(upbeat music)
- Hello again, welcome back to Microsoft Mechanics Live!
Today we're gonna take a look at a 15 minute tour
of all latest compliance and security updates
to Microsoft 365.
Really starting with defense in depth
capabilities across identity, data, devices
and applications including the latest
in password-less authentication
and also information protection
and advanced threat protection.
Plus, improvements to assessing
and managing your security and compliance posture
across Microsoft 365,
with one of my favorite capabilities
Microsoft Secure Score, the new compliance manager,
Advanced eDescovery and much more.
Today I'm joined by Adam Hall from the Microsoft 365
Security Compliance team, Welcome.
- Thank you sir, good to be here.
- Give a big warm welcome to Adam.
(crowd applause)
All right, so, security compliance.
Really two areas that are starting to fuse together
in a lot of interesting ways these worlds are converging.
Can you tell us more about this?
- Absolutely, so, while we have two dedicated teams
working on security and compliance,
there is a frequent intersection.
Particularly when it results in information about people,
the right of the user and so on.
We've seen regulatory compliance, things like GDPR,
coming along where this is not just compliance
for knowing what's going on.
This is about the rights of the individual
and companies need to be able to know
in the event of a breach, was my information leaked or not.
And I can come to you and say, tell me and be able to prove
did you have a leak for me or not?
And so as an example in GDPR,
there's all these statutes that basically say,
prove to me that you had controls in place,
and prove to me that you know,
whether my information was affected or not.
- And so you can see with that example,
that really these are things
that you have to be able to prove, and make sure
that you've got evidence of all of that.
Otherwise there are hefty fines
that you may have to face in those cases.
So, why don't we start with security.
I think everybody here was very interested
in the topic of security,
What approach are we taking there with Microsoft 365?
- So, we have to be constantly hardening
our own platforms and we think about this across identity,
information protection, threat protection,
and security management.
The foundation we use for all of these
is how we run our cloud platforms ourselves.
We've dedicated security teams,
we have teams like research center,
threat intelligence, we call MSTIC,
and there's like three or 4,000 people
who's jobs it is to do security research, identify exploits
and vulnerabilities and feed into our intelligence
so that you can leverage those learnings
as customers as well.
Our identity services team are stopping tens of millions
of attacks ever single day.
And so, we're really on the forefront there
of trying to do identity protection as well.
We take all this information
and then we apply machine learning at a massive scale
to be able to constantly improve
and evolve on our detections every single day.
- So, some of the things we're seeing in terms
of what we're looking at is all the different signals
that we've got with data encryption, malware,
all of the multifactor authentication logins
that we're seeing and all these are signals
that we're processing everyday, right?
- [Adam] Yes, and the security graph is
collecting these vast amounts of information,
trillions of signals per day.
These are coming from different services,
there's a couple of hundred commercial consumer services,
as well as third-party sources.
And all of this information comes in
so that we can run these machine learning algorithms
and heuristics to say, "What have we got?"
And that feeds the insides into our Microsoft 365 services.
- Right, and I know there's been a number
of new recent innovations but can we take a look
at some of the new things.
- Excellent, so, let's start with identity, the front door.
For a long time, passwords have been the way for people
to be able to authenticate.
I guess that most people are
using a password as their primary authentication,
but the sophistication of the attacks means that
that's just simply not good enough,
they're too weak and it's not a good foundation,
and as we see more and more attacks
becoming more and more prolific, we've been on a mission
to eliminate the password and so, we've been working
on eliminating that, bringing in multifactor authentication.
We started with Windows Hello, on Windows 10,
where we introduced the ability to use facial recognition,
or things like fingerprints,
to be able to authenticate without a password
into your account, and then we have the authenticator app,
which is now updated
to support passwordless authentication as well.
So, using that same underlying technology as Windows Hello,
to power authentication in a cloud context.
- [Jeremy] All right, well let's see
what that looks
like on your Mac. - Absolutely,
so let's start with this on the Mac.
I am trying to log in to office.com here
and I am going to try to log in.
Now, as I select my account, instead of being asked
for a password, what I'm going to see
if I can click that, there it goes, it helps if I click.
I am going to see that I'm prompted with a code
and I'm getting the same code on my phone.
I need to select that to identify that I have
a device that's in front of it,
and then I'm asked to authenticate using my thumbprint
on the phone as well.
Straight after that, I'm straight through to Office,
I can now launch my applications, and now I can log in
to all of these cloud applications
without any further authentication
and I don't have to remember passwords anymore,
that's a great thing. - Very cool!
(crowd applause)
And of course to take things one step further,
you can use things like conditional access controls
in fact we have a dedicated show
on this topic beyond the controls,
in terms of realtime assessments.
They're being accessed.
What additional things can we do
to protect the information itself as it's being shared
Or maybe if bad actors somehow have infiltrated
into my network or got potential access to it,
what would we do there?
- So, information protection is probably the area
with the biggest overlap between security and compliance
and we have had a number of updates in this space.
