In today's threat landscape, the realm of cyberattacks is in a constant state of flux, evolving at an unprecedented pace. Attack vectors, methodologies, and vulnerabilities are continuously changing, presenting a formidable challenge to cybersecurity teams worldwide. To effectively combat this ever-changing landscape of attacks, security teams must equip themselves with tools that are innovating and adapting based on new threats. Foundational security tools play a crucial role in modern security and they must continuously invest in improving and enhancing their offerings to ensure they remain resilient against emerging threats.
Moreover, the disruptive force of AI is reshaping the cybersecurity landscape, both for attackers who are leveraging AI-powered tools to launch more sophisticated and automated attacks, and for security teams harnessing AI for prevention, detection, and response. To help our customers with these challenges, we are excited to announce the following capabilities in Microsoft Defender XDR:
AI-powered disruption of SaaS attacks: Automatic attack disruption is a game-changing feature first released at Ignite 2022. It is an on by default, powered by AI/ML capability that uses the correlated workload signal in XDR to detect & stop in-progress attacks (i.e. ransomware, BEC, AiTM) in real time with a high level of confidence. Over the last couple of years, Defender XDR has made significant investments in additional scenarios like disrupting attacks that use SAP data with signals from Microsoft Sentinel.
Today, we are excited to share that attack disruption has expanded to disrupt attacks that include malicious OAuth apps. This is enabled through the use of Microsoft’s vast threat intelligence, combined with sophisticated AI models that are layered on top of the broad, native and 3rd party signals within the platform.
OAuth apps have become a prominent attack vector for adversaries. Back in December, Microsoft observed an attack using an high privileged OAuth app to deploy virtual machines for cryptocurrency mining, and ultimately began spamming user email accounts for financial fraud. Because OAuth apps are often a “set and forget,” action, most users don’t realize the level of permissions and privileges they’ve delegated to them.
Once an attacker has gained access to an OAuth app with high permissions, they can create new ones that look credible on the surface but are being used to exfiltrate sensitive data. With the AI-powered disruption of SaaS attacks, Defender XDR will now disable the compromised OAuth app which will shut the attacker out from further misuse using its direct integration with Microsoft Defender for Cloud Apps. Not only has attack disruption broadened its coverage, but it can significantly stop more scenarios that involve a compromised user such as leaked credentials, stuffing & guessing.
Figure 1. OAuth app disruption in the Defender portal
Defender XDR now includes native protection for Operational Technology (OT) and Industrial Control Systems (ICS), as we have natively integrated Microsoft Defender for IoT into the Defender portal. Security teams can now detect and respond to cyber threats across OT environments and get key insights into their OT security posture, detect threats, and understand them in context of broader incidents. Through the new integration of OT organizations benefit from:
Figure 2. A triggered detection for a potentially impacted OT device in a human operated ransomware attack
In addition to OT signals, Defender XDR further enhances its integration with Microsoft Purview by bringing in critical Insider Risk management (IRM) insights into the SOC investigation experience. The IRM insights add context to the existing user page in XDR and provide visibility into activities that make a user high risk from a data security perspective. Because data has become a main target for attackers, it’s important to build data security into existing SOC processes for effective incident management and alert prioritization. Think about implementing the following within your SOC processes:
To learn more about the insider risk management feature, check out the latest blog from Microsoft Purview.
Figure 3. A multi-stage incident that involves DLP with insider risk information on user severity
Microsoft’s unified security operations platform, in public preview since April 4, is designed to offer end-to-end protection by consolidating various security operations tools and experiences into a single, coherent system. Now, customers of Microsoft Sentinel and Defender XDR can leverage comprehensive capabilities with more out of the box value, flexibility and better protection.
Building on this announcement, we have additional capabilities now ready for customers to use on the unified SOC platform. These include:
In addition to the shared capabilities between Defender and Microsoft Sentinel, today we are also delivering a new way to manage secure session access for SaaS apps. Microsoft Defender for Cloud Apps now provides new in-browser protection capabilities via Microsoft Edge that enable security teams to seamlessly manage how a user can interact with in-app data based on their risk profile. The in-browser protection reduces the need for proxies, improving both security and productivity, based on session policies that are applied directly to the browser settings.
Based on the user’s risk profile, admins can limit their app access to read only, or build granular policies that prevent downloads and uploads during a session. Protected users get a smooth experience when using the cloud apps that doesn’t impact their productivity – through the native integration with Edge there are no latency or app compatibility issues, and it provides more flexibility in protecting your valuable data across SaaS apps.
To enable these policies today, check out our documentation: https://learn.microsoft.com/defender-cloud-apps/in-browser-protection#in-browser-protection-requirem...
Figure 4. A block message from Defender for Cloud Apps to prevent the download of a sensitive file within the Edge browser
Looking ahead
Staying ahead of security threats is critical. Its important to embrace the latest security innovations to keep your organization secure whether if its across new attack vectors like a malicious OAuth app, taking advantage of native support for new areas in protection, or seeing the benefits of moving to a unified platform for all your SOC needs.
To learn more about these Defender XDR announcements, join us at the RSA conference from May 6-9 in San Francisco, attend main stage and booth session.
You can find more information and resources below.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.