Upload File

post breach security with ata or atp · receives data from ata gateways and ata lightweight...

  • Home
  • Documents
  • Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms
36
MICROSOFT 365 Post breach security with ATA or ATP Tim De Keukelaere

Upload: others

Post on 17-Mar-2020

13 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Post breach security

with ATA or ATP

Tim De Keukelaere

Page 2: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Tim De Keukelaere

@Tim_DK

http://be.linkedin.com/in/timdekeukelaere/

http://www.dekeukelaere.com

Page 3: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

A few facts

• Cyber criminals are indiscriminate in their attacks –

• any size of organization has something worth stealing

• Cyber criminals have become more sophisticated in targeting their victims

• A lot of companies that say they won’t be targeted will have already been breached – they just don’t know it yet

• US companies took an average of 206 days to detect a data breach

• Breaches that took less than 30 days to contain had an average cost of $5.87 million, rising to $8.83 million for breaches that took longer to contain

http

s://ww

w.ib

m.co

m/se

curity

/data

-bre

ach

#re

po

rts

Page 4: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Attack Kill Chain

Page 5: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Post Breach Focus Area

Page 6: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365 The issue with traditional IT security tools

Designed to protect

the perimeter

Complexity Prone to false

positives

When user credentials are stolen

and attackers are in the

network, your current defenses

provide limited protection.

Initial setup, fine-tuning,

and creating rules and

thresholds/baselines

can take a long time.

You receive too many

reports in a day with

several false positives that

require valuable time you

don’t have.

Page 7: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365 The solution :

User and Entity Behavior Analytics (UEBA)

• Monitors behaviors of users and other entities by using multiple data sources

• Profiles behavior and detects anomalies by using machine learning algorithms

• Evaluates the activity of users and other entities to detect advanced attacks

Enterprises successfully use

UEBA to detect malicious

and abusive behavior that

otherwise went unnoticed by

existing security monitoring

systems, such as SIEM and

DLP.

Page 8: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Microsoft Solutions

Advanced Threat analytics Azure Advanced Threat Protection

Page 9: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Advanced Threat Analytics(ATA)

Page 10: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Microsoft Advanced Threat

Analytics brings the behavioral

analytics concept to IT and the

organization’s users.

Microsoft Advanced Threat AnalyticsAn on-premises platform to identify advanced security attacks and insider threats before they cause damage

Behavioral

Analytics

Detection of advanced

attacks and security risks

Advanced Threat

Detection

Behavioral

Analytics

Detection of advanced

attacks and security risks

Advanced Threat

Detection

Page 11: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365 Microsoft Advanced Threat Analytics

Detect threats fast with

Behavioral Analytics

Adapt as fast as your

enemies

Focus on what is

important fast using

the simple attack

timeline

Reduce the fatigue of

false positives

No need to create rules or policies, deploy agents, or monitor a flood of security reports. The intelligence needed is ready to analyze and is continuously learning.

ATA continuously learns from the organizational entity behavior (users, devices, and resources) and adjusts itself to reflect the changes in your rapidly evolving enterprise.

The attack timeline is a clear,

efficient, and convenient feed

that surfaces the right things on a

timeline, giving you the power of

perspective on the “who, what,

when, and how” of your

enterprise. It also provides

recommendations for next steps

Alerts only happen once

suspicious activities are

contextually aggregated,

not only comparing the

entity’s behavior to its own

behavior, but also to the

profiles of other entities in its

interaction path.

Page 12: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

ATA Architecture

Page 13: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

ATA CenterManages ATA Gateway and ATA Lightweight Gateway configuration settings

Receives data from ATA Gateways and ATA Lightweight Gateways

Detects suspicious activities

Runs ATA behavioral machine learning algorithms to detect abnormal behavior

Runs various deterministic algorithms to detect advanced attacks based on the

attack kill chain

Runs the ATA Console + can send emails and events when activity is detected

Page 14: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

ATA (Light) GatewayCapture and inspect domain controller network traffic

■ ATA Gateway - Port mirrored traffic

■ ATA Lightweight Gateway - local traffic of the domain controller

Receive Windows events from■ SIEM or Syslog servers

■ Domain controllers (using Windows Event Forwarding)

Retrieve data about users and computers from the Active Directory domain

Perform resolution of network entities (users, groups and computers)

Transfer relevant data to the ATA Center

Page 15: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

New in 1.9New and Improved Detections

■ Suspicious service creation

New Reports■ Passwords Exposed in clear text

■ Lateral movement paths to sensitive accounts

Improved Investigation■ New and improved entity profile

■ Manual tagging of sensitive groups and accounts

Infrastructure Enhancements■ Performance Improvements

Page 16: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Capacity Planning

Use the ATA Sizing Tool

• http://aka.ms/atasizingtool

Page 17: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365 Installation Experience – ATA Center

Page 18: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365 Installation Experience – ATA Gateway

Page 19: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Post Install

❑ Set ATA Center and Gateway power plans to high performance

❑ Configure Gateways for Automatic Updating

❑ Configure Telemetry Data Collection

❑ Import license key

Page 20: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Honeytoken Accounts

Configured through the ATA Center

Requires SID

Page 21: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Exclusions

Exclude specific IP addresses from:

• DNS Reconnaissance

detections

• Pass-the-ticket detections

Page 22: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Event CollectionWindows Event log ID 4776 enhances ATA Detection capabilities

