drop back doors or PowerShell scripts so
you can see what would go on and what kind of things and information you get
provided next up in the Microsoft threat protection bundle is office 365 ATP I'd
say this is the best known of the bunch most of you either have had it or wish
you have it and it includes the anti-phishing safe attachments safe
links enhance filtering and all sorts of other techniques to allow the user to be
best protected I highly recommend even if you don't have office 365 ATP that
you have some sort of filter between you and the outside world phishing attacks
is huge these days this is how the attackers are coming in so if you don't
have something out here that is checking those attachments checking those links
making sure that you don't get in personation and spoofing you are a
sitting duck for text so make sure you have something between you and that
email client the next one up is cloud app security what this is about is
looking for cloud applications or other unusual IT software that you didn't
authorize in your firm so it lets you you can also upload traffic logs from
your firewalls you have to convert them you have to especially
put them in in a certain format and you upload them to the cloud app security
and it analyzes it to see what's going on it lets you know if there's different
applications that people are using that they shouldn't be you can also set up
infrequent travel alerts in my example here I set up a suspicious inbox for
bidding I set up a forward from an admin box outside to an external email and it
alerts me when that occurs and it actually blocks the activity so you can
set up all sorts of policies to say hey if somebody logs in from an unusual
location I need to be alerted I need to be blocked if somebody does what's
called impossible travel where suddenly they log in from Los Angeles and then
the next thing you know they're logging in from Paris France
they can't just immediately pop over to Paris there's probably an attack going
on so let's let's log that down and lockdown them oisin is a fraud as a
result the final piece and probably the least well-known I would say of the four
is xuer events prêt protection and it's not just her cloud assets you can
actually let it look at your on-premise domain as well you can have it integrate
in with your defender ATP endpoints you can have it review what's going on in
your VPN connections really important these days with more and more people
working from home and then finally you can hook it into your as your Active
Directory and actually set up a managed service account on your domain
controller and look for unusual activity going on for example the default
scheduled reports are going to tell you when there's modification to sensitive
groups in active active directory it's gonna tell you if you've you're exposing
LDAP authentication 'he's basically exposing your user passwords and clear
text across your domain and last but not and certainly not least and more
important it's going to show you when there's lateral movements to sensitive
accounts meaning that those local passwords are being cracked or harvested
by an attacker and they're doing lateral movement
across your network so as you can see this is kind of doing a holistic view of
your entire network all the way from the workstations to your email to your
domain controllers to your cloud assets and think in terms of what your current
security solutions are doing for you do you have something similar ask your
vendors what they have available to you as well I'll be touching more in Azure
security in future episodes I've just done the top of the iceberg here and
until next time please make sure you come out to the YouTube channel Tech
Talk from IDG for lots more news of the day until next time this is Susan
Bradley for CSO online