Windows 10: Defense-at-Scale approach with Office 365 Advanced Threat Protection

Brink · Sep 20, 2018

In part 1 of this series, we reviewed the significant enhancements made to Office 365 Advanced Threat Protection (ATP) in recent months. In this blog, we’ll delve into the scale of threat signals leveraged by Office 365 ATP and highlight how that scale bolsters our ability to detect and protect against advanced threats quickly and accurately. Our strength of signal is one of the important elements helping Office 365 ATP provide the best security for emails, documents and collaboration. The foundation of Office 365 ATP is the Microsoft Intelligent Security graph which provides 6.5 trillion signals per day. This number is so large, it is hard to put into perspective but if you could analyze each of the 6.5 trillion signals at one signal per second, it would take roughly 200,000 years to analyze all the signals. With the power of machine learning, Exchange Online Protection (EOP) and Office 365 ATP do this analysis every day. Clearly, the information, learning, and intelligence gained from the Intelligent Security Graph is an impressive differentiator for our security services.

Office 365 ATP leverages these signals to detect malicious content faster and more accurately than any other service. We often reference the 400 billion emails analyzed by Office 365 every month which translates to more than 150,000 emails analyzed every second. Analyzing these emails provides trillions of signals that help our threat protection engines discern the good from the bad at a granular level, making the service agile and effective. Office 365 ATP has continued to improve even while the volume and sophistication of threats continues to escalate. Our approach to security has been so effective, currently, Office ATP has a malware catch rate greater than 99.9%. The rich data set helps fine tune our machine learning algorithms so that we can constantly enhance coverage for unknown and emerging threats in-real time.

Figure 1. Leveraging Machine Learning Models to identify phish lures

Early detection of malicious content

Because of the volume of data analyzed every day; Office 365 ATP has better visibility into potential malware and phishing. The service can quickly identify suspicious content to protect users from a variety of malware and phishing attacks. For example, this malicious link was caught by Office 365 ATP only a few mins after it was launched. This phishing campaign tries to gather email account details of the recipients.

Figure 2. HTML page mimicking email sign-in page

Note that while other engines had not yet detected the attack, Office 365 ATP flagged the URL as malicious early enough to protect users from clicking on it.

Figure 3. No engine detected the malicious URL per VirusTotal

In another example, attackers were trying to trick users to provide their credentials. This type of phishing vector is rampant because gaining access to emails provides opportunities for attackers to access sensitive data or compromise other accounts owned by the victim.

Figure 4. HTML page mimicking sign-in page for OneDrive

In this instance also, Office 365 ATP flagged it as malicious before any other engine was able to detect it.

Figure 5. No engine detected the malicious URL per VirusTotal

Flagging suspicious content among a sea of legitimate content

Of the 400 billion emails analyzed by our threat protection engines monthly EOP and Office 365 ATP flag around 600 million email messages as malicious. That means only 0.0015% of all the emails analyzed are bad. Finding such a small fraction of malicious content among a sea of legitimate emails requires our engines to be smart and accurate. Office 365 ATP acquires that intelligence by learning from the huge amount of data that the Intelligent Security Graph provides. Such precision and granularity are also critical in accurately flagging malicious content and reducing false positives.

The detonation technology used to inspect attachments and links for malicious content also generates huge number of unique signals that can used to train our machine learning algorithms. These signals are shared across our services to improve the overall security posture and enhance their protection and detection capabilities.

Figure 6. Classifying unknown threats using detonation, heuristics, and machine learning

The strength of signals that Office 365 ATP leverages makes it a powerful engine that provides intelligent detection and industry-leading protection against advanced attacks.

Experience Office 365 ATP

If you’re attending Microsoft Ignite, please join us to learn more.

BRK4000 - Leveraging the power of Microsoft threat protection to secure the modern workplace across ...

BRK4001 - Secure enterprise productivity with Office 365 threat protection services including EOP, A...

BRK4002 - Securing your Office 365 environment from advanced phishing campaigns with Office 365 Adva...

