Continued commoditization of cybercrime, with marketplaces selling compromised devices and credentials for less than $1. The findings and statistics of the 2021 release make grim reading for defenders: Ransomware actors with budgets over $1 million for zero-day research or purchase. Microsoft publishes its Digital Defense Report annually. In this section, we will explain the trends defenders face against attackers and dive into the facts and figures behind them. This obscures the true nature of what has happened and why. In their announcements and disclosures confirming such breaches, necessitated either by legal obligations or media pressure, victims invariably refer to the attack as a cyber incident. We’ll conclude the chapter with what this translates to in terms of winning back your trust in the Defender brand and, no pun intended, the Zero Trust strategy that Microsoft advocates.īarely a week goes by that we don’t see media coverage of a security breach at a household name, business, or institution. The Defender of Windows XP and Vista is not the Defender of this era. Microsoft invests billions of dollars per year into security services, research, and development. Just as threats have changed, so has the biggest dog in the yard (and, incidentally, the company that created the yard where many of those security problems occur). It is impossible to avoid the elephant in the room: Microsoft security software. What you learn in this chapter will paint the background of modern threats facing organizations’ IT, including the cyber-attack kill chain that Microsoft 365 Defender can be used to protect against and respond to. The cyber kill chain and MITRE Adversarial Tactics, Techniques, and Common Knowledge ( ATT&CK ).In this chapter, we’re going to cover the following topics: Now we live in an era where the workforce has left the confines of the office or VPN where data has jumped from your data center to someone else’s and where hybrid identities unleash access to organizations’ apps anywhere, on any device, including that one constant across eras: email. Nowadays, attackers’ budgets, capabilities, and demands outstrip those of a time when a conventional anti-virus and gateway firewall was all you had to consider. The threats are considerably different from those experienced as long ago as the beginning of Windows’ mass adoption by the workplace, or even 5 or 10 years ago, far into IT maturity in many organizations. The threats that organizations face continue to change across all industries and scales. It’s useful to understand the state of cybersecurity as a backdrop when beginning or continuing any journey with Microsoft 365 Defender, which this book will help you master as a defender. Toward the end, you’ll find out how M365D can be integrated with Sentinel and how to use APIs for incident response.īy the end of this book, you will have a deep understanding of Microsoft 365 Defender, and how to protect and respond to security threats. You’ll also learn how to deploy Microsoft Defender for Identity and explore its different deployment methods that can protect your hybrid identity platform, as well as how to configure Microsoft Defender for Office 365 and Cloud Apps, and manage KQL queries for advanced hunting with ease. You’ll start with a quick overview of cybersecurity risks that modern organizations face, such as ransomware and APT attacks, how Microsoft is making massive investments in security today, and gain an understanding of how to deploy Microsoft Defender for Endpoint by diving deep into configurations and their architecture.Īs you progress, you’ll learn how to configure Microsoft Defender Antivirus, and onboard and manage macOS, Android, and Linux MDE devices for effective solutions. This book will help you get up and running with Microsoft 365 Defender and help you use the whole suite effectively.

Panda antivirus review 2015