Category: Microsoft news

Sometimes, technology can make things overly complex.

Even with the best of intentions, there can be too much of a good thing. In the world of cybersecurity, complexity has been a mainstay, but in recent years, it has grown beyond its breaking point and has become a liability for security practitioners.

The Forrester study, titled Security Through Simplicity (Dec. 2018)—commissioned by the Microsoft Security team—clearly shows that digital transformation, while necessary for business success, compounds the complexity of an already tangled security threat landscape. However, the study also found a correlation between vendor consolidation and strategy modernization to reduce security complexity.

Digital transformation introduces new levels of complexity

Digital transformation is a critical shift under which businesses are using data-powered platforms and applications to improve nearly every aspect of their business operations. New open ecosystems and the democratization of data means more users in varied locations sharing data across more applications, devices, platforms, and environments—both internally and externally.

As businesses continue to digitize processes, security teams must contend with an increase in attack vectors and more complicated management, all while keeping pace with increasingly sophisticated attackers. In the face of this massive challenge, security teams must evaluate and refresh their legacy security procedures, tools, and skill sets to accommodate a new and adaptable approach to enterprise security.

In the study, paid for by Microsoft, Forrester asked 481 IT security decision makers, “How challenging are the following security goals/objectives to achieve?” and found them all to be highly or extremely challenging:

Reducing security complexity

So how are enterprise IT security teams successfully reducing complexity to improve their security efforts in the face of digital transformation? The study found an interesting correlation between vendor consolidation and strategy modernization in successfully achieving both business and security initiatives, when executed in concert with each other.

A high number of disparate security solutions in place for on-premises and cloud infrastructure and applications makes visibility and central management extremely difficult. Reducing the number of disparate security point solutions that must interact with each other—particularly older, legacy ones—brings complexity down to a manageable level and allows businesses the visibility, security, and control to expand their digital adoption with confidence. Vendor consolidation and modernization can also yield cost savings by lowering technology budgets, increasing management efficiencies, and avoiding the costs of a data breach or regulatory noncompliance.

A small subset (11 percent) of enterprises that have successfully achieved both critical initiatives, modernization, and vendor consolidation, have been able to reduce complexity and reap the rewards of digital transformation. These organization are:

• 54 percent more likely to feel that their IT security strategy helps them to digitally transform their organization.
• 42 percent more likely to feel that their IT security strategy helps reduce risk of a customer data breach.
• 33 percent more likely to feel that their IT security strategy improves their customers’ experiences.

Key recommendations

Companies undergoing digital transformation seek new ways to engage with customers, create additional revenue streams, and place innovation at the forefront of their corporate strategy. Failing to secure their digital assets can lead to those same organizations forfeiting hard-won successes.

Forrester’s in-depth survey of 481 IT security decision makers yielded several important recommendations:

• Implement security by design.
• Consolidate security vendors and security solutions.
• Increase measurement, analytics, and reporting capabilities.
• Discover and manage shadow IT.
• Adapt security to users.

Get your copy of the full study.

I’m on my way to the RSA Conference in San Francisco, California, and am looking forward to connecting with our customers and partners there. We have a lot to talk about. Last week, Ann Johnson announced two new services that we now offer to help empower our customers as they deal with the industry-wide cybersecurity talent crunch: Microsoft Azure Sentinel and Microsoft Threat Experts. Today, I’m excited to share more news about our work in security.

Leading integration across the industry

In the face of the cybersecurity talent shortage, our customers are increasingly reliant on their tools working together. We are part of a broad, heterogeneous ecosystem of technology providers, and we take seriously our responsibility to lead integration across them.

We’ve made progress to report on three fronts:

• There are now 50 partners participating in the Microsoft Intelligent Security Association, a group of technology providers who have integrated their solutions with Microsoft products to provide customers better protection, detection, and response. New members include: Sophos, Citrix, Adobe, and Symantec.
• The Microsoft Graph Security API now has new capabilities that allow you to share threat indicators to extend detection, easily invoke powerful investigation and remediation activities, and build better connected security apps and workflows without the need to code.
• Azure Active Directory (Azure AD), which already provides authentication for more than 810,000 applications for our enterprise customers, now integrates with several Zscaler applications. With both Azure AD and Zscaler supporting the SCIM 2.0 standard, our joint customers can now use the Azure AD provisioning service to automate the lifecycle of user and group accounts, giving you a more secure and scalable way to allow user access to Zscaler applications.

Added security controls for Azure and Microsoft 365

In our own security products, we continue to invest heavily in capabilities that take advantage of the cloud and artificial intelligence (AI) to empower your team and let them focus on the most important tasks to protect against threats and keep information secure. We made several key strides in security to strengthen protection for our customers:

• Threat intelligence-based filtering is now available for Azure Firewall. This addition enables customers to alert or deny traffic from/to malicious IP addresses and domains based on the near real-time data feed powered by the Microsoft Intelligent Security Graph.
• Azure Security Center now leverages machine learning to reduce the attack surface of internet-facing virtual machines, and its application whitelisting controls have been extended to Linux and on-premises servers. The network map in Azure Security Center extends support for Virtual Network peering, a commonly used networking configuration in which traffic flows between Azure Virtual Networks through the Microsoft backbone.
• Microsoft Threat Protection now provides automated investigation and remediation in the Microsoft Security Center, a unified console that helps SecOps teams spend their limited time on the most high-value tasks, like proactive hunting and strategic improvements.
• We are extending our unique, native integration between Microsoft Cloud App Security and Azure AD conditional access. Out-of-the box templates now enable organizations to configure some of our most popular policies, such as blocking the download of sensitive content in real-time, within seconds.
• New native capabilities in the Microsoft Office 365 version of Office client applications help document and email authors apply the right classification and sensitivity labels, helping you ensure information is protected in accordance with your organization’s policies.

Securing the Internet of Things (IoT)

IoT deployments can help organizations cut costs with predictive maintenance or to create new revenue streams from connected products. Unfortunately, the security pro talent shortage makes it difficult to successfully plan the IoT security controls necessary. We worked with the Industrial Internet Consortium to produce a new IoT Security Maturity Model that provides clear industry best practices for evaluating your IoT risk profile and planning the remediation you need. We’ve also added a new deployment method to Azure Sphere to help you reduce risk across your entire fleet of IoT devices. The new guardian modules built on Azure Sphere bring the security of Azure Sphere to brownfield IoT devices, allowing your business groups to complete IoT deployments without increasing risk for your organization.

Connect with us at RSA

I’m proud to be part of the team driving all this innovation, but technology is not a silver bullet. Its role is simply to empower you—the defenders. On Wednesday, March 6, at 10:30 AM PST, Ann Johnson will speak in her keynote about other ways we, as an industry, can empower people. I encourage you to attend, if you’re at the conference. You can learn more about Microsoft security at booth 6059. We’d love to connect with you there, or in one of the sessions we’ll be leading—find out more about our activities at microsoft.com/rsa.

This is an exciting week for us at Microsoft. At RSA Conference 2019, we are announcing new and exciting capabilities in Azure and Microsoft 365. With this blog post, we wanted to share with you what we have been working on for Azure Security Center. Azure Security Center now leverages machine learning to reduce the attack surface of internet facing virtual machines. Its adaptive application controls have been extended to Linux and on-premises servers, and extends the network map support to peered virtual network (VNet) configurations.

Leveraging machine learning to reduce attack surface

One of the biggest attack surfaces for workloads running in the public cloud are connections to and from the public Internet. Our customers find it hard to know which Network Security Group (NSG) rules should be in place to make sure that Azure workloads are only available to required source ranges. Security Center can now learn the network traffic and connectivity patterns of your Azure workload and provide you with NSG rule recommendations for your internet facing virtual machines. This helps you better configure your network access policies and limit your exposure to attacks.

Azure Security Center uses machine learning to fully automate this process, including an automated enforcement mechanism, enabling its customers to better protect their internet facing virtual machines with only a few clicks. These recommendations also use Microsoft’s extensive threat intelligence reports to make sure that known bad actors are blocked.

Extending adaptive application controls

Adaptive application control is an intelligent, automated end-to-end application whitelisting solution from Azure Security Center. It helps you control which applications can run on your VMs located in Azure, which, among other benefits, helps harden your VMs against malware. Security Center uses machine learning to analyze the applications running on your VMs and helps you apply the specific whitelisting rules using this intelligence.

We are extending adaptive application controls in Azure Security Center to include Linux VMs and servers/VMs external to Azure (Windows and Linux) in audit mode. This means that Azure Security Center will identify applications running on your servers which are not in compliance with the Azure Security Center generated whitelisting rules and will audit those violations. This will enable you to  detect threats that might otherwise be missed by antimalware solutions; to comply with your organization’s security policy that dictates the use of only licensed software and to audit unwanted software that is being used in your environment.

Network map support for VNet peering

Azure Security Center’s network map has added support for virtual network peering, a configuration in which traffic flows between Azure Virtual Networks through the Microsoft backbone, as if they were virtual machines in the same virtual network, through private IP addresses only. The support includes displaying allowed traffic flows between peered VNets and peering related information on Security Center’s network map.

With these additions, Azure Security Center strengthens its role as the unified security management and advanced threat protection solution for your hybrid cloud workloads. We encourage you to take advantage of these new capabilities for all your Internet-exposed Azure resources. If you have not started using Azure Security Center in your Azure subscription, get started today.