(upbeat futuristic music)
(audience applauds)
- Hello and welcome to Microsoft Mechanics Live.
Coming up we're joined by Microsoft Security CVP,
Rob Lefferts for a closer look at updates
to Threat Protection from Microsoft, to protect your users,
your data, endpoints, Cloud apps, and infrastructure
across your organization.
So everybody, please give a warm welcome
to Mister Rob Lefferts!
(audience applauds)
- Thank you, it's great to be back,
thanks for having me, Jeremy. - Thank you.
So, one thing that I've noticed here is that,
at Microsoft, being a long-time employee, is our openness,
it's really part of our DNA.
You know, everywhere you look,
whether it's operating systems, dev tools,
languages that we support,
even managing stuff across other Clouds
like we learned about this week,
modern app architectures, you name it,
we were trying to make folks (mumbles) app
in terms of how we can protect them.
This approach also applies to security.
- That's right.
Bad actors don't judge and don't care,
whether you have a homogenous or heterogeneous environment.
They are just looking for a way in
and to exploit what you have.
So, as we approach security,
we have to protect without prejudice.
It would be nice if you were on the newest OS, devices,
apps, and services, but that's not realistic.
And as we look to protect what you have,
the thing that's made that possible is the Cloud.
In the days of pure on-prem
there wasn't any signal coming back.
The bad guys were still there,
you just couldn't see them
because they were localized attacks.
- And one kind of interesting point
as you move to the Cloud, the bad guys, or the bad actors,
just follow you up to the Cloud,
they kind of rise up with you.
- That's right.
It doesn't matter where you go, they'll come with you,
like really bad little barnacles
stuck on a side of your boat.
The difference is, now we have better visibility
into how they are attacking you.
So, you are right,
because of the openness of our Cloud
we are in a unique position to translate the signal
that's coming back from your systems
and make sure you can protect what you need to,
detect threats as they come in, and respond quickly
when malicious actors or code breaches your perimeter.
And in many cases, we'll protect, detect
and respond to threats automatically for you.
- [Jeremy] And all of this comes together
with two solutions here:
Azure Sentinel, our Cloud native SIEM service
with built in AI for analytics
which is now generally available, by the way,
and also Microsoft Threat Protection
that's gonna help you to protect, detect, and respond
to threats across your data, your apps, identity,
and devices, and that's shortly gonna be released
into public preview.
- Right, over the last year we've announced our vision
and made progress on both Microsoft Threat Protection
and Azure Sentinel, now they're real
and everyone can go try them.
And what you'll see across our Threat Protection
is the work we are doing to bring SecOps teams
focused on post-breach investigations, Security Admins
looking at root cause vulnerabilities, and IT Admins
looking at security configurations all together.
- All right, so I'd love if you can you walk us through
an end-to-end scenario of what we can do.
- Great, I'm gonna start off in Azure Sentinel.
Azure Sentinel is Microsoft's new cloud-native SIEM.
It works by correlating security logs and signals
from across all sources:
your apps, services, infrastructure,
networks, whether they reside on-premises,
in Azure or in other Clouds.
So, let's walk through a scenario
that starts in Azure Sentinel, connects to Microsoft 365
and show you the power of these solutions working together.
We'll start off as most security teams will,
looking at their SIEM,
which is the next generation of Azure Sentinel.
You can see already, there are 803 million events
collected in the last 24 hours.
So we've already got data flowing in.
The first thing I wanna do is connect to data sources
from Microsoft Threat Protection.
So I'll click on Data Connectors,
pick off Microsoft Defender ATP, which is part of MTP,
and then, with one click, I'll connect it up,
of course, alerts flowing in from Defender ATP
are at no additional charge inside of Azure Sentinel.
Just like that I got that connected.
Furthermore, I've got other data sources
that I've already wired up.
See here Zscaler to keep track of my network traffic
is being monitored in Azure Sentinel
and I can keep track of how that data is flowing in
and I have workbooks and queries to help me work on it.
Now the first thing I might wanna do is actually go hunting.
So, we've provided an out-of-the-box set of queries,
of course, you can build your own,
let's look this first one:
to query for suspicious network traffic patterns.
And what your actually see, this is KQL,
this is the standard query language
that we're using for log analytics, and you see it a lot
across Microsoft security products.
When I run that query, it actually pulls back
some suspicious-looking events, really interesting,
probably the kind of thing
where I'm going to want to spend a bunch of time
investigating this, so I'll just go ahead and bookmark that
to come back to it later.
