(electronic whirring music)
- Coming up, as more of us work remotely,
we look at some of the latest security attack vectors
and review protections to support remote working scenarios,
and where you can get tailored
and recommended improvement actions
with Microsoft Secure Score.
So I'm joined today by Microsoft Mechanics
favorite hacker in chief, Dave Weston,
from the Windows Engineering Team.
Welcome back to the show, Dave.
- Hey, thanks. It's been a while.
I think the last time we were together,
we were taking a selfie on a hacked machine.
- Right, so we were demonstrating various attacks
out in the wild, from macros to hardware level compromises
at Ignite, and how to mitigate them.
In fact, if you missed that show, you can watch it
at aka.ms/StoppingRealAttacks.
And of course, with more of us working from home,
things have changed significantly,
I think for all of us over the past couple of months.
And for IT in particular, it's harder to keep users safe.
And also your corporate resources secure.
- Right, so the new normal we're experiencing
can be outside of the comfort zone of corporate IT.
Not all the traffic from users
is going back through the VPN.
And that means we can't apply all
our traditional network security appliances to that traffic.
This also means a lot of users are going directly
to the cloud from their personal machine.
And even though we've got SSL to encrypt that traffic
and make sure it's secure, the devices themselves
might be fully unpatched,
they might be something that was laying around,
and not have the latest security features.
And this can expose both new vulnerabilities,
as well as existing ones.
- Right, and then sometimes it's unrealistic, really,
to enforce measures that you might have had in place before
when kind of everything was happening in the office,
when a majority of work was really within your perimeter.
Right now, with all of that traffic kind of coming
from the outside, it's going to saturate a lot of VPNs,
I think, forcing all the traffic through those connections.
So given the situation then,
what's the best way then, to protect yourself?
- Well Jeremy, here's the good news.
You can actually achieve the same level of security,
or even better in work-from-home scenarios,
as you could in the corporate world.
You just have to use a different set of tools and techniques
to get to the same level of control.
So we're going to show you how
to add more layers of defense,
so when people return back to work,
your security is actually going to be even stronger.
- So what types of vulnerabilities now are we seeing,
given kind of the current landscape?
What are the things that we can do now to protect ourselves?
- So as you dig through the layers of your defense,
it's super important that you know your starting point
and then where you need to go.
So at Microsoft, we actually have a product
called Microsoft Secure Score.
And to find it, you just go into
the Microsoft 365 Security Center,
and you'll see links to it.
Now here you'll see the score is percentage based,
and it breaks down across the various security categories.
So things like identity, data,
devices, apps and infrastructure,
for each one, it shows the activity history,
and how you're organization stacks up against others
in your same industry.
You can also get tailored recommendation for controls
that show you what to implement
based on what you have deployed,
what type of devices you've enrolled in your organization,
and even which versions of Microsoft 365,
Windows or Office you have.
So now I'm going to click in
and go into improvement actions.
And you'll notice some of the really heavy hitters
with high impact are things like
multi-factor authentication, sharing controls,
and remote work assist.
- And these are really great fundamentals, I think,
but how do some of these recommendations
now reflect mitigations that we've added maybe to protect
against specific attack vectors that we're seeing now
as more and more of us are working at home.
- So many attacks we're seeing are actually not new.
They're just evolved or tailored for the current conditions.
So we have a couple of improvement actions
or recommendations based
on the phishing and malware campaigns
that we've seen related to COVID-19.
So for example, obfuscated scripts.
This is actually a great workaround
for attackers or script kitties,
that know how automated script analysis tools work,
and they know how to hide from them
by hiding what they're trying to do.
But just more on that in a second.
The second is network protection.
So as more of these users are logging in from home,
and directly to the cloud, we want to maintain the same
level of security you had in that corporate environment,
but without VPNs and network security devices.
- You don't shy away from live malware and real campaigns.
So can you show us a couple of examples with real attacks?
- Of course, this is the best part of my job.
So let's dig into one really cool one.
So I'll start with an obfuscated script we've seen,
and this is obviously being delivered by email.
So in this case, I've simulated the attack
by using real malware and current delivery tactics.
So in this case, it just looks like Megan's boss, Adele,
has sent her a zip file, informing her
that her social security number has been hacked
and used to open a fraudulent unemployment claim.
So of course, she's heard a lot about this,
and it's even impacted her friends and family members.
So it's a really convincing message.
So if she opens it, she won't see anything right away.
But if you look closely, you'll see actually contains
two pieces of malware.
The first is Sonbokli, and the other is a different exploit.
So it's actually now running in my VM.
And just by opening the zip file
the damage is actually already done.
So let's go a little deeper
and take a look at this script in Notepad.
So you see, it looks kind of crazy,
almost looks like garbage,
even someone like me who writes stuff
like this all the time.
So the chances that an automated tool
would be able to parse it are pretty low.
So this is what we would call an obfuscated script.
And there's just a few clues that make that obvious.
In this case, you could actually see
it's calling PowerShell.
So this technique is used to bypass the variety
of script detection algorithms
that are in security products.
