Archive

Archive for the ‘Mobile security’ Category

Microsoft continues to extend security for all with mobile protection for Android

June 23rd, 2020 No comments

Just a year ago, we shared our first steps on a journey to enable our customers to protect endpoints running a variety of platforms with our announcement of Microsoft Defender ATP for Mac. Knowing that each of our customers have unique environments and unique needs and are looking for more unification in their security solutions, we communicated our commitment to build security solutions from Microsoft, not just for Microsoft. Since then, we’ve announced capabilities for Linux servers, and at RSA, and we offered you a sneak peek into our mobile threat defense investments.

Today, I’m proud to announce the public preview of Microsoft Defender ATP for Android.

Protecting mobile devices from evolving threats, phishing attacks, unwanted apps

As more business is getting done on mobile devices, the lines blur between work and personal life. The threats here are unique. For example, one of the biggest and fastest growing threats on mobile is phishing attacks, majority of which happen outside of email, such as via phishing sites, messaging apps, games, and other applications, and are tricky to spot on smaller form factors. Other common mobile threats include malicious applications that users are lured into downloading, as well as increased risk introduced by rooted devices that may allow unnecessary escalated privileges and the installation of unauthorized applications.

In this rapidly evolving world of mobile threats, Microsoft is taking a holistic approach to tackling these challenges and to securing enterprises and their data with our new mobile threat defense capabilities. We’re leveraging our unique visibility into the threat landscape and the vast signal, intelligence, and security expertise we have from across domains, such as our expertise in phishing and email, our endpoint threat research on malware and attacker techniques, and our focus on identity and zero trust to bring protection capabilities to mobile. Our integrated approach to security enables us to provide more complete coverage. Leveraging these capabilities, Microsoft Defender ATP for Android will help to protect our customers and their users by delivering:

  • Protection from phishing and access to risky domains and URLs through web protection capabilities that will block unsafe sites accessed through SMS/text, WhatsApp, email, browsers, and other apps. We’re using the same Microsoft Defender SmartScreen services that are on Windows to quickly detect malicious sites which means that a decision to block a suspicious site will apply across all devices in the enterprise.
  • Proactive scanning of malicious applications, files, and potentially unwanted applications (PUA) that users may download to their mobile devices. Our capabilities and investments in cloud-powered protection and intelligence on application reputation allow us to quickly detect sophisticated malware and apps that that may display undesirable behavior.
  • Adding layers of protection to help prevent and limit the impact of breaches in an organization. By leveraging tight integration with Microsoft Endpoint Manager and Conditional Access, mobile devices that have been compromised with malicious apps or malware are considered high risk and are blocked from accessing corporate resources.
  • A unified security experience through Microsoft Defender Security Center where defenders can see alerts and easily get the additional context they need to quickly assess and respond to threats across Windows, Mac, Linux, and now mobile devices.

There’s more to share on how these capabilities work and how to get started on the blog in the Microsoft Defender ATP tech community.

In the coming months we will be releasing additional capabilities on Android and you will hear more from us about our investments in mobile threat defense for iOS devices as well.

I’m also thrilled to share that our initial release of Microsoft Defender ATP for Linux is now generally available. Customers have asked us to broaden our selection of platforms natively supported by Microsoft Defender ATP, and today we’re excited to officially start our journey with Linux. This release marks an important moment for all Microsoft Defender ATP customers when Microsoft Defender ATP becomes a truly unified solution to secure the full spectrum of desktop and server platforms that are common across enterprise environments: Windows, macOS, and Linux.

We are committed to helping organizations secure their unique and heterogenous environments and we have so much more in store for you this year. We’re excited for you to join us in our journey as we continue to deliver the industry’s best in integrated threat protection solutions.

For more information on Microsoft Security Solutions, visit our website. Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

 

-Rob

The post Microsoft continues to extend security for all with mobile protection for Android appeared first on Microsoft Security.

