Cloud Frontiers: A Deep Dive into Serverless Spatial Data and FME
Microsoft threat protection + wdatp+ aatp overview
1.
2. The challenge of securing your environment
The digital estate offers
a very broad surface
area that is difficult to
secure.
Bad actors are using
increasingly creative
and sophisticated
attacks.
Integrated, intelligent
correlation and action on
signals is difficult, time-
consuming, and
expensive.
3. User browses to a
website
Phishing
mail
Opens
attachment
Clicks on a URL
+
Exploitation
& Installation
Command &
Control
Brute force account or
use stolen account credentials
User account
is compromised
Attacker
attempts lateral
movement
Privileged
account
compromised
Domain
compromised
Attacker accesses
sensitive data
Exfiltrate data
Maximize Detection
Azure AD Identity Protection
Identity protection &
conditional access
Cloud App Security
Azure ATP
Azure AD Identity Protection
Identity protection &
conditional access
Identity protection
Extends protection & conditional
access to other cloud apps
Microsoft Defender ATP
Endpoint Detection, Protection and Response
Office ATP
Safeguards against malicious threats posed
by email messages, links (URLs) and
collaboration tools
4. Each physical datacenter
protected with world-class,
multi-layered protection
Secured with cutting-
edge operational security
• Restricted access
• 24x7 monitoring
• Global security experts
Global cloud infrastructure
with custom hardware and
network protection
Over 100
datacenters
across the
planet
5. MicrosoftSecurity Advantage
$1B annual investment in cybersecurity
3500+ global security experts
Trillions of diverse signals for
unparalleled intelligence
6.
7. Optimal security, minimal complexity
Today’s security is multiple, disjointed, complex products
Mail
Protection
Single
Sign On
DLP &
GDPR
Identity
Security
Apps
Security
Incident
Response
Mail
Encryption
Device
Management
Endpoint
Security
Identities Endpoints User Data Cloud Apps Infrastructure
Microsoft Threat Protection
8. Microsoft Intune
Office 365 Threat
Intelligence/ATP P2
Microsoft Defender
Advanced Threat
Protection
Azure Active
Directory
Office 365 Advanced
Threat Protection P1
Microsoft Cloud
App Security
Azure Security
Center
Azure Advanced
Threat Protection
Windows 10
Identities: Validating, verifying and
protecting both user and admin
accounts
User Data: evaluating email messages
and documents for malicious content
Endpoints: protecting user devices and
signals from sensors
Infrastructure: protecting servers,
virtual machines, databases and
networks across cloud and on-
premises locations
Cloud Apps: protecting SaaS applications
and their associated data stores
1
3
2
5
4
Exchange Online
Protection
SQL ServerWindows Server
Linux
9. Microsoft Intune
Office 365 Threat
Intelligence/ATP P2
Microsoft Defender
Advanced Threat
Protection
Azure Active
Directory
Office 365 Advanced
Threat Protection P1
Microsoft Cloud
App Security
Azure Security
Center
Azure Advanced
Threat Protection
Windows 10
1
3
2
5
4
Endpoints: protecting user devices and
signals from sensors
User Data: evaluating email messages
and documents for malicious content
SQL ServerExchange Online
Protection
Windows Server
Linux
Infrastructure: protecting servers,
virtual machines, databases and
networks across cloud and on-
premises locations
Cloud Apps: protecting SaaS applications
and their associated data stores
Identities: Validating, verifying and
protecting both user and admin
accounts
10. Microsoft Intune
Office 365 Threat
Intelligence/ATP P2
Microsoft Defender
Advanced Threat
Protection
Azure Active
Directory
Office 365 Advanced
Threat Protection P1
Microsoft Cloud
App Security
Azure Advanced
Threat Protection
Windows 10
1
3
2
5
4
Endpoints: protecting user devices and
signals from sensors
Azure Security
Center
User Data: evaluating email messages
and documents for malicious content
SQL ServerExchange Online
Protection
Windows Server
Linux
Infrastructure: protecting servers,
virtual machines, databases and
networks across cloud and on-
premises locations
Cloud Apps: protecting SaaS applications
and their associated data stores
Identities: Validating, verifying and
protecting both user and admin
accounts
11. Microsoft Intune
Office 365 Threat
Intelligence/ATP P2
Microsoft Defender
Advanced Threat
Protection
Azure Active
Directory
Office 365 Advanced
Threat Protection P1
Azure Security
Center
Azure Advanced