The next thing that we've got
is actually a set of detailed analytics rules
across a range of things from TI to advanced AI
and, of course, security professionals
can build their own analytics
to help them find new things in their environment.
But let's start where many SecOps teams will,
let's look straight at the incidents.
These are the hot topics in your environments,
and unfortunately, we've got some hot topics to deal with--
- [Jeremy] And red means bad as always.
- [Rob] Red is bad, and we're got red.
- [Jeremy] Okay, let's see it.
- [Rob] Let's take a look at that:
multi-stage attack link to malicious.
That's bad.
The first thing we wanna do is notice that Sentinel
has fused together data coming from multiple sources.
What we actually see first
is that there's malicious network traffic
going to a specific IP address,
and now we've correlated that to the server
that it was coming from and at this point
we've actually fused together data coming from NTP
with data in other parts of our environment.
So when I click on that server, I get a detailed timeline
of the alerts from Microsoft Defender ATP
showing me interesting further activity on the server
like there was a Powershell command that got run,
further lateral movement,
and then ultimately someone broke into exchange
and set up some inbox forwarding rules.
So we can see that really bad stuff was going on.
We need to do something about that.
- [Jeremy] All right, let's stop it.
- [Rob] Let's click on meta-link,
it gives us information about that Powershell event
and now I can go ahead and launch the Playbook,
and what this actually does is build inside of logic apps
is a flow to help me clean up exactly the set of problems
in my environment.
You can see that it's gonna help me block this IP address
in Microsoft 365 and, furthermore,
it's gonna block it in Zscaler,
so my network is fully protected
and then, finally, it's gonna notify the network admin
of the changes that we've made to the firewall.
- [Jeremy] Okay, great.
So, now we've actually stopped the attack,
now we can close the incident and go to lunch, right?
- What are you talking about?
You of all people should know,
the containment isn't that easy,
it's just going to get worse, it always does.
So we really need to look at the scope
and cause of the attack, the potential impact
of what was compromised and see what else needs remediation.
So let's go back to the incident view.
Click on this link to launch NTP,
so we can see a full view of those actions
inside of Microsoft Threat Protection.
What you see is that the SIEM and NTP
are connected together, so we have information
from Azure Sentinel about what happened there,
but we've blown out the full view of the kill chain across
the attack patterns given by MITRE
so we can track progress in that way
and we have detailed information
about what happened in N365,
so additional devices were impacted,
there were two devices that got compromised,
users were compromised and then along the way
the attacker took out a couple of mailboxes.
- Always a good thing.
So you pretty much own them basically,
so they're still among us which is always bad,
but are bad things going to keep happening?
- Normally, I'd say yes to that kind of a question.
It turns out the bad actors
are not like James Bond villains,
they're not going to sit back and tell you their plan
and wait for you to respond,
so that you can escape from trouble.
They're moving quickly,
they're using scripted attack sequences
and you need to respond quickly.
For a security team that using manual tools
that could take weeks or even months.
The good news, which is rare these cases,
is we can take advantage of automated investigation
that got kicked off in N365.
So let's take a look at that.
I'll click on the automated investigations tab
and we see three investigations that are ongoing.
The first one is cleaning up
those suspicious Powershell command-lines.
The last one is cleaning up all those inbox forwarding rules
that got set up at exchange and then in the middle
we saw that the attacker
is doing reconnaissance on users in our directory,
and so we wanna understand what happened there,
do we have more compromised accounts?
We'll click into that and we actually see the full flow
of what this investigation did,
from the trigger through all of the entities
that got investigated in into the recommended steps.
Now in this organization, they have a policy that says,
"We need the admin to approve
"before we reset a user's password."
So when I click on the users, we see five users
that were investigated and found not to be compromised.
But for two of them, their behavior continue to be bad,
and we can you tell they're malicious,
those can no longer be trusted.
- [Jeremy] I'm always a little bit suspicious
of this guy here Jonathan Wolcott.
- Well, as you've seen from multiple demos
that I've given here, Jonathan Wolcott's always in trouble
and in this case he got compromised again.
- We need to fire this guy.
- We need to fire,
we at least need to reset his password.
So let's go ahead and do that.
So we'll go ahead and click approve,
and this will use conditional access
to reset the passwords of the compromised accounts.
- [Jeremy] Okay, great, so now we've fully mapped out
the scope of the attack, we're able to remediate it
and now we're safe?
- Not so fast.
(chuckles)
We took care of the aftermath, we cleaned up everything
that was going on with the attack: identity, email,
endpoints, block the IP addresses,
we're dealt with these incidents,
but more will come.
