(upbeat music)
(audience applauds)
- Hello everyone and welcome to Microsoft Mechanics Live.
Coming up we're joined by Microsoft's own
Chief Information Security Officer and CVP, Bret Arsenault,
for an introduction of the brand new
Insider Risk Management Solutions coming to Microsoft 365.
It's gonna help you identify and mitigate threats
inside your organization.
And we're gonna show you how else it actually helps you
gauge the level of risk at these internal events
so you can easily decipher between innocent violations
or more deliberate behaviors in the areas of data theft,
or confidentiality leaks from your users,
and also security control violations
that they might be doing and much more.
So please join me in welcoming Microsoft's own CISO,
Chief Information Security Officer, Bret Arsenault.
(audience applauds) - Thanks Jeremy.
It's good to be here. - Glad you could come today.
All right so its not that often
that we actually have somebody
from Microsoft's own internal security team on the show.
It's something brand new actually,
but your team has actually played a pivotal role in terms of
shaping the new Insider Risk Management at Microsoft.
- Yeah, I think that we're in a pretty unique position.
My team and I, we've been our own customer
for the thing that we're doing here.
And so, we built this capability for our own use
just to protect Microsoft people and assets
and then we partnered with the Microsoft 365 team
to actually bring the solution we use
to market for our customers.
and then for context we deliver services to about
two hundred thousand people globally
and when you think about it,
it includes vendors that we have just
a lot of experience with the tools and processes,
that you have to have in place just to protect information,
end users, and devices, but most importantly,
we have external threats, everyone knows that,
but we also have internal threats
and how do we protect those spaces?
- Okay so how should we think about then insider risk
and how hard is it then to get a handle on this today?
- Before we had cloud capability and some of the MLNAI,
it was impossible.
It's non-trivial at all and so I work
with CISOs across the industry and internal threats
are an inevitable part of every business
in the day-to-day operations of what they do.
And so, just think about the number of people
who access resources and are the
natural cycle of people coming and going from a company.
It's pretty daunting and so we know from our own experiences
it really hard to maintain that trust with our people
without having the right visibility,
the processes, and the control to actually work in that.
But the important thing I think we really learned
through all this is it's super important
to differentiate between what's an intentional
and an unintentional risk from your users.
- [Jeremy] Right
- I mean if you think about it, a truly malicious user
might try to do things like
go against your corporate policies.
As an example, I'm turning off security controls.
I'm sure none of you have ever done that.
Or they may also have done things,
like installing malicious software.
So often the intent here is to leak or steal data
for personal gain or for malicious reasons.
Of course, you need ways to prevent, detect and contain
those types of threats.
But there's other classes of threats
where the user really may not know
they're breaking corporate policy.
And so, this example where you have a data leak.
Someones excited about a project
and they're sharing it with folks and not realizing
it's sending sensitive information.
Files or things that they're telling people about.
So we really want to keep our employees
productive and not chase false alerts.
We need to be able to see these activities
that occurred in real time in the context of the user,
the intent and the impact,
to make sure we take the right course of action,
cause its not the same depending on that.
- Right and I like that the idea here is really
to assume positive intent for the most part really,
but maintain this kind of healthy skepticism,
but how are you influencing then how Microsoft
delivers this in an automated way?
- Well I think the first thing here
is approach is everything.
We have to strike this balance
between trust and productivity.
And so this means making sure that with the solution
that we create, isn't disruptive
and is really not in the way of the user.
So as we surface risk we need to make sure
that you put the focus on the genuine
suspicious activity so we don't,
one, cause problems with our users,
but also overload the analysts with alerts
that are false positives.
- All right and so I think this is the perfect point.
To dive in and actually show this solution.
So why don't you show us how this works?
- Sure, I think if you take a look,
this is the Insider Risk Management Tool.
And just to get people comfortable with the tool,
you sort of have four areas.
You'll see these are alerts that are firing.
These are active cases.
We have users.
We have policies that are being enforced
and how they're being used.
And of course each of these tabs
will drive you to these areas.
It's important to note though, that the users,
you'll notice there isn't a username associated with it.
And there's really two reasons to drive that.
One, that we take privacy seriously at the company, and
two, we don't want to have any bias in this as an analyst,
so if it turns Out that its your friend or your boss
or somebody else you don't want to know who ...
