Hi everyone.
And welcome back to my course on Enterprise Security fundamentals.
In this lesson I want to talk about attack detection and several Microsoft tools on premises and cloud
based that help organizations in detecting attacks.
So first of all let's talk about an overview of the attack detection when information systems are properly
configured.
All attacks even those that are unsuccessful leave some traces that they occurred.
Clever attackers will attempt to remove those traces once they have gained access to the system.
Right.
So if telemetry monitoring is configured properly within an organization monitoring system will alert
the blue team to potential intrusion activity before the attackers have a chance to remove that telemetry
from the compromised system.
And now let's take a look at some techniques methods and tools for attack detection.
The first one and most obvious one would be logging and monitoring unless there is a system to record
events as they happen on a computer or finding evidence about how and when something happened will be
difficult to record or detect
most likely
an intrusion or intrusion signs signs of an intrusion.
Therefore the collection of System Event telemetry is important to detecting and understanding how an
attacker is infiltrating and compromising the system.
One way of securing event telemetry from deletion by an attacker who has compromised the system is to
move the event telemetry systems to a centralized location as quickly as possible centralizing event
logs provide the benefit of placing many data sources in a single location where events can be correlated
attackers who compromised the system will also be unable to remove Event Log evidence of their activities.
If those events are recorded on a separate system now the next tool I want to talk about is the same
system.
So the sim systems perform analysis of event log data as it is generated Sim systems can aggregate data
from a variety of sources correlate that data and generate events based on determinations made about
that correlated data.
Sim systems can be software that runs on Windows or Linux server operating systems and are also available
as hardware or virtual appliances.
Some Sim systems provide compliance retention and forensic analysis functionality so they can be used
in conjunction with or as a replacement for other event log management systems in an organization.
The next one is intrusion detection system or shortly ideas and ideas is a software application or hardware
or a virtual appliance that monitors on organizations information systems for problematic activity or
violations of policy.
There are multiple types of ideas including network intrusion detection systems.
That's an ideas that monitoring networks for suspicious activity or host based intrusion detection systems.
Each ideas that monitor a specific system multiple ideas can report to a central CRM system the central
Sim system would then provide centralized telemetry storage correlation analysis alerts and security
recommendations based on the telemetry data on intrusion protection system or intrusion prevention system
shortly.
IP US is a special type of ideas that includes the functionality that allows for an automated response
to occur when an intrusion is detected.
Next one is the latest let's say technology available in the latest security tools.
And that is a tech detection and machine learning attack detection and machine learning basically is
recognizing the characteristic evidence of an attack in hundreds of thousands if not millions of event
log entries spread across a multitude of different event sources.
When you are trying to do this manually to recognize this event logs out of thousands millions of fantasies.
Well basically it's like finding the proverbial needle in the haystack.
An advantage of big data and machine learning is that they are very good at finding patterns and anomalies
that may not have been apparent.
Using older analysis techniques big data on machine learning techniques allow the characteristic traces
of attacks that are present in an organization's event logs to be recognized and surfaced.
This occurs because while the characteristic of a single attack may be subtle when the characteristics
of thousands of attacks are analyzed across tens of thousands of organizations commonalities are more
easily identified.
Cloud services ingest data constantly.
So this means that all the identifying characteristic of newly recognized attack will become known to
all customers almost immediately.
Now I want to discuss about the Microsoft attack detection products so Microsoft has several products
that can be used to detect suspicious activity on an organization's information systems based on collection
and analysis of telemetry.
These products can be used individually or together depending on the organization's needs.
Some of these products can run locally on an organization's network and other products use Microsoft's
cloud infrastructure for management and analytic functionality
so let's go through this product so very quickly.
So one of them the first one of them would be Microsoft advanced threat analytics or Microsoft 80 80
is the solution that you can deploy in on premises environments to detect threats 88 uses behavioral
analytics to determine what constitutes abnormal behavior on your organization's network based on its
understanding of prior behavior of security entities.
For example noticing when an account has a suspicious sign on activity that kind of differs from the
normal sign on activity when an account performs an enumeration of the membership of sensitive groups
for example or when on account.
