1. Exchange Online Advanced Threat Protection

2. Evolving threat space Any new outbreak consists of two parts
Original Virus or URL
Mass Virus or URL infections
Mass Virus or URL infections
Virus and URL Outbreak
New variant
Any new outbreak consists of two parts
Zero hour attack
Elongated period of attack
Traditional AV/AS cannot protect against zero day attack comprehensibly
Attackers can go completely unnoticed during zero day attack

3. Evolving threat space Short-span attacks can be just minutes to hours
Serial variant attacks
Short-span attacks can be just minutes to hours
Serial variant attacks generally repeat pattern every few hours
T=0
T=5
T=10
T=15
T=100
Phisher creates malicious domain
First phishing message sent
Phishing message lands in user inbox
Domain classified as malware on URL block lists
User clicks on link in message
Attacker can easily change the links in the message after mail is delivered

4. Exchange Online advanced threat protection
Protection against unknown malware/virus
Behavioral analysis with machine learning
Admin alerts
Time of click protection
Real time protection against Malicious URLs
Growing URL coverage
Rich reporting and tracing
Built-in URL trace
Reports for advanced threats
4 pillars

5. Suspicious attachment
Service architecture
Safe
Multiple filters + 3 antivirus engines with Exchange Online protection
Malicious links
Recipient
Safe links rewrite
Unsafe
Suspicious attachment
Detonation chamber (sandbox)
Executable?
Registry call?
Elevation?
……?
Sender

6. Safe attachments
Protect against zero day exploits in attachments by blocking messages
Provides admins visibility into compromised users
Leverages sandboxing technology
IP + envelop filter
Signature- based AV
Blocking known exploits
EOP user
without ATP
with ATP
Antispam filter

7. Safe attachment—experience
Admin sets policy
Admin gets notification if message is blocked

8. Rewriting URLs to redirect to a web server
Safe links
IP + envelop filter
Signature- based AV
Blocking known exploits
EOP user
without ATP
Antispam filter
Rewriting URLs to redirect to a web server
with ATP
User clicking URL is taken to EOP web servers for the latest check at the “time of click”
Web servers
perform latest URL reputation check
Protect against sites with malicious content, phishing sites
Provides admins visibility into compromised users
Rewriting the URLs to proxy them through another server

9. Safe links—experience
Users notified if a malicious link is clicked in
Admin sets policy

10. Rich reporting and click trace
Admins have complete visibility into who clicked on what links
Reporting by file types and disposition

11. Purchasing Exchange Online ATP
Customer
Channel at launch
ERP at launch
All commercial customers
Direct, CSP, Open, MPSA, and EA channels
$2 per user per month
Multi-tenant government customers
Direct, Open, MPSA, and EA channels at an ERP of $1.75 per user per month at launch
$1.75 per user per month
Office 365 Government Community Cloud (GCC), and Office 365 Nonprofit customers
Not available
Office 365 Education Customers
Direct, Open, and EES
$1.40/ Faculty/month
$.70/Student/Month