- It could even be you. It could, yeah.
- [Jeremy] Maybe not you.
- I'd have a different job.
Yeah, it could be me and so you wouldn't want the analyst
to be able to see that.
So that's an important part of it.
So if you take a look, for example,
at some of these alerts that are happening in this scenario,
you'll see a set of activities across here,
trending over time, you can dive
into one of those alerts and again,
you'll see it needs review, when it was done
and what policies its matching.
But I think what's more interesting is the user activity
which really goes most recent and so we'll see.
In this case, we have an HR resignation date set.
We have files printed, copied to USB devices,
as well as downloading SharePoint online,
but when you look at it,
notice this one contains sensitive information,
including an ABA routing number, so that's important.
Or if you have data classifications,
they're going well on the things of,
these are confidential or otherwise.
And so you look at those, and this would be a good case
where you'd say, Hey let's confirm the alert
and actually create a use case instead of doing that
what I would like to do is take a look at a use case.
- Okay. - And this is not me.
- And this is just kind of alerts coming in
that you have to kind of judge
whether or not they're kind of case-worthy effectively.
Now you can go into a case and ...
- [Bret] Exactly
- See one that you wanna actually look at.
- [Bret] Exactly and so when you go here,
we'll take a look at some of the cases that we have going on
and again, that same view. summarize view and timeline view
and then we'll come down here and we'll
look at some of the actual cases.
And again, they're anonymous.
So we look at 893 and FO is for First Offense
and we'll take a look at that as one example.
Now to orient you, there's a timeline view here
that shows you over time and then the risk of the events
and the risk thing is important
because you have an aggregate risk score for this case,
which is a 31 out of 100 so if you think like a FICO Score?
- [Jeremy] Yeah
- [Bret] This is like that, but the opposite.
- [Jeremy] But the opposite.
So the higher it is, the worse the score because of risk.
- Yeah, you don't want a high score here.
- [Jeremy] It's like golf.
- [Bret] Exactly, yes, yes I am a very valuable golf player.
I have the lowest dollar per stroke
because of the number of times I hit a ball.
And so when you look at the user activity here,
again, you have a view that can show you a serialized view
or you have this view that shows you time and risk
and there's a set of insights.
These bubbles represent insights that are mapped down here
like files copied, SharePoint online downloads.
You can ask Jeff Teeper about that later today.
Emails sent externally, security tampering,
offensive language, et cetera and so,
each one of these has a set of activities
and you'll see that 254 files were downloaded
but zero had labeled it confidential.
Or nothing in there as far as sensitive information
and we'll see the same thing here.
They're copied to USB device and we can see as well
there's a resignation date that's set.
- [Jeremy] So this one look pretty Benign then I guess.
- [Bret] Yeah, but you know what?
It's about changing behavior in modification.
We should probably still send an automated message
so we have a set of templates the analysts can use
to remind this person, since they took it to USB,
even though it was Benign data,
we should probably send them a confidentiality reminder
and their obligations both to the company.
Does that make sense?
- Yeah totally, so now we've seen one that's pretty Benign,
but I think there are cases, I think the Benign ones
are probably more common, but there are some cases
where its not so Benign right?
- Yeah definitely, so if we take a look
at this repeat offender, which is not necessarily saying
that's always the scenario, but in this repeat offender case
again, we have this timeline view,
- [Jeremy] Much higher risk score.
- [Bret] And the risk score, yeah, 91 out of 100.
- [Jeremy] Okay, he's getting an A in other words.
- [Bret] Yeah (chuckles) on risk.
- On risk. - On higher risk.
- [Jeremy] And there's a lot more going on here.
There's all these different dots.
So the size of the dots is kind of the size
of the corpus of the data and there's a lot going on.
A couple events here as well.
- [Bret] There is, and more importantly,
there's a couple of events
that we've see on this repeat offender.
So again, you have the same idea.
There's a set of insights, here's a set of activities.
So we can see that this person
was using offensive language in teams.
They had done five chat messages.
They also had sent email with offensive language
which is complete bull-shirt,
which, we don't allow language like that.
- [Jeremy] Right, exactly.
- [Bret] As so then of course, but we can see
what was actually taken, what do they actually do
in this scenario?