BRK2004 - The future of threat protection: Become efficient, cost effective, and more secure with Of...

THR2037 Comprehensive threat protection for Office 365

BRK3279 - So long and thanks for all the (email) phish

If you have not tried Office 365 ATP for your organization yet please begin a free Office 365 E5 Trial today and start securing your organization from the modern threat landscape.
Click to expand...

Source: Staying ahead of modern-day attacks Part 2: Defense-at-Scale approach with Office 365 ATP - Microsoft Tech Community - 256881

:)

Brink · Sep 20, 2018

New demo: Advanced Threat Protection across Windows 10 and Office

Find out how to prevent and contain cyberattacks across email and endpoints with Windows Defender Advanced Threat Protection (Windows Defender ATP) and Office 365 ATP.

This new demo from Microsoft Mechanics explains how these technologies work together to help detect and prevent attacks, and how—if an attack makes it through your defenses—they can help you contain the threat and take immediate action. Using real-world scenarios, you’ll learn about:

The filters in place to stop known threats in real time

Near real-time threat removal

How to discover, investigate, contain, and respond to any threats that do make it through your defenses

HkQZR9RBbPE

Don’t have time to watch this video now? Bookmark it for easy viewing later.

Ready to get started?

For more information, see the Windows Defender ATP technical documentation and Evolving Office 365 Advanced Threat Protection with URL Detonation and Dynamic Delivery.
Click to expand...

Source: New demo: Advanced Threat Protection across Windows 10 and Office Windows for IT Pros

Brink · Sep 20, 2018

Office 365 ATP for SharePoint, OneDrive and Microsoft Teams available

When moving your organization to cloud services, security concerns add another layer of consideration; one of trust.

Security and compliance is an ongoing process, not a steady state. It is constantly maintained, enhanced, and verified by highly-skilled, experienced and trained personnel. We strive to keep software and hardware technologies up to date through robust processes. To help keep Office 365 security at the top of the industry, we use processes such as the Security Development Lifecycle; we also employ techniques that throttle traffic and prevent, detect, and mitigate breaches.

At Microsoft we continue systematic approach to disrupting attacks through eliminating weaknesses by eliminating the vectors of attack themselves by implementing architectural changes some of which leverage virtualization, containers, and other types of technologies.

In April 2015 we launched Office 365 Advanced Threat Protection to help customers secure their environment from evolving security threats providing protection against unknown malware and viruses, real time, time-of-click protection against malicious URLs, and rich reporting and URL trace capabilities.

In our continued effort to address the modern threat landscape, today we’re announcing General Availability of Office 365 Advanced Threat Protection for SharePoint, OneDrive, and Microsoft Teams.

Office 365 Advanced Threat Protection SharePoint, OneDrive, and Microsoft Teams uses signals and smart heuristics as quality indicators to identify the files within your tenant that may contain malicious content, which includes correlating the file activity signals from SharePoint, OneDrive, and Microsoft Teams within your tenant with the Microsoft Security Intelligence Graph threat feeds.

Examples of file activity signals include anonymous, company wide or explicit sharing, or activity from guest users. Threat feeds that Office 365 Advanced Threat Protection leverages include known malware in email or SharePoint, Windows Defender/Defender ATP detections, suspicious or risky logins or other indicators of irregular file activity within your tenant.

Getting Started

Office 365 Advanced Threat Protection SharePoint, OneDrive, and Microsoft Teams can be configured in the Office 365 Security and Compliance Center.

Learn more on configuring Office 365 Advanced Threat Protection for SharePoint, OneDrive, and Microsoft Teams at https://support.office.com/en-us/article/Office-365-ATP-for-SharePoint-OneDrive-and-Microsoft-Teams-....

Resources

Office 365 Advanced Threat Protection overview [https://support.office.com/en-us/article/Office-365-Advanced-Threat-Protection-overview-e100fe7c-f2a...]

Advanced Threat Protection safe attachments in Office 365 [https://support.office.com/en-us/article/ATP-safe-attachments-in-Office-365-6E13311E-92AE-495E-A619-...]

