Microsoft è diventata oramai la più grande azienda di cybersecurity al mondo per quantità annua di investimenti. E infatti la sicurezza è o dovrebbe essere oggi la maggior preoccupazione delle aziende che affrontano la trasformazione digitale. Oggi grazie a questi continui investimenti Microsoft ci mette a disposizione alcuni tra gli strumenti più evoluti ed innovativi per incidere effettivamente sui tre fondamentali pilastri della sicurezza: •contrasto a software ed azioni malevoli •protezione delle identità •protezione dei dati Avete mai sentito parlare di Intelligent Security Graph con Application Guard, Credential Guard, Device Guard, Windows Defender, Advanced Threat Analytics, Advanced Threat Protection, Threath Intelligence, Cloud App Security, Microsoft Intune, MFA....? In questa sessione cercheremo di "presentare" tutte queste tecnologie introducendone caratteristiche e funzionalità! By Giampiero Cosainz

2. MODERN SECURITY
BY MICROSOFT
Giampiero Cosainz / Technical Unit Director, walk2talk
Giampiero.Cosainz@walk2talk.it
linkedin.com/in/gpc72/

3. SPONSOR

4. Who am I?
Giampiero Cosainz
System Engineer e Trainer
walk2talk srl
Giampiero Cosainz
giampiero.cosainz@walk2talk.it
MCT, MCSE, MCSA, MCTS, MCP

5. About Us…
walk2talk
www.walk2talk.it
Microsoft Partner Gold
Centro PearsonVue
Visitate il blog www.walk2talk-blog.it

6. Agenda
Parliamo di..?
The New Microsoft Cybersecurity Architecture

7. Istruzione & Diffusione della Conoscenza
Sicurezza Fisica di device e apparati
Antivirus & Sicurezza Perimetrale
…sono indispensabili
ma non bastano più!!!

8. Statisticamente qualsiasi organizzazione,
indipendentemente dalla dimensione o dal settore di attività,
subirà un attacco informatico significativo entro i prossimi 12 mesi,
mentre oltre la metà ne hanno subito almeno uno nell’ultimo anno

9. Ore 11.40
Sala A

14. The Microsoft Security
Response Center
Led by some of the world’s most experienced security experts.
They identify, monitor, respond, and resolve security incidents
and on-premises and cloud vulnerabilities around the clock,
each day of the year.

17. & management
Protect users’ identities & control access to
valuable resources based on user risk level
protection
Protect against advanced threats
and recover quickly when attacked
protection
Ensure documents and emails are seen
only by authorized people
management
Gain visibility and control over security tools

18. & management
Protect users’ identities & control access to
valuable resources based on user risk level

19. (Multifactor Unlock)
(Virtualization-based Security)

21. Azure Active Directory Identity Protection

27. & management
Protect users’ identities & control access to
valuable resources based on user risk level

28. protection
Protect against advanced threats and
recover quickly when attacked

30. Office 365
Advanced Threat Protection

34. Azure Storage Blob Service

35. Office 365
Threat Intelligence

40. Windows Defender
(Windows 10)

46. Windows Defender
Advanced Threat Protection

57. Microsoft Advanced Threat Analytics
/ Azure Advanced Threat Protection

58. Microsoft Advanced Threat Analytics
brings the behavioral analytics concept
to IT and the organization’s users.
Microsoft Advanced Threat Analytics
Behavioral
Analytics
Detection of advanced
attacks and security risks
Advanced Threat
Detection
An on-premises platform to identify advanced security attacks and insider threats before
they cause damage

59. Analyze1
How Microsoft Advanced Threat Analytics
works
After installation:
• Simple non-intrusive port mirroring, or
deployed directly onto domain controllers
• Remains invisible to the attackers
• Analyzes all Active Directory network traffic
• Collects relevant events from SIEM and
information from Active Directory (titles,
groups membership, and more)

60. How Microsoft Advanced Threat Analytics
works
ATA:
• Automatically starts learning and profiling
entity behavior
• Identifies normal behavior for entities
• Learns continuously to update the activities
of the users, devices, and resources
Learn2
What is entity?
Entity represents users, devices, or
resources

61. Detect3 Microsoft Advanced Threat Analytics:
• Looks for abnormal behavior and identifies
suspicious activities
• Only raises red flags if abnormal activities are
contextually aggregated
• Leverages world-class security research to detect
security risks and attacks in near real-time based on
attackers Tactics, Techniques, and Procedures (TTPs)
ATA not only compares the entity’s behavior
to its own, but also to the behavior of
entities in its interaction path.
How Microsoft Advanced Threat Analytics
works

62. Alert4
How Microsoft Advanced Threat Analytics
works
ATA reports all suspicious
activities on a simple,
functional, actionable
attack timeline
ATA identifies
Who?
What?
When?
How?
For each suspicious
activity, ATA provides
recommendations for
the investigation
and remediation

67. protection
Protect against advanced threats and
recover quickly when attacked

68. protection
Ensure documents and emails are
seen only by authorized people

69. Azure Information Protection
(+ Office 365 Data Loss Prevention)

70. • Control and help secure email, documents, and sensitive data that you share
outside your company walls. From easy classification to embedded labels and
permissions, enhance data protection at all times with Azure Information
Protection - no matter where it’s stored or who it’s shared with.
Classify data based on sensitivity
and add labels - manually or
automatically.
Encrypt your sensitive data and
define usage rights when needed.
See what’s happening with your
shared data to gain more control
over it.

75. Cloud App Security

79. Microsoft Intune

84. la nuova frontiera della gestione dei dispositivi
Ore 16.00
Sala C

85. Ore 14.40
Sala A

86. protection
Ensure documents and emails are
seen only by authorized people

87. management
Gain visibility and control
over security tools

89. Stato dell’arte e roadmap
Ore 17.10
Sala A

92. management
Gain visibility and control
over security tools

93. subscriptions

95. Sì
P1 P2
EMS E3 EMS E5
Sì
Sì Sì
P1 P2
No Sì
No Sì

96. - Power BI Pro*
- Advanced eDiscovery*
- Office 365 ATP*
- Office 365 Cloud App Security*
- Phone System*
- Customer Lockbox*
- FastTrack*
* Servizi non presenti in Office 365 E3

97. M365 Business
Office 365 E3
Windows 10 Enterprise E3
per user
(Including VDA)
EMS E3
Office 365 Business Premium
Windows 10 Enterprise E5
per user
(Including VDA rights)
EMS E5
M365 E3 M365 E5
Office 365 E5
Windows Pro
EMS SMB1

98. subscriptions

99. L’approccio alla sicurezza deve cambiare
“If you spend more on coffee than on information security, you will be hacked. What’s more, you deserve to be hacked.”
Richard Clarke - White House Cybersecurity Advisor (RSA Conference 2002)
Investire in sicurezza
“A business will have good security if its corporate culture is correct. That depends on one thing: tone at the top. There will be no
grassroots effort to overwhelm corporate neglect.”
William “Bill” Malik - VP and Research Area Director for Information Security at Gartner (2000)
La cultura della sicurezza deve partire dai vertici aziendali e deve essere una priorità in tutte le procedure e processi
“I am convinced that there are only two types of companies: those that have been hacked and those that will be. And even they
are converging into one category: companies that have been hacked and will be hacked again.”
Robert S. Mueller, III - Director Federal Bureau of Investigation (RSA Cyber Security Conference 2012)
Monitorare l’infrastruttura
“Progetta le tue difese contemplando la possibilità che vengano eluse perché tu non sai come farlo, ma l'attaccante si.”
Ermanno Goletto e Roberto Massa – Microsoft MVPs (2017)
Nella pianificazione della protezione è necessario valutare di non aver previsto una o più vulnerabilità
“Phishing is a major problem because there really is no patch for human stupidity.”
Mike Danseglio, ex program manager di Microsoft Security Solutions Group (2006)
L’anello debole della sicurezza è spesso rappresentato dalle persone

100. Giampiero Cosainz
giampiero.cosainz@walk2talk.it
Grazie!

101. Let the past go and step off into the future