Microsoft 365 Enterprise Security with E5 Overview

Microsoft 365 Enterprise Security with E5 Overview
Security through simplicity Microsoft 365 Enterprise E5 security overview David J. Rosenthal Vice President, Digital Business Microsoft Technology Center, New York City October 24, 2019
TECHNOLOGY HAS CHANGED THE WAY WE DO BUSINESS. PROTECTING COMPANY ASSETS REQUIRES A NEW APPROACH. of the world’s data has been created in the last two years IBM Marketing Cloud, “10 Key Marketing Trends For 2017” 90% cloud apps in the avg. large enterprise, 61% is shadow IT. Microsoft 2018 1,181of hacking breaches leverage stolen/ weak passwords Verizon 2017 Data Breach Investigation Report 81% The intelligent, connected cloud introduces both opportunity and risk
Complexity is the enemy of intelligent security $1.37M On average that an organization spends annually in time wasted responding to erroneous malware alerts 1.87M Global cybersecurity workforce shortage by 2022 70 35Security products Security vendors Is the average for companies with over 1,000 employees Global Information Security Workforce Study 2017Nick McQuire, VP Enterprise Research CCS Insight. “The Cost of Insecure Endpoints” Ponemon Institute© Research Report, June 2017
Cloud Redefines Security Responsibilities
$$ Customer Security landscape
Complex and expensive integration Constant training on new tools Too many alerts to handle Gaps in visibility The ‘best-of-breed’ model is broken
The security paradigm needs to change.
Native capabilities provide simplicity Fewer vendors and products to manage Less end-user friction and resistance Lower integration costs Reduced blindspots “If you make security hard, people may work around it. With Microsoft 365, we get native capabilities, visibility into our operational environment, and simplicity for all employees.” Simon Hodgkinson Group Chief Information Security Officer BP, United Kingdom
Securing the enterprise with Microsoft 365
Threat Protection Information Protection Security Management Optimize with security insights and configuration tools Correlate threat information and automatically respond Data is your most important company asset Identity & Access Management
Secure identities to reach zero trust Strengthen your security posture with insights and guidance Help stop damaging attacks with integrated and automated security Protect sensitive information anywhere it lives Threat Protection Identity & Access Management Information Protection Security Management Intelligent security for the modern workplace Microsoft 365 unifies enterprise security and user productivity Holistic security across your digital landscape
For enterprise customers that embrace Microsoft productivity tools, significant gains can be realized in security
https://www.youtube.com/watch?v=AL2V-wCaYps Placeholder for overview video
Microsoft 365 Enterprise E5 value Adds incremental value to Microsoft 365 E3 across these solution areas Microsoft Internal Use Only Brings together information protection & advanced compliance capabilities to protect and govern data while reducing risk Compliance Adds audio conferencing and calling capabilities in the cloud to enable your teams Meetings & Calling Adds Power BI capabilities that help you realize significant business value from your data Analytics Extends identity and threat protection to help stop damaging attacks with integrated and automated security Security Microsoft 365 E5
Productivity, Creativity and Teamwork solutions Analytics Office Applications Outlook/ Exchange Microsoft Teams Skype for Business Delve Azure Active Directory P2 Windows Defender Advanced Threat Protection Office 365 Advanced Threat Protection P1 & P2 Azure Advanced Threat Protection Microsoft Cloud App Security Azure Information Protection P2 Office 365 Cloud App Security Advanced eDiscovery Customer Lockbox Advanced Data Governance Skype Audio Conferencing Phone System Power BI Pro, MyAnalytics Microsoft 365 Enterprise E5 (includes E3 solutions) E3 E5 Microsoft 365 Enterprise E5 Azure Active Directory P1 Windows Hello Credential Guard Microsoft Advanced Threat Analytics Windows Defender Antivirus Azure Information Protection P1 Office 365 Data Loss Prevention Windows Information Protection BitLocker eDiscovery Compliance Security
Why Microsoft 365 security?
