(techno music)
- Hello everyone and welcome to Micosoft Mechanics Live.
Coming up we're joined by Microsoft
Security CVP, Rob Lefferts, to give you a first look
at the latest updates to help you secure your workplace.
Now we're gonna show you Microsoft's approach
to protect users' data endpoints, cloud apps
and infrastructure with Microsoft's end to end
threat protection and we're also extending best in class
protections across platforms with services
like Microsoft Defender ATP and as part of that
we're going to show you how you can actually benefit
from cloud-based intelligence with the brand new
Threat and Vulnerability Management.
Before we get started, everybody please give me
a warm welcome for Rob Lefferts, CVP at Microsoft.
(audience applause)
- [Rob] Thanks for having me, it's great to be back.
- [Jeremy] Alright so last time it
was like two weeks ago right?
- [Rob] Two weeks ago, but now I have a jacket.
- Yes, we took a look at the family of solutions
that really comprise Microsoft Threat Protection.
And really how through all of this in using the intelligence
security graph we actually pull across the signals,
for users' data endpoints, cloud apps and infrastructure
into an incident level set of views
in a single dashboard in Microsoft 365.
You guys haven't stopped, you guys continue to innovate
in all these different areas.
Now before we dive deep into the big news of the day
with Microsoft Defender ATP and threat and vulnerability
management, can you catch us up on the announcements
over the past couple of weeks?
- Sure, it's true, we really haven't stopped at all.
We're making it easier for you to expand the capabilities
of your internal SecOps teams.
So we're literally taking threat protection coverage
to the next level, expanding the surface area and depth of
entities for protection across your Microsoft and broader
infrastructure and other clouds.
Now one of the big things we've introduced is the ability to
now contact our security experts directly to get help with
detecting and understanding security incidents through
a new program called Microsoft Threat Experts.
Microsoft Threat Experts is a brand new service for critical
threat monitoring and hunting, expert analysis, and support
from our team of cyber security experts.
Let's take a look at an example.
So this, what I'm showing you,
is actually a targeted attack notification.
In this scenario your company has given us permission
to hunt across your anonymized and scrubbed information.
We've seen something dangerous.
In this case, critical active threat related
to data staging and exfiltration.
So that sounds bad.
- [Jeremy] Right.
- [Rob] And we've actually broken it down for you.
A timeline of observed events, the list of
impacted machines, recommendations and next steps,
and you can get into the details
of the full data that we saw including
the alert process tree and the incident graph.
- Very cool stuff, so we can actually get the insights from
Microsoft experts, again to really help you understand
the threats in your environment.
Now I also saw on the graphic a second ago that we also had
Azure Sentinel, our brand new cloud-native SIEM service.
Can you explain a bit more what we're doing there?
- Yeah, Azure Sentinel is a new cloud-native SIEM service
with built-in AI for analytics that reduces the cost
and complexity of achieving a central
and focused near real-time view
of the active threats in your environment.
Azure Sentinel helps you to collect data at cloud scale
across all users, devices, applications and infrastructure
both on-premises and in multiple clouds.
This helps you to detect previously uncovered threats
and minimize false positives using analytics
and unparalleled threat intelligence.
You can also investigate threats with AI
and hunt suspicious activities at scale,
tapping into decades of work in cyber security at Microsoft.
And of course, respond to incidents
and automate your response workflows.
As you see here, for example, approvals to take action,
blocking user logins and even integrating
with your infrastructure to block a suspicious IP address.
This is all built in orchestration
using the security playbook, and the best part is
there's no security infrastructure to set up and maintain,
and it scales elastically with the cloud.
- And both Threat Experts as well as Azure Sentinel are by
design, they're spanning multiple workloads,
both cloud services and on-premises infrastructure, right?
- That's right, we really have a mission
to meet customers where they're at.
You shouldn't need to migrate wholesale to the cloud
or conversely, keep everything on-premises to benefit
from these capabilities and services.
This also applies to your endpoints,
where we also wanna provide threat protection regardless
of the endpoint that you might be using.
So today, we're announcing the next phase
in broadening support across platforms
to additional operating systems beginning with macOS.
What used to be--
- [Jeremy] You can applaud.
