microsoft. Андрей Иванов. "Удивительное рядом -...

Г. Казань20 октября 2016#CODEIB

Андрей ИвановCloud Security LeadMicrosoft

Удивительное рядом -безопасность из облака

EMAIL [email protected]

Среднее количество дней

присутствия злоумышленника

во взломанной системе до его обнаружения

200+ Дней с момента

обнаружения вторжения до

полного восстановления

80Потери вследствие

падения эффективности

бизнеса и возможностей

роста

$3 Триллиона Средняя стоимость

утечки данных (15% увеличение

год к году)

$3.5 Миллиона

“НА СЕГОДНЯШНИЙ ДЕНЬ ЕСТЬ ДВА ТИПА КОРПОРАЦИЙ – ТЕ, КОГО УЖЕ ВЗЛОМАЛИ, И ТЕ КТО

ЕЩЕ ПОКА НЕ ЗНАЕТ ОБ ЭТОМ”-JAMES COMEY, ДИРЕКТОР ФБР

HOW DO BREACHES OCCUR?

Вирусы и уязвимости

нулевого дня – не

единственная проблема

безопасности

99.9% Использованных атакующими уязвимостей, имели опубликованный CVE более года назад

46% Скомпрометированных систем не содержали каких-либо вирусов

50% Из тех, кто открывал письмо или вложение делали это в течение первого часа

23% Пользователей открывали фишинговые письма (11% открывали вложения)

Эффективность

фишинговых атак

оставляют мало время для реакции

Хакеры стали хитрее и не ломятся напрямую

Вектора атак

5

Типовые фазы атаки

Cloud Identity Provider

Удаленный доступ как сервисEasily Publish your on-prem applications outside the corporate

network

Single sign onUtilize cloud Identity Provider as a central management

point for all your apps

Microsoft Operations Management Suite

Приложения и данные

SaaS

Единая среда технологий безопасности платформы Microsoft

Malware Protection Center Cyber Hunting Teams Security Response

Center

УстройстваИнфраструктура

CERTs

PaaS IaaS

Identity (Учетные записи)

INTELLIGENT SECURITY GRAPH

Cyber DefenseOperations Center

Digital Crimes Unit

Antivirus NetworkIndustry Partners

Identity Apps and Data Devices Infra

Protect. (Защита, противодействие угрозам)

• Azure MFA• MIM2016 (PIM)• Azure PIM• Win10 (Hello for Business)• SCCM End-Point Protection• Azure Key Vault• Just enough administration• Local Administrator Passw

ord Solution

• Win10 Information Protection

• Azure AD App Proxy• AD RMS• Azure Information Prot

ection• Azure Key Vault• Intune (MAM)• Azure Conditional Acce

ss• O365 ATP• O365 DLP

• Windows Secure Boot• Intune (MDM)• SCCM• Device-based condition

al Access• Bitlocker• Win10 Device Guard

• AD Group Policies• WS 2016 Shielded VM• OMS Backup and Recov

ery• Win10 auto VPN• WS2016 Credential Gua

rd, Remote Credential Guard

• SCM• EMET

Detect (Мониторинг и аналитика)

• ATA• Azure AD premium reporti

ng • Azure AD Identity Protectio

n• OMS (Security and Complia

nce)• Azure Security Center• Win 10 Defender ATP• O365 ASM

• Azure Cloud App Security

• OMS (Application insight connector)

• O365 ASM

• Win 10 Defender ATP• Device health attestatio

n

• Azure Security Center• OMS (Security and Com

pliance)• SCOM (ACS)

Response (Реагирование на инциденты)

• OMS (automation)• Azure AD Identity Protectio

n• Azure Security Center• O365 ASM

• Azure Cloud App Security

• O365 ATP• O365 Advanced eDisco

very

• Intune MDM (очистка устройства )

• Win10 IP (отзыв сертификата)

• OMS (automation)• Azure Security Center

https://azure.microsoft.com/en-us/documentation/services/multi-factor-authentication/

https://docs.microsoft.com/en-us/microsoft-identity-manager/pam/privileged-identity-management-for-active-directory-domain-services

https://azure.microsoft.com/en-us/documentation/articles/active-directory-privileged-identity-management-configure/

