Alex Esibov: In this video, we’re going to walk you through
the threat detection capabilities in Microsoft Cloud App
Security that allow you to identify advanced attackers and
insider threats. Today, organizations are storing some of
their most sensitive resources in the cloud. As a result,
attackers are developing dedicated techniques and cloud
specific attack patterns. Microsoft has various security
research teams that are constantly monitoring the evolving
threat landscape and attacker groups across nation state
actors, financial actors, and agenda driven actors. And
over the last few years, we are seeing that many sophisticated
attacks are now cloud only, targeting identities, resources,
and data in the cloud. Microsoft Cloud App Security contains
powerful detection capabilities across the different stages
of an attack. The service leverages advanced entity and user
behavior analytics or UEBA combined with user defined
policies to identify organization specific suspicious behaviors.
Let’s take a look at an example in the Cloud App Security
Portal. The Microsoft Cloud App Security dashboard shows
you aggregated information that helps you better
understand the overall cloud security status of your
organization. All of the alerts that Microsoft Cloud App Security
generates are displayed in the alert queue. Further down,
the users with the highest investigation priority are listed
based on factors such as the severity of their alerts and
their impact to the organization. Microsoft Cloud App
Security was built with the security operations teams in
mind and, therefore, all the alerts it generates are use
case driven to alert on specific security scenarios. In
addition, you can integrate the service with the SEIM
solution for an aggregated view of all the alerts in the
organization.
Now, let’s take a look at the user with the high
investigation priority, Bill Dortch. Click on alerts and then
search for the user that you would like to investigate.
The use case driven approach helps us see the story of
the attack, so we can decide quickly if and how to
investigate this scenario. As you can see, the first alert
is on multiple failed logins to the app. That represents
a potential brute force attack. Then you see an alert
for an unusual connection from a TOR exit node, together
with another alert on impossible travel activity for Bill
Dortch. Microsoft Cloud App Security profiles the behavior
of the users and the tenant and builds a continuously
updated baseline that allows it to alert only when something
unusual is happening and, therefore, reduce the noise and
potential false positives. The additional alerts indicate a
high probability of the account being compromised. Mass
download alerts and the suspicious inbox forwarding
detection both indicate an attempt to exfiltrate user data.
The final alert is a ransomware activity that indicates that
after the attacker was able to exfiltrate the information
from the organization, he is attempting to encrypt it
and prevent access to it. Each alert contains a dedicated
alert page with all the needed context for an investigation.
Let’s take a closer look at the ransomware alert.
Here, we can see that 402 files with the extension locky,
a known ransomware format, were uploaded to the cloud.
Based on your analysis of these alerts, you can act on the
affected user directly from the activity log to make sure
that the threat is remediated.
Microsoft Cloud App Security continuously adds new detections
and capabilities to address new threats in the cloud. The
security research expertise and the global scale at Microsoft
allows us to identify those new threats fast and make sure
that we protect our customers.