And so in this case they would send a notice
on Code of Conduct but again, assume positive intent.
Maybe we should train them,
and they should understand more
about what their obligations are.
Then we have another case, exactly similar,
which was a possible data leak.
So we know the person said that.
But what I'm really interested in,
is what's recently happened and so again,
I have this slide here, you can see the risk score
and the activities and insights but lets go ahead
and just focus in on the last week.
- [Jeremy] Okay, there's quite a few events there already.
- [Bret] Yeah there's still quite a few events.
- [Jeremy] Just in the last week.
- [Bret] Exactly and I see on Friday,
files were downloaded from SharePoint
but notice it contained confidential information
and data that was marked confidential was in the contents.
So we have the problem.
And I see a habit here.
Saturday, similar scenario, 687 files.
Again, files downloaded from SharePoint online
but what concerns me most is then I see this aggregate view
with sensitive data including credit card information,
confidential information being downloaded to a USB device.
- [Jeremy] Okay so this is looking riskier.
That's why its a 91?
- [Bret] Yeah, that's why its a 91 in the aggregate score
and then you also see on Monday they've come in,
which was yesterday and they've actually
said they're gonna leave the company.
- [Jeremy] So that's kind of pushes you over the edge then
in terms of saying, Okay, this is a real one.
- Yeah, as an analyst, I'm gonna go,
Well I'd better go take a look,
assuming the right permissions.
But let me go take a look at these files
that were confidential, and right in the same pane,
I can go in and scan through the things that were downloaded
and in this particular one, when I'm looking
at the confidential document,
and what I see here is basically device spec
for a device that we're about to release on this person
had downloaded to USB who's about to resign.
I'm probably gonna do more than just send a notice here.
So in this case, we're gonna go ahead
and open up an investigation.
And not a data investigation.
We're gonna go straight into an employee investigation
which, in that case, I just create a file
and then all this stuff is packaged up
and it goes to the HR and the legal teams
that can go into the next compliance tool,
eDiscovery or go through that analysis and take action.
So there's a case where it wasn't a Benign.
It's probably positive and we can take action
all from one place.
- Cool so this is kind of, and it's cool that you
get the previews of these files themselves
so you can really see what they are.
- Yeah.
- Why don't we explain though, what happens
behind the scenes.
So you think about it in something like Microsoft 365.
There's just a ton on logs and information
and things that you're processing.
Files that people are opening, the downloads.
It could be hundreds of different interactions
and log bines per day.
Now, you start to look at how difficult is it
to parce a log like this,
and I love going through this,
especially if its green on black
but if you extrapolate these then
over across an entire organization, you see,
think about all the teams that are involved.
All the organizations and the departments and the systems
that they're gonna be logged into and all the applications
that you open and it's like finding a needle in a haystack
or even better, a polar bear in an ice storm or snow storm.
- [Bret] It is, exactly.
- [Jeremy] All of these things, its really hard
to find this stuff so what we wanna be able to do
is build a way to reason over all that different information
so not just connect it but also major things.
Like sentiment or anomalies, all the different behaviors
that are there and leverage kind of the intelligence
to correlate all of that and accrue it to risk.
So as more and more this risk is identified,
then we can flag that for you as an investigation
or for an alert for further investigation like we saw here
and we're using really, this kind of signal
for third party services as well as Microsoft services.
So we saw here in this case that the user resigned.
So we're actually using and stitching together
that information from the HR system and really,
that's what caught the attention of the algorithm here.
To say this is the thing that kind of spawned on
the risk itself.
To be clearer, the signal needs to come from your HR system
via connector and our Insider Risk Management Solution
also ships with a means to ingest HR signals
from a whole suite of different HR systems
and along the way, it was kind of scoring the risk
and activity of everything that we just saw on the demo.
- No, that's exactly right
and it's just not about finding the insiders risk.
It's how you quantify the risk in time
to take the right action.
- Okay, so why don we show how the implementer
is actually going to get all this stuff set up.
So I'm here in Insider Risk Management.
you can see I've got quite a few different actions
I can take.
I'm just click into policies because these are the things
that I actually want to configure.
So, if I go in, I can add a policy.
I'm just gonna live zoom into here
so you can see it a little bit better.