Threat Protection
Windows 10
1
3
2
5
4
Endpoints: protecting user devices and
signals from sensors
User Data: evaluating email messages
and documents for malicious content
SQL Server
Microsoft Cloud
App Security
Windows Server
Linux
Exchange Online
Protection
Infrastructure: protecting servers,
virtual machines, databases and
networks across cloud and on-
premises locations
Cloud Apps: protecting SaaS applications
and their associated data stores
Identities: Validating, verifying and
protecting both user and admin
accounts
12. Microsoft Intune
Office 365 Threat
Intelligence/ATP P2
Microsoft Defender
Advanced Threat
Protection
SQL Server
Azure Active
Directory
Office 365 Advanced
Threat Protection P1
Microsoft Cloud
App Security
Azure Security
Center
Azure Advanced
Threat Protection
Windows 10
1
3
2
5
4
Endpoints: protecting user devices and
signals from sensors
User Data: evaluating email messages
and documents for malicious content
Exchange Online
Protection
Infrastructure: protecting servers,
virtual machines, databases and
networks across cloud and on-
premises locations
Cloud Apps: protecting SaaS applications
and their associated data stores
Windows Server
Linux
Identities: Validating, verifying and
protecting both user and admin
accounts
13. Microsoft Intune
Office 365 Threat
Intelligence/ATP P2
Microsoft Defender
Advanced Threat
Protection
SQL ServerWindows Server
Linux
Azure Active
Directory
Office 365 Advanced
Threat Protection P1
Microsoft Cloud
App Security
Azure Security
Center
Azure Advanced
Threat Protection
Windows 10
1
3
2
5
4
Endpoints: protecting user devices and
signals from sensors
User Data: evaluating email messages
and documents for malicious content
Exchange Online
Protection
Infrastructure: protecting servers,
virtual machines, databases and
networks across cloud and on-
premises locations
Cloud Apps: protecting SaaS applications
and their associated data stores
Identities: Validating, verifying and
protecting both user and admin
accounts
14. Identities Endpoints User Data Cloud Apps Infrastructure
Users and admins Devices and sensors Email messages and
documents
SaaS applications
and data stores
Servers, virtual
machines, databases,
networks
Intelligent Security Graph
6.5 TRILLION signals per day
18. Protect sensitive data on-premises and in the cloud
Classification
and labeling
Classify data based on
sensitivity and add labels—
manually or automatically.
Protection
Encrypt your sensitive
data and define usage
rights or add visual
markings when
needed.
Monitoring
Use detailed tracking
and reporting to see
what’s happening with
your shared data and
maintain control over it.
Microsoft Information Protection
19. Microsoft Threat ProtectionA comprehensive, seamlessly integrated solution providing end-to-end
security for your organization.
Microsoft 365 Security Center
Azure Security
Center
3rd party data
sources
Azure Active
Directory
Microsoft Defender
ATP
Office 365 ATP
Microsoft Cloud
App Security
Microsoft Cloud
App Security
Azure ATP
Microsoft Cloud
App Security
Microsoft Threat Protection automation
Microsoft Azure Sentinel
Our next generation SIEM
Event orchestration
Cloud & Hybrid
Infrastructure
EndpointsIdentities Data & Email Cloud Apps
20.
21. Built-in. Cloud-powered.
⁞ Embedded into Windows 10
⁞ World class anti-tampering
⁞ Deep data collection & 6m storage
⁞ Best of breed EPP , EDR
⁞ Support for W7/8, non-Windows
⁞ Integrated config mgmt.
⁞ Vulnerability analysis
⁞ Secure score & CA
⁞ Automation
⁞ Cross suite integrations
⁞ Data separation, RBAC
⁞ Cloud expertise
26. Vulnerability Management Isn’t Just Scanners Anymore
Continuous Discovery
Vulnerable applications and configuration via continuous
endpoint monitoring to gain immediate situational awareness
Prioritize
Context-Aware Prioritization
Findings by enriching with threat intelligence sources,
business context and crowd wisdom to build an accurate
risk report
Mitigate
Surgical Mitigation & Automated Fix
Threats by tailoring a surgical mitigation/fix plan based on
organizational risk using Microsoft’s security stack, 1st party
and 3rd party partners
39. Fileless (living-off-the-land) threats
Highly sophisticated and human operated Ransomware
Legitimate business software used as a weapon
Each platform has a unique threat landscape
Hardware/firmware attacks are a growing risk
Targeted attacks leading to data breaches continue to grow
40.
