Windows 10: Enhancements made to anti-phish capabilities for Office 365

Brink · Oct 17, 2018

We recently reported how we measure catch rates of malicious emails for Office 365 Exchange Online Protection (EOP) (available with any Office 365 subscription) and Advanced Threat Protection (ATP) (available as a standalone service or with Office 365 E5).

Today, we’re sharing the results from the enhancements we made to anti-phish capabilities for Office 365 to address impersonation, spoof, and phish content and internal phish emails sent from compromised accounts. Over the last year, Microsoft’s threat analysts discovered threat actors pivoting from malware to sophisticated, often targeted phishing campaigns. The scale of these attacks and how quickly users click through on malicious links is shown in Figure 1.

Figure 1. Phish email statistics from Office 365 from January 2018 to September 2018.

Understanding the phish landscape

To develop solutions mitigating these modern phishing campaigns, our engineers rigorously analyzed phish emails in Office 365, uncovering a general pattern of phish campaigns following the path shown in Figure 2.

Figure 2. Phish email campaign pathway from initial reconnaissance to data exfiltration.

Additionally, since Office 365 is one of the world’s largest email service providers, Microsoft gains visibility and experience across most—if not all—types of cyber threats. Every day, Microsoft analyzes 6.5 trillion signals, and each month we analyze 400 billionemails, while detonating 1 billion items in our sandbox. This telemetry helps us understand the full spectrum of phish attacks and the sophisticated and varied methods used by attackers, summarized in Figure 3. With this understanding of the phish landscape, our engineers not only designed new capabilities, but also enhanced existing capabilities to address the phishing emails being launched at customers.

Figure 3. Phish emails attack spectrum and variety of attack methods.

Understanding the situation

When we began our journey of enhancing our anti-phish capabilities, we admittedly were not best of breed at mitigating phish. As we alluded to previously, transparency with customers is a core priority at Microsoft. Figure 4 shows the number of phish emails that Microsoft (Office 365) missed in comparison to several other vendors also protecting email for customers within Office 365.

From November 2017 to January 2018, you see that Office 365 (orange bar in Figure 4) was not the best solution at phish catch. (We previously discussed how we measure phish catch.) The values are based on normalized email volume. As the inset plot shows, the scale of mail volume in Office 365 far exceeds the mail volume of third-party vendors. Fundamentally, this scale is one our differentiators and strengths as it offers us much greater depth and breadth into the threat landscape.

Figure 4. Normalized phish email miss from November 2017 to January 2018 in Office 365 email traffic. Inset shows actual mail flow volume.

Solving the problem with our technology, operations, and partnerships

Leveraging our signal from mail flow, the expertise of 3,500 in-house security professionals, and our annual $1 billion investment in cybersecurity, we strategically addressed the growing wave of phishing campaigns. Our engineers determined four categories of phish emails and designed capabilities addressing each type. Figure 5 summarizes the enhancements made to the anti-phish capabilities in Office 365.

Figure 5. Phish email categories and anti-phish enhancements made in Office 365 to address the categories.

Details on all the anti-phish updates for Office 365 are available in the following posts:

Schooling a Sea of Phish Part 1: How Office 365 Advanced Threat Protection Helps Stop Spear Phishing

Schooling a Sea of Phish Part 2: Enhanced anti-spoofing technology in Office 365

Schooling a Sea of Phish Part 3: Intra-Org Email Link Scanning and Detonation of Phish Lures

Securing the modern workplace with enhanced threat protection services in Office 365

While the enhancements are interesting, ultimately, catch rate is the parameter that counts, and it is important to remember that no solution can ever stop all threats. Sometimes misses occur, and the most effective solution will miss the least. To this end, we are very excited to share our phish miss rate from May 1, 2018 to September 16, 2018. As you can see in Figure 6, today, when compared to the same set of vendors that we compared ourselves to in November to January, we exhibit the lowest miss rate of phish emails in Office 365. Figure 6 is the culmination of the incredible focus, drive, and expertise of Microsoft researchers and engineers working together to push the boundaries of threat research, machine learning, and development of algorithms that together provide customers the most impressive and effective protection against phish emails available for Office 365 today.

Figure 6. Normalized Phish Email Miss Rate in Office 365 from May 1, 2018 to September 16, 2018. Inset is a blowup of the graph from August 1, 2018 to September 16, 2018.