(audience applause)
- What used to be Windows Defender, now runs on a Mac,
and of course it's Microsoft Defender ATP.
- Alright, now we've built it up,
you've gotta give us a look. - Let's take a look.
Okay, so I'm on macOS, running Mojave.
I have, because I'm me, downloaded some dangerous malware
from the web, and I opened it up, and it gets blocked.
The virus was detected, I can open up
Microsoft Defender ATP, and as I do,
I can take actions like quarantining the file.
I can see more details on this.
And I actually got the familiar Windows Defender, now
Microsoft Defender, experience around all of those settings.
In addition, it will integrate
with our EDR capabilities in the cloud.
So all the signal from this Mac endpoint is coming up here
into the Defender security center and I can see, ah,
this is the trojan that ran on that endpoint.
I can click into the machine and get the details
of the process tree, I can scroll down
and see the incident graph, I can scroll even further
and look for information about this file in my organization.
So I see all of the machines that were impacted,
I scroll down and I see, good news,
it was just this one machine.
- [Jeremy] Very cool.
So for everybody that's watching, we're actually making
the macOS limited preview available today.
But what are we doing in other areas
to actually expand endpoint protections?
- We're also announcing another capability.
And it's called Threat and Vulnerability Management
as part of Microsoft Defender ATP.
This brings together security operations with our IT admins
to discover, and more importantly address risks.
Connecting the alerts with their recommended fixes,
so you can be more effective
in quickly responding to threats.
- And this is really cool.
I think all of this is pretty game changing stuff, right?
- Yeah, this capability is correlating millions of signals
across the threat landscape with the information
gathered in real time from your endpoints.
And then surfaces up your potential risk
with rich insights, and lets you take action through
integration with our management tools.
- And I think to put this into context,
and probably everybody here has been there,
with an EDR solution you might get a list
of all the impacted devices, then you gotta walk over
to the IT department for the systems management team
and say, "here are all the things
that I think are affecting our clients.
I wanna see which clients have those apps installed."
They come back with a list, then you look at this
and say, "okay, we've gotta patch this subset of that list,
maybe a week or so passes and then finally
these systems are up to date.
- Yeah, it's very time consuming.
As you say, it could take weeks between detecting that you
have an issue or vulnerability,
and getting the systems patched.
This is about first addressing potential attacks
before they impact you, and second
if something requires immediate action,
you can quickly ascertain who's affected
and respond faster with everything you need
to get the fix deployed.
- Alright so again, let's make
this real for everyone watching.
- Let me show you.
We'll start off on the Threat and Vulnerability Management
dashboard inside of the Defender ATP console.
And the first thing that we see
in the upper left is an exposure score.
This is telling me about the risk level in my organization,
not just about configuration and applications,
but also about what's going on in the threat landscape.
And on the right-hand side, it gives me a to-do list.
Everything that I should get done in my environment.
Now if you're like me, you may never
get to the end of your to-do list
and we want to help you with that problem.
- [Jeremy] Right.
- [Rob] So today we're going to talk about
Contoso Media Player, version 3.03
which we see here somewhere down on my list.
I should really get on that and make sure that it's patched.
- [Jeremy] Yep, so what happens?
Although it looks like you've got Twitter open here.
- [Rob] Well, if you're like me, you might follow
a bunch of researchers on Twitter
in order to stay up to date to news and exciting events
- [Jeremy] Not always good news,
but sometimes zero-days that are there.
- Well what happens in this event, if you're tracking it,
you would see, oh no, there's a zero-day
inside of Contoso Media Player.
Now I realize I've gotta do something.
The great news is that Threat and Vulnerability Management
is on top of that for you, so if we go back to the dashboard
what we actually see is that to-do security recommendation
has bubbled up to the top of the list
because Microsoft Defender ATP has detected that for you.
We flagged it as a zero-day, we say attention is required,
we even suggest alternate mitigation.
So if there weren't a patch out yet, it would say,
"ah, you can disable plugins in this app
and that would take care of the risk in the interim."
And we give you insights about the threat
that has popped up in the environment.
So now that vulnerability is being exploited
and threat insights tells you about that,
and it integrates with threat analytics
that we already have in Microsoft Defender ATP.
