- Coming up, we're joined by Security CVP Rob Lefferts
to take a look at Microsoft Threat Protection
that harnesses trillions of threat signals
from the Microsoft Intelligent Security graph
to secure your workplace.
We're gonna show you how you can get
a unified single consul, to get visibility
of security threats across your identities,
endpoints, email, user data, SaaS apps,
infrastructure and more.
And how this helps you to build
and investigate a connected account
of what's going on in your environment,
including built-in protections,
and how new AI-powered security playbooks
dynamically harden your environment
through automated work flows.
(upbeat electronic music)
I'm joined today by Rob Lefferts,
excited to have you on the show.
- Thanks for having me.
- So, you lead Microsoft's efforts around threat protection.
It's really a topic that never gets stale,
and it's always relevant, 'cause attacks just keep getting
more and more sophisticated.
I know this is a huge area of investment
for us at Microsoft.
- That's right.
We spend at least a billion dollars
in security innovation annually.
We've developed the Microsoft Intelligence Security graph,
which is foundational to all of our services.
We literally employ more than 3,500
security experts internally.
This is in addition to our partnerships
with law enforcement agencies worldwide,
through our Digital Crimes Unit.
- Right, and one thing on Mechanics,
we typically cover, by the different services,
all the different security capabilities we have,
maybe for Office 365, Windows, Azure.
But I know that your team's been working on
unifying all of these with Microsoft Threat Protection.
But what's the thought behind this?
- So to add some perspective here,
with the Intelligence Security graph,
we're attracting an average of 6.5 trillion
security signals each day across our services.
Attacks are coming in from multiple vectors.
They could be your identity, your endpoints,
your user data, across email and documents,
your apps, infrastructure, and more.
We manage services at scale across all of these vectors,
collecting security signals
from 400 billion emails scanned per month,
450 billion authentications per month,
1.2 billion devices scanned monthly,
5 billion threats detected on devices, and much more.
If you see something in email, through signal sharing
we can protect against it in Identity.
So, you really need to focus on both the breadth and depth
of the detection and protection that you put in play.
There are literally tens of millions of attacks
that we prevent each day, that are typically undetectable.
- Right, so it's a unique role that Microsoft plays,
in terms of understanding and responding
to the threat landscape.
- Security ops teams are more and more overwhelmed everyday.
Typically, people use a variety of tools to keep current,
but these can generate a lot of noise,
with alerts that have little to no correlation.
It breaks my heart each time I hear about a breach
that was detected, but there wasn't enough time
to respond before it got out of control.
We've seen a lot of cases where teams
have literally missed important attack indicators,
because it's hard to know where to focus.
With Microsoft Threat Protection
we are able to correlate related signals
across different attack vectors into a single incident.
So in addition to allowing you to harness
our threat intelligence foundation to keep current,
one of the most important things we are doing,
as you can see here, is to help you connect the dots
across security incidents, with a single unified view
of what's going on in your environment.
To demonstrate how Microsoft Threat Protection
provides holistic security for your organization,
let's start with a simulated attack.
We'll do this using another cool capability
in Microsoft Threat Protection, called Attack Simulator.
To simulate email attacks on your end users,
to help educate them on how to handle modern threats.
I'm going to send a simulated phishing email.
In fact Jeremy, you can be the target of the attack.
- [Jeremy] Alright, let's do it.
So here, I'm actually in Outlook.
I can see there's email from my administrator
for updating my 401k account, it looks like.
So, I'm gonna go ahead and try to log in
with my corporate credentials,
and you can see I'm logging in as Jonathan Walcott
in this case.
It's all branded, it looks like my login page.
So this looks fine, but it's not taking my password.
So, I'll try again and see if I can get this to work,
and it's still not working.
So, it seems like something's wrong,
maybe after a couple attempts I'll give up,
maybe try again tomorrow.
- And you've been owned.
What happened here, is we simulated a phishing attack,
using Attack Simulator in Office 365.
In the real world, an attacker would have done
a lot of social engineering research,
to dupe you into giving away your creds.
So let's fast forward a little in time,
and investigate what might have happened
in that real attack.
- Alright, let's do it.
- Alright, so I'm here
at the Microsoft Threat Protection dashboard.
And what I can see is, it's bringing together information,
both in the form of an incident to you,
but it's showing me data from users,
devices, email accounts, in all of my organization.
I'll click into the incident queue,
and see what you'd expect, a list of incidents.
Each one of these is a full story.
So you can see inside the incident,
I've got a number of correlated alerts,
and I can click through the timeline
to see this is how they broke in,
with a compromised account, because you got phished.
This is how they used a credential theft tool,
to grab creds to move laterally in the organization.
This is how they started sending outbound email
rather than just spam.
And then start to exfiltrate information.
- [Jeremy] So it didn't stop with a phish,
they just kept going.
- [Rob] It was the beginning of a prolonged attack,
and they've dug into your organization,
and they're going to stick around for months.
But we can also drill into details.
So let's look at this one alert about suspicious PowerShell.
There's a rich set of information here about what happened.
You opened a Word document
that had a bunch of macros in it,
that actually started to attack your machine.
We can go down further and see another kind of information
coming from the identity systems.
So we see suspicious user behavior in progress,
in fact it looks like a golden ticket has been issued,
to give this user account more authorization
than it should have.
- [Jeremy] Okay, never a good thing.