While the graph in Figure 6 is illuminating, we also want to share statistics from Office 365 EOP/ATP related to phish mitigation. Figure 7 is a summary of the remarkable impact these powerful new anti-phish capabilities across EOP/ATP have had with helping secure Office 365 users, and further showcases our tremendous depth and scale into the threat landscape. For those unfamiliar with Office 365 ATP, “Safe Links” provides time of click protection from malicious links in email where the click triggers several different protection technologies, including URL reputation checks, machine learning capabilities, and link detonation as needed. Recently, Safe Links expanded its capabilities to intra-org emails, making Office 365 ATP the only service to offer this type of protection while ensuring the internal emails remain within the compliance boundary of Office 365. We hope you agree at that the anti-phish capabilities have evolved at a remarkable pace and with amazing results.

Figure 7. The impact to end users from the enhanced anti-phish capabilities in Office 365.

Learn more

We hope this post provides a good overview on how we are helping customers with modern phishing campaigns. Please be sure to check out the Ignite session, Secure enterprise productivity with Office 365 threat protection services including EOP, ATP, and Threat Intelligence, where we give more details. Your feedback enables us to continue improving and adding features that will continue to make ATP the premiere advanced security service for Office 365. If you have not tried Office 365 ATP for your organization yet, you should begin a free Office 365 E5 trial today and start securing your organization from the modern threat landscape.
Click to expand...

Source: How Office 365 learned to reel in phish - Microsoft Secure %

:)

Brink · Oct 17, 2018

New enhancements for Office 365 security and compliance capabilities

Today, we’re pleased to announce several enhancements that bolster Office 365’s security and compliance capabilities.

With the launch of Office 365 Threat Intelligence, we are enriching security in Office 365 to help customers stay ahead of the evolving threat landscape. Today, we’re also introducing a new reporting interface to improve the customer experience for Advanced Threat Protection (ATP) and extending the ATP Safe Links feature to Word, Excel and PowerPoint for Office 365 ProPlus desktop clients.

Office 365 Advanced Data Governance also launches today, providing our customers with robust compliance capabilities. A new policy management interface for Data Loss Protection (DLP), helps Office 365 customers remain compliant and in control of their data.

Let’s take a closer look at these enhancements.

Enhancing threat protection—a path to proactive cyber-defense with Office 365 Threat Intelligence

According to a recent Ponemon Institute study,* the average cost of a data breach has risen to $4 million, with costs incurred for litigation, brand or reputation damage, lost sales—and in some cases—complete business closure. Staying ahead of threats has never been more important.

Office 365 Threat Intelligence, now generally available, provides:

Interactive tools to analyze prevalence and severity of threats in near real-time.

Real-time and customizable threat alert notifications.

Remediation capabilities for suspicious content.

Expansion of Management API to include threat details—enabling integration with SIEM solutions.

To provide actionable insights on global attack trends, Threat Intelligence leverages the Microsoft Intelligent Security Graph, which analyzes billions of data points from Microsoft global data centers, Office clients, email, user authentications, signals from our Windows and Azure ecosystems and other incidents that impact the Office 365 ecosystem.

It provides information about malware families, both inside and outside your organization, including breach information with details down to the actual lines of code that are used for certain types of malware. Threat Intelligence also integrates seamlessly with other Office 365 security features, like Exchange Online Protection and ATP—providing you an analysis that includes the top targeted users, malware frequency and security recommendations related to your business.

For an overview of Threat Intelligence, watch the following video:

4WE3WRkhrgg

Threat Intelligence is included in the Office 365 Enterprise E5 plan or as a standalone service. Visit Threat Intelligence—Actionable insights for global threats to learn more.

New Office 365 Advanced Threat Protection (ATP) reporting interface

The new reporting interface for Office 365 Advanced Threat Protection (ATP) reports is now available in the Office 365 Security & Compliance Center. These security reports provide insights and trends on the health of your organization, including information about malware and spam sent or received in your organization and advanced threat detections that Office 365 ATP helped discover and stop.

Using the new report interface, admins can schedule reports to be sent directly to their inbox, request custom reports and download or manage these reports through dashboards in the Security & Compliance Center. In our continued journey to provide our customers with the most powerful and robust advanced security solution, this new reporting interface helps you understand how ATP mitigates today’s most sophisticated threats from impacting your organization.