But the best way for us to show you how this works,
is to show you exactly how a VBScript obfuscator
and deobfuscating tool works.
So let's look at this tiny basic line of code.
It's only like a dozen characters
and super straightforward.
But when you obfuscate it,
it turns into this big long garbled mess,
but it will still execute just
like the original script would.
So ideally protect against this type of threat
we want to use a defense in depth,
or layered security strategy.
We want to start with prevention, and also have detection.
So the way to think about this is like your house.
You want to lock your front door,
but in case someone gets past that lock,
you also want to have a security camera
to create multiple layers of protection.
So let's start with how to detect this threat.
So now if you have
Microsoft Defender Advanced Threat Protection,
there's actually a really good chance just out of the box,
it will detect and detain the threat.
In fact, you can detect malware on machines
that aren't even domain or Azure AD joined.
So here we can see that there
were two exploits detected by MD ATP.
And if I click on Sonbokli,
you'll see in the investigation graph
that the ATP service has actually already done a lot
of heavy lifting for you.
It's analyzed all the files,
it's investigated a variety of processes,
it's looked at services running on your machine,
and it's giving you the IP addresses extracted
from these different elements.
And they contain the threat by fully disabling the file.
- Right, and this is a great example,
I think, of the detection,
but what are the preventative measures here,
that you can take so those scripts don't even run?
- So let's jump in, and I'll show you
how to block any obfuscated script,
so that your protections extend to even zero-day offenders
that we might have not seen yet in the cloud.
So we can do that pretty easily
by just starting with friendly GP edit,
then we'll navigate to Administrative Templates,
we'll go a little further into Windows Components,
then Defender anti-virus,
and now exploit guard and attack surface reduction.
Let me make this window just a little wider,
so you can see it.
Now I'm going to click on
Configure Attack Surface Reduction,
and I'm going to make sure it's enabled at the policy level.
And the value name here is a GUID
that you need to hunt down on docs.
I've helped you by creating a short link
at aka.ms/FindASRGUIDs,
one word, to help you find them.
I'll go ahead and set that policy value to one.
Now we'll click Apply.
Okay, and now I'll do the ceremonial force gpupdate,
and we'll give that just a second.
Now that we've applied that policy,
I'll try to rerun the obfuscated script.
And in just a second, you'll see that we blocked it.
And now I can click in for more details.
And there's actually another exploit.
That one doesn't have a name
that actually sounds like IKEA furniture.
- So again, this means that any obfuscated script
is going to get blocked.
So it goes beyond just what's kind of known to us,
and what's in our signature files,
it's going to block anything of that class.
So the second highlighted control
that you mentioned was network protection.
What does that do?
- So this is a really big thing for remote work.
If everyone's working from within your corporate network,
and all the traffic is routed over VPN or firewall,
then whatever rules are in that firewall,
will be used to control the sites
or IP addresses that are permitted through,
and that reputation list will normally
be managed by your firewall provider.
But Microsoft also manages reputation lists
of known malicious sites and IPs.
And it's based on the hundreds of millions of signals
that we collect from global endpoints.
So this is used by capabilities
like Microsoft SmartScreen Filter
and the Edge Browser that flags malicious sites,
but it's also used by network protection
in Microsoft Defender Exploit Guard.
Beyond enlightened apps,
it actually protects against any process,
even a Command Prompt.
So if that Command Prompt tries
to access a known malicious site or IP, it would be blocked,
similar to how your firewall would have
in the corporate environment.
So let me show you.
Here's another email from Adele.
And she's sharing a PDF file that has of course,
the COVID-19 theme.
The doc looks super legit and it's a contract tracker.
So it's for my zip code, and that sounds pretty useful
to me today in this environment.
So let's go ahead and check it out.
Now I see a page requesting a few details to get access.
And if I fill this in,
all that info is going to have been phished.
- Okay, so that looks pretty legitimate.
I think I probably would have fell for it actually,
with that document template.
I'm interested though in how you could actually
stop something like this.
- Absolutely, so let's jump back into gpedit,
and we're going to configure a policy that can help us.
So now I'm in the same exploit guard location
that we saw before.
But this time, I'll open Network Protection.
I'll click on Prevent users and apps
from accessing dangerous sites,
and I'll enable it and set the behavior to block.
Now I'll run gpupdate again.
And now we head back into my PDF file,
we click the link, and you'll see the connection was blocked
in the browser, along with a toast notifying you.
So this site can't phish my information.
- One thing that I've also noticed, by the way,
is a lot of people who might have been living
on their PCs at work, and then maybe living
on their phones at home
or maybe they've got a work laptop that dies,
so they can't really get a new one
from the IT guy down the hall.
Now they need to dust off a lot
of maybe their old equipment, their old laptop,
and be able to be productive.
And these devices a lot of times just aren't up to date
with all the patches or security controls.
What can we do to help in those cases?
- Yeah, Jeremy, that's been really common.
So this is where you can use Microsoft Endpoint Manager,
and combine it with things like security baselines,
and conditional access, to make sure that any connecting
devices meet the expected security requirements.
So the security baselines that Microsoft provides,
give you a set of configs that you can customize.
