Enterprise Ransomware Mitigations

Transcription

1 打造數碼安全校園

2

3

4

5 Enterprise Ransomware Mitigations Windows 10, Edge Browser, Office ATP Enterprise Mobility Suite (EMS) ATP OneDrive for Business Azure Backup 3rd party Cloud Backup

6 THE WINDOWS CLIENT DEFENSE PRE-BREACH POST-BREACH Device protection Threat resistance Identity protection Information protection Breach detection investigation & response Device integrity Device control SmartScreen Windows Microsoft Firewall Edge Microsoft Device Guard Edge Windows Device Defender Guard Windows Anti-Malware Defender Application Guard Windows Hello :) Credential Guard BitLocker and BitLocker to Go Windows Information Protection Azure RMS Conditional Access ATP

7 COMPREHENSIVE THREAT RESISTENCE Office ATP SmartScreen Windows Firewall External Internal Microsoft Edge Device Guard

8 PROTECT DEVICES BEFORE THEY ENCOUNTER THREATS Microsoft SmartScreen Phishing and malware filtering technology for Microsoft Edge and Internet Explorer 11 in Windows 10. Provides protection from drive-by downloads attacks Cloud service is continuously updated, nothing for you to deploy. Exchange Online Advanced Threat Protection Cloud-based filtering service helps protect against unknown malware and viruses. URL trace technology examines potentially harmful links.

9 E XCHANGE O NLINE ADVANCED THREAT PROTECTION ( ATP) Sender Multiple filters + 3 antivirus engines with Exchange Online protection Detonation chamber (sandbox) Executable? Registry call? Elevation?? Has attachment? -Suspicious file type Links Unsafe Safe Recipient

10 ISOLATION WITH WINDOWS DEFENDER APPLICATION GUARD Microsoft Edge Apps Windows Platform Services Windows Platform Services Critical System Processes Kernel Application Guard Container Kernel Windows Operating System Kernel System Container Hyper-V Hyper-V Device Hardware Hypervisor

11 WINDOWS DEFENDER ANTI-VIRUS PROTECTION Protection that competes to win Scored 98.1% detection rating from AV Comparatives testing against top competitors (March 2016). Behavior and cloud-powered malware detection Can detect fast changing malware varietals using behavior monitoring and cloud-powered protection that expedites signature delivery Tamper Resistant Windows Trusted Boot and platform isolation protect from attacks and enable it to self-repair Built into Windows and Always Up-To-Date No additional deployment & Infrastructure. Continuously up-todate, lower costs

12 THE WINDOWS 10 DEFENSE STACK PROTECT, DETECT & RESPOND PRE-BREACH POST-BREACH Device protection Threat resistance Identity protection Information protection Breach detection investigation & response Device integrity Device control SmartScreen Microsoft Edge Device Guard Anti-Malware Application Guard Windows Hello :) Credential Guard BitLocker and BitLocker to Go Windows Information Protection Azure RMS Conditional Access ATP

13

14 M I C R O S O F T

15

16

17 Credential Guard Trustlet #2 Trustlet #3 TODAY S SOLUTION: CREDENTIAL GUARD Pass the Hash (PtH) attacks are the #1 go-to tool for hackers. Used in nearly every major breach and APT type of attack Apps Credential Guard uses VBS to isolate Windows authentication from Windows operating system Windows Platform Services Protects LSA Service (LSASS) and derived credentials (NTLM Hash) Fundamentally breaks derived credential theft using MimiKatz, an open-source tool to perform Windows security test. Kernel Windows Operating System Hyper-V Hyper-V Kernel SystemContainer Device Hardware Hypervisor

18 THE WINDOWS 10 DEFENSE STACK PROTECT, DETECT & RESPOND PRE-BREACH POST-BREACH Device protection Threat resistance Identity protection Information protection Breach detection investigation & response Device integrity Device control SmartScreen Microsoft Edge Device Guard Anti-Malware Application Guard Windows Hello :) Credential Guard BitLocker and BitLocker to Go Windows Information Protection Azure RMS Conditional Access ATP

19 S H A RI NG PRO T E CT IO N Azure Rights Management Services Protect all file types. Create protected (p) version of files, e.g. ptxt, pjpg, pfile Support for all commonly used devices and systems Windows, OSX, ios, Android

20 THE WINDOWS 10 DEFENSE STACK PROTECT, DETECT & RESPOND PRE-BREACH POST-BREACH Device protection Threat resistance Identity protection Information protection Breach detection investigation & response Device integrity Device control SmartScreen Microsoft Edge Device Guard Anti-Malware Application Guard Windows Hello :) Credential Guard BitLocker and BitLocker to Go Windows Information Protection Azure RMS Conditional Access ATP

21 CONDITIONAL ACCESS CONTROL User attributes User identity Group memberships Auth strength (MFA) Devices Authenticated MDM Managed Compliant with policies Not lost/stolen Application MAM controlled Business sensitivity Conditional access control with EMS Other Network location On-Premises applications

22 WINDOWS DEFENDER ADVANCED THREAT PROTECTION DETECT ADVANCED ATTACKS AND REMEDIATE BREACHES Built into Windows No additional deployment & Infrastructure. Continuously up-to-date, lower costs. Behavior-based, cloud-powered breach detection Actionable, correlated alerts for known and unknown adversaries. Real-time and historical data. Rich timeline for investigation Easily understand scope of breach. Data pivoting across endpoints. Deep file and URL analysis. Unique threat intelligence knowledge base Unparalleled threat optics provide detailed actor profiles 1st and 3rd party threat intelligence data.

23 Windows 10 BACKUP FOR CONTINGENCY Enable user seamlessly backup in nearly real-time, and self-service restore upon situation

24 BACKUP FOR CONTINGENCY Enable user seamlessly backup in nearly real-time, and self-service restore upon situation Designed for productivity. Fits for frequently modified files on selected folder (e.g. Documents) Gives backup of your data in the cloud and gives user access from any device Designed for cloud backup storage endpoint, for both Windows client and server. IT control storage, that can be easily enlarged Backup is schedule-based. File storage and sharing with 1 TB storage per user.

25 32