Exchange Online Advanced Threat Protection

Evolving threat space Any new outbreak consists of two parts Original Virus or URL Mass Virus or URL infections Mass Virus or URL infections Virus and URL Outbreak New variant Any new outbreak consists of two parts Zero hour attack Elongated period of attack Traditional AV/AS cannot protect against zero day attack comprehensibly Attackers can go completely unnoticed during zero day attack

Evolving threat space Short-span attacks can be just minutes to hours Serial variant attacks Short-span attacks can be just minutes to hours Serial variant attacks generally repeat pattern every few hours T=0 T=5 T=10 T=15 T=100 Phisher creates malicious domain First phishing message sent Phishing message lands in user inbox Domain classified as malware on URL block lists User clicks on link in message Attacker can easily change the links in the message after mail is delivered

Exchange Online advanced threat protection Protection against unknown malware/virus Behavioral analysis with machine learning Admin alerts Time of click protection Real time protection against Malicious URLs Growing URL coverage Rich reporting and tracing Built-in URL trace Reports for advanced threats 4 pillars

Suspicious attachment Service architecture Safe Multiple filters + 3 antivirus engines with Exchange Online protection Malicious links Recipient Safe links rewrite Unsafe Suspicious attachment Detonation chamber (sandbox) Executable? Registry call? Elevation? ……? Sender

Safe attachments Protect against zero day exploits in email attachments by blocking messages Provides admins visibility into compromised users Leverages sandboxing technology IP + envelop filter Signature- based AV Blocking known exploits EOP user without ATP with ATP Antispam filter

Safe attachment—experience Admin sets policy Admin gets notification if message is blocked

Rewriting URLs to redirect to a web server Safe links IP + envelop filter Signature- based AV Blocking known exploits EOP user without ATP Antispam filter Rewriting URLs to redirect to a web server with ATP User clicking URL is taken to EOP web servers for the latest check at the “time of click” Web servers perform latest URL reputation check Protect against sites with malicious content, phishing sites Provides admins visibility into compromised users Rewriting the URLs to proxy them through another server

Safe links—experience Users notified if a malicious link is clicked in email Admin sets policy

Rich reporting and click trace Admins have complete visibility into who clicked on what links Reporting by file types and disposition

Purchasing Exchange Online ATP Customer Channel at launch ERP at launch All commercial customers Direct, CSP, Open, MPSA, and EA channels $2 per user per month Multi-tenant government customers Direct, Open, MPSA, and EA channels at an ERP of $1.75 per user per month at launch $1.75 per user per month Office 365 Government Community Cloud (GCC), and Office 365 Nonprofit customers Not available Office 365 Education Customers Direct, Open, and EES $1.40/ Faculty/month $.70/Student/Month