Become a Microsoft Defender External Attack Surface Management Ninja: Level 400 training
Learn to become a Microsoft Defender External Attack Surface (Defender EASM) Ninja! This blog will walk you through the resources you'll need to master and derive maximum value from Microsoft's Defender EASM product.Defender EASM - Performing a Successful Proof of Concept (PoC)
To effectively determine the benefits of adopting Defender EASM, you should perform a Proof of Concept (PoC). Before enabling Defender EASM, you and your team should go through a planning process to determine success criteria, as well as execute a series of tasks that must be accomplished in the PoC.
Microsoft Secure score not updating after implementation of Attack Surface Reduction
<p>Hello everyone,</p> <p>I wanted to share that we have successfully implemented <strong>Attack Surface Reduction (ASR)</strong> rules across our endpoint devices as part of our ongoing security hardening efforts. These configurations are actively deployed and enforced through Intune ASR to help mitigate common attack vectors like Office macro abuse, executable content from email/web, and other high-risk behaviors.</p> <p>However, we’ve noticed that despite this implementation, some ASR-related recommendations are still appearing in Microsoft Secure Score. This can occur due to delays in telemetry updates, device reporting issues, or Secure Score metrics not immediately reflecting policy enforcement across all endpoints.</p> <p>We are currently reviewing the underlying data and device reporting to ensure full visibility and alignment with Secure Score.</p>Identify Digital Assets Vulnerable to Subdomain Takeover
Subdomain takeover vulnerabilities are, in most cases, the result of an organization using an external service and letting it expire. Microsoft Defender External Attack Surface Management continuously maps the external-facing resources across your organization's attack surface to identify, classify, and prioritize risks, including subdomain expiration and takeover.New Blog Post | Why is Defender EASM Discovery important?
Full blog post: Why is Defender EASM Discovery important? - Microsoft Community Hub The Defender External Attack Surface Management (Defender EASM) Discovery is an integral part of the external attack surface management process. Organizations often struggle to keep up with demanding business requests and create additional infrastructure not under their IT compliance. COVID increased pressure on organizations to allow employees to work from home and make rapid changes to new or existing infrastructure. How can you get an accurate picture of your risk with all these changes happening? How could you know where your attack surface is vulnerable? Defender EASM Discovery is the answer. Original Post: New Blog Post | Why is Defender EASM Discovery important? - Microsoft Community HubNew Blog Post | Identify Digital Assets Vulnerable to Subdomain Takeover
Read the full blog post: Identify Digital Assets Vulnerable to Subdomain Takeover - Microsoft Community Hub Subdomain takeover vulnerabilities are, in most cases, the result of an organization using an external service and letting it expire. However, that expired subdomain is still a part of the organization's external attack surface, with domain DNS entries pointing to it. An attacker could then claim this subdomain and take control of it with little to no effort, a considerable blow to an organization's security posture. How does this happen? For example, a company might enlist a service desk provider, "FreshDesk.' It would point a subdomain like "support.mycompany.com" to FreshDesk and then claim this domain with the Freshdesk service to activate it. However, a problem arises when the organization abandons the service because they migrate to other services or for some other reason. Meanwhile, after the service agreement expires, the subdomain remains pointing to the FreshDesk platform. While this might not seem bad initially, the risk of allowing attackers to execute scripts under the subdomain enables them to obtain data from the main website. The risk becomes even more significant when this scenario involves a service that handles PPI, PHI, or trade secrets. Microsoft Defender External Attack Surface Management continuously maps the external-facing resources across your organization's attack surface to identify, classify, and prioritize risks, including subdomain expiration and takeover.Welcome to the Microsoft Defender External Attack Surface Management Tech Community
Welcome to the Microsoft Defender External Attack Surface Management (MDEASM) Tech Community! Here, we'll share the latest content about how network teams, security defenders, and incident responders can get the most out of MDEASM's industry-leading attack surface management capabilities.