If we go into our policy name.
I can give it a name.
I'll just call it, Mech.
Let me zoom back out.
Now here we've got a couple of different things
that we can do.
We can actually look at things like
departing employee data theft, data leaks,
security violation on Laptop or pc, offensive language.
I'll go ahead and select the Departing employee
and we'll click okay on that.
And then I'm gonna go back in to this
and we'll see that we've got the opportunity
to add users or groups.
So we can either add just individual people or groups
but I'm gonna actually target this to everybody
and I'm gonna click okay on that as well.
And now I can see where I wanna actually prioritize content.
Because every team's a little bit different.
So some, they might wanna use, like, Microsoft teams
or SharePoints.
Some might wanna go off of, or key off of sensitive labels
that are applied to files or sensitive information types.
Things that we can get through a DLP signal for example.
In my case, I'm just gonna click next,
cause I think everything's important
and then these are the things where
we can actually choose our alert indicator.
So, HR events, sharing files from SharePoint online.
All these different types that we can actually choose
what type of signals that we want.
So we've got all this different granularity here as well.
And then if I click through,
I can actually see the select monitoring windows
so this is gonna say how long the lifespan of these
are going to be.
So again, I have all these different options
for scoping the time span.
I can determine the number of days,
the historical timeframe, the future window
that I wanna actually be able to look at
in the future of the different activities that are going on
and I can check for activity post termination.
So all these different things that I can do
as I can figure these policies and once I do that
I can just basically hit review and then I can
create my policy if I want to.
And now that's gonna start actually triggering
and firing off events.
So in a few minutes, it's gonna look more like your screen
where you can actually start to see alerts coming in
or it might take a couple of days if you're a smaller org,
but it might come in faster if you're larger right?
- Yeah, no, exactly and I think,
in multinational organization, you'll probably see alerts
firing pretty quickly like you see here on my dashboard.
So how do you quickly get through that, it's totally fair.
- Cool, so this is gonna really help a lot of organizations.
It's a really great example also,
of being able to take all the expertise
that you and your team had and experience from building
kind of how security teams work
and put that product into the kind of what we're shipping
as part of Microsoft 365 and share it
with the rest of the world here.
It's really great stuff.
- Yeah I think we've gone full circle
where we rebuilt the capability inside.
Now we're coming back around and we're using
the public version ourselves.
So our own people are not using this
which actually frees up some engineering time for me.
- Right and this is gonna be so I'm saving.
It's super revolutionary in this case.
I think in terms of using all the machine learning
and the things that we can do with AI,
to really help information professionals,
and people that are kind of assessing
organizational risk for information,
focus on the big areas and also save time
to identify all the different opportunities
for flagging out to their HR teams or legal teams.
- Yeah, they need to be clear.
It's about encouraging the right behavior.
It's not just about finding Insiders, right.
It's how do you get the right behavior
and what is the impact and in the end, the intent.
Always that impact and intent.
You'll find opportunities for user training which is great
and the more you communicate your policies,
the better your results will be.
Most of the time people just aren't aware of the policies.
- Right and it doesn't have to be formal training either.
So in some cases there are things like data loss prevention
that can help, even educate folks
as they working with the product.
- Yeah, no I think that's the great thing
about Microsoft 365.
As an example you can have a tooltip
so that before someone sends the data,
particularly the people who are doing it unintentionally,
in a tooltip, we'll say, You're about to do this.
Don't do it or you need to get a permission
to actually go make that happen.
- And this is great because users can be more aware
of the actions that they might have.
Broader consequences and then
to know how to work that effectively.
So where can people go to learn more
if they're interested in trying out
Insider Risk Management Microsoft 365?
- That's a great question Jeremy.
Microsoft 365, The Insider Risk Management Program
is actually in Private Preview.
And so you can sign up at the link shown
which is aka.ms/InsiderRiskPreview.
Also, we have a blog where we continually share
our best practices that we learned both
from the Product Team and my team,
which you can also check out at aka.ms/InsiderRiskPreview.
- Awesome, thank you so much Bret.
And that's all the time we have for this show.
If you haven't already,
hit subscribe for Micosoft.com/mechanics.
Thanks for watching and we'll see you next time.
- Thank you very much. (upbeat music)