Two ways to receive the information:

• SIEM

• Windows Event Forwarding

Page 23: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365MICROSOFT 365

Demo - ATA

Page 24: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Azure Advanced Threat Protection(ATP)

Page 25: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Azure Advanced Threat

Protection

Detect threats fast

with Behavioral

Analytics

Focus on what is

important using

attack timeline

Reduce the

fatigue of false

positives

Best-in-class security

powered by the

Intelligent Security

Graph

Protect at scale

with the power of

the cloud

Page 26: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365 Detect advanced attacks throughout the kill chain

Page 27: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

ATP Architecture

Azure ATP Cloud ServiceRuns on Azure infrastructure and is connected to Microsoft's intelligent security graph

Azure ATP workspace portalDisplays the data received from Azure ATP sensors and enables you to monitor, manage, and investigate threats in your network environment.

Azure ATP sensorInstalled directly on the DC’s, Monitors their traffic directly, without the need for a dedicated server or configuration of port mirroring.

Azure ATP standalone sensorInstalled on a dedicated server that monitors the traffic from DC’s using either port mirroring or a network TAP.

Page 28: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Capacity PlanningUse the Sizing Tool

• http://aka.ms/atpsizingtool

Page 29: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Installation Experience – ATP (1)

https://portal.atp.azure.com/

Create the workspace

Add users to ATP Group(s)

https://portal.atp.azure.com/
Page 30: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Installation Experience – ATP (2)

Page 31: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Installation Experience – Sensor (1)

Page 32: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Windows Defender ATP Integration

Page 33: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365MICROSOFT 365

Demo - ATP

Page 34: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Azure ATP Security AlertsSecurity Alert Guide

https://docs.microsoft.com/en-us/azure-advanced-threat-

protection/suspicious-activity-guide

https://docs.microsoft.com/en-us/azure-advanced-threat-protection/suspicious-activity-guide
Page 35: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365

Obtaining ATA / ATP

Page 36: Post breach security with ATA or ATP · Receives data from ATA Gateways and ATA Lightweight Gateways Detects suspicious activities Runs ATA behavioral machine learning algorithms

MICROSOFT 365


suspicious email detection

Suspicious Minds - talentosfenae.blob.core.windows.net

Suspicious hearts 1

GATEWAYS - RTSD

Suspicious Activity - NPPA

REPORT SUSPICIOUS ACTIVITY - InfraGardREPORT SUSPICIOUS ACTIVITY Suspicious Activity is any observed Testing or Probing Security: behavior that could reasonably indicate Attempting

Report on... · Servicing procedures and precautions, etc. ... 12. ATA 26 13. ATA 27 14. ATA 28 15. ATA 29 16. ATA 30 17. ATA 31 18. ATA 32 19. ATA 33 20. ATA 34

Www.grandstream.com. Overview Company Overview GXP Series IP Phones GXV IP Multimedia Phones ATA and Gateways Coming Soon! Company Overview GXP Series

Suspicious Behavior Detection: Current Trends and …pengcui.thumedialab.com/papers/suspicious behavior-survey...niques for detecting suspicious behaviors that have existed over the

Suspicious Transaction Reporting

Barriers & Gateways

Suspicious Cheese Lords

High Suspicious AF

Suspicious Shrimp

GATEways 2013

beroNet Gateways

Your ATA - Cisco · ATA 191 and ATA 192 Top Panel Figure 1: ATA 191 and ATA 192 Top Panel Cisco ATA 191 and ATA 192 Analog Telephone Adapter User Guide for Multiplatform Firmware

ATA Course Catalog - ATA College

Gateways Background

VoIP ATA series (ATA171plus, ATA172plus, ATA-171, … series/FXS series/ATA17X/ATA... · ATA Web User Guide VoIP ATA series (ATA171plus, ATA172plus, ATA-171, ATA-172, ATA-171M, ATA-171P)

Suspicious Packaging

Suspicious Deaths - California

The Suspicious Wabbit

Suspicious Object Detection and Tracking · Suspicious Object Detection and Tracking 7 1.3 SCOPE OF THE PROJECT The application provides efficient “Suspicious Object Detection”

VoIP Gateways

LOCATIONS• Air Conditioning ATA 21 • Electric Power ATA 24 • Equipment & Furnishings ATA 25 • Flight Controls ATA 27 • Hydraulic Power ATA 29 • Landing Gear ATA 32 •

Clinically Suspicious cervix

Suspicious Minds

Community Gateways

Suspicious Activity Reporting For Dummies®, Special … · Suspicious Activity Reporting For Dummies ... suspicious is critical; after all, ... Keep them in mind if you

Payment gateways(PG) and SMS gateways(SG) WELCOME [email protected] 1 . Agenda Need for payment gateways. Architecture of payment gateways. Working of payment gateways. Benefits

SUSPICIOUS ACTIVITY DETECTION

Report Suspicious Activity

Recognize Suspicious UASRecognize Suspicious UAS · 2020. 8. 11. · Recognize Suspicious UASRecognize Suspicious UAS Unmanned aircraft systems (UAS) are used for a range of tactical

Validation of the Nationwide Suspicious Activity Reporting ... · Validation of the Nationwide Suspicious Activity Reporting (SAR) Initiative: Identifying Suspicious Activities from