The new ATP reporting interface.

Extending ATP Safe Links to Office 365 ProPlus desktop clients

Later this month, we will enable ATP for Office 365 ProPlus desktop clients, a unique demonstration of the power of collaboration across the Microsoft ecosystem. As cyber criminals broaden the scope of attacks beyond email workloads, it’s necessary to extend security capabilities beyond email. The Safe Links feature in ATP protects customers from malicious links in email.

Safe Links is integrated across Outlook desktop, web and mobile to help protect a user’s inbox across devices. When a user clicks a link in an Office 365 client application (Word, Excel or PowerPoint), ATP will inspect the link to see if it is malicious. If the link is malicious, the user will be redirected to a warning page instead of the original target URL, protecting the user from compromise. This new capability will further integrate and expand security across Office 365. Our intent has always been to provide our customers with an end-to-end, unified and secure experience across all of Office 365, and this extended capability of Safe Links is an example of our continued step toward this goal.

Ensuring compliance—why Office 365 Advanced Data Governance matters

As the amount of electronic data grows exponentially, many organizations are exposing themselves to risk by retaining unnecessary data. For example, many organizations continue to retain the personal information of former employees who left the company long ago. If this data were compromised in a breach, the company could be liable for costly remediation, such as lifetime credit monitoring for these former employees.

Office 365 Advanced Data Governance applies machine learning to help customers find and retain important data while eliminating trivial, redundant and obsolete data that could cause risk if compromised.

Advanced Data Governance, also now generally available, delivers the following capabilities:

Proactive policy recommendations and automatic data classifications that allow you take actions on data—such as retention and deletion—throughout its lifecycle.

System default alerts to identify data governance risks, such as “Unusual volume of file deletion,” as well as the ability to create custom alerts by specifying alert matching conditions and threshold.

The ability to apply compliance controls to on-premises data by intelligently filtering and migrating that data to Office 365.

Customers are already seeing value from Advanced Data Governance. Tom Stauffer, vice president of Records and Information Management for the Walt Disney Company, says:

“Effective governance of unstructured information across communication, content and social platforms has long been a goal of organizations. Microsoft Office 365 Advanced Data Governance appears to provide a well-thought-out solution that is integrated into their entire Office 365 suite. This functionality and integration provides the powerful potential of delivering on this long-sought-after goal, and doing so without a major burden to end users.”

In the coming months, we will be delivering additional Advanced Data Governance enhancements, such as event based retention, manual disposition and supervision.

Learn more about Advanced Data Governance in this episode of Microsoft Mechanics:

dL5DF7LN07s

Office 365 Advanced Data Governance is included in the Office 365 Enterprise E5 plan. It is also available as part of the Office 365 Advanced Compliance plan—which also includes Office 365 Advanced eDiscovery and Customer Lockbox to provide a comprehensive set of expanded compliance value.

For a deeper demo of Office 365 Advanced Data Governance, watch this presentation.

For additional information about Advanced Data Governance, please see these TechNet articles:

Overview of retention policies

Overview of label management

Filter data when importing PST files to Office 365

Enhanced Office 365 Data Loss Prevention (DLP) management experience

Customers all over the world use Data Loss Prevention (DLP) policies in Office 365 to help prevent sensitive information from getting into the wrong hands. Because of your feedback, we put DLP management front and center, providing quick access to content protection policies, app permissions and device security policies—all in one place.

It’s now easier than ever to configure and enforce sensitive data policies across your organization using the new DLP management experience in the Office 365 Security & Compliance Center. The new Policy page shows you important information about your current DLP policies at a glance, with detailed audit reports just a click away. It’s also easier to turn on and configure DLP—simply choose what you want to protect, then specify any special conditions to look for and the automatic actions you want to enforce to protect your important data. You can also go into the advanced settings to access additional customization and configuration options to help meet your specific compliance requirements. Learn more in this article.

The enhanced DLP management experience makes it easier to create and manage policies.

Join our Security, Privacy & Compliance tech community

These new features help broaden and enhance the scope of security and compliance capabilities within Office 365. To further evolve your organization’s security and compliance with these services, join our Security, Privacy & Compliance tech community. It is a great resource to communicate and learn from your peers, as well as offer your insights on the growing importance of security, privacy and compliance.
Click to expand...