Why Microsoft 365 E5? Provides unmatched depth and breadth in enterprise security signals Prioritizes user productivity alongside security Products are designed to work better together Automates routine tasks to speed up incident response Secures more than just Microsoft products Reduces Total Cost of Ownership (TCO)
Microsoft Intelligent Security Graph
Why Microsoft 365 E5? Provides unmatched depth and breadth in enterprise security signals Prioritizes user productivity alongside security Integrates products to work better together Automates routine tasks to speed up incident response Secures more than just Microsoft products Reduces Total Cost of Ownership (TCO)
Getting to a world without passwords High security, convenient methods of strong authentication Windows Hello Microsoft Authenticator FIDO2 Security Keys
Corporate Network Geo-location Microsoft Cloud App SecurityMacOS Android iOS Windows Windows Defender ATP Client apps Browser apps Google ID MSA Azure AD ADFS Require MFA Allow/block access Block legacy authentication Force password reset ****** Limited access Controls Employee & Partner Users and Roles Trusted & Compliant Devices Physical & Virtual Location Client apps & Auth Method Conditions Machine learning Policies Real time Evaluation Engine Session Risk 3 40TB Effective policy Conditional Access
Holistic Identity Protection Azure Active Directory Proactively identifies suspicious login attempts and challenges them with MFA Microsoft Cloud App Security Detects anomalous behavior and reduces threats by limiting access to data and applications Microsoft Intelligent Security Graph Azure Advanced Threat Protection Recognizes compromised accounts and lateral movement, alerts you, and visualizes the attack timeline SCENARIO: A third-party site is hacked and user credentials are exposed on the dark web.
Attachment opened Integration + Automation Malware infects PC ! Windows Defender ATP removes malware Remediate infected end-points Search companywide email and remove attachment from affected mailboxes Phishing mail Intelligent Security Graph Shared security signals Personal email SCENARIO: Malware gets onto a work PC through a personal email inbox. Windows Defender ATP Office 365 ATP Infection detected Block the attachment from future attacks
Malicious emails found User anomalies suggest identity compromise Threat signal shared with WDATP for auto remediation Automatic remediation actions complete Because Minutes Matter
Browse to a website Phishing mail Open attachment Click a URL Exploitation & Installation Command & Control User account is compromised Brute force account or use stolen account credentials Attacker attempts lateral movement Privileged account compromised Domain compromised Attacker accesses sensitive data Exfiltrate data Azure AD Identity Protection Identity protection & conditional access Microsoft Cloud App Security Extends protection & conditional access to other cloud appsProtection across the attack kill chain Office 365 ATP Malware detection, safe links, and safe attachments Windows Defender ATP Endpoint Detection and Response (EDR) & End-point Protection (EPP) Azure ATP Identity protection Attacker collects reconnaissance & configuration data
DEVICES ON P REMISES CLOUD & SaaS AP P S Wherever it lives or travels Protect sensitive information • Discover sensitive data across apps, cloud, on-premises and endpoints • Classify documents and apply persistent sensitivity labels • Prevent unauthorized sharing or unsafe storage with encryption and rights- restrictions • Apply DLP actions based on classification labels, such as block sharing
Labels are easy for users to see and understand Label is metadata written to data, so it is persistent and readable by other systems e.g. DLP engine Sensitive data is automatically detected Classify & label sensitive company data Automatically discover personal data and apply persistent labels
Detect content in cloud storage services • Inspect files for sensitive information – based on policy • Discover sensitive data across 3rd party clouds like SalesForce, Box, Dropbox and others. Apply classification labels & protection Automatically apply labels defined in Microsoft Information Protection to sensitive files discovered in cloud apps Automatically classify, label & protect files in cloud apps
Scan for sensitive files on-premises Manage sensitive data prior to migrating to Office 365 or other cloud services • Use discover mode to identify and report on files containing sensitive data • Use enforce mode to automatically classify, label and protect files with sensitive data • Can be configured to scan: • CIFS file shares • SharePoint Server 2016 • SharePoint Server 2013
Meet data privacy requirements • Discover compliance-related sensitive data across locations, including on-premises • GDPR-specific sensitive information types helps protect personal data in EU countries • Assess whether your cloud apps are GDPR compliant • Gain visibility into classification, labeling and protection of personal data (including endpoints, locations, users) • Guide end-users when working with personal data – with policy tips and recommendations