And if I go into the profile I created earlier,
and now I go to properties,
and then edit on the Configuration settings,
you can see there's all different types of security controls
that we can configure in the baseline.
Let's show you a couple.
So let's jump into lock screen settings.
That's pretty cool.
App runtime, you've got app management.
You can control things like USB
or CD ROM autoplay behavior, BitLocker.
And as I scroll down you'll actually see
there are dozens of classes of controls,
each with the baseline settings pre-configured.
So we worked with tons of organizations around the globe
to get these baselines together to help you save time.
- Alright, so once you have all of this set up,
so it's going to be able to tell then
if a connecting device is compliant.
You're going to do that by using
a very simple conditional access rule.
It says block any device that tries to connect to Azure AD
that's not deemed compliant.
Now, what's that user experience then look like,
if you try to connect
with your non-compliant old laptop device?
- So I actually have an old non compliant laptop here.
And you can tell how scary it is,
because it's got the skulls and all those types of things.
So let's find out what it looks like to get this compliant.
So you can tell that this is actually an older version
of Windows 10 because the Task View icon next to search
still looks like Princess Leia.
It's actually running Windows 1703.
So it's pretty out of date at this point.
So I'm going to go ahead and open up Edge.
Now I'm going to go to Office.com, and I'll try to sign in.
I'll put in my username and password,
give me one second there.
And you'll see that because this machine
doesn't meet the security requirements of my organization,
conditional access is blocking me
from accessing any corporate resources
because it's not safe on this device.
- Okay, so how do we get this machine then
to a compliant state, so that you can connect
to resources and get work done?
- Well if this PC was already managed previously,
it would just automatically pull down any configs
or updates it needs, if you just give it a little time.
It pulls everything down, and installs it quickly
without any user intervention.
But since this was a personal device, and it wasn't managed,
I'll actually have to manually walk through the process.
So let's go into Settings.
I'll go to Accounts, Access work or school,
and then I'll click Connect.
Now I have to enter my username again,
and my password.
And now you'll see I was able to connect to the Contoso MDM,
which is the Microsoft Endpoint Manager environment
we saw earlier.
And now that it's under management,
I'll simply apply all the security baseline settings,
and get automatically to a compliant state,
and ready to access resources.
And if we hop over to MEM, you'll see this PC
is actually now being shown as compliant.
- So now that these security baselines have been applied,
conditional access can basically make that determination
on sign in, and see that all of the configurations
are in place to access protected resources.
- That's right, so let's prove it.
So back on our old laptop, I can see we're managed
and the policy is appropriately saved.
So let's open up Edge again.
And by the way, because I joined this PC to Azure AD
when I connected to the work account,
I don't even need to enter my creds again for Office 365.
So when I jump onto Office.com,
I'm automatically authenticated
and I have access to all my apps and services.
- Nice, so now you can get your work done
without really compromising information protection.
But one thing to note here, because that security baseline
really is a collection with dozens of controls,
you're not going to find security baselines
as a single recommendation with Secure Score,
but many of the underlying settings
that security baseline has, are in the improvement
recommendations and actions that you'll see.
And so I know that Secure Score
has also recently added new capabilities,
but can you tell us what's new,
beyond what we just saw in Secure Score?
- Yeah, so we've actually added a bunch of new stuff
for capabilities that are related to planning
or tracking your progress
against your security goals over time.
So as I scroll down my list of improvement actions
that I showed you earlier,
you'll see that some are marked as planned,
others are marked as risk accepted.
For cases I might want to opt out of
if I click into one, you'll see
that I can actually set the status here under action plan.
And in this case, I'll just go ahead and leave it as is.
So in history, I can actually track my progress over time,
and all the activities along with the points for each.
This is super great for communicating progress
to stakeholders about security.
So now, and finally in metrics and trends,
you'll see even more insights,
and you can see things like your score zones,
a comparison trend over time of your score,
and how it compares to other organizations like yours
and maybe in a similar industry.
You can also see any regressions due to configuration,
user, or device changes.
You can see your score changes
since your last discussion or check in.
And any risk acceptance trends for the improvement actions,
where you've opted out or said that
you want to accept the risk of not implementing.
And these measures are super customizable.
For example, if I scroll back up into score zones,
I can tweak the range for what constitutes
a good or a bad score,
which can vary based on your industry,
or the corporate goals you have around security.
And you can even integrate Secure Score
and all the selected improvement actions
with your ticketing systems.
An example would be things like ServiceNow.
- Those are great updates.
Thanks so much for sharing
all the different new attack vectors and campaigns,
and really the controls we have to stop them.
Things have really changed quite a bit
with our current work from home environment.
While we've touched on just a few of the campaign types,
Secure Score is actually going to point
to even more improvement actions,
to increase your security posture.
Of course, you can learn more as a Microsoft 365 admin,
by going to aka.ms/securescore
to see your tailored dashboard and recommendations.
And also keep watching Microsoft Mechanics
for the latest technical updates
and announcements across Microsoft.
Thanks for watching, I'll see you next time.
(upbeat music)