Source: Announcing the release of Threat Intelligence and Advanced Data Governance, plus significant updates to Advanced Threat Protection - Office Blogs

Douglas Clelland · Oct 17, 2018

Cortana & Office 365 Integration

We are trying to integrate Cortana with our Office 365 subscription, but it never works. Here are the steps we have done:

Turned on Cortona in the Office 365 Admin portal

We are using Windows 10 1703 – connected Office 365 service to Cortana

Did the same on windows 10 mobile with no luck, Cortana says its connected to Office 365, but sees no data and we are getting zero errors

We went rough office 365 support first and tried all fo their suggestions, they kicked us over to Windows support which is currently closed.

We are on v1703 with all updates in place, it does not work on Windows 10 desktop or mobile

any ideas? I can give you all steps 365 support had us run through if that will be helpful

Thank you

Doug

Brink · Oct 17, 2018

New Protection Capabilities for Office 365 Personal and Home

With the growing presence and sophistication of online threats like viruses, ransomware, and phishing scams, it’s increasingly important to have the right protection and tools to help protect your devices, personal information, and files from being compromised. Microsoft already provides robust security for Office services, including link checking and attachment scanning for known viruses and phishing threats, encryption in transit and at rest, as well as powerful antivirus protection with Windows Defender. Today, we’re announcing new advanced protection capabilities coming to Office 365 Home and Office 365 Personal subscribers to help further protect individuals and families from online threats.

With an Office 365 Home or Office 365 Personal subscription, you already get best-in-class apps like Word, PowerPoint, and Excel as well as powerful cloud services like OneDrive and Outlook.com. Office 365 lets you create, share, and communicate anywhere, on any device.

The new protection capabilities offer subscribers additional peace of mind with:

File recovery from malicious attacks like ransomware.

Tools to help keep your information secure and private.

Advanced protection from viruses and cybercrime.

Recover files from malicious attacks like ransomware

Ransomware has become an increasingly pervasive attack method in which cybercriminals “lock up” and prevent access to files in an effort to extort money from their victims. To help protect customers we are introducing two new capabilities that allow you to recover your files if they are affected by a malicious attack like ransomware.

Files Restore—We’re bringing our powerful Files Restore feature from OneDrive for Business to your personal OneDrive account, so it doesn’t matter if they’re work or personal files—they’re protected in OneDrive. Files Restore allows you to restore your entire OneDrive to a previous point in time within the last 30 days. You can use this feature to recover from an accidental mass delete, file corruption, ransomware, or another catastrophic event.

With Files Restore, you can recover from an accidental mass delete, file corruption, ransomware, or another catastrophic event.

Ransomware detection & recovery—Office 365 can now detect ransomware attacks and help you restore your OneDrive to a point before files were compromised, so you don’t have to submit to cybercriminal demands. We know this is important to our customers and a top request on UserVoice. If an attack is detected, you will be alerted through an email, mobile, or desktop notification and guided through a recovery process where you’ll find the date and time of attack preselected in Files Restore, making the process simple and easy to use. As these threats evolve, we are continuously improving detection capabilities to help keep you safe from the most advanced ransomware.

Notification of ransomware detected on your mobile phone, so you can immediately take action and restore your files.

Tools to help keep your information secure and private

Sending confidential or personal information online, like tax documents, family budgets, or a new business proposal, can be worrisome. Whether you’re sending an email or sharing a link, you want your information to reach only the intended recipients. Office 365 is adding three new capabilities to help keep your data secure and private in these cases.

Password protected sharing links—We’re adding an additional security option for links you share in OneDrive. You will now be able to set and require a password to access a shared file or folder. This prevents others from accessing your files if your intended recipient accidentally forwards or shares the link.

Set a password to access shared files or folders for an additional layer of protection.

Email encryption—Email encryption in Outlook.com offers an added layer of protection and ensures end-to-end encryption of your email. Unlike Outlook.com, some email providers don’t encrypt their connection, making it easy for hackers to intercept and read your communication. When you use Outlook.com email encryption, your email remains encrypted over a secure connection—minimizing the threat of your information being intercepted or leaked to cybercriminals.

