(upbeat music)
- Coming up, we look at updates to
Microsoft Cloud App Security for unified visibility
and control of your Microsoft
and non-Microsoft cloud apps and services.
We're gonna look at updates to cloud app discovery
with a new GDPR compliant readiness assessment
for your cloud apps.
The ability to now universally detect users
who should no longer have access to your SaaS applications
as well as new ransomware detections
for your cloud app environment.
And we'll also show you the latest advances
in real time monitoring
with conditional access app control and more.
(upbeat music)
I'm joined today for our foremost expert
on cloud app security and data loss prevention.
No stranger to Microsoft Mechanics, Asaf Kashi.
Welcome.
- Thank you, it's good to be back.
- So you've been focused on delivering
a CASB solution for a while now,
but before we dive into some of the updates,
can you give us a quick overview
on how we're delivering in this area
and some of the uniqueness
of what we're bringing to the space.
- Absolutely.
Let's start by understanding CASB.
Cloud Access Security Brokers are designed
to give you visibility and control into your cloud apps
in use in your organization.
Beyond the apps that are sanctioned by IT,
there may be hundreds of apps used by teams or individuals
creating shadow IT.
CASB solutions help you discover them
so that you can control and govern
the data in these applications.
So Microsoft Cloud App Security is a complete CASB solution
and in many cases goes above and beyond
other solutions in this area.
For example, when we do app discovery,
we're using more than 70 risk factors
to assess the risk of all of your apps
against regulatory certifications,
industry standards, and best practices.
Second, we're focused on accelerating in detection
and threats of anomalies with machine learning
by tapping into Microsoft's Intelligent Security Graph, ISG,
giving us access to the broadest set of security signals
to allow for faster detection and remediation for you.
Then there's the real time monitoring and control
where we're extending Azure Active Directory's
conditional access with app control
to all of your cloud apps.
And finally, for the continued protection
of your company data, we've integrated with
the Microsoft Data Classification Service
to give you a consistent way to classify data
across all of your applications.
- So there's lots that we're doing then
to extend capabilities really to Microsoft services
and non-Microsoft apps,
but we've got several updates in these areas, right?
- Right.
So let's start with discovery.
As usual, we're continuing to increase
the number of apps that we can discover.
We currently have over 16,000 apps in our app catalog,
and while we've always discovered internal
or external applications,
we added the ability for you to explicitly add
custom line of business cloud apps
that your organization may have built.
We can do this by just clicking on add new custom app
and then filling in all the properties
for this particular application that was developed in house.
Now I've done that,
and what you can see here in the cloud catalog,
you can see that I already have a My Azure app
as well as a dinner menu line of business app,
which were filled in before
and have gotten rated as 10s
because this is an internal app
and I'm trusting my own applications.
Now, if we look at the risk scoring,
for those of you who are effected by GDPR,
I mentioned before that we have over 70 risk factors.
13 of those are specifically new and apply to GDPR.
You'll see under compliance if I move over to the risks
for in this case Microsoft OneDrive for business,
that we've added all of these at the bottom here.
For instance, GDPR right to erasure,
GDPR report data breaches,
and you can now rate all of these applications
based on their readiness for GDPR.
Now, some of you may not care the same way
about all of these risk factors,
so you can tell Cloud App Security
which risk factors you care about most
and customize your view here.
So let's take a look here at the discovery settings.
We have the cloud discovery settings,
and in here you can see all of the various attributes,
so if I scroll all the way to the bottom here,
since we just added the GDPR ones,
we can look at those and say hey you know,
I care about the right to erasure
as a super important one for my organization
and I'm going to turn that to very high so at that point,
it'll effect the cloud catalog for my organization.
- And this all provides really great visibility for
the risks and things that apps that I'm using would pose,
but what do I do next?
- Right, so now you need to communicate the risk
back to your organization.
So we give you the ability to generate
an executive report that you can share with your management.
So let's take a look at how I generate that report.
If I click on the three elipses again,
you can see that I can generate
Cloud Discovery executive report.
Now, I've generated one earlier today and here it is.
