The goal of this series will be to introduce, in practical words, the features and capabilities of the security tools included in the Microsoft 365 E5 license and provide examples how it can optimize your cyber security program - both in effort and spending terms. Microsoft E5 contains Microsoft Defender 365, which is part of the overall Microsoft Defender XDR, also including Microsoft Defender for Cloud.
Format each of your headings below to Heading 2 to keep your post neat and SEO-friendly.
In the coming posts I will look at what protection each part of Microsoft Defender 365 provides, how is that covered by the Microsoft E5 license and provide some comparison of effort and cost with other products.
The backstory
I decided to start this blog post series after several conversations with partners and customers about the cybersecurity practices they have, tools they use and problems they face.
I found a common lining - they all had Enterprise Agreements with Microsoft and E5 licenses, but they never got to implement most if any of the security features that come with this license. They still relied on other vendors - sometimes best-in-class point solutions, sometimes legacy ones, to tick the compliance boxes of security. And strangely enough, they were looking to tick the unticked boxes, by obtaining yet another point solution, while they already had the tools in their hands - they just didn't know about it. As you can imagine this results in greater budgets for cybersecurity, it makes the skills problem bigger - as for every point solution, the skill gap of the internal security team is increased, and ultimately results in worse off security than the initial state (except for that compliance checkbox).
Microsoft Defender 365 Overview
Microsoft Defender 365 is an XDR (Extended Detection and Response) security platform which provides means to protect Endpoints, Identities, Cloud Apps and Data.
Each element of the platform delivers prevention and detection capabilities to stop threats before they damage the organization.
The elements speak to each other to provide coordinated protection, automatic healing, unified threat intelligence and cross-domain threat hunting all in one unified portal.
The immediate benefit to organization is the reduction of effort in setup and operations, the narrow skill-gap. Each platform element is built to have the same feel for the security engineers. Automation and integration is continuously improved by Microsoft security. The platform provides an open query language for custom prevention and detection rules.
Microsoft Defender for Office 365
The first product I am going to take a look at is Microsoft Defender for Office 365.
This is the product that protects Office 365 apps and data - email, Teams, Share Point online, One Drive.
Many organizations are today using Office 365 for their email platform, but they still use 3rd party email security gateways in-front of the Office 365 cloud. Some example services are Mimecast, Cisco Cloud Email Security, Symantec Email Security Cloud, etc.
While these platforms provide great security and functionality, this usually comes at a cost: expensive setup costs, non-trivial and expensive licensing models - consisting of multiple addons for functionalities such as message encryption, DLP or SIEM integration, and hard and expensive upskilling to avoid the "set-and-forget" situation of the tool.
Don't get me wrong, setting this up correctly still requires an experienced engineer with skills both in email security and the Microsoft Defender 365 platform, but it is an order of magnitude faster to set up when you're already using Office 365.
The platform capabilities can be summed as:
Edge protection
Protecting your email system at the edge of the Microsoft Office 365 infrastructure, leveraging all security intelligence available to the cloud to protect against:
Known bad email server
Known bad domains
Volume attacks
Unknown threats - based on anomalous behavior of sending servers and domains
Sender Intelligence
Protecting your email system against basic and advanced spoofing attacks by:
Detecting account compromise of sender
Verifying sending server identity - DKIM,DMARC,SPF, ARC
Using spoof intelligence to detect who is spoofing you and should that be allowed
Detecting bulk emails and qualifying them as SPAM or marketing
Detecting user and domain impersonation
Content filtering
Protecting against malicious or suspicious email content by:
Utilizing multiple AV engines to detect known bad files
Blocking files by type
Sandboxing unknown files to qualify them as malicious or benign
Detonating URL links to determine if they are malicious
Using multiple ML models to detect advanced multi-staged attacks
Using predefined and custom Information classifiers to detect and prevent infiltration of sensitive data (DLP)
Post delivery protection
Protecting you against unknown threats after message delivery by:
Retroactively searching and purging emails and attachments that have been qualified as malicious post delivery
URL rewriting in emails and attachments to prevent visiting malicious sites - such that are weaponized post delivery, while being benign at delivery time
As part of the unified portal, there is an Alert and Incident dashboard, Reporting module with multiple customizable canned reports, an easy to use Explorer - where each email can be tracked, analyzed and qualified by security admins, a query center - where threat hunting can be done and a Threat Analytics dashboard that provides threat intelligence of recent and ongoing threat campaigns and the impact of the organization
There are other very cool features part of the platform:
The Report Message Add-in by Microsoft
The Attack Simulation Training Module
Secure Posture Analyzer
The Report Message Add-in is an Outlook Add-in that works for all Outlook clients (web, desktop app, mobile app) and provides the functionality of end users to directly report messages as SPAM, Phishing or Not-Spam. This report encapsulates all the details of the message and can be submitted both to internal security teams and Microsoft security for analysis and improvement of the security system. No more email forwarding, back-and-forth communication trying to get users to send the original email as attachment, and spending time logging tickets.
The Attack Simulation Training allows for creating of one off and scheduled email phishing campaigns with tons of canned templates. The biggest benefit as compared to other platforms is the integration with the user security signals already present in the platform, which gives you an idea of repeated offenders and the actual impact of an offending user.
If your organization is into such kind of trainings (its controversial really) this is an amazing addition.
The Secure Posture analyzer helps maintain your policy configuration up to date with evolving protections and newly introduced features. It also provides visibility of user settings that override best practices and provides suggestions for remediating it.
Note: I will look at the advanced DLP and Email Encryption features as part of the Microsoft Information Protection features included in the E5 license.
Cost and efficiency improvement
What is the actual cost saving if you already have Microsoft E5 license, but are using an external email security platform? It really depends on the features, but list price for many vendors range like this:
Standard email protection package (Antivirus, Anti Spam): 2$-3$ per user per month
Advanced features addons(Sandboxing, URL detonation, Retroactive detections): 3$-5$ per user per month
Phishing Awareness Training: This ranges between 1$ and 5$ per user per month, as vendors are usually bundling these with features normally present in the email security gateway.
A calculation (taking average prices excluding advanced DLP and Email Encryption) shows that a medium sized organization of 500 users could save ~45000$ a year by making use of the security features included in their E5 license . And if you don't have any Microsoft Security license, it will still cost you less - ~30000 to get the Microsoft Defender for Office P2 plan.
In terms of effort efficiencies, it really depends on your current process and other toolset, but if utilizing all security features of Microsoft Defender 365, there is a significant security operations effort reduction for ingesting, analyzing data and responding to security incidents.
What's next?
In the next post, I will cover the Microsoft Defender for Endpoint next generation Antimalware and EDR solution part of the E5 license.
Stay tuned!
if you need help with making use of your E5 license, or you want to generally adopt a strategy of platform security, rather than point security solutions, you can always reach us at info@sunwellsolutions.com
Commentaires