• Dedicated security workspace for security administration and operations teams • Centralized visibility, control and guidance across Microsoft 365 security • Actionable insights help security administrators assess historic and current security postures • Centralized alerts and tools help security operations better manage incident response Centralized security management Microsoft 365 Security Center
• Quantifiable measurement of your security posture • Visibility across all of Microsoft 365 security services and managed entities (e.g.: Identities, Endpoints, etc) • Board-level trend report to shows security ROI • Benchmarks for industry and size • Recommendations for improving your score Improve your security posture Microsoft Secure Score
Insights and recommendations • Learn about the latest threats as they emerge in the threat landscape • Determine your endpoints exposure to the latest threats • Identify recommended mitigations and actions • Prioritize your next steps
Teaming up with our security partners to build an ecosystem of intelligent security solutions that better defend against a world of increased threats Integration with the security tools you already have Microsoft Intelligent Security Association
Microsoft 365 secures more than just Microsoft products • Single sign on for thousands of applications, use Azure Multi-Factor Authentication or your current MFA solution • Monitors and protects how your data is accessed in real- time across your non-Microsoft cloud apps and services • Integrates with your current Data Loss Prevention solution • Maintains data classification and protection when emails or documents travel to non-Microsoft platforms • Protects emails and files on any device (Windows, Mac, iOS, Android, or Android Enterprise) • Extends Microsoft data labels and protections to any non- Microsoft or internally-developed solution • Integrates security signals from Microsoft’s Intelligent Security Graph into your SIEM • Protects workloads running in the cloud, for both Windows and Linux
Workers gained Microsoft 365 Enterprise E5 – by the numbers Productivity in end user data breaches ($3.3M PV saved in remediation and other related costs) EXAMPLE: 5,000 users, 3 yrs 101% ROI NPV = $23.5M, $4,696/ user 10.25% reduced TCO 11.3 months faster adoption as a unified solution 10-15% across-the-board productivity improvement Forrester Total Economic Impact™ (TEI) Achieving Digital Business Transformation With Microsoft 365 Enterprise E5: A Total Economic Impact Analysis, September 2017 accessing systems and information 22minutes per day from increased collaboration and information sharing Security 24minutes per day Highly mobile workers saved from reducing 3rd-party security solutions 55.3% Reduction $442,467PV total savings
Recap The cloud continues to change security ‘Best of platform’ approach reduces complexity Integration and automation at-scale put Microsoft ahead of the market Microsoft 365 secures non-Microsoft products and plays well with the security tools you love
I need to be compliant with data protection regulations, like GDPR. How can Microsoft help me discover, classify and protect my sensitive data? How do I find and manage shadow IT and rogue devices, and put in place policies to ensure we remain compliant and secure? If a user gets compromised, how can I configure security policies that automatically enforce additional layers of authentication to keep my organization safe? Microsoft 365 addresses real-world security challenges I have solutions from many vendors in my enterprise IT environment, how can Microsoft help me secure our entire digital landscape? Eventually, we will experience a breach. How can Microsoft help me detect it and respond fast to limit damage? How can Microsoft help me understand my security posture and get recommendations on how to improve it?
Contact Information © 2019 Razor Technology www.razor-tech.com David Rosenthal VP & General Manager Digital Business @DavidJRosenthal SlideShare Blog: www.razor-tech.com 5 Tower Bridge 300 Barr Harbor Dr., Suite 705 West Conshohocken, PA 19428 www.razor-tech.com David.Rosenthal@razor-tech.com Cell: 215.801.4430 Office: 866.RZR.DATA LETS KEEP IN TOUCH 43
Appendix
Security operations that work for you Partnerships for a heterogeneous worldEnterprise-class intelligent security
“We chose Microsoft 365 Enterprise E5 because of its components’ tight integration, intuitive user experiences, and the strong Microsoft cloud roadmap and commitment to security. We also find it easy to attach best-of-breed security add-ins where we like. Perhaps most important, we use the native security capabilities in Microsoft 365 to reduce complexity and streamline processes.” Simon Hodgkinson Group Chief Information Security Officer, BP UK