41.
42. Behavior
Monitoring
Memory
Scanning
Command
Line Detection
AMSI
• File System
• Boot/Volume
• Registry
• Process /
DLL’s
• Network
• Code injection
• …
• Quick Scan
• On system events
• Ad-hoc requests
by BM
• Defeats
Polymorphism
Especially
effective
against:
• LOLBIN
• LOLBAS
• Obfuscation
Instrumentation of:
• Javascript
• VBScript
• Macro
• Powershell
• WMI
• Dotnet
ML + Cloud
powered!
ML + Cloud
powered!
43.
44.
45.
46.
47.
48.
49.
50.
51.
52.
53.
54.
55. Microsoft Defender ATP
Microsoft Intune
Azure Information Protection
Microsoft Secure Score
Azure Security Center
Orchestrated protection and remediation
Azure AD & Conditional Access
Microsoft Cloud App Security
Microsoft Office 365
A uniquely integrated
endpoint protection platform
57. User
Anomalous user behavior
Unfamiliar sign-in location
Attacker
User account
is compromised
Attacker attempts
lateral movement
Attacker accesses
sensitive data
Privileged account
compromised
Lateral movement attacks
Escalation of privileges
Account impersonation
Attacker steals
sensitive data
Zero-day /
brute-force attack
The anatomy of an attack
58. Detect and investigate advanced
attacks involving identities
across on-premises, cloud and
hybrid environments
Azure
ATP
60. Azure
ATP
Monitor your on-premises Active
Directory with a convenient cloud service
Reduce strain and cost in your on-
premises environment with analytics
done in the cloud
Scale your anomalous behavior
detections with the power of the cloud
Pivot to and remediate a malicious attack
in Windows Defender ATP
Deploy with ease into your existing
infrastructure
Benefit from the scale of the cloud
Windows
Defender
ATP
61. Get a clear, efficient, and
convenient feed that surfaces
the right things on a timeline
Enjoy the power of perspective
on the “who-what-when-and
how” of your enterprise
Benefit from detailed
information for next steps
Focus on what is important
using the simple attack timeline
63. Abnormal resource access
Account enumeration
Net Session enumeration
DNS enumeration
SAM-R Enumeration
Abnormal working hours
Brute force using NTLM, Kerberos, or LDAP
Sensitive accounts exposed in plain text
authentication
Service accounts exposed in plain text
authentication
Honey Token account suspicious activities
Unusual protocol implementation
Malicious Data Protection Private Information
(DPAPI) Request
Abnormal VPN
Abnormal authentication requests
Abnormal resource access
Pass-the-Ticket
Pass-the-Hash
Overpass-the-Hash
Malicious service creation
MS14-068exploit
(Forged PAC)
MS11-013exploit (Silver
PAC)
Skeleton key malware
Golden ticket
Remote execution
Malicious replication requests
Abnormal Modification of
Sensitive Groups
Azure Advanced Threat Protection
Reconnaissance
!
!
!
Compromised
Credential
Lateral
Movement
Privilege
Escalation
Domain
Dominance
64. ATP Architecture
Alert notifications
Access to console
- Workspace Management
- Workspace portal
Parsed network
traffic from DCs
Azure ATP
Sensor
Domain
Controller
Alert notifications
to SIEM
Windows
Defender
ATP
Events
Windows Event Forwarding
Domain
Controller
Port mirroring
Alert notifications to SIEM
SIEM
Azure
ATP
Azure ATP
Standalone
Sensor
65. Verwendung von Intelligenz für eine einheitliche Identitätsuntersuchung
über On-Premises und Cloud-Aktivitäten hinweg
Azure
ATP
Microsoft
Cloud App
Security
Azure AD
Identity
Protection
66. Attack timeline
Day 1 – 11:
Attacker
compromises
privileged user’s
non MFA-enabled
account.
1 Day 137 – 143:
Attackers create rules on
Contoso’s SharePoint and
email to automate data
exfiltration to a cloud
storage solution.
3Day 16 – 218:
Attackers perform
mailbox searches
across Office 365.
2
Day 16 – 163:
Attacker uses stolen
credentials to VPN into
corporate network.
4 Day 163 – 243:
Attacker moves laterally
throughout organization’s
network, compromising
privileged credentials
5
COMPROMISED
CREDENTIAL
EXFILTRATE
DATA
CONNECTION
TO ON-PREM
MOVE
LATERALLY