You can see that it's a very nicely formatted
shadow IT report.
It includes a lot of different information
about your organization.
It includes the data as well as some key findings.
We also make some recommendations on what you
as an administrator for your organization can do next,
and then we fill in a few additional graphs
and other data points that your organization
can see the value they're getting from the product
as well as protect their organization better
by understanding what their users are doing.
- So these are really great insights
and can use this to drive awareness
and really show the risks of the organization
to get everybody on board with data security
and governance practices,
but let's switch gears and move onto threat detection.
What's new there?
- Yeah, so let's go to alerts.
This is where you'll see all the detections in place
against anomalous activity.
Here I've chosen user Charlie,
and we can see a number of alerts for this particular user.
We've had the ability to detect suspicious browser usage,
impossible travel activity, or mass download,
which can all indicate the compromise of an account
or ransomware for a while.
We now have a new detection for ransomware,
which leverages these signals
as well as suspicious file types.
So over here if I open the ransomware activity,
we can see that the user Charlie
has uploaded a file known as a payment instruction,
so it's probably a compromise
or has been hit by ransomware.
We also see that this particular user
has uploaded 440 unique files
that have the locky file extension,
so it's definitely suspicious,
and if we open these two file activities,
we can see that the file I'm ready to pay .text
as well as the .locky file are already there.
So we detected all of these together
and we've put it together into a single alert
that says this particular user has been compromised
and has some ransomware issues.
- Right, in this case,
we've got actually something that we can do about it
'cause we've seen OneDrive here in this case was being used
and with that, we can actually use file restore,
which allows us as admins or the users
to actually roll back up to 30 days
to a previous state of those files
maybe before the ransomware event actually happened.
This is something that we saw on the show
when Jeff Teper was on last time.
- Absolutely.
So if we go back to alerts,
one more thing I'd like to show you
is a new detection that is able to flag
terminated users who continue to access your cloud apps.
So over here, I've opened up
specifically this one activity by a terminated user.
This user is David, and in this case,
David seems to be continuing to use the Amazon Web Services
even though after their Azure ID account
was already deleted.
This is useful for example, if a user leaves your company
and you want to make sure that their access
to all corporate resources is now revoked
even though they're resources
that are not connected to Azure Active Directory
single sign on.
This works because CAS is monitoring
all of your connected apps.
We're able to see when a disabled or deleted user
is still accessing one of those apps when they shouldn't be,
and then we can alert you about it.
- And that's really something I think most of us know in IT
where it's really useful to have a unified
identity management system,
maybe something like Azure AD like we have here,
but it really goes beyond just like password management
or even things like multifactor authentication.
Now with Azure AD,
we can do something called conditional access
that actually looks for where you're logging in from,
the device that you're logging in with,
you know, what you're normally doing to really detect
and take action against risky logins.
- Yeah, so we've actually been very busy
expanding our conditional access capabilities as well.
First, to just recap from a previous show we've done,
conditional access app control starts in Azure AD.
So let's take a look here,
and I'm going to start in Azure AD,
click on conditional access under the security tab
and take a look at some of the policies I already have here.
If I open one of the policies that is routing the traffic
from Azure Active Directory from a particular application
to Cloud App Security, we can see that the conditions,
I specify a number of users.
So in this case, we've chosen a few specific users
and we'll meet Ronald later.
I've picked a few applications.
This could be all of the applications
or specific cloud apps that you care about.
There are no other conditions in this policy selected,
but I could select a particular risk
or a particular location, IP address, et cetera.
And then finally, I'm using the session control here
to route this traffic over to Cloud App Security.
So now in Cloud App Security,
I can take a look at matching policies,
and let's take a look at this.
This one is blocking download of sensitive files.
If I open this particular policy,
I can see that in this policy,
I was able to monitor or control file download
and based on in this case
some classification label internal DLP,
we're now taking a particular set of actions.
In this case, we're blocking.
We can always test just to monitor and practice the policy,
but at the end of the day,
you do wanna take blocking action
and you do want to alert your administrator.
So these controls to monitor and block downloads
are super useful and we see customers using them,
but within the apps themselves,
there are unique actions that users can use
to exfiltrate data out of the organization.