FaQ

Can I block download of infected files in Office 365?
There is a tenant level configuration that allows or blocks the download of an infected file. This configuration is leveraged by the different native user experiences that are triggered within SPO, ODB and Teams. Tenant admins can be updated using a PowerShell script. Refer to https://technet.microsoft.com/en-us/.../fp161390.aspx and the DisallowInfectedFileDownload parameter for additional details.

Is there a licensing requirement for ATP?
ATP is included in Office 365 Enterprise E5 and Office 365 Education A5. You can add ATP to the following Exchange and Office 365 subscription plans:

Exchange Online Plan 1

Exchange Online Plan 2

Exchange Online Kiosk

Exchange Online Protection

Office 365 Business Essentials

Office 365 Business Premium

Office 365 Enterprise E1

Office 365 Enterprise E3

Office 365 Enterprise F1

Office 365 Education A1

Office 365 Education A3

To buy Office 365 Advanced Threat Protection, see Office 365 Advanced Threat Protection.

To compare features across plans, see Compare Office 365 for Business plans.
Click to expand...

Source: Office 365 Advanced Threat Protection for SharePoint, OneDrive and Microsoft Teams now available - Microsoft Tech Community

Brink · Sep 20, 2018

Announcing Windows Defender Advanced Threat Protection for Enterprise

We designed Windows 10 from the very beginning to be our most secure platform ever. With features like Credential Guard, Device Guard, Windows Hello, and Enterprise Data Protection, Windows 10 offers unique defenses from attacks. Windows Defender, our free anti-malware service, provides protection to almost 300 million devices – every day. And Windows continues to raise the defenses in the system every month as any security issues are investigated and proactively updated through Windows Update.

This ongoing commitment to security has led to strong demand from enterprise customers. From the Department of Defense, which is adopting Windows 10 across all branches of service, starting this year with 4 million devices – to NASCAR to Virgin Atlantic to – we’re excited to see customers with the most demanding requirements move to Windows 10 faster than ever before.

Today, we announce the next step in our efforts to protect our enterprise customers, with a new service, Windows Defender Advanced Threat Protection.

h9xS7mhi1BA

Cyber Attacks Are Increasing in Sophistication

We’re seeing increasingly brazen cyberattacks. Cybercriminals are well organized with an alarming emergence of state-sponsored attacks, cyber-espionage and cyber terror. Even with the best defense, sophisticated attackers are using social engineering and zero-day vulnerabilities to break-in to corporate networks. Thousands of such attacks were reported in 2015 alone. We’ve found it currently takes an enterprise more than 200 days to detect a security breach and 80 days to contain it. During this time, attackers can wreak havoc on a corporate network, stealing data, breaching privacy, and destroying the trust of customers. These attacks are incredibly expensive, costing organizations an average of $12 million per incident with broader impact to a company’s reputation.

As the attackers’ approaches have evolved and become more sophisticated, so too must our approach to provide security to our enterprise customers. And, our customers agree, as 90% of surveyed IT Directors said they need a full-fledged advanced threat protection solution that identifies attacks quicker with comprehensive intelligence, and provides actionable remediation.

Windows Defender Advanced Threat Protection will Help Detect, Investigate and Respond to Attacks

To help protect our enterprise customers, we are developing Windows Defender Advanced Threat Protection, a new service that will help enterprises to detect, investigate, and respond to advanced attacks on their networks. Building on the existing security defenses Windows 10 offers today, Windows Defender Advanced Threat Protection provides a new post-breach layer of protection to the Windows 10 security stack. With a combination of client technology built into Windows 10 and a robust cloud service, it will help detect threats that have made it past other defenses, provide enterprises with information to investigate the breach across endpoints, and offer response recommendations.

Windows Defender Advanced Threat Protection:

1) Detects Advanced Attacks provides key information on who, what, and why the attack happened. Sophisticated threat intelligence enables attack detection, informed by the world’s largest array of sensors and expert advanced threat protection, including a team of experts at Microsoft and expert security partners.

