This blog is part of a series that responds to common questions we receive from customers about deployment of Microsoft 365 security solutions. In this series you’ll find context, answers, and guidance for deployment and driving adoption within your organization. Here is the second installment of an 8 part series on deploying intelligent security scenarios. Check out our last blog, Protect your data in files, apps, and devices.
Constantly evolving threats to your company data can cause even the most conscientious employee to unknowingly open infected files or click on malicious web links. Security breaches are inevitable. You need to discover threats quickly, remediate immediately, and mitigate the impact of malware and breaches.
Many common types of threats target attack vectors such as email, network endpoints, and user credentials. In this blog, we explain how Microsoft 365 threat protection solutions interoperate threat detection across these attack vectors (Figure 1).
Figure 1. Threat detection interoperates across Microsoft 365.
Protect identities: Azure Active Directory (Azure AD) and Azure Advanced Threat Protection (Azure ATP)
Azure ATP provides end-to-end network security by protecting user identities and credentials stored in on-premises Active Directory, while Azure Identity Protection protects them for Azure AD. To prevent identity credential attacks, Azure AD conditional access detects risk events, such as users with leaked credentials, sign-ins from anonymous IP addresses, impossible travel to atypical locations, infected devices, and IP addresses with suspicious activity or unfamiliar locations.
Azure ATP detects suspicious activities across the network attack surface, such as:
- Reconnaissance work, during which attackers gather information on how the environment is built, what the different assets are, and which entities exist.
- Lateral movement cycles, during which attackers invest time and effort in spreading their attack deeper inside your network.
- Domain dominance (persistence), during which attackers capture the information, allowing them to resume their campaign using various sets of entry points, credentials, and techniques.
These services that protect specific parts of the attack surface can also share signals to alert services protecting other surfaces of the enterprise.
Azure ATP detects these suspicious activities and surfaces the information, including a clear view of who, what, when, and how, in the Azure ATP workspace portal, which can be accessed by signing in to your Azure AD user account.
Protect email: Microsoft Office 365 Advanced Threat Protection (Office 365 ATP)
Threat protection for Office 365 begins with Microsoft Exchange Online Protection, which provides protection against all known malicious links and malware. Office 365 ATP builds on this protection by offering holistic and ongoing protection across your Office 365 environment, including email and business apps, by securing user mailboxes, business-critical files, and online storage against malware campaigns in real-time.
Office 365 ATP Safe Links helps protect your environment by offering “time-of-click” protection from malicious links. If a link is unsafe, the user is warned not to visit the site or informed that the site has been blocked. Office 365 ATP and Exchange Online Protection can be configured in the Office 365 admin center.
Protect endpoints: Windows Defender Advanced Threat Protection (Windows Defender ATP)
For endpoint attacks, Windows Defender ATP provides near-instant detection and blocking of new and emerging threats using advanced file and process behavior monitoring and other heuristic solutions. These endpoint sensors collect and process behavioral signals from the operating system, which are then translated into insights, detections, and recommended responses to advanced threats. Windows Defender ATP offers dedicated protection updates based on machine learning, human and automated big-data analyses, and in-depth threat resistance research to identify attacker tools, techniques, and procedures, and to generate alerts when these are observed in collected sensor data.
Windows Defender ATP’s application control capability is a feature of Windows 10 that provides increased security against malware and zero-day attacks by blocking anything other than trusted apps. It is managed in Microsoft System Center Configuration Manager (ConfigMgr).
Deployment tips from the experts
Now that you know more about how Microsoft 365 security solutions can protect your data, here are several proven tips to put it all into action.
Consider the key attack vectors. Devices, email, network, and identity credentials are the most common areas for cybersecurity attacks. To help secure these vectors:
- Protect identities—Detect suspicious activities across the network attack surface by signing in to the Azure ATP workspace portal with your Azure AD user account.
- Protect email—Configure Office 365 ATP and Exchange Online Protection in the Office 365 admin center to protect against malicious links and phishing attacks.
- Protect endpoints—Set up the endpoints in your organization so that Windows Defender ATP, which is built in to Windows 10, can get sensor data from them. You do this by onboarding your endpoints to the service and by configuring the individual security controls.
Plan for success with FastTrack. This valuable service comes with your subscription at no additional charge. Whether you’re planning your initial rollout, needing to onboard your product, or driving end-user adoption, FastTrack is your benefit service that is ready to assist you. Get started at FastTrack for Microsoft 365.
Want to learn more?
For more information and guidance on this topic, check out the “Cybersecurity threats: How to discover, remediate, and mitigate” white paper. You can find additional security resources on Microsoft.com.
More blog posts from this series:
- Tips for getting started on your security deployment
- Accelerate your security deployment with FastTrack for Microsoft 365
- First things first: Envisioning your security deployment
- Now that you have a plan, it’s time to start deploying
- New FastTrack benefit: Deployment support for co-management on Windows 10 devices
- Assessing Microsoft 365 security solutions using the NIST Cybersecurity Framework
- Enable your users to work securely from anywhere, anytime, across all of their devices
- Protect your data in files, apps, and devices