For instance, share, print, and upload
are all specific activities you can take in Box,
and we wanna give you the control to monitor
and take action when those happen.
So let's take a look at some policies here,
and in this case, I'm going to open
the block custom activities in Cloud App Security,
and what you're seeing here,
instead of choosing monitor or control,
I'm choosing the block activities
and what that allows me to do
is choose some set of activities,
and in this case, you're seeing, I'll scroll down here,
but you can see some download, some edit,
sharing activities, they're all particular
to individual applications.
We've chosen about 17 in this particular policy,
and then again, we can scope it down to particular user.
In this case, again, we're talking about Ronald,
who we're gonna meet shortly hopefully,
and we've got an action to block.
This can be the same thing.
You can test until you're ready to deploy the policy,
and then you roll it out as a blocking and alerting policy.
- So in this case, we're seeing custom actions
that you can really block or enforce within Box,
but are there other apps that we support?
- Yeah, so we've added custom activities
to the most popular apps.
Let me show you.
If I scroll back up to my filter,
I can see that if I open the drop down for apps,
there's a number of different applications in here already.
We've checked some of them as well as
some of them that we don't want in this particular policy.
Of course, the control within each app will vary
based on the particular app.
- So now all of this is set up,
let's take a look at the user experience.
So here, I'm gonna log into Box.
When I click continue on my sign in,
I'm actually Ronald in this case,
so we'll go ahead and select Ronald.
So here immediately I can see that
I've got a access to Box is being monitored.
- That's right.
You're seeing that because the monitor policy is configured,
and whether or not the end user sees this
is actually configurable by the admin.
In this case, we did want you to know
that we're monitoring you.
- Okay, so I'll continue on into Box
and it should look like it would normally look
from the user perspective, so.
- [Asaf] That's right, so in the past,
I've actually shown you what block download looks like.
Why don't you try sharing a file
since that was the policy that we looked at today?
- [Jeremy] Right, so I'm gonna go ahead
and click on share here and let's see what happens.
There we go.
So we see the action's blocked.
I get a nice notification that
this activity is not allowed by my organization.
- That's right, and based on the policy we saw earlier,
you won't be able to upload or download files here either.
- This is really impressive
because I can imagine the generic kind of web calls
that you're making for download,
but now you're actually hooking into
native functionality within Box in this case.
What else though has the team been working on?
- Yeah, so we wanna make it as easy as possible
for you to classify your data,
and we worked across the Microsoft cloud services
on a common data classification service.
This is the same one used by Azure Information Protection
and Office 365.
Let's take a look at this.
So if I open a file DLP policy,
for instance this one containing social security numbers,
in the past, I've shown you where you can use
the inspection methods of both built-in DLP
as well as the partner DLP.
What we've added is data classification service.
When I choose this,
what I can now see is that there's a new inspection type
with new sensitive information types.
If I click on this, you can see that there are now
in this case 82 sensitive information types
that are coming in directly from Office 365 DLP.
This is really powerful because you're now using
the same information types in Office 365
and are able to apply them to any application,
including non-Microsoft cloud applications.
- So it's really important here to have consistency,
especially given all the data regulations.
This is really consistent across
Microsoft information protection and Office 365.
What are some of the other things
that people can look forward to?
- Yeah, so we're gonna continue to add to our monitor apps.
We're gonna add more granular security measures
to the app controls that we've showed you today
and we're also gonna expand beyond
the browser-based applications
to even include mobile devices.
We're also actively working towards
even deeper integrations with other Microsoft products
such as Windows Defender ATP,
which will expand discover beyond your corporate network
and it'll also add integrated controls
to block applications.
- It's really great seeing all the updates today, Asaf,
but if people are watching at home,
where can I go to learn more?
- You can learn more about CAS
and try it out today for yourself
by going to the link shown.
- And of course, keep watching Microsoft Mechanics
for the latest tech updates.
If you haven't already, subscribe to our channel
by clicking on the gear shown.
Thanks for watching, we'll see you next time.
(upbeat music)