Information from our research team
telling you what was found, what's going on,
now lit up with TVM to give you the list
of exposed entities in your organization.
- [Jeremy] Okay.
- Let's go back to the dashboard.
And unfortunately the news just keeps getting worse.
- [Jeremy] It never gets better
on the security side, does it?
- [Rob] Well.
(Rob and Jeremy laugh)
Now we actually see that the little target icon
is lit up and there are active alerts in my environment.
So there was a zero-day, there was an exploit
and now I am actually actively being attacked.
- [Jeremy] Right.
- [Rob] And I can click through into that
and because it is part of my EDR system,
I am automatically getting information about,
well what was that alert?
How does it fit into a full incident story?
Tell me about the details of this device and the individual
process tree showing me what happened there.
And as I go back, let's start
doing something about this.
- [Jeremy] Let's start figuring out who is impacted.
- [Rob] Here we see in the list of top vulnerable
software, we're actually building an inventory of all the
apps in your environment, and we collect that
in your real time, noticing not only what is installed,
but also what is being used and how are users applying it?
As we click into Contoso Media Player,
we get the full rundown.
Here is all the security recommendations.
Here's all the discovered vulnerabilities
and published CDEs.
Here's the list of exposed devices that are impacted.
I can check one out, let's click on that machine.
- [Jeremy] It's getting more red.
- [Rob] There's more red on the screen.
What's interesting is that we look at the device,
we actually see that information about what kind of data
is on that device and the fact that it's a high value asset.
So we're actually pulling the sensitivity labels from
information protection on the laptop
to show there's confidential information on this device.
- [Jeremy] So this is a pretty bad laptop to be exposed.
- [Rob] Getting hacked, I think we should get ahead of this.
I think we should do something about it.
Let's go back to the dashboard.
Let's click on update Contosto Media Player.
This actually prepares everything that you need
in order to package up the fix and start to get it deployed.
In many large organizations, this is a tag team event
between the security team and the IT team.
Would you play the IT team for me?
- [Jeremy] I will, yes, this is an easy job
for me as the IT team, so go for it.
- [Rob] So I can check on this update using analytics
to actually see how broadly is it deployed
on the planet, is it reliable and usable?
And then I can request immediate remediation,
which points to the update, gives a full list
of the impacted machines, creates a machine group
for that and hands it over into a security task force.
- So basically I've got a device group,
a collection of devices that I need to actually push this
patch to, I've already got the package in my environment
so I can just basically target those machines, get that out.
And the nice thing is, Rob doesn't even have to
call me later because now when we go back
into the console, you can monitor it, right?
- Yeah, not that I don't trust you,
but it's great to be able to stay up to date.
And so the Microsoft Defender ATP sensor is telling me
as those patches roll out, how do machines get updated?
I can validate that everything is getting to a good
and healthy state, and once that's done, we actually see
the exposure score come back to its normal place.
- Very cool, everything's back to normal.
What I really like about this is you kind of expect
monitoring, maybe some light remediation
from other EDR tools and solutions,
but because we've got all of this client policy
configuration, software update management capability,
we go way beyond kind of the simple fixing.
- That's right, we want to be the best
and most complete endpoint protection
for organizations of all sizes.
- It's a really great set of updates today.
You heard it here and saw it here first.
Now if you want to start trying some
of these capabilities out for yourself,
where do you recommend that people go to get started?
- Sign up for the previews
and get the necessary trials running.
Azure Sentinel preview is out, give it a run.
Microsoft Defender ATP on macOS, and also if you haven't
tried it on Windows, you should try that too.
And try out Threat and Vulnerability Management.
Coming to preview next month in Microsoft Defender ATP.
- And of course you wouldn't be Rob Lefferts
without your token recommendation.
- Yeah, since I'm a security professional,
let me offer some tips, actually I'll offer the same tip
I had last time because I know it's still
such a big issue for organizations.
If you haven't turned on multi-factor authentication,
please make sure that you do that
and start on your journey towards
passwordless authentication.
- Thanks Rob, and of course we're gonna keep following
and tracking the latest security updates at Microsoft,
so thanks for watching Microsoft Mechanics today.
Hit subscribe if you haven't already
and we'll see you next time, goodbye for now.
(audience applause)
(techno music)