Protecting your organization against password spray attacks

April 23rd, 2020 No comments

When hackers plan an attack, they often engage in a numbers game. They can invest significant time pursing a single, high-value target—someone in the C-suite for example and do “spear phishing.” Or if they just need low-level access to gain a foothold in an organization or do reconnaissance, they target a huge volume of people and spend less time on each one which is called “password spray.” Last December Seema Kathuria and I described an example of the first approach in Spear phishing campaigns—they’re sharper than you think! Today, I want to talk about a high-volume tactic: password spray.

In a password spray attack, adversaries “spray” passwords at a large volume of usernames. When I talk to security professionals in the field, I often compare password spray to a brute force attack. Brute force is targeted. The hacker goes after specific users and cycles through as many passwords as possible using either a full dictionary or one that’s edited to common passwords. An even more targeted password guessing attack is when the hacker selects a person and conducts research to see if they can guess the user’s password—discovering family names through social media posts, for example. And then trying those variants against an account to gain access. Password spray is the opposite. Adversaries acquire a list of accounts and attempt to sign into all of them using a small subset of the most popular, or most likely, passwords. Until they get a hit. This blog describes the steps adversaries use to conduct these attacks and how you can reduce the risk to your organization.

Three steps to a successful password spray attack

Step 1: Acquire a list of usernames

It starts with a list of accounts. This is easier than it sounds. Most organizations have a formal convention for emails, such as firstname.lastname@company.com. This allows adversaries to construct usernames from a list of employees. If the bad actor has already compromised an account, they may try to enumerate usernames against the domain controller. Or, they find or buy usernames online. Data can be compiled from past security breaches, online profiles, etc. The adversary might even get some verified profiles for free!

Step 2: Spray passwords

Finding a list of common passwords is even easier. A Bing search reveals that publications list the most common passwords each year. 123456, password, and qwerty are typically near the top. Wikipedia lists the top 10,000 passwords. There are regional differences that may be harder to discovery, but many people use a favorite sports teams, their state, or company as a password. For example, Seahawks is a popular password choice in the Seattle area. Once hackers do their research, they carefully select a password and try it against the entire list of accounts as shown in Figure 1. If the attack is not successful, they wait 30 minutes to avoid triggering a timeout, and then try the next password.

Protecting your organization against password spray attacks

Figure 1:  Password spray using one password across multiple accounts.

Step 3: Gain access

Eventually one of the passwords works against one of the accounts. And that’s what makes password spray a popular tactic—attackers only need one successful password + username combination. Once they have it, they can access whatever the user has access to, such as cloud resources on OneDrive. Or use the exploited account to do internal reconnaissance on the target network and get deeper into the systems via elevation of privilege.

Even if the vast majority of your employees don’t use popular passwords, there is a risk that hackers will find the ones that do. The trick is to reduce the number of guessable passwords used at your organization.

Configure Azure Active Directory (Azure AD) Password Protection

Azure AD Password Protection allows you to eliminate easily guessed passwords and customize lockout settings for your environment. This capability includes a globally banned password list that Microsoft maintains and updates. You can also block a custom list of passwords that are relevant to your region or company. Once enabled, users won’t be able to choose a password on either of these lists, making it significantly less likely that an adversary can guess a user’s password. You can also use this feature to define how many sign-in attempts will trigger a lockout and how long the lockout will last.

Simulate attacks with Office 365 Advanced Threat Protection (Office 365 ATP)

Attack Simulator in Office 365 ATP lets you run realistic, but simulated phishing and password attack campaigns in your organization. Pick a password and then run the campaign against as many users as you want. The results will let you know how many people are using that password. Use the data to train users and build your custom list of banned passwords.

Begin your passwordless journey

The best way to reduce your risk of password spray is to eliminate passwords entirely. Solutions like Windows Hello or FIDO2 security keys let users sign in using biometrics and/or a physical key or device. Get started by enabling Multi-Factor Authentication (MFA) across all your accounts. MFA requires that users sign in with at least two authentication factors: something they know (like a password or PIN), something they are (such as biometrics), and/or something they have (such as a trusted device).

Learn more

We make progress in cybersecurity by increasing how much it costs the adversary to conduct the attack. If we make guessing passwords too hard, hackers will reduce their reliance on password spray.

Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity. For more information about our security solutions visit our website. Or reach out to me on LinkedIn or Twitter.