Well a computer sorry appears to be participating in a text such as a golden ticket attack the next
tool on our list here is Asia advanced threat protection.
Basically Asia advanced threat protection has very similar functionality to 88 except all of these telemetry
is funneled for analysis into the cloud rather than the analysis being performed on premises similar
to 88 Asia ATP DP uses behavioral analytics to determine what constitutes abnormal behavior on your
organization's network based on learning the prior behavior of security entities.
Asia ATP can ingest telemetry data from Sim systems windows event forwarding directly from Windows event
collector as well as radius accounting from VPN and points by the way at the end of of this lesson.
I will include some links as references.
If you want to find out more about each product and what exactly it does in greater detail.
Asia Security Center.
The next one on our list.
Well Asia Security Center was originally deployed as a tool to analyze and report on the security resources
in Asia.
Asia security center agents can be deployed now to on premises servers as well as your security center
can analyze event telemetry from servers running both on premises both bare metal or virtualize as well
as servers running as I asked the infrastructure as a service virtual machines correlating events so
that administrator are able to view the timeline of a specific attack as well as steps that can be taken
to mitigate the attack the next on our list as Windows Defender advanced threat protection or Windows
Defender ATP Windows Defender advanced threat protection is a product for Windows 10 and points that
provides the following functionalities endpoint behavioral sensors so it monitors a Windows 10 computers
telemetry including gathering data from event logs running processes registry file and network communications
data.
This data is forwarded to the organization's Windows Defender ATP cloud instance.
After that the next functionality is cloud security analytics so cloud security analytics takes the
telemetry gather at the end point level and analyzes that data providing threat detections and recommendations
responses back to the organization.
This analysis occurs against information available to Microsoft across the windows second system as
well as cloud products such as Office 365 and Asia.
For example Microsoft may learn about and resolve a specific threat from the telemetry of one set of
windows defender defender HP customers.
Well the same site allows Windows Defender HP to make recommendations when the same threat is detected
in the endpoint telemetry of another Windows Defender HP customer and last but not least in the threat
intelligence.
So Windows Defender ATP doesn't just rely on telemetry collected with customers consent across the Microsoft
ecosystem.
Microsoft also has a security researchers and engages with partner organizations to identify attacker
tools and techniques and to raise alerts when evidence of these tools and techniques surfaces in the
customers through telemetry.
The next one on the list is Office 365.
Advanced Threat protections.
Or Office 365 ATP Office 365 ATP is a service that you can add to your existing Office 365 subscription
Office 365 ATP provides functionality around email messaging and files that are used within an office
3 6 5 6 3 shit subscription such as those stored in a SharePoint Online or team site Office 365 ATP
provides the following functionality it scans email attachments to find malware it's Kanzi mail messages
and Office documents to locate Malicious Web addresses it locates spoof email messages and it determine
when an attacker attempts to impersonate your users organizations using custom domains now to take a
little bit of let's say deep diving into all of these products.
We are going to let's say just detail a little bit more about each and one of them.
So first of all let's talk about machine learning and the machine learning benefits.
Right so one of the biggest changes that occurred in information security are is the real rapid development
of behavioral anomaly detection.
And this has become possible because of advances in machine learning.
In fact with the most recent Windows 10 update we actually Microsoft has been able to let's see have
the ability to run a lot of machine learning stuff on Windows 10 on a window stem workstation and as
well as on Windows Server 2016 but also by the accessibility of the public cloud where a lot of information
can be stored
Microsoft's got a thing called the Microsoft Security graph and the Microsoft Security graph and this
is the next one we'll be talking about so the Microsoft Security graph basically records all information
that people opt in to record about their security.
That is where certain anomalous behavior might be detected in one particular endpoint.
And that customers up to Microsoft Security graph once that the correct three characteristics of that
anomalous behavior is understood for that one end point.
Every other customer every other Microsoft customer benefits because suddenly those characteristics
are understood across all of the points.
So this is a very very big change because in the old days with the antivirus signatures what would what
you would take to happen was the antivirus vendor would need to be sent a copy of the virus or would
need to see a copy of the virus that have done.
They would have to build the necessary signatures.
And of course you'd have to update your signatures.