“Given our strategy to digitally transform using native technologies underpinned by secure platforms, we recognized that we needed to take the best of all Microsoft products, which are combined in Microsoft 365 Enterprise E5.” Simon Hodgkinson Group Chief Information Security Officer, BP UK
“As we see the security landscape evolving with more sophisticated attacks, we trust Microsoft to stay ahead of the latest threats to protect our network and our data.” Chris Krebs Chief Information Officer Fruit of the Loom
“Using Cloud App Security as a magnifying glass, we gain amazing visibility into our SaaS environment. Cloud App Security works with Azure Information Protection to alert us if someone is trying to share sensitive data. Our vision is to use Cloud App Security together with the Azure conditional access policies that we have already defined, such as for our SuccessFactors app.” Muhammad Yasir Khan Head of IT Infrastructure Nakilat, Qatar Gas Transport
“With Azure Active Directory, we can set policies that treat employees outside the office more strictly than those inside it and that prompt for Multi-Factor Authentication on unmanaged devices or for certain applications. With Microsoft 365, we no longer have to choose between mobility and security— we have both.” Bryan Ackermann Chief Information Officer Korn Ferry, United States
“We set Azure Information Protection so that when you click ‘confidential,’ the file will be encrypted automatically and access will be restricted to designated users—even if you accidentally send it to the wrong person.” Erlend Skuterud Chief Information Security Officer Yara, Norway
“We’re using Azure AD to give each of our 20,000 employees one identity and one password, which lets us provide simple, safeguarded access to network assets across business units. We’ve used Azure to change the culture at Hearst— we’re getting people to look ahead and see IT as an enabler, not a barrier.” Chris Suozzi Director of Cloud Programs Hearst Communications
“Teams across different divisions and different countries can now easily build and safely store and share documents. In the past, there was nothing comparable.” Conor O’Halloran Head of Identity Management Merck KGaA, Darmstadt, Germany
“Today, we trust EMS and Surface devices running Windows 10 as a highly reliable platform that protects our data—such as the proprietary running shoe designs that make our name—in a mobile environment.” Edwin Idema IT Manager, EMEA Asics
“The biggest advantage of Windows Defender ATP over any other endpoint protection software is that it’s already part of the operating system and not a third- party add-in.” Itzik Menashe VP IT and Information Security Telit, United Kingdom
“I can take numbers and actions from Secure Score to management to explain what we’re going to do next and how that will improve our level of protection. It helps us keep on top of security.” Itzik Menashe VP IT and Information Security Telit, United Kingdom
The security perimeter has changed devices datausers apps On-premises & Web apps
On-premises & Web apps
Data center security Data loss prevention Compliance tools Anomaly detection Security management Information rights management Email security Threat detection Hybrid cloud security The security market is segmented and confusing
How do you balance security and productivity? Built-in, native security for your platform, devices, and productivity tools. ? A
Jason’s Deli January 11, 2018 As many as 2 million payment cards were stolen and sold on the dark web. FedEx February 15, 2018 Personal information was found on an unsecure cloud storage server. Under Armour March 29, 2018 An unauthorized party acquired data from 150 million cloud app users. Saks Fifth Avenue April 1, 2018 Hackers stole 5 million credit and debit cards and sold them on the dark web. Real life data breaches
Realities of digital transformation
of companies have embraced the cloud (1.88B) of the global workforce will be mobile by 2023 of European companies say they are GDPR compliant of successful enterprise attacks will be on Shadow IT resources by 2020 96% 43% 1/3 Only 26% The intelligent, connected cloud introduces both opportunity and risk Technology has changed the way enterprises conduct business… …requiring a new approach to protecting company assets 2018 State of the Cloud Survey (Rightside) Global Mobile Workforce Forecast Update 2017-2023, Strategy Analytics How to eliminate enterprise shadow IT, Gartner, April 11, 2017 “The State of GDPR Readiness: GDPR Readiness Progresses, But Strategies Depend Too Heavily on IT” Forrester, January, 2018
complexity Lack of specific recommendations on how to improve security posture Too much time spent managing security vendors Too many alerts to investigate Learning how to configure and manage disparate security solutions slows deployment Integration is time-consuming and increases total cost of ownership User productivity is compromised for the sake of security, resulting in users bypassing security measures
Microsoft 365 Enterprise E5 security products
