{"id":13093,"date":"2019-08-19T11:20:59","date_gmt":"2019-08-19T18:20:59","guid":{"rendered":"https:\/\/www.microsoft.com\/insidetrack\/blog\/?p=13093"},"modified":"2024-01-19T12:03:40","modified_gmt":"2024-01-19T20:03:40","slug":"microsoft-defender-atps-antivirus-capabilities-boost-malware-protection","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/insidetrack\/blog\/microsoft-defender-atps-antivirus-capabilities-boost-malware-protection\/","title":{"rendered":"Microsoft Defender ATP’s antivirus capabilities boost malware protection"},"content":{"rendered":"
This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft.<\/p>\n<\/div>\n<\/div>\n
Today\u2019s antimalware solutions must help protect against and combat increasingly sophisticated, malicious software. Frequently, traditional antimalware strategies put IT security professionals in the position of being reactive to attacks, instead of proactively preventing them; they don\u2019t adequately address the challenges presented by a more mobile\u2014and modern\u2014workplace. More than ever, it\u2019s important to have security solutions in place that are as agile and innovative as the new threats that are constantly emerging.<\/p>\n
One of our missions at Microsoft Digital is to empower the modern enterprise by providing a trusted, more secure computing environment. We\u2019ve protected client devices against malware for years, previously using traditional, sometimes third-party antivirus solutions, installed on client devices and managed through Microsoft System Center Configuration Manager. Windows 10, however, introduced a new, more modern way to protect client devices. Windows Defender Advanced Threat Protection (ATP) is the result of a complete redesign in the way Microsoft provides client protection. It is agentless, built directly into Windows 10, and was designed to learn, grow, and adapt to help security professionals stay ahead of incoming attacks.<\/p>\n
With Windows 10, we can use the built-in security features to enable malware protection and other critical security capabilities that help protect devices right from the start. Microsoft Defender ATP is a unified platform for Windows protection that includes a broad range of capabilities, some of which include:<\/p>\n
Before we take a closer look at the security features in Microsoft Defender ATP, let\u2019s discuss the evolution of malware protection in Windows.<\/p>\n
Over the years, antimalware protection for Microsoft Windows has evolved from separate installations of System Center Endpoint Protection and third-party antivirus software to Microsoft Defender ATP and its antivirus capability. Let\u2019s take a quick look at how\u2014and, more importantly, why\u2014we transitioned to it.<\/p>\n
Windows 7 didn\u2019t include a built-in antimalware solution, so we installed System Center Endpoint Protection on client devices across Microsoft, using Microsoft System Center Configuration Manager to update and distribute malware definitions. We still use System Center Endpoint Protection to help protect earlier versions of Windows in our environment.<\/p>\n
Windows Defender Antivirus was introduced in Windows 8 to help protect client devices, but it was mainly targeted to consumers, rather than large companies. Under the hood, though, it provided enterprise-grade antimalware capabilities. At the time, Configuration Manager, which we use to manage System Center Endpoint Protection, couldn\u2019t be used to manage Windows Defender Antivirus in Windows 8. Because we needed the additional capabilities, like telemetry and easier management of security-related tasks, we continued to install System Center Endpoint Protection on the Windows 8 devices in our environment.<\/p>\n
Based on this, we encouraged the System Center Configuration Manager team to enhance it to be compatible with Windows Defender Antivirus. This way, we, and other security professionals, could take full advantage of the combined benefits of both applications. We wouldn\u2019t need additional infrastructure to install or update antimalware and would spend less time and effort managing agent and definition updates. That could save us time and effort\u2014and it offered a promising path toward more modern ways to manage, and even extend, client malware protection for the enterprise.<\/p>\n
With Windows 10, and the introduction of Microsoft Defender ATP, the enterprise grade antivirus capabilities we need are built directly into the operating system. Microsoft Defender ATP works seamlessly with Configuration Manager to deliver enterprise management and policy setting capabilities along with a collection of telemetry to enforce compliance. The antivirus capabilities are dynamic and are backed by cloud intelligence that helps defend us from known and unknown malware threats, even at first sight, instead of relying on virus signatures that have to be updated after new threats are identified.<\/p>\n
Now that our malware protection is part of Microsoft Defender ATP, intelligent endpoint behavioral sensors and AI are doing the scanning for known viruses. We have cloud security analytics, and threat intelligence that help us quickly detect and respond to threats in our environment. We\u2019re also excited that\u2014in addition to the antivirus capabilities in Microsoft Defender ATP\u2014we can use the built-in firewall<\/a> and other security-related features, including:<\/p>\n Let\u2019s take a closer look at what we\u2019ve experienced and some of the benefits we\u2019ve seen since we started using Microsoft Defender ATP\u2019s next generation protection capabilities for malware protection at Microsoft.<\/p>\n By using an antivirus that\u2019s built into Windows 10, along with the additional antivirus capabilities from Microsoft Defender ATP, many policy management and other tasks we needed to perform to protect client devices in our environment are no longer necessary or have been optimized. We no longer need to deploy and manage third-party or standalone malware protection. Everything we need is built into the operating system and is updated through Windows Update. We don\u2019t need to buy or maintain servers just to run antimalware or other hardware-operations tasks\u2014tasks that once took up to 60 percent of our time. Now, we can capture telemetry, act on it, and spend more time on security instead of operations. We\u2019re saving both time and money that we used to spend in planning, testing, installing, and upgrading antimalware for our environment.