Beginning Security with Microsoft Technologies: Protecting Office 365, Devices, and Data

Description

Secure and manage your Azure cloud infrastructure, Office 365, and SaaS-based applications and devices. This book focuses on security in the Azure cloud, covering aspects such as identity protection in Azure AD, network security, storage security, unified security management through Azure Security Center, and many more. Beginning Security with Microsoft Technologies begins with an introduction to some common security challenges and then discusses options for addressing them. You will learn about Office Advanced Threat Protection (ATP), the importance of device-level security, and about various products such as Device Guard, Intune, Windows Defender, and Credential Guard. As part of this discussion you’ll cover how secure boot can help an enterprise with pre-breach scenarios. Next, you will learn how to set up Office 365 to address phishing and spam, and you will gain an understanding of how to protect your company's Windows devices. Further, you will also work on enterprise-level protection, including how advanced threat analytics aids in protection at the enterprise level. Finally, you’ll see that there are a variety of ways in which you can protect your information. After reading this book you will be able to understand the security components involved in your infrastructure and apply methods to implement security solutions. What You Will Learn Keep corporate data and user identities safe and secure Identify various levels and stages of attacks Safeguard information using Azure Information Protection, MCAS, and Windows Information Protection, regardless of your location Use advanced threat analytics, Azure Security Center, and Azure ATP Who This Book Is For Administrators who want to build secure infrastructure at multiple levels such as email security, device security, cloud infrastructure security, and more. Table of Contents About the Author About the Technical Reviewer Acknowledgments Introduction Chapter 1: Current State of Security Intelligent Security Graph Email Protection Device Protection Identity Protection Data Protection Chapter 2: Securing Emails and Office 365 Exchange Online Protection EOP Setup Antispam Protection Antimalware Protection Thwarting Spam Connection Filter Spam Filter Outbound Filter Quarantine and Action Center/Restricted Users “Security & Compliance” Window for ATP Policies Office 365 ATP Features and Capabilities Safe Links Safe Attachments Spoof Intelligence Office ATP Quarantine Chapter 3: Device-Level Security Prebreach Advanced Security Mode: Device Guard Windows Defender Application Control Traditional Scenario Creating a WDAC Policy from a Reference Computer Group Policies Intune Settings SCCM Current Branch Cloud Scenario Hardware Requirements for WDAC and WDEG Windows Defender Exploit Guard Exploit Protection Control Flow Guard Data Execution Prevention Forced Randomization for images (Mandatory ASLR) ASLR Mandatory ASLR Randomize Memory Allocations (Bottom-Up ASLR) High-Entropy ASLR Validate Exception Chains (Structured Exception Handler Overwrite Protection) Validating Heap Integrity Program Settings Attack Surface Reduction Rules Executable Content from Email Clients and Web Mail Office and Scripting Threats Advanced Protection Against Ransomware Credential Stealing from the Windows Local Security Authority Subsystem (lsass.exe) Other Processes Network Protection Controlled Folder Access Windows Defender Application Guard Windows Defender System Guard System Integrity Check While the Device Is Starting Maintaining System Integrity While Windows Is Running (Runtime) Validation of Platform Integrity (Runtime): Device Health Attestation Windows Defender Antivirus Managing WDAV Updates and Applying Security Baselines Applying Windows Security Baselines Postbreach Windows Defender ATP Incident Queue Alerts Queue Automated Investigation and Remediation Secure Score Threat Analytics Advanced Hunting Overview of Management and APIs Windows Defender ATP API Microsoft Threat Protection Chapter 4: Identity Protection Windows Defender Credential Guard Enabling Windows Defender Credential Guard Group Policy Intune Windows Defender Device Guard and Credential Guard Advanced Threat Analytics Architecture Setup ATA Timeline Azure Advanced Threat Protection Architecture Setup Azure ATP Timeline Azure Active Directory Identity Protection Risky User Accounts and Vulnerabilities Privileged Identity Management Assigning Roles Activating Roles Approving Requests Auditing Access Reviews Chapter 5: Data Protection Azure Information Protection AIP Policies Checking the Protection Document Tracking for Document Authors Applying Settings in the SharePoint Document Library and Exchange Online Applying IRM Settings in SharePoint Applying IRM Setting in Exchange Online Labels and Data Loss Prevention in Office 365 Windows Information Protection Deploying Through Intune Intune Policies for Device and Data Protection Protecting Data at the Front Gate Using Intune/Azure AD Conditional Access Microsoft Cloud App Security Framework Architecture Dashboard Risk Score App Connector Flow Blocking Download Policy for Unmanaged Devices Compliance Manager Microsoft Secure Score Final Thoughts Index