In “Step 9. Protect your OS” of the Top 10 actions to secure your environment blog series, we provide resources to help you configure Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) to defend your Windows, macOS, Linux, iOS, and Android devices from advanced threats.
In an advanced threat, hackers and cybercriminals infiltrate your network through compromised users or vulnerable endpoints and can stay undetected for weeks—or even months—while they attempt to exfiltrate data and move laterally to gain more privileges. Microsoft Defender ATP helps you detect these threats early and take action immediately.
Enabling Microsoft Defender ATP and related products will help you:
Threat & Vulnerability Management is a new component of Microsoft Defender ATP that provides:
To use Threat & Vulnerability Management, you’ll need to turn on the Microsoft Defender ATP preview features.
Attack surface reduction limits the number of attack vectors that a malicious actor can use to gain entry. You can configure attack surface reduction through the following:
Enable these capabilities to reduce your attack surface:
| Hardware-based isolation | Configure Microsoft Defender Application Guard to protect your company while your employees browse the internet. You define which websites, cloud resources, and internal networks are trusted. Everything not on your list is considered untrusted. |
| Application control | Restrict the applications that your users can run and require that applications earn trust in order to run. |
| Device control | Configure Windows 10 hardware and software to “lock down” Windows systems so they operate with properties of mobile devices. Use configurable code to restrict devices to only run authorized apps. |
| Exploit protection | Configure Microsoft Defender Exploit Guard to manage and reduce the attack surface of apps used by your employees. |
| Network protection | Use network protection to prevent employees from using an application to access dangerous domains that may host phishing scams, exploits, and other malicious content. |
| Controlled folder access | Prevent apps that Microsoft Defender Antivirus determines are malicious or suspicious from making changes to files in protected folder. |
| Network firewall | Block unauthorized network traffic from flowing into or out of the local device. |
| Attack surface reduction controls | Prevent actions and apps that are typically used by exploit-seeking malware to infect machines. |
The Intelligent Security Graph powers the antivirus capabilities of Microsoft Defender Antivirus, which works with Microsoft Defender ATP to protect desktops, laptops, and servers from the most advanced ransomware, fileless malware, and other types of attacks.
Configure Microsoft Defender Antivirus capabilities to:
| Enable cloud-delivered protection | Leverage artificial intelligence (AI) and machine learning algorithms to analyze the billions of signals on the Intelligent Security Graph and identify and block attacks within seconds. |
| Specify the cloud-delivered protection level | Define the amount of information to be shared with the cloud and how aggressively new files are blocked. |
| Configure and validate network connections for Microsoft Defender Antivirus | Configure firewall or network filtering rules to allow required URLs. |
| Configure the block at first sight feature | Block new malware within seconds. |
Microsoft Defender ATP endpoint detection and response capabilities detect advanced attacks in real-time and give you the power to respond immediately. Microsoft Defender ATP correlates alerts and aggregates them into an incident, so you can understand cross-entity attacks (Figure 1).
Alerts are grouped into an incident based on these criteria:
Figure 1. Microsoft Defender ATP correlates alerts and aggregate them into incidents.
Review your alerts and incidents on the security operations dashboard. You can customize and filter the incident queue to help you focus on what matters most to your organization (Figure 2). You can also customize the alert queue view and the machine alerts view to make it easier for you to manage.
Figure 2. Default incident queue displays incidents seen in the last 30 days, with the most recent incident showing at the top of the list.
Once you detect an attack that requires remediation, you can take the following actions:
Microsoft Defender ATP can be configured to automatically investigate and remediate alerts (Figure 3), which will reduce the number of alerts your Security Operations team will need to investigate manually.
Figure 3. You can view the details of an automated investigation to see information such as the investigation graph, alerts associated with the investigation, the machine that was investigated, and other information.
Create and manage machine groups in Microsoft Defender ATP to define automation levels:
| Automation level | Description |
| Not protected. | Machines will not get any automated investigations run on them. |
| Semi – require approval for any remediation. | This is the default automation level. An approval is needed for any remediation action. |
| Semi – require approval for non-temp folders remediation. | An approval is required on files or executables that are not in temporary folders. Files or executables in temporary folders, such as the user’s download folder or the user’s temp folder, will automatically be remediated if needed. |
| Semi – require approval for core folders remediation. | An approval is required on files or executables that are in the operating system directories such as Windows folder and program files folder. Files or executables in all other folders will automatically be remediated if needed. |
| Full – remediate threats automatically. | All remediation actions will be performed automatically. |
Microsoft Threat Experts is a new, managed threat hunting service that provides proactive hunting, prioritization, and additional context and insights that further empower security operations centers (SOCs) to identify and respond to threats quickly and accurately with two capabilities:
Microsoft Defender ATP customers can register for Microsoft Threat Experts and we will reach out to notify you via email when you’ve been selected.
Learn more
Check back in a few weeks for our final blog post in the series, “Step 10. Detect and investigate security threats,” which will give you tips to deploy Azure Advanced Threat Protection to detect suspicious activity in real-time.
Resources
The challenges that small and midsize businesses (SMBs) face when it comes to security continue to increase as it becomes more difficult to keep up with sophisticated cyberthreats with limited resources or security expertise. Research conducted highlights the top seven SMB cybersecurity trends and steps that can be taken to stay protected.
The main components of the Microsoft Intune Suite are now generally available. Read about how consolidated endpoint management adds value and functionality for security teams.
To confidently secure identity and access at your organization, here are five areas Microsoft recommends prioritizing in the new year.
Matt Suiche of Magnet Forensics talks about top security threats for organizations and strategies for effective incident response.
