Kim Kischel: In this video, we’ll show you how Microsoft
Cloud App Security can protect your information using
both built-in anomaly detections and user defined
deterministic rules.
These two detection engines complement each other,
allowing for wide coverage of different security scenarios,
such as detecting malicious insiders and data exfiltration.
Let’s start by looking at the anomaly detection capabilities.
Microsoft Cloud App Security automatically profiles user
behavior to identify common usage patterns for actions,
such as download and sharing. That way, Microsoft Cloud
App Security can identify unusual user behavior relative
to their baseline and alert you when such suspicious
activities occur. From the dashboard, navigate to the
policies page.
Microsoft Cloud App Security includes out of the box
detections from multiple security scenarios, such as
unusual download activities and unusual sharing activities.
Each of these policies contains configuration options that
allow you to scope the policy. Let’s filter these policy
templates to threat detection policies and use mass
download by a single user. You can now alter the template
and define after how many repeated activities you want
to be alerted on.
You can also scope the policy to a specific set of users.
And you can define how you want to be alerted when a
new policy match occurs, selecting from the Microsoft
Cloud App Security alerts queue or via email and text
notifications.
Finally, you can create automatic governance actions
that will be taken when a suspicious activity is identified.
For each of these alerts, Microsoft Cloud App Security
surfaces all the relevant information to help you understand
what happened and helps you decide which if any actions
need to be taken. So, let’s take a look at an alert based
on this policy.
Navigate to alerts via the menu bar on the left.
Under policy, search for the policy mass download by a
single user.
Here, you can see a new alert. When you click on the alert,
you will be able to see additional details, including the
affected files and user. And you can continue to drill into
the details of this alert and take action.
In addition to anomaly detections, Microsoft Cloud App
Security allows you to define deterministic roles to
identify suspicious patterns. As an example, Microsoft
Cloud App Security can identify AWS as three buckets
that are publicly exposed and allow everyone to access
the information within the buckets unauthenticated.
Open AWS as three buckets for the source for multiple
large data leakage incidents over the last few years
and attackers were able to identify this bad configuration
and exfiltrate sensitive information.
In this example, you can see that a specific bucket is
currently exposed publicly. In order to resolve this
situation, you can manually decide to stop sharing this
bucket by using the make private capability.
To avoid similar scenarios in the future, you can also
adjust the policy to automatically take action when a
new public S3 bucket is identified and make it private
without the need to manually take action.
Protecting your information includes different levels of
coverage, and it’s important to constantly monitor user
behavior to identify suspicious patterns and take actions
accordingly.