SECURITY. Becoming a Security Hero: defending your users from rogue attacks

Transcription

1 Becoming a Security Hero: defending your users from rogue attacks Erik Ronny de

2 Agenda Understand how Microsoft protects your company from rogue attacks Understand which security solutions fits best your needs Learn the key considerations and deployment steps

3 Sinterklaas and the stolen wish lists

4

5 Anatomy of an attack Hulppiet ontvangt en opent het verlanglijstje Verlanglijstje met macro ENTER Hulp piet Elevated permissions MS Lateral movement Sinterklaas PC wordt gehackt Inlog gegevens van Sinterklaas worden achterhaald Kernel Exploits Kernel-mode Malware Pass-the-Hash EXPAND Sinterklaas SharePoint ESTABLISH Verlanglijstjes worden gedownload van SharePoint Macro opent backdoor naar hacker PC Browser or Doc Exploit Execution Malicious Attachment Execution Stolen Credential Use ENDGAME BUSINESS DISRUPTION LOST PRODUCTIVITY DATA THEFT ESPIONAGE, LOSS OF IP RANSOM

6 Demo set-up

7 Een mooie klus voor Security Piet

8 How to detect threats in your blind spots? Windows Defender Advanced Threat Analytics (ATP) Microsoft Operations Management Suite (OMS) Microsoft Cloud App Security (CAS)

9 Operations Managemen Suite Security & Compliance Microsoft Cloud App Security Advanced Threat Analytics Zero-day s (MS16-032) Misconfiguratie (LAPS) Windows Defender ATP EDP, Device Guard, Passport, Credential Guard

10 Windows Defender ATP

11 Adding a post-breach mindset PRE-BREACH POST-BREACH Device Device protection protection Threat Identity resistance protection Information Identity protection Information Threat protection resistance Breach detection Breach detection investigation & investigation & response response Device Health Attestation attestation Device Guard Device Control Security policies SmartScreen Built-in 2FA Account AppLocker lockdown Credential Device Guard Windows Microsoft Defender Passport Network/Firewall Windows Hello :) Device Built-in protection 2FA / Account Drive encryption lockdown Windows Credential Information Guard Microsoft Protection Passport Conditional Windows Hello access ;) Device SmartScreen protection / Drive AppLocker encryption Enterprise Device Guard Data Protection Windows Defender Conditional access Network/Firewall Windows Defender ATP Advanced Threat Protection (ATP)

12 Windows Defender ATP Provide insights to cybersecurity threats in your organization Detect signs of attacks Quickly understand how attacks entered Determine impact (damage) of attacks Enables you to respond Available from Windows 10 Anniversary Update Professional Enterprise Education Uses Windows Telemetry (security) 3 rd party antimalware must Windows Defender ELAM driver compatible

13 Demo Windows Defender Advanced Threat Protection

14 Operations Management Suite

15 Operations Management Suite Provide insights to cybersecurity threats in your organization Detect signs of attacks Quickly understand how attacks entered Determine impact (damage) of attacks Enables you to respond Available from Windows 10 Anniversary Update Professional Enterprise Education Uses Windows Telemetry (security) 3 rd party antimalware must Windows Defender ELAM driver compatible

16 Analyse Security Piet Wat er is gebeurd Op welke machine Hoe laat Met welke tool

17 Demo Operations Management Suite Security & Compliance

18 Cloud App Security

19 Cloud App Security Breach detection investigation & response in the cloud Ensure appropriate access to cloud apps Know if my users have been breached Gain visibility into cloud apps and usage Know what apps are used in my environment Prevent data leakage

20 Operations Managemen Suite Secrity & Compliance Extend enterprise-grade security to your cloud and SaaS apps OM+S EM+S C & E E5 Windows 10 E5 Microsoft Cloud App Security Windows Defender ATP EDP, Device Guard, Passport, Credential Guard Azure Active Directory Identity Protection Protect your data, everywhere Azure Information Protection Protect your users, devices, and apps Detect problems early with visibility and threat analytics Advanced Threat Analytics

21 Detect attacks before they cause damage On-premises detection Detection in the cloud Microsoft Advanced Threat Analytics (ATA) Cloud App Security + Azure Active Directory Premium Behavioral Analytics Behavioral analytics Detection of known malicious attacks Anomaly detection Detection of known security issues Security reporting and monitoring

22 Analyse Security Piet Inlog gegevens Sinterklaas zijn gestolen Waarmee OneDrive is geopend Laten we naar Cloud App Security kijken wat we daar zien

23 Demo Cloud App Security

24 Recap

25 Operations Management Suite Provide insights to cybersecurity threats in your organization Provides a holistic approach to security challenges in a mobile-first, cloud-first world Helps you to protect and identify breaches before they cause damage Adopt a POST-breach mindset based upon knowledge of how attackers change their playbook

26 Vragen?

27 17:15 18:15 Closing Note Hasain Alshakarti & Marcus Murray