Microsoft Ignite 2016 1/18/2019 7:21 AM © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Anatomy of an attack: Defending yourself in the Office 365 Cloud 1/18/2019 7:21 AM Anatomy of an attack: Defending yourself in the Office 365 Cloud Brandon Koeller Principal Program Manager Lead © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Agenda Takeaways Attack stages Recon Initial breach 1/18/2019 7:21 AM Agenda Takeaways Attack stages Recon Initial breach Elevation of privilege Entrenchment Exfiltration Wrap-up © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Takeaways How will an attacker try to get my data? 1/18/2019 7:21 AM Takeaways How will an attacker try to get my data? What can I do to protect myself in the O365 Cloud? © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Elevation of Privilege 1/18/2019 7:21 AM Attack stages Recon Initial Breach Elevation of Privilege Entrenchment Exfiltration © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Attack: Recon Who is my target? Is the target company in O365? 1/18/2019 7:21 AM Attack: Recon Who is my target? Is the target company in O365? What data am I looking to acquire? Which user account do I need to acquire? Demo: Maltego Teeth Demo: Google Dorking © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

1/18/2019 7:21 AM Defend: Recon How do you prevent someone from discovering information about you and your company? You can’t. Think like an attacker and recon yourself! https://tools.kali.org/information-gathering/maltego-teeth, https://paterva.com/web7/buy/maltego-clients.php Google Dorking. https://www.exploit-db.com/google-hacking-database/ © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Attack: Initial breach 1/18/2019 7:21 AM Attack: Initial breach Password spray Brute force Social engineering, phishing Password re-use Demo: Mailsniper password spray with guessed usernames © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Defend: Initial breach 1/18/2019 7:21 AM Defend: Initial breach Best defense is a good offense. Attack yourself. MFA Disabling Basic Auth Failed Logon Policies Phishing protections Demo: Threat Finder © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Attack: Elevation of privilege 1/18/2019 7:21 AM Attack: Elevation of privilege Enumerate directory Find admins Password spray until you win Demo: Directory enum, admin role enum, mailsniper password spray admins © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Defend: Elevation of privilege 1/18/2019 7:21 AM Defend: Elevation of privilege MFA Least privilege Just in time access Alt accounts Demo: Monitoring admin activity © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Attack: Entrenchment Creating alt accounts Impersonation 1/18/2019 7:21 AM Attack: Entrenchment Creating alt accounts Impersonation Delegate permissions Demo: Injecting mail forwarding rules, delegates, impersonation, forms © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Defend: Entrenchment Monitoring is the key. 1/18/2019 7:21 AM Defend: Entrenchment Monitoring is the key. Prevent mail forwarding rules via secure score. Demo: Mail forwarding rules prevention via secure score Demo: Get-AllTenantRulesAndForms.ps1 © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Attack: Exfiltration Accounts are access 1/18/2019 7:21 AM Attack: Exfiltration Accounts are access Exfiltration mostly by smash and grab (after lengthy recon) Demo: Impersonation, global mail search via Mailsniper © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

1/18/2019 7:21 AM Defend: Exfiltration Protect your highest sensitivity data with data classification, DLP, IRM, etc. Monitor for things like cross-mailbox search queries. Monitor for gateway mechanisms like impersonation. Demo: Cloud App Security © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Wrap-up Data and visibility is key. 1/18/2019 7:21 AM Wrap-up Data and visibility is key. Enable your audit data feed. Risks spread across hybrid and multi-cloud. Threat scenarios are generic, protections are specific. Cloud services still leave you with core security accountabilities. Plan, implement, test. © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

1/18/2019 7:21 AM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.