- [Rob] All bad.
But now, let's understand what really happened
across the organization.
Because we know it wasn't this one machine,
it was multiple devices.
Here we see the list of all the devices,
and note this for later, it says,
"Conditional access applied."
Because the system has automatically started
to contain the breach.
We can also see all the users that were impacted.
And we see that it hit four users in our organization,
as it moved around.
And again, we applied Conditional Access
to start to protect the users.
- Right, so these are all the detailed heuristics
than, effectively, but how do we get details
around the detection and the remediation,
kind of to quarantine and really respond to this attack.
- That's one of the most important things
Microsoft Threat Protection can do.
And as you've seen as we've gone through,
we've put together this broad picture,
that's driven by automated investigation.
And here, we see a roadmap of the playbook
making that happen.
There's three main stages.
The first around containment,
that's where we automatically applied Conditional Access
to restrict access from an impacted users or machines.
Then there's a process of investigation,
that pivots across all the entities in your environment.
Start with machines, go to all the files that were impacted,
go from there to all of the users,
find all of the machines those users logged into,
and keep going, building a huge scope.
This is where security ops organizations
spend 80% of their time,
and this is the kind of thing that we can automate
to really drive faster.
- 'Cause it was all signal from various
different providers before, and now it's in one incident.
- Pulled it all together.
And shown here, we'll actually help you
take action and respond.
So, there are steps that we can take on individual alerts,
such as this Suspicious PowerShell alert,
to make sure we clean up that machine.
As you can see from the investigation here,
we've looked across all the emails, users, and devices,
and we've taken action.
We've gone and reset the user accounts that were impacted.
We've deleted emails, scrubbed it out of inboxes,
and we've removed malware from devices,
so that you know the full scope of reach was cleaned out.
- And like you said before, conditional access.
We reset their accounts, they might have had to,
maybe reset their password, or even stepped up
to multi-factor authentication.
- That's exactly right.
Powering the whole thing around making remediation easy
for users to experience.
- Okay, so what if I want to go beyond,
kind of, what's built in,
and these are all built in ways to respond
through the security playbooks.
What if I want to start using,
maybe something that's trending,
something that's brand new,
that's infecting various organizations,
how would I be able to see that?
- Well one of the things we mentioned earlier,
were these 3,500 security professionals.
And what they're actually doing is
producing threat intelligence.
So, we keep organizations up to date
on what's happening in the threat landscape.
You see here, "Threat News."
We made up a fake threat attack,
that we named BadKitten, just for fun,
and what we actually tell you is what's happening
for that around the world, and your organization.
Who are the attackers, how do the work,
what are they after, and what machines are impacted
in your company.
You mentioned advanced hunting,
we'll actually help you start to look for it
in your organization.
So let's start an investigation.
What we see here is a query using a SQL-like,
log analytics query language,
that let's me look, for example,
all the browser sessions that were launched from Outlook,
talking to specific IP addresses.
- Right, and this is like what we saw with malware hunting
effectively with log analytics, on a previous show,
now we have it built into the portal.
- It's exactly the same query language.
It's built on the same technology,
and we've connected it to GitHub.
So we actually have repos, where researchers and analysts
are contributing to a community of,
how do we find these bad guys.
We're contributing, others are as well,
and we're connecting them to the portal.
So when I click here on "Community"
I actually get direct access to that query,
and can start doing the hunting in my environment.
- So can I do things like customize this?
- Yeah, I can tweak the query.
I can make it look exactly the way I want.
It gives me a list of machines and users.
I could take action and fix them,
or I can actually use this to create
irregular detection rules.
So I wanna stay up to date everyday.
Maybe nothing's happening now,
but keep me informed if something changes,
and something does start to happen in my environment.
Tweak that to specific machine groups,
and now I've really created custom TI
that works in my environment.
- So lots of really great updates
that are gonna help out security teams everywhere.
But what else are we doing to make their lives easier?
- In addition, the Microsoft Threat Protection portal
comes preloaded with reports and dashboards,
to provide insights about the effectiveness of the people,
processes, tools, in the Security Operations Center.
- Right, and these capabilities are really gonna help
respond to attacks and proactively strengthen your defenses
while using Microsoft Threat Protection.
Now, what do you recommend people do to get started?
- First, check out Microsoft Threat Protection,
as part of the new,
Microsoft Identity and Threat Protection offering.
We're in the process of rolling it out now,
and if you don't see it yet,
you can try out Windows Defender ATP,
Office 365 ATP, and Azure ATP to get started.
Second, if you're looking to really up your security posture
across the board, I always recommend using Secure Score,
to see where you stand now,
and scores are weighted based on the effectiveness
of the controls you implement.
Customers who capitalize on the assessments
and recommendations from Secure Score,
typically reduce their chance
of getting breached by 30 fold.
And that leads to my third recommendation,
because it always tops the list in Secure Score,
turn on multi-factor authentication,
at minimum, for your admin accounts.
That's really a critical step.
It blocks 99.9% of credential-based attacks.
From there, you can get started on your path
to passwordless authentication.
And with Azure AD, Windows Hello, and users
becoming more and more accustomed to it,
now is the time.
- Thanks Rob, and of course we'll keep following
the latest security updates on Microsoft Mechanics.
So hit subscribe, if you haven't already,
and we'll see you soon.
Thanks for watching.
(upbeat electronic music)