<\/p>\n In addition to those savings, our antivirus capabilities now provide additional protections that extend beyond scanning a device\u2019s file system for malicious files and behaviors. Advanced analytics, machine learning, and AI are constantly improving recognition, and so we can block new and never seen before threats on first sight without signature updates.<\/p>\n Microsoft Defender ATP provides cloud-delivered protection for near-instant detection and blocking of new and emerging threats. Dedicated protection is updated based on machine learning, human and automated big-data analysis, and in-depth threat resistance research.<\/p>\n Microsoft Defender ATP\u2019s next generation protection capabilities provide always-on scanning, using advanced file and process behavior monitoring and other heuristics (also known as \u201creal-time protection\u201d). With advanced in-memory capabilities, as well as Attack Surface Reduction controls, and network protection capabilities, it can also prevent file-less malware.<\/p>\n By using a new antivirus capability from Microsoft Defender ATP called \u201cBlock at First Sight,\u201d we have a new critical protection capability. Approximately 96 percent of all malware files detected and blocked by our antivirus capabilities are observed only once in the world. If a threat is unknown and metadata about the threat isn\u2019t enough, we\u2019ve configured the antivirus features to automatically collect and scan the sample in the Microsoft cloud to analyze it for zero-day threats. This includes running the suspicious file in a virtualized environment.<\/p>\n We\u2019ve found that policy orchestration through the Microsoft Defender ATP portal is straightforward and uses fewer system resources and processes than solutions that require more orchestration. Fewer system resources and processes mean better computer performance.<\/p>\n Now, we have an improved process for keeping antimalware on our client PCs up to date. Even if a user hasn\u2019t signed in to the corporate network for a while, Windows Update will keep Microsoft Defender ATP\u2019s next generation protection capabilities up to date. We don\u2019t have to worry whether a server is delivering updates, or if it\u2019s deploying the solution to the endpoints, because Windows Update automatically keeps the client up to date.<\/p>\n Additionally, the datacenter servers that supported installation and updates of client components were taken down. We don\u2019t need to buy or maintain servers just to run antimalware or other hardware-operations tasks\u2014tasks that once took up to 60 percent of our time.<\/p>\n Since using Microsoft Defender ATP\u2019s next generation protection capabilities, we haven\u2019t had to create broad exclusion lists, like those we used with third-party antivirus products to help us preserve user productivity and device performance. We now have the flexibility to allow users to exclude specific trusted files, processes, and directories for better performance. For example, excluding certain Windows files from antimalware scanning can make Windows start more quickly. Most Microsoft employees have administrator permissions on their local computers, so they can configure their own device because they know best what tools and files they\u2019re using. This is particularly important at Microsoft because of the number of developers and test environments\u2014we don\u2019t want to interrupt compilers during malware checks, because the compilers would need to start all over again. A developer can request <compile name>.exe as an exception in Microsoft Defender ATP to prevent interference.<\/p>\n We also use Windows Defender ATP\u2019s antivirus capabilities on Windows Server 2016 in the datacenter. The functionality, configuration, and management are mostly the same for Windows 10 and Windows Server 2016, with only a few key differences:<\/p>\n Note: For a list of server-related exclusions, see the <\/em>Microsoft Anti-Virus Exclusion List<\/em><\/a> on the TechNet Wiki.<\/em><\/p>\n Microsoft Defender ATP\u2019s next generation protection capabilities have provided excellent results as we\u2019ve seen in our own environment and reflected in industry test scores. It\u2019s easier to manage, there\u2019s nothing to deploy, and with automated updates, we\u2019re saving time and costs over what we used to see in antimalware-related maintenance, upgrades, servers, and operational tasks. Beyond offering advanced malware protection, Microsoft Defender ATP has been a game changer in how we protect client devices from cyber threats. With Microsoft Defender ATP, the power of the Windows security stack is providing preventative protection\u2014it detects attacks and zero-day exploits, and we have centralized management for our end-to-end security lifecycle.<\/p>\n Microsoft Defender ATP detects advanced attacks and data breaches and automates security incidents. Using it, we have the intelligence and tools to investigate and mitigate threats within minutes, instead of the days or weeks it used to take. If you\u2019re ready to learn more about how Microsoft Defender ATP can improve the security posture of your organization, you can download the Windows Defender Advanced Threat Protection Information Kit<\/a>.<\/p>\n This content has been archived, and while it was correct at time of publication, it may no longer be accurate or reflect the current situation at Microsoft. Today\u2019s antimalware solutions must help protect against and combat increasingly sophisticated, malicious software. Frequently, traditional antimalware strategies put IT security professionals in the position of being reactive to […]<\/p>\n","protected":false},"author":146,"featured_media":13095,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"_hide_featured_on_single":false,"_show_featured_caption_on_single":true,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[],"coauthors":[674],"class_list":["post-13093","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","m-blog-post"],"jetpack_publicize_connections":[],"yoast_head":"\n\n
\n
Benefits of using advanced malware protection available in Microsoft Defender ATP<\/h2>\n
\u00a0Cloud-delivered protection<\/strong><\/h3>\n
\u00a0Always-on scanning, using advanced file and process behavior monitoring<\/strong><\/h3>\n
\u00a0Blocking malware at first sight<\/strong><\/h3>\n
\u00a0<\/strong>Simplified<\/strong> management<\/h3>\n
\u00a0<\/strong>Security<\/strong> updates<\/h4>\n
\u00a0<\/strong>Using<\/strong> exclusion lists for better client performance<\/strong><\/h4>\n
Microsoft Defender ATP\u2019s<\/strong> next generation protection capabilities in the datacenter<\/strong><\/h4>\n
\n
One solution to<\/strong> protect, detect, and respond to advanced attacks<\/strong><\/h2>\n
<\/h2>\n
\n