We need to find and close the root cause
of how they've breached the org in the first place.
So let's go ahead and find that root cause.
I'll go back to the incident in MTP
and I'll click on that very first server.
This gives us a full overview
of everything going on with this device
including security recommendations,
and so as I click in there, I see three recommendations
about how the configuration of this machine
could be hardened to better protect the whole company.
And in fact, the first one that you can see
has a bunch of red, as you say--
- [Jeremy] Little red bugs and bull's-eyes
can be a good thing.
- [Rob] Red is bad.
The red bug means that there is an active exploit
out in the wild that addresses this vulnerability.
The target means there are alerts in your environment
mapped to this vulnerability.
So, this is exactly how the attackers got in.
We'll click on that vulnerability,
it gives us more information
and we've mapped that back to CVEs
so you can understand how this is done at large
and in the wild.
What we really wanna do now is find all the other places
where the CVE might be impacting us.
So, we'll go run another hunting query.
I'll pace this one in and it's looking for that CVE
on other devices and when I run back that query,
I get a list of machines, and if you can see the name
of that second one.
- [Jeremy] It looks like a domain controller.
- [Rob] It looks like a domain controller.
So now we know we're really in trouble.
- [Rob] It seams like fixing all these horror machines,
it's gonna take some time probably.
Is there something that we can do then
to help IT versus (mumbles) CSV file over the fence?
- Yes, fortunately, our ATP research team maps
from vulnerabilities to mitigations.
And so what I can do when I click into this server,
I'll go again to the security recommendations here
and I see there is an update I could deploy,
but also there's an alternate mitigation,
where I can just use Exploit Guard
to prevent this attack from being successful.
That's the kind of thing that I really wanna do here.
Before I do that, I'd love to understand the impact of it
to the broader organization.
So I'll go ahead and click and see
what will this remediation do in my environment
and I can actually see
that it won't have a very broad impact which is great news.
- Nice, so we're going to see here in this case,
we can generate configured sites to see that in this case
we're not gonna break stuff,
which is always good in security,
'cause security often does break stuff,
but now we're gonna handle this over to the IT department
and probably let them take care of it,
what can be better than that Excel spreadsheet
without the CSV file?
- Yeah, I think that printing out a big giant Excel table
is what the IT teams really appreciate,
or you could go ahead and take advantage
of the built-in integration that we have,
here were are actually using serving now
to request a ticket that will allow the IT team
to make progress on this,
we also have great integration with InTune
to relay the request that has the full list of machines
and the desired change.
So when I submit that request, that goes off,
the team starts to take advantage of it,
but because I'm a suspicious security person,
I always want to watch how that progresses.
So I click on this and I get this nice blue bar
which is Defender ATP watching the progress of this
getting rolled out and then I can validate
that it is successful in my broad organization.
Finally, I can take a step back
and look at the entire estate
and understand what is my exposure level,
what is my secure score, and what are the big risks
that I need to worry about and fix
across my entire environment.
- And with the final change we are finally safe.
- Jeremy, we're never safe.
Why do you keep saying this?
You always need to be looking at your environment,
and any security team would need to look
through the entire chain of events
to see where things could be more secure.
A great place to start is to get recommendations
from secure score.
We've now incorporated signals from identity, Office 365,
data and Azure infrastructure into one place
and we give you this concrete list
of the most important things that you can do next.
And because it's been six months since I've been on the show
I, of course, need to say, please turn on NFA,
it's the top thing on the list,
if you haven't done it now,
it is the most important thing you can do
to protect your environment.
- Right, so, and the nice thing is with all of this stuff,
even servers, all the different infrastructure we have,
everywhere, can be protected,
as long as they can log back to us, right?
- That's right.
Wherever they are, as long as they can log to us,
we can monitor them.
- So very cool.
So, great overview across all the different capabilities,
for Azure Sentinel, Microsoft Threat Protection,
I like to think about them as peanut butter and jelly,
so, we're gonna let people go
to learn more about that stuff.
- Azure Sentinel is available today,
you can learn more at aka.ms/azuresentinel
Follow us at aka.ms/MTP over the coming weeks
to join the Microsoft Threat Protection preview.
And of course, don't forget to take advantage
of Microsoft and Azure Secure Score to find out
what to enable next, go to aka.ms/SecureScorePreview.
- Thanks again for joining us, Rob, and also
keep watching Microsoft Mechanics
for the latest Tech updates.
If you haven't already, hit subscribe right now
and we'll see you next time.
(upbeat music)