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/manage-identity-verification-using-microsoft-passport

https://technet.microsoft.com/en-us/library/mt634331.aspx

https://azure.microsoft.com/en-us/services/key-vault/

https://msdn.microsoft.com/en-us/library/dn896648.aspx

https://technet.microsoft.com/en-us/mt227395.aspx

https://technet.microsoft.com/en-us/mt227395.aspx

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/protect-enterprise-data-using-wip


https://azure.microsoft.com/en-us/documentation/articles/active-directory-application-proxy-publish/

https://technet.microsoft.com/en-us/library/hh831364(v=ws.11).aspx

https://blogs.technet.microsoft.com/enterprisemobility/2016/06/22/announcing-azure-information-protection/

https://blogs.technet.microsoft.com/enterprisemobility/2016/06/22/announcing-azure-information-protection/

https://azure.microsoft.com/en-us/services/key-vault/

https://blogs.technet.microsoft.com/enterprisemobility/2015/11/17/enhancing-managed-mobile-productivity/

https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access/

https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access/

https://products.office.com/en-us/exchange/online-email-threat-protection

https://blogs.office.com/2013/10/28/office-365-compliance-controls-data-loss-prevention/

https://technet.microsoft.com/en-us/windows/dn168167.aspx

https://www.microsoft.com/en-us/cloud-platform/microsoft-intune

https://www.microsoft.com/en-us/cloud-platform/system-center-configuration-manager

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwjBnr-7lsHPAhXLBcAKHbHmBuMQygQIIzAA&url=https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access/#device-based-conditional-access&usg=AFQjCNHmKpu5tSrob3fH46Hy88Uu3RLdcg

https://www.google.com/url?sa=t&rct=j&q=&esrc=s&source=web&cd=1&cad=rja&uact=8&ved=0ahUKEwjBnr-7lsHPAhXLBcAKHbHmBuMQygQIIzAA&url=https://azure.microsoft.com/en-us/documentation/articles/active-directory-conditional-access/#device-based-conditional-access&usg=AFQjCNHmKpu5tSrob3fH46Hy88Uu3RLdcg

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/bitlocker-overview

https://technet.microsoft.com/ru-ru/library/dn986865(v=vs.85).aspx

https://technet.microsoft.com/en-us/windows-server-docs/security/guarded-fabric-and-shielded-vms

https://www.microsoft.com/en-us/server-cloud/solutions/backup-and-recovery.aspx

https://www.microsoft.com/en-us/server-cloud/solutions/backup-and-recovery.aspx

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/vpn-profile-options

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/remote-credential-guard



https://blogs.technet.microsoft.com/secguide/2016/07/28/security-compliance-manager-4-0-now-available-for-download/

https://support.microsoft.com/en-us/kb/2458544

https://www.microsoft.com/en-us/cloud-platform/advanced-threat-analytics

https://azure.microsoft.com/en-us/documentation/articles/active-directory-view-access-usage-reports/

https://azure.microsoft.com/en-us/documentation/articles/active-directory-view-access-usage-reports/

https://azure.microsoft.com/en-us/documentation/articles/active-directory-identityprotection/?rnd=1#detection-and-risk




https://azure.microsoft.com/en-us/documentation/articles/security-center-intro/

https://microsoft.sharepoint.com/sites/Infopedia_G02KC/Pages/Custom/Windows10Security.aspx

https://blogs.office.com/2016/06/01/gain-enhanced-visibility-and-control-with-office-365-advanced-security-management/

https://www.microsoft.com/en-us/cloud-platform/cloud-app-security


https://blogs.technet.microsoft.com/msoms/2016/09/26/application-insights-connector-in-oms/

https://blogs.technet.microsoft.com/msoms/2016/09/26/application-insights-connector-in-oms/


https://microsoft.sharepoint.com/sites/Infopedia_G02KC/Pages/Custom/Windows10Security.aspx

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices

https://technet.microsoft.com/en-us/itpro/windows/keep-secure/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices




https://technet.microsoft.com/en-us/library/hh212908(v=sc.12).aspx

https://www.microsoft.com/en-us/cloud-platform/automation-and-control







https://products.office.com/en-us/exchange/online-email-threat-protection

https://support.office.com/en-us/article/Office-365-Advanced-eDiscovery-fd53438a-a760-45f6-9df4-861b50161ae4

https://support.office.com/en-us/article/Office-365-Advanced-eDiscovery-fd53438a-a760-45f6-9df4-861b50161ae4

https://docs.microsoft.com/en-us/intune/deploy-use/use-remote-wipe-to-help-protect-data-using-microsoft-intune





https://www.microsoft.com/en-us/cloud-platform/automation-and-control


microsoft. Андрей Иванов. "Удивительное рядом -...

Software