6 Key Microsoft announcements at the 2020 RSA Conference
Written by Rob Quickenden, Cisilion’s Chief Strategy Officer
The annual RSA Conference brings together 50,000 cybersecurity professionals to connect with peers from around the world to uncover new and better ways to keep the digital world safe.
Most of the leading Security vendors are there as you expect. As is becoming the annual norm, Microsoft used this opportunity to bring more exciting announcements around its ever-expanding offerings and capabilities in security.
1. Inside Risk Management
Insider Risk Management which has been in preview for a couple of months is now widely available.
The world we work in today with Internet everywhere, multiple devices being carried by employees and a work from anywhere culture means corporate data is likely to be stored or accessed on laptops, tablets phones, and even watches. Where blocking access is not an option, IT need ways to identify, take action on, and prevent insider risks to keep their business data safe.
Insider Risk Management (part of Microsoft 365) helps tackle this challenge by gathering signals from across Microsoft 365 and other third-party systems and then leverages the Intelligent Security Graph Insider Risk and machine learning to identify anomalies in user behaviour and flag high-risk activities – enabling businesses to more effectively protect and govern their data.
2. Communication Compliance
Communication Compliance, which extends the existing compliance services within Microsoft 365 can be tuned to leverage machine learning to quickly identify and take action on code of conduct policy violations within all company communications channels. This has also just been generally released.
3. Microsoft Threat Protection
Over the past year, Microsoft has been busy consolidating and harmonising all the various threat protection services and standardising the signalling, risk profile and events. In a world where multiple vendor solutions are no longer the recommended approach to provide end to end security, Microsoft Threat Protection helps simply whilst strengthening protection for the enterprise.
Traditionally, Security and IT have an endless list of alerts coming in from multiple monitoring systems and across their network, cloud, data centre and devices, making it almost impossible to link those at speed, recognise an attack, prioritise, and act quickly on the most critical threats or risks.
The unification of Microsoft’s Threat Protection services means that security/IT teams can now get a correlated, incident–level view of threats rather than having to manage and investigate multiple individual alerts from multiple systems.
The key capabilities in Microsoft Threat Protection include:
- Investigating threats, automatically (or semi-automatically) responding to them, and restoring affected assets to a secured state automatically, while simplifying hunting across the landscape for other signs of attack.
- Self–healing compromised user identities, endpoints, and mailboxes, allowing security and IT teams to spend more time focussing on projects and policies by using AI and ML to automate remediation.
- Sharing critical threat insights in real-time to help stop the progression of an attack.
- Azure Sentinel enhancements which are covered below.
4. Updates to Azure Sentinal
Microsoft Azure Sentinel is a scalable, cloud-native, security information event management (SIEM) solution which allows businesses of any size to keep pace with the exponential growth in security data, improve security outcomes, and reduce hardware and operational costs.
New enhancements have been announced this week at RSA in San Francisco designed to deliver instant value and increased efficiency for security operations teams. These include
- New community rewards (bounty program) for contributions to develop dashboards, orchestration, playbooks etc
- New developer guides and APIs along with GitHub code and data collections
- Ability to import AWS CloudTrail logs at no cost until June 2020
- New security campaign views which gives security teams an all-encompassing view of email attack campaigns targeted at their organisation
- New connectors for easier data collection from a wider range of security appliances and services
5. Security Campaign Views
Campaign views and compromise detection and response has also been made generally available following a short preview.
This feature gives security teams an all–encompassing view of email attack campaigns targeted at their organisation, along with making it easy to spot vulnerable users or configuration issues that enabled the attack or breach to succeed in the first place.
Early detection and response to compromised users is critical to ensuring that attacks are detected and actioned/remediated as early as possible so that the impact of a breach is minimised.
6. New Security Awareness Training
Through a partnership with Terranova, a market leader in computer-based training, Microsoft will be including Terranova’s entire phishing-related training set for free for organisations that use or are licensed for Office 365 Advanced Threat Protection Plan 2 (including in Microsoft 365 E5).
This security awareness training, coupled with Microsoft security solutions and risk analytics, will enable and extend Office 365 Advanced Threat Protection to provide a complete solution, encompassing customised user learning paths that enable IT and your compliance teams to create governance around organisational risk and maintain a stronger security posture.
Your Next Steps
If you’d like more information, fill in the form below and we’ll put you in touch with our Microsoft security team. But for now, that’s it from me! As always, I welcome any feedback and comments on what you think Microsoft’s most important announcements have been.