Windows Defender Advanced Threat Protection is powered by a combination of Windows behavioral sensors, cloud based security analytics, threat intelligence, and by tapping into Microsoft’s intelligent security graph. This immense security graph provides big-data security analytics that look across aggregate behaviors to identify anomalies – informed by anonymous information from over 1 billion Windows devices, 2.5 trillion indexed URLs on the Web, 600 million reputation look-ups online, and over 1 million suspicious files detonated every day.

This data is then augmented by expertise from world-class security experts and advanced threat protection Hunters from across the globe, who are uniquely equipped to detect attacks.

2) Response Recommendations. The service’s security operations data provides an easy way to investigate alerts, explore the entire network for signs of attacks, examine attacker actions on specific devices, and get detailed file footprints from across the organization to recommend responses.

With time travel-like capabilities, Windows Defender Advanced Threat Protection examines the state of machines and their activities over the last six months to maximize historical investigation capabilities and provides information on a simple attack timeline. Simplified investigation tools replace the need to explore raw logs by exposing process, file, URL and network connection events for a specific machine or across the enterprise.

And, a cloud-based detonation service enables files and URLs to be submitted to isolated virtual machines for deep examination. In the future, Windows Advanced Threat Protection will also offer remediation tools for affected endpoints.

3) Complements Microsoft Advanced Threat Detection Solutions. Because Windows Defender Advanced Threat Protection is being built into Windows 10, it will be kept continuously up-to-date, lowering costs, with no deployment effort needed. Powered by a cloud backend, no on premise server infrastructure or ongoing maintenance is required. It complements email protection services from Office 365 Advanced Threat Protection and Microsoft Advanced Threat Analytics.

Already Protecting 500,000 Endpoints

Just like we developed Windows 10 with feedback from millions of Windows Insiders, we worked with our most advanced enterprise customers to address their biggest security challenges, including attack investigations and day-to-day operations, to test our solution in their environments. Windows Defender Advanced Threat Protection is already live with early adopter customers that span across geographies and industries, and the entire Microsoft network, making it one of the largest running advanced threat protection services.

Here is a sampling of feedback we’re hearing from some of our early adopter customers:

“Cyber security is my biggest concern and securing all endpoints in my organization is my current priority. Windows Defender Advanced Threat Protection is unique in that it can see exactly what’s going on across every endpoint, which other solutions are failing to address.” Greg Petersen, Senior Director, IT Security, Avanade

“You need to have several layers of defenses, and Windows Defender Advanced Threat Protection adds to our defense strategy. The worldwide sampling that only Microsoft can offer helps find questionable behavior on our computers and alerts us in a timely manner, making our computers and network safer.” Fran De Hann, Senior Security Advisor, Pella Windows

“Deploying Windows Defender Advanced Threat Protection gave us incredible awareness about several critical security vulnerabilities in our network, which we’ve already taken immediate action to address, along with updating our security policies.” Henrik Pedersen, IT Manager, TDC Hosting, Denmark

We encourage our customers to upgrade to Windows 10 for our most advanced security protection, with the opportunity to take advantage of Windows Defender Advanced Threat Protection when it becomes available more broadly this year.

We are excited to offer this service to protect our customers.

Terry
Click to expand...

Source: Announcing Windows Defender Advanced Threat Protection | Windows Experience Blog

Windows 10: Defense-at-Scale approach with Office 365 Advanced Threat Protection

Defense-at-Scale approach with Office 365 Advanced Threat Protection

Defense-at-Scale approach with Office 365 Advanced Threat Protection

Defense-at-Scale approach with Office 365 Advanced Threat Protection

Defense-at-Scale approach with Office 365 Advanced Threat Protection - Similar Threads - Defense Scale approach

Windows Defender Advanced Threat Protection

Microsoft Defender Advanced Threat Protection

DEACTIVATE ADVANCED THREAT PROTECTION

Windows Defender Advanced Threat Protection?

Windows Defender Advanced Threat Protection?

Office 365 Protected View

Advanced Threat Protection

Advanced Threat Protection

New demo: Advanced Threat Protection across Windows 10 and Office