And when you updated your signature then you would be able to sort of recognize this new virus.
Well this works a lot more quickly especially when all of the analysis and data is basically this telemetry
and is going up into the cloud.
So that as soon as it's identified somewhere you're not waiting for it.
Are not waiting to know so you're not waiting for example for the weekly definition update.
So those definitions are basically going down straight ahead.
So there's several products that we talked about in the previous slides.
And let's let's take another look at them.
So first of all that there's Microsoft Advanced Threat analytics or Microsoft 80
in a lot of ways.
Microsoft Advanced Threat analytics and the one I talked about in the previous slide Asia advanced threat
protection.
These two products do very similar things.
Right.
Advanced Threat analytics is on prem only version whether where advanced the Asian advance threat protection
is the cloud based version.
So you choose ZTE or advanced threat protection and what they do is that they do behavioral based detection
and they also detect stuff like you know normal viruses that would turn up and that will be detected
by Windows Defender but they also look at how users and how entities within active directory interact
on a regular basis with active directory and then they flag anomalous behavior.
Right.
So if you've got an account that has only ever been used for a particular task and then suddenly it's
being erased to become a domain admin let's say that would be flagged and you would receive an alert
you've got off to that Windows Defender ATP right.
As we've talked in the previous slide we have already covered Asia advanced threat protection because
as I said it does the same exact things as E.T. only that it is the cloud based version
so Windows Defender ATP.
Let's take another quick look at Windows Defender ATP.
So what does Windows Defender ATP does is it basically normally with Windows Defender each Windows Defender
endpoint is an endpoint and let's see if you if you if you grasp the idea is an endpoint to itself which
means that one computer doesn't share information with another.
Right.
The idea with Windows Defender ATP is it all hooks up into the cloud into that Microsoft Security graph
that we talked about so that you get telemetry across all of your organizations and things not just
the detection of malware but suspicious changes to registry files suspicious activity and event logs
they will be flagged for you again because when all of these telemetry is going up into the cloud and
is being analyzed there it's easier to flag with that rather than you know the way that we do it that
we did it in the old days where you'd be going and searching through event logs for specific ideas that
we were alerted about something right.
So what happens here is this telemetry just goes up into the cloud right.
And we get a load because it knows what to look for with event ideas with changes to registries with
changes to files and so on.
So this is the let's say advantage of the Windows Defender ATP and you you'd also have the sensors deployed
all your endpoints which are strictly communicating with the cloud.
There are a lot of cool features you could do.
You could for example isolate the machine and from the network and the design point would be able to
communicate only with Windows Defender ATP and you could perform deeper investigation on that machine
and a lot of a lot of other cool features like that.
Okay.
Then we have Asia's security center and with Asia's security center primarily is designed if you are
running all of your low workloads in Asia and it will also find problems with your software as a service
configuration.
So if you're running websites within Asia it will make recommendations for example putting firewalls
in place in front of those Web sites applications gateways and so on.
It will also flag problems that you might have with your virtual machine configuration with your right.
Asia's sequel configuration and so on.
You can also put an on premises agent for servers with windows with.
Sorry Asia Security Center but to a certain extent you'd probably see if you are worrying about your
on prem security and you wanted the data so that telemetry going up into Asia you'd be probably thinking
more with Asia advanced threat protection which as I said was as of March 2018 generally available.
Now analytics in the cloud is going to be the way.
So again let me repeat myself so I can make myself very very clear analytics in the cloud is going to
be the way forward in terms of detection because it's a very very good way of picking up anomalous activity
just just just hoping that you could run a box on premises and that that's going to pick up all of the
anomalous activity.
Right.
Well it can now.
It can.
It can only know what it's going to know if you are hooking into the Microsoft Security graph directly.
And again you opt in.
It's not like Microsoft like stealing your data and asking you without asking for your information without
your permission.
And then you've got the advantage of everything that they know about security being able to be detected
within your environment.
As I said guys this concludes our lesson.
What I want you to do is go in and take the quiz at the end of this section and I will see you in the
next section where we will be discussing several other concepts like the CIA concept and security organizations
preparations and proper proper security policy creation.
I hope this has been informative for you.
And thank you for watching.