The post Protecting your organization against password spray attacks appeared first on Microsoft Security.

Unifying security policy across all mobile form-factors with Wandera and Microsoft

February 19th, 2020 No comments

The way we work is evolving—technology enables more effective employees by helping them to be productive where and when they choose. Businesses have also been enjoying the productivity benefits of an always-on and always-connected workforce.

While new business applications and device form-factors helped to accelerate these changes, organizations are now discovering the challenges with managing security and compliance policies in the modern workplace. As devices physically leave the corporate campus, administrators need tools to effectively manage end user applications and the corresponding access to company data; this is a particularly complex challenge for businesses who manage mobile devices running a variety of operating systems with significantly different management capabilities.

Mobile devices also introduce new IT challenges that can seriously impact business operations, such as:

  • Legacy security infrastructure such as Secure Web Gateways aren’t built for mobile devices, and backhauling traffic isn’t feasible for enforcing acceptable use policies, meaning that inappropriate content could be accessed, or shadow IT tools used, potentially creating legal liability for the business.
  • Insecure apps and content risks such as mobile phishing represent new attack vectors; modern app distribution methods and mobile-specific attack vectors (e.g., SMS, WhatsApp, Facebook Messenger) represent significantly expanded surface area that IT teams must now protect.
  • Excessive mobile data usage can lead to bill shock and result in unexpected financial risk for businesses of all sizes.

The modern business needs to manage risk in the simplest and most effective way, while simultaneously enabling worker productivity. Embracing tools that meet the needs of mobile work will improve employee and organizational productivity, and ultimately make the business more agile.

Mobility comes in many form factors and OSs, leading to admin complexity

The explosion in the number of iOS and Android smartphones and tablets sold over the last decade is a testament to their revolutionary impact in providing always-on communication, productivity, and organizational tools. Mobility has been great for businesses; according to Frost and Sullivan, portable devices increase productivity on work tasks by 34 percent and save employees 58 minutes per day.

While smartphones have been at the forefront of transforming personal productivity and improving business operations, they are not the only form-factor available for work that is performed on-the-go. Many worker tasks, such as manipulating large data sets or refining high resolution images, require specialized hardware such as a large display or a trackball to optimize the user experience and efficiency. A different type of mobile tool is needed for certain remote workers with job-specific tasks.

Windows devices have long been a key tool for enabling office employees, and in recent years, laptops have become lightweight and highly portable, making them as versatile as mobile devices. Many laptops now also include a physical SIM or eSIM to enable always-on connectivity, and the 2-in-1 form factor is proving to be a popular choice for office workers because of the resulting flexibility in working style.

Challenges managing a diverse mobile workforce go beyond the device

Supporting Windows devices outside of the office creates new challenges for IT teams—principally, how does the admin effectively manage users working remotely? Separate tools exist to manage apps and user access on different operating systems, creating management overhead. Additionally, Windows devices are typically attached to Wi-Fi and other unmetered networks where users are not constrained in how much data they can consume without penalty. As these devices are enabled for mobile data networks, these powerful systems need to be more intelligent in the way they consume data.

The difference in managing apps and data on mobile vs on Windows led to increased complexity for the admin. For example, Microsoft Word may be deployed via an Enterprise Mobility Management (EMM) solution such as Microsoft Intune on mobile, while on Windows, System Center Configuration Manager (SCCM) may be used. The different management infrastructures required for these tools have increased overhead and created challenges for IT teams maintaining more than one service to manage employees that simultaneously use mobile and Windows devices for working.

Any changes to users, such as employees joining or leaving the company, must be replicated across both tools. Additionally, the different tools have disparate controls, meaning that it is impossible to apply consistent security, acceptable use, and Conditional Access policies. Applying policies inconsistently can result in users receiving inappropriate privileges or disparate access to services across different form factors and operating systems. As a result, employees may be drawn to using a corporate-approved app on their Windows device but an unapproved consumer variant on their mobile device, leading to increased risk.

Strategies for effectively enabling a mobile workforce

It is just as important to protect users working remotely as it is to protect users within the network perimeter. Extending security policy in a consistent manner to