Encryption is particularly useful in cases where it is unclear what level of security your intended recipients’ email providers offer. Recipients receive a link to a trusted Office 365 webpage where they can choose to receive a one-time passcode or re-authenticate with a trusted provider before viewing the email. Outlook.com email recipients who view the encrypted email in Outlook.com, the Outlook for iOS and Android app, or the Windows Mail app can read and reply just like they can with any other email—no extra steps needed. When composing an email in Outlook.com, sensitive information like social security numbers can be detected to provide you with a suggestion to send with encryption.

Prevent forwarding—You can now restrict your email recipients from forwarding or copying emails you send from Outlook.com. Additionally, Microsoft Office documents you attach to these emails are encrypted even after downloading, so if the recipient shares or forwards your attachment, the recipient of the forwarded email will not be able to open the attachment. Emails sent with the prevent forwarding option are also encrypted.

Select Encrypt and Prevent Forwarding so recipients can’t forward or copy the email.

Advanced protection from viruses and cybercrime

In October, we announced advanced link checking and attachment scanning in Outlook.com to protect you from previously unseen viruses and phishing scams in real-time. As cybercriminals resort to tricking people into giving away their sign-in credentials or downloading viruses through malicious emails and links, these advanced protections help keep Office 365 Home and Office 365 Personal subscribers safe with enterprise-grade security.

Advanced link checking in Word, Excel, and PowerPoint—We know it’s also important to provide this advanced protection in other places you encounter links. Starting later this year, links you click in Word, Excel, and PowerPoint will also be checked in real-time to determine if the destination website is likely to download malware onto your computer or if it’s related to a phishing scam. If the link is suspicious, you will be redirected to a warning screen recommending you don’t access the site.

If you click an unsafe link, you’ll see a warning screen recommending not to continue.

Additional security protecting your account

Today’s announcements have focused on new, advanced protection capabilities for our Office 365 Home and Office 365 Personal subscribers. However, those who use our free services also have strong protections in place. This includes robust Microsoft account security like two-factor authentication and anomalous sign-in detection. In addition, all Outlook.com attachments and links in emails are scanned for known viruses and phishing threats. OneDrive scans files on download for known threats, provides file versioning for all file types, and sends notifications if a mass file deletion is detected. We also implement industry standards with encryption at rest and in transit. These core capabilities align with the Microsoft promise to offer a high degree of security and protection for all our users.

Availability and feedback

We’re excited to provide these new advanced protection capabilities to our subscribers. Ransomware detection & recovery and Files Restore start rolling out today and will be available to all Office 365 subscribers soon. Password protected sharing links, email encryption, and prevent forwarding will start rolling out in the coming weeks. Advanced link checking and advanced attachment scanning is already available in Outlook.com, and advanced link checking in Word, Excel, and PowerPoint will be coming the second half of 2018. Visit our support page to learn more about all the advanced protection features included in Office 365 Home and Office 365 Personal subscriptions.

Let us know what you think of our new features. Share your thoughts and ideas in the OneDrive UserVoice, Outlook UserVoice, Word UserVoice, Excel UserVoice, and PowerPoint UserVoice.
Click to expand...

Source: Defend yourself from cybercrime with new Office 365 capabilities - Office Blogs

See also: Defend yourself from cybercrime with new Office 365 capabilities

Windows 10: Enhancements made to anti-phish capabilities for Office 365

Enhancements made to anti-phish capabilities for Office 365

Enhancements made to anti-phish capabilities for Office 365

Enhancements made to anti-phish capabilities for Office 365

Enhancements made to anti-phish capabilities for Office 365 - Similar Threads - Enhancements made anti

Stop email spam and phishing Outlook Office 365

Stop email spam and phishing Outlook Office 365

Stop email spam and phishing Outlook Office 365

New enhancements to Office 365 Message Encryption

New Multi-Geo Capabilities in Office 365

New Search for words in your images capability in Office 365

New enhancements for Office 365 security and compliance capabilities

New Protection Capabilities for Office 365 Personal and Home

New to Office 365 in November: new collaboration capabilities and more

Users found this page by searching for:

ability to create custom phish alerts for customers with office 365 atp p1

ability to create custom phish alerts for customers with atp p1

O365 Users targeted by phish campaign