We've been on a mission to unify classification and labeling
for both sensitivity labels and retention labels,
so labels that apply to email and documents,
and email that apply to compliance,
retention, archival and so on.
So, this is the security and compliance center,
and we've brought together all of the security
and all of the compliance into the one console.
On the left hand side here, we have classifications
and if I just zoom in here,
we will see that we have two options,
The sensitivity labels on the left hand side,
and the retention labels on the right.
This allows us to compile in one place the taxonomies
both sensitivity and classification, and retention.
Within each of those we can bring up
a configuration of each one,
this highly confidential label allows me
to turn on thing like encryption.
Do I want visual marking like water marks,
headers and footers
and any other settings around automated labeling,
content protection, and so on.
- Very good. So, Office for Mac is something else that we've
got now with additional protections around,
what can we do there?
- So we've seen the admin side,
on the clients side we need a great user experience,
and we've had this in Office on Windows for a while now,
and now we have native configuration
within Office for Mac as well.
- And after that, there's no more add in,
it's also native in the ribbon?
- No more add ins, this is native into the ribbon,
I have a sensitivity label here and a document that's open.
It's currently classified as general,
this has pulled down the taxonomy, that we just looked at
in the admin console, currently labeled as general.
I'm gonna move this to highly confidential,
and what you will see is a couple of things happen.
In the background, the water mark has now kicked in
to say it's highly confidential, and down the bottom here,
we've identified to the user that we've moved
from a general classification to highly confidential,
this is meter data on the document, it can travel anywhere,
and we will always know what
the classification of that document is
as a native experience on the Mac.
- It's really great actually to see all this update
to classifying and protecting your data but that said,
even the best thought out security mechanisms
and best thought out processes, data classifications
that you make, really the best defense
is kind of assuming that somebody is inside already,
that you're not complacent that you know
that breaches are gonna happen.
We call that assumed breach, what are we doing there
in terms of if bad actors actually do find a way?
- So it's absolutely a best practice to assume breach.
And for every organization across users, the devices,
the data, cloud applications, infrastructure,
assume that the bad actors are already in.
And so as a good example with NotPetya,
we were monitoring email and browser based attacks
but this was very different,
this was a completely new attack Victor,
where not NotPetya got into the packaging process
of a valid application update, that put the payload
into the package and that was deployed out.
A valid process, with a valid package, but now with
a nefarious ransomware attack inside of it.
So, that just proves that the modern workplace,
very complex, that you need to have a set of services
that are secure but everything in your environment
is a potential attack victim.
- Right, so what additional ways then do we have to protect
and detect and respond to new forms of attacks?
- So, within our Microsoft 365 services,
we think a lot about intelligence,
integration and automation.
And we take all the learning of that into and build it
and bake it into the services that we ship.
So, we have lots of new and updated technologies,
along with things like user education.
So, attack simulator for example, allows you
to do a targeted attack in a safe way
on your own users to identify, who are the risky users,
who are the ones that are gonna click
on this wrong link and do the wrong thing.
Helping you educate your users to do the right thing,
so that you can help attacks from not happening as well.
- Alright, so what does that experience look like?
cause I know that we're bringing back,
some of the threat experiences together
into one console, right?
- So we bring in all of that signal together,
We talked about multiple trillions of signals,
what does that mean to our customers?
We want to bring together into a new security center
where we bring this in and show you what
the threat correlations mean to you.
So this is the new security center
and there's lots of rich information here
that is relevant to your environment.
I can drill in and take a look at the incident,
here I have a number of incidents that are going on,
I'm gonna drill into one of them.
Now the incident is not an isolated thing,
it's not one event, it's not one log,
it's lots of things going on.
And so, within this incident
there are are a number of alerts that popped up
and I can click into one of them and drill in.
In this case we have a Suspicious PowerShell script
that's been run across a number of entities.
I can take different pivots, so we have the devices
that have been affected by this incident.
I can see potential attack victors like email,
and data that the payload came through.
I can see the users that have been affected,
and then we roll that all together
into what we call an investigation playbook.
And this playbook gives you a step by step view
into all of the things that have happened,
all the remediation's that we've run,
and give you a view of that,
and so you can graphically see all
the things that happened, all the things that have done,
and in this case we've done
an automatic remediation because
this is just things that we should clean up straight away
without you having to spend time thinking about it.
- This is very cool, So can these insights then feed
into other security solutions maybe seem solutions
that might be run in?
- So absolutely, and we've just made available
the Microsoft Grab API which allows us
to bring all of those workloads, make them available to you,
and integrate with third parties
as well through the Graph Explorer API.
This provides a connection interface to all of those alerts
and all of those security services
within your environment and our partners as well.
- And some of the partners that we have here are
on the Microsoft Intelligent Security Association.
Lots of big vendors as you can see here
that are really providing some
of the best solutions around protecting
the cloud and your assets.
- It's delivering the best result that we can for you
as our joint customers,
bring in all of that partnering extensive
that we've got in the environment,
bring in all of those integrated alerts
into a growing ecosystem of security intelligence partners.
- Right so, once you have all the insights,
how easy is it then to apply all the controls
to your environment to mitigate against
the different threats?
- Our main solution here is Microsoft Secure Score.
Now this tool has been expanded from the original Office 365
and Windows to now include the enterprise mobility
and security solutions as well.
Today I'm going to show you some of the new controls
and take a look at what the future of this might look like.
So this is the new Microsoft Security Center,
and the first thing you'll notice
is we have a score 850 over 1405.
This is the score that I have,
over the potential that I have.
Now if any of you have looked
at our Secure Score previously,
you'll be wondering where did my dials go,
where did my office score go?
We've moved to categories, which allows us
to not only provide you with more information across
a broader set of services, across identities,
data, devices, apps and infrastructure,
but to also bring in extra signal that you might see
from actual security centers so we can bring that in
and that signal would come into the infrastructure center.
We also give you all the guidance
that you had before as well.
So for example, I have this discover risky
and non compliance Shadow IT applications
in the environment.
This is coming in from MCAS, I can take a look at that,
it's gonna tell me what it is, what it needs to do
in order to be turned on, and they've given you
a very simple Take action button,
which would take me straight to the location to turn it on
or if you're using the third-party,
you can also use that button because
it will recognize that you will still want
the score even though you don't use one of ours.
- Very cool, it's a really great place
to get started if you're a security admin.
It's one of those awesome tools
to really rate yourself against kind of the competition,
give yourself a score.
But if you're a compliance admin,
what are some of the tools that you can use there
to make sure your organization's compliant?
- And that's where compliance manager comes in.
So pivoting a little bit into compliance,
compliance manager
is about helping you understand your compliance posture
and from a regulatory perspective,
helping you understand,
what are the controls that are important to me,
What are the things I need to be doing,
and how can Microsoft help me understand what that is,
above and beyond all of the compliance
that we've built into our platform and services as well.
So there are now 12 assessments available,
including security control frameworks from such as NIST.
(mumbling)
Now by default, compliance manager doesn't
turn them all on, we turn on the ones that we believe
are most common, but you can always add more.
So, I can click on, add an assessment,
there is a dropdown of options available,
I'm gonna select an Office 365 one
and I'm going to enable NIST CSF.
Once I add that to the dashboard, it will refresh,
and scroll down, and it will be added at the bottom.
Now I can start to gain insights into
what is my compliance score here,
and how am I gonna help meet my compliance obligations.
You'll see us keep expanding this,
we're gonna add more regulatory compliance
regulations and industry standards over time.
- So it's pretty significant progress
in terms of even a few months ago,
kind of when GDPR came into regulation,
came actually to be a proper thing in May.
So one area we haven't really covered yet,
which is really important from
a compliance perspective though is visibility
and control over your data?
- So, some of the new capabilities that we've got
are very exciting in the compliance realm,
are in eDiscovery, and so if we pop over into eDiscovery,
we have some new features such as long term audit logs,
file plan manager and the ability to auto play labels
to both exchange and to share both online.
These updates make it easier for you as our customers
to be able to classify and govern sensitive data.
So, lets take a look, I'm gonna click in,
I've got a number of investigations going on here
and I'll drill into one, now, if I switch
to the advanced eDiscovery, I start to see all
of the information.
The first glance that we've got here though,
is that we have nearly 181,000 results,
that's way too many for me to be able
to really understand what's going on.
- For a human to be able to process, right?
- [Adam] So we can do some advanced searching.
Bring in and not only search queries,
but we can also bring in conditions and themes as well.
This allows us to do search and tagging,
and to say, for this information that comes in,
I can now say this query and run it again,
I can reduce that amount of data and if I save and run that,
I end up with a much smaller amount of only 90 results.
And it's down from 181,000 and it's simply by using
the query results and bringing themes
and search criteria in and then being able
to tag all that information so I can look it up
from that one point. - That's using
machine learning and intelligence
under the covers do do all this, right?
- Yep all of that is powered by the search engine,
the Microsoft search engine and bringing in the power
of the heuristics and analytics as well.
- So very cool, awesome set of updates in terms
of all the things you can do from a compliance perspective.
A lot of these are first looks, these are updates
on the security compliance fronts,
Some of these things are rolling out now,
some are rolling out a bit in the future.
Thanks for joining us today, Adam.
You've covered a lot of surface area,
really crossed all of the security and compliance spectrum,
but where can people go to learn more?
- So the best place to get all the information is to
follow our blogs and follow us on Tech Community.
Follow the link that's on the screen.
This will allow you to keep up to date to what's going on,
and engage with the team,
and make sure that you're connected
with everything that's going on in the world of security.
- Awesome, of course we'll keep tracking all this
on Microsoft Mechanics, of course you should follow us
on Twitter and hit the subscribe button on YouTube.
Thank you all for watching and see you next time.
- Thank you.
(crowd applause)
(upbeat music)