New Blog | Identity hunting with an enhanced IdentityInfo table
Advanced hunting with an enhanced IdentityInfo table Back in June 2023, we announced the enhanced IdentityInfo table in Microsoft 365 advanced hunting for Microsoft Defender for Identity customers. Today, we are expanding the availability of this table for all Microsoft defender for Cloud apps customers as part of our journey to enable this experience for all Microsoft 365 Defender customers. Read the full blog here: Identity hunting with an enhanced IdentityInfo table (microsoft.com)
New|Microsoft Purview Data Loss Prevention: Announcing general availability of several capabilities
At Microsoft, we are committed to providing a unified and cloud-native solution that can help you prevent the loss of your sensitive data across your applications, services, and devices without the need to deploy and maintain costly infrastructure or agents. Microsoft Purview Data Loss Prevention (DLP) is an integrated, and extensible offering that allows organizations to manage their DLP policies from a single location and has a familiar user experience for both administrators and end-users. DLP is easy to turn on, doesn't require any agents and has protection built-in to Microsoft 365 cloud services, Office apps, Microsoft Edge (on Windows and Mac), and on endpoint devices. DLP controls can also be extended to the Chrome and Firefox browsers through the Microsoft Purview extension and to various non-Microsoft cloud apps such as Dropbox, Box, Google Drive, and others through the integration with Microsoft Defender for Cloud Apps. We are excited to announce the general availability of several capabilities in Microsoft Purview Data Loss Prevention that help organizations to increase their depth of protection, extend their protection capabilities to additional planes and platforms, as well as empower administrators to be efficient in their day-to-day tasks. Read the full blog here: Microsoft Purview Data Loss Prevention: Announcing general availability of several capabilities - Microsoft Community HubFound an oddity in Defender for Cloud Apps
I checked our Defender for Cloud Apps portal this morning, just looking around at different activity logs and queries. I found something odd. The activity shows usage on a mobile device, Apple iOS using MS Outlook, a creation of an email with attachments, both of which were in Kanji and Hanzi characters. This is not due to encoding as some were translated like "Please note that you should practice the customs of the process." as the email subject. Plus there were many files attached as well, some names translated. "Hirojozhi Jie" "Hirojozuke" The file extensions do not translate, unfortunately. User has confirmed that he did not create or send out emails from the mobile device. Investigation in Mail Explorer in Defender does not show the email as ever existing. I am considering it a spoof email. How do I verify it was a spoof? How is it that a spoof is listed in the cloud portal coming from a mobile device, that seems too specific.Device is showing as Non-Compliant when login from Chrome
Hi All, I have created a Conditional access policy and session based access policy in MCAS to block download of sensitivity data from unmanaged device. everything is working fine when I login from Edge browser, but I concern is When I login from Chrome within Azure AD joined client that it's saying non-compliant. However When I login from Edge browser within same client, it will be showing as compliant in sign-in logs. appreciate the help! Thanks, Dilan
A bug in the sign in with Security Key option for M365
1. Register a pair of keys in M365. 2. On a PC you are presented with an option to sign in with a security key! 3. On a MAC you are presented with an option to sign in with a security key! 4. On ChromeOS you are not presented with that option. ChromeOS supports FIDO2 and it works on many other sites. It is only M365 that has this issue. As a Partner I reached out to Microsoft support, who said Microsoft has dropped all support for ChromeOS. I do not expect to run Word on a Chromebook, but I can run the web version of any of Microsoft tools on a Chromebook. Why then, can I not have the same level of security on my account that I could if I was accessing the site on a PC or Mac? Microsoft should fix this bug if they really care about security of their customer's accounts, no matter how they access the site.
New blog post | A proactive and comprehensive approach to data security with Microsoft Purview Data
In today’s modern workplace data security incidents can happen any time as users collaborate on data across a myriad networks, devices, and applications. And the volume of data, people who interact with the data, and activities around the data are all constantly changing. All of this means that the data security risks are increasing exponentially, and many organizations are struggling to keep up given their limited resources. This comes at a time when a recent Microsoft study showed that two in five security leaders feel at extreme risk due to cybersecurity staff shortage [1]. Organizations are looking for a solution that can provide comprehensive coverage across apps and devices to address these risks and is also easy to deploy and manage. A proactive and comprehensive approach to data security with Microsoft Purview Data Loss Prevention - Microsoft Community HubNew Blog Post | Prioritize Risk remediation with Microsoft Defender for Cloud Attack Path Analysis
Prioritize Risk remediation with Microsoft Defender for Cloud Attack Path Analysis - Microsoft Community Hub Our previous blogs “A Proactive Approach to Cloud Security Posture Management with Microsoft Defender for Cloud,” and "Proacting Hunting with Cloud Security Explorer in Defender for Cloud - Microsoft Community Hub" emphasized the importance of proactive security posture management and outlined a successful organizational structure for security teams. As a follow up article here we walk you through the scenarios how to identify and mitigate the biggest security risk issues while distinguishing them from less risky issues. Cloud environments are dynamically changing and to support rapidly changing threat and business environments in near real time, security teams need to act rapidly and effectively to mitigate risks and protect sensitive data and critical systems. Though cloud security solutions detect vulnerabilities and misconfigurations, growing number of assets can mean hundreds or thousands of security recommendations, overwhelming the security professionals to remediate the risks. By using Microsoft Defender for Cloud Attack Path Analysis, organizations can gain a better understanding of the potential attack paths that an attacker may take to compromise their cloud environment. This enables security professionals to prioritize risk remediation efforts and focus their resources on the most critical vulnerabilities and risks, to improve their overall security posture. To understand the prerequisites to Identify and remediate attack paths, visit: https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path#availability Security administrators can use attack path analysis for risk remediation by following these steps: Identify the Attack Paths: The first step is to identify the attack paths that an attacker might take to exploit vulnerabilities in the system. This includes mapping out the various components of the system, identifying the entry points, and analyzing the potential paths that an attacker might take. Analyze the Risks: After identifying the attack paths, the next step is to analyze the risks associated with each path. This includes evaluating the likelihood and impact of a successful attack and identifying the potential consequences for the organization. Prioritize Remediation Efforts: Based on the analysis of the risks, security administrators should prioritize their remediation efforts. This includes focusing on the most critical vulnerabilities and attack paths that present the greatest risk to the organization. Develop and Implement Mitigation Strategies: After prioritizing remediation efforts, security administrators should develop and implement mitigation strategies to address the identified vulnerabilities and attack paths. Test and Monitor: After implementing mitigation strategies, it is important to monitor the system to ensure that the vulnerabilities have been addressed and the attack paths have been closed. Security administrators need to proactively use the https://learn.microsoft.com/en-us/azure/defender-for-cloud/how-to-manage-attack-path to ensure all critical paths are remediated Original Post: New Blog Post | Prioritize Risk remediation with Microsoft Defender for Cloud Attack Path Analysis - Microsoft Community HubNew Blog Post | The New Microsoft Security Customer Connection Program (CCP)
Read the full blog post: The New Microsoft Security Customer Connection Program (CCP) - Microsoft Community Hub The security community is constantly growing, changing, and learning from each other in order to better position the world against cyber security threats. For years, Microsoft has driven a customer-obsessed development process by hosting two private communities for end-users of Microsoft security products: the Microsoft Cloud Security Private Community and the Microsoft 365 Defender Customer Connection Program. Under a strict confidentiality framework, our engineering teams get direct community feedback and insights for our roadmap plans, new user experience designs, private preview features, and more. Today, we are happy to announce that these two communities have now come together under one team – The Microsoft Security Customer Connection Program.New Blog Post | Microsoft Defender Weekly Wrap - Issue #55
Original Post: Microsoft Defender Weekly Wrap - Issue #55 | Revue (getrevue.co) Happy Friday all! I hope the week was good for you. I spent the first part of the week in Redmond doing some customer stuff. It was a whirlwind trip. Landed on Sunday, worked on Monday, then traveled back to the home office on Tuesday. And it clearly wasn’t enough time to settle into the time change, so I’ve been trying to recoup my energy for the remainder of the week. … The folks managing the Defender for DevOps features are asking for your help. Pull Request Annotations in Defender for DevOps Defender for DevOps exposes security findings as annotations in Pull Requests (PR). Security operators can enable PR annotations in Microsoft Defender for Cloud. Any exposed issues can then be remedied by developers. This process can prevent and fix potential security vulnerabilities and misconfigurations before they enter the production stage. Defender for DevOps annotates the vulnerabilities within the differences in the file rather than all the vulnerabilities detected across the entire file. Developers are able to see annotations in their source code management systems and Security operators can see any unresolved findings in Microsoft Defender for Cloud. Survey link: https://rodtrent.com/zzb … This week, here’s something special. Microsoft Security Operations Analyst Blueprint Survey Want to help drive the updates to the SC-200 exam? Your feedback will be used to determine which skills and abilities may be assessed in the Microsoft Security Operations Analyst certification exam. Please complete and submit your responses by December 14, 2022. Survey link: https://rodtrent.com/4t3 … I have one more trip, and one more major thing to do before taking off for the remainder of the year for the holidays. The last couple weeks after Thanksgiving have been busier than I remember in years past, so I’m truly looking forward to the time off. Talk soon. -Rod