Security solutions in Microsoft 365 Enterprise E5 Azure Active Directory Microsoft Cloud App Security Windows Hello Windows Credential Guard Microsoft 365 Security Center Microsoft Secure Score Microsoft Cloud App Security Azure Advanced Threat Protection Windows Defender Advanced Threat Protection Office 365 Advanced Threat Protection Microsoft Cloud App Security Azure Information Protection Office 365 Data Loss Prevention Microsoft Cloud App Security Windows Information Protection Microsoft Intune BitLocker Threat Protection Identity & Access Management Information Protection Security Management
Identity & Access Management Threat Protection Security Management Information Protection Secure Email Gateway Endpoint Detection and Response (EDR) Endpoint Protection (EPP) Anti-phishing Anti-virus/ Anti-malware User and Entity Behavior Analytics (UEBA) Anomaly Detection Threat Intelligence Feeds Remote Browser Intrusion Detection System (IDS) Intrusion Prevention System (IPS) Host intrusion prevention system (HIPS) Host Firewall Security Scoring Reporting Secrets Management Database Security Encrypted Cloud Storage Back Up Disaster Recovery Virtual Private Networks (VPN) IoT Protection Cloud Workload Protection DDoS Protection Incident Response Services Asset Discovery Pen Testing/ Risk Assessment Vulnerability Assessment Web Application Testing Managed detection and response (MDR) SOC Security training SIEM (SIM/ SEM/ Log management) Incident Ticket System Network Firewall Mobile Threat Detection tools Cross-platform endpoint protection Single Sign-on (SSO) Multi-Factor Authentication (MFA) Access Control Privileged Access Management (PAM) Data Loss Prevention (DLP) Data Encryption Information Protection Data Classification Data Governance Cloud Access Security Broker (CASB) Key Management Mobile Application Management Cloud-based Management Security categories M365 Enterprise E5 covers Security categories other Microsoft solutions cover What Microsoft Services/ MSSPs/ ISVs cover What Microsoft integrates with What Microsoft doesn’t do Network traffic analysis (NTA) Container Security* Anti-tamper software* Deception Web content filtering
Microsoft Cloud App Security Discovers cloud app being used in your enterprise, identifies and combats cyberthreats and enables you to control how your data travels Azure Information Protection P2 Protects sensitive enterprise data, even when it travels outside of your organization Windows Defender Advanced Threat Protection A unified endpoint security platform that protects against advanced attacks and automatically investigates and remediates evolving threats Azure ATP Detect and investigate advanced attacks on-premises and in the cloud Azure Active Directory P2 Identity & Access Management that is automated across your entire digital footprint Office 365 Advanced Threat Protection P1 Protects your email, files and online storage against unknown and sophisticated attacks Security Office 365 Advanced Threat Protection P2 Research threats, track phishing or malware campaigns aimed at your users, and search for threat indicators from user reports and other intelligence sources MICROSOFT 365 E5 SECURITY PRODUCT SUITE E5 My Analytics Customer Lockbox Power BI Pro Audio Conferencing, Phone System Advanced Data GovernanceCompliance Analytics Voice Advanced eDiscovery
Threat protection gain insight from the trillions of security-related signals on the Intelligent Security Graph from across the global Microsoft ecosystem. Standard integration capabilities connect to your other security tools (3rd party or homegrown). Security capabilities extend beyond Microsoft to secure 3rd party platforms, apps, and services. Intelligent, adaptive security gives users more freedom in how they work, from anywhere on any device. Native security capabilities reduce complexity and shorten deployment times. Individual products are purpose-built to integrate, which decreases TCO. A security platform approach that can reduce the number of vendors you manage. Microsoft 365
Speed up investigations by mapping lateral movement, providing evidence to support alerts and making recommendations for remediation and improved security. Proactively protect against threats with advanced hunting queries and education for end users that simulates phish/malware attacks. Automate security to detect threats and correlates alerts to identify a specific attack vector, investigates and remediates threats, reauthenticates high-risk users, and takes action to limit access to data. Discover shadow IT so it can be secured and managed, reducing your exposure to data leakage and finding threats with machine learning, like behavior-based anomalies. Control access to sensitive data, even when it’s shared outside of your organization or accessed via a 3rd party application. Automatically change what level of access is allowed and how users authenticate based on ML that detects risk, like impossible travel, an infected device, or compromised credentials.
Eliminate passwords by using biometrics or pins. A single solution that can protect identity across on premises and cloud directories. Discover, restrict, and monitor privileged identities and their access to resources. Discover 3rd party cloud apps that are in use and assess their risk, so you can sanction or block the application. Alert me when a user's credentials are for sale on the dark web and elevate their user risk level. If a user’s identity or device becomes compromised, automatically block/limit access, or require MFA. Secure identities to reach zero trust
Teach users to guard against email phishing by simulating an attack in a safe environment. Reduce false positives by contextually aggregating alerts together to identify a specific attack vector. Detect anomalies and suspicious behavior without needing to create and fine tune rules. After a threat is remediated, share signals to trigger protection for all email and devices, companywide. Detect and remove ransomware, then recover my files. Advanced email protection against phishing attempts, and unknown (zero day) threats. Automatically investigate endpoint alerts and remediate threats, removing them from all impacted machines. Detect attacks across both on-premises and cloud signals. Help stop damaging attacks with integrated and automated security Threat Protection
Grant select partners and customers access rights to sensitive information. Scan historical on-premises data files for potentially sensitive information before you move to the cloud. Protect sensitive data when it travels outside of your organization via email, USB, or a 3rd party SaaS app. Identify potentially sensitive information, like credit card or bank routing numbers, and automatically apply a sensitivity label and protection to the file. Automatically apply data protection policies if a user's access to that data changes, the user becomes compromised or the data reaches a certain age. Protect sensitive information anywhere it lives Detect and protect sensitive data that falls under compliance regulations, such as GDPR.
Incident and event forensic reporting.Detailed reports on the latest threats, so you can answer questions, like "How well am I protected against the latest threats?" Recommended actions you can take to improve your security posture. Benchmark your security against companies in your industry or of similar size. A quantifiable measurement of your security posture. Strengthen your security posture with holistic visibility, control and guidance
Features P1 Directory Objects1 No Object Limit User/Group Management (add/update/delete). User-based provisioning, Device registration Available Single Sign-On (SSO). Free, basic tiers + self-service app integration templates5 No Limit B2B Collaboration7 Available Self-Service Password Change for cloud users Available Connect (Sync engine that extends on-premises directories to Azure Active Directory) Available Security/Usage Reports Advanced Reports Group-based access management/provisioning Available Self-Service Password Reset for cloud users Available Company Branding (Logon Pages/Access Panel customization) Available Application Proxy Available SLA Available Premium Features Advanced group features8 Available Self-Service Password Reset/Change/Unlock with on-premises writeback Available Device objects 2-way sync between on-premises directories and Azure AD (Device write-back) Available Multi-Factor Authentication (Cloud and On-premises (MFA Server)) Available Microsoft Identity Manager user CAL4 Available Cloud App Discovery9 Available Connect Health6 Available Automatic password rollover for group accounts Available Conditional Access based on group and location Available Conditional Access based on device state (Allow access from managed devices) Available 3rd party identity governance partners integration Available Terms of Use Available SharePoint Limited Access Available OneDrive for Business Limited Access Available 3rd party MFA partner integration Preview Available Microsoft Cloud App Security integration Available Identity Protection • Detecting vulnerabilities and risky accounts: • Providing custom recommendations to improve overall security posture by highlighting vulnerabilities • Calculating sign-in risk levels • Calculating user risk levels • Investigating risk events: • Sending notifications for risk events • Investigating risk events using relevant and contextual information • Providing basic workflows to track investigations • Providing easy access to remediation actions such as password reset • Risk-based conditional access policies: • Policy to mitigate risky sign-ins by blocking sign-ins or requiring multi-factor authentication challenges • Policy to block or secure risky user accounts • Policy to require users to register for multi-factor authentication Advanced Identity Governance • Privileged Identity Management (PIM) • Access Reviews Only in Azure AD P2 What is the difference between Azure AD P1 & P2?
Features P1 Azure Information Protection content consumption by using work or school accounts from AIP policy-aware apps and services Available Protection for Microsoft Exchange Online, Microsoft SharePoint Online, and Microsoft OneDrive for Business content Available Bring Your Own Key (BYOK) for customer-managed key provisioning life cycle2 Available Custom templates, including departmental templates Available Protection for on-premises Exchange and SharePoint content via Rights Management connector Available Azure Information Protection software developer kit for protection for all platforms including Windows, Windows Mobile, iOS, Mac OSX, and Android Available Protection for non-Microsoft Office file formats, including PTXT, PJPG, and PFILE (generic protection) Available Azure Information Protection content creation by using work or school accounts Available Office 365 Message Encryption Available Administrative control3 Available Manual, default, and mandatory document classification Available Azure Information Protection scanner for content discovery of on-premises files matching any of the sensitive information types Available Azure Information Protection scanner to apply a label to all files in an on-premises file server or repository Available Rights Management connector with on-premises Windows Server file shares by using the File Classification Infrastructure (FCI) connector Available Document tracking and revocation Available • Configure conditions for automatic and recommended classification • Azure Information Protection scanner for automated classification, labeling, and protection of supported on-premises files • Hold Your Own Key (HYOK) that spans Azure Information Protection and Active Directory (AD) Rights Management for highly regulated scenarios Only in AIP P2 What is the difference between AIP P1 & P2?
Features P1 Safe Attachments Available Safe Links Available Anti-Phishing Policies Available Safe Attachments in SharePoint, OneDrive and Teams Available Safe Links in Teams Available Real-time reports Available • Threat tracker • Explorer (Advanced threat investigation) • Automated investigation and response • Attack simulator Only in Office 365 ATP P2 What is the difference between Office 365 ATP P1 & P2?
Mac (3rd party) Android, iOS (3rd party) Linux (3rd party) Windows Defender ATP • Windows Defender ATP integrates with leading EDR/ EPP providers for cross platform support • These 3rd party solutions forward all events, alerts into the Windows Defender ATP console making it the centralized console for most of sec admin’s day to day work • Configuration of the 3rd party solution’s client is still handled in the 3rd party's product but that is often a one-time thing. Their client may be deployed via Intune or SCCM or the 3rd party solution itself • If an alert shows up in Windows Defender ATP, SecOps may need to switch over to the 3rd party solution’s console for more detailed info
Privileged Identity Management Discover, restrict, and monitor privileged identities User Administrator UserAdministrator privileges expire after a specified interval Enforce on-demand, just-in-time administrative access when needed Ensure policies are met with alerts, audit reports and access reviews Manage admins access in Azure AD and also in Azure RBAC
Roadmap
• Comprehensive protection of sensitive data via both manual and automated classification and labeling • Simplified IT operations with unified labeling and policy management in the Security & Compliance Center • Labeling experiences built natively into Office apps (Word, PowerPoint, Excel and Outlook) across platforms – Mac, iOS, Android, Windows, and web apps • Complete visibility and analytics for sensitive data across your organization • Extend information protection to non- Microsoft apps and services with the Microsoft Information Protection SDK and third-party partner ecosystem Information protection investments –thru CY2019
• One console • Combines different alerts from different sources (endpoints, email, identities, etc) • Incidents are created automatically based on ML • Detailed view into threats impacting the organization Integrated SecOps experience
• Discover sensitive documents on Windows devices • Integrated reporting for labeled documents • Understand if sensitive corporate data resides on compromised devices • Pivot to investigate and mitigate detected endpoint threats in 1-click Integration for sensitive data discovery, classification and enforcement on endpoints
• Define entitlements for employees and partners • Associate entitlements with resources such as cloud, on-premises apps, SharePoint Online, Security groups • Create policies and approval workflows to ensure governed access Identity governance – entitlements management
55% Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod te. Source: Lorem ipsum dolor sit amet, consectetur 40% Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod te. Source: Lorem ipsum dolor sit amet, consectetur 81% of hacking breaches leverage stolen and/or weak passwords. Source: 2017 Verizon Data Breach Investigations Stats templates EXAMPLE
55% Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod te. Source: Lorem ipsum dolor sit amet, consectetur 40% Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod te. Source: Lorem ipsum dolor sit amet, consectetur 40% Lorem ipsum dolor sit amet, consectetur adipiscing elit, sed do eiusmod te. Source: Lorem ipsum dolor sit amet, consectetur Additional stats templates

Microsoft 365 Enterprise Security with E5 Overview

Check these out next

Microsoft 365 Enterprise Security with E5 Overview

Recomendados

Más contenido relacionado

Presentaciones para ti(20)

Similar a Microsoft 365 Enterprise Security with E5 Overview(20)

Más de David J Rosenthal(20)

Último(20)

Microsoft 365 Enterprise Security with E5 Overview