Automated Response with Windows Defender ATP 9/12/2018 6:09 AM BRK3062 Automated Response with Windows Defender ATP Heike Ritter Sr. Product Manager @HeikeRitter Nathan Burke VP Marketing, Hexadite @nathanwburke © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Outline What is Windows Defender ATP? Detecting Attacks 9/12/2018 6:09 AM Outline What is Windows Defender ATP? What is EDR/EPP? Detecting Attacks A Blessing and a Curse The Cybersecurity Capacity Problem Increase in Attack Volume Increase in Alerts Shortage of Skilled Security Staff What is Security Automation? How Companies Address the Challenges Case Study: Nuance Communications What’s Coming to WDATP? © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

What is Windows Defender ATP ? 9/12/2018 What is Windows Defender ATP ? Unified endpoint security solution with Windows 10 threat & endpoint protection and response under one roof Security Analytics Enhanced detection – Application Guard, Exploit Guard, script introspection Windows Security Graph APIs Windows Server support Enhanced detection - memory, injection, kernel, visibility to Windows Defender AV detections Response actions Custom Threat Intelligence Detection and exploration integration with Office 365 ATP Behavior-based, cloud-powered EDR solution Built into Windows 10, agentless and no deployment Rich timeline for investigation & interactive hunting Unparalleled threat optics and deep OS security and big data expertise Anniversary Update Creators Update Fall Creators Update © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9/12/2018 6:09 AM What Do Customers Get? Security teams now have a single console to centrally manage the end-to-end security lifecycle for their devices. As a key component of the Microsoft 365 security stack, Windows Defender ATP brings together detection and investigations across devices, identities, and information. Customers now have more visibility into threats than ever before. © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9/12/2018 6:09 AM 970,000,000 Windows Defender ATP processes 970 million malicious security events per day per day from across the Microsoft enterprise and consumer eco-system. © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Cybersecurity has a capacity problem. 9/12/2018 6:09 AM Cybersecurity has a capacity problem. By Nevit Dilmen (Own work) via Wikimedia Commons © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9/12/2018 6:09 AM Prioritization is just a conscious decision about what you’re willing to ignore. © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9/12/2018 6:09 AM By Nathan Burke (own work) © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

What is Security Automation? 9/12/2018 6:09 AM What is Security Automation? Mimicking the ideal steps a human would take to investigate a cyber threat. Determining whether the threat requires action. Performing necessary remediation actions. Deciding what additional investigations should be next. © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

“Security automation is preventing people from doing a machine’s job.” Golan Ben-Oni Global CIO IDT Corp.

Automated Response Demo 9/12/2018 6:09 AM Automated Response Demo New Functionality Coming to Windows Defender ATP © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9/12/2018 6:09 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session Tech Ready 15 9/12/2018 Please evaluate this session From your Please expand notes window at bottom of slide and read. Then Delete this text box. PC or tablet: visit MyIgnite https://myignite.microsoft.com/evaluations Phone: download and use the Microsoft Ignite mobile app https://aka.ms/ignite.mobileapp Your input is important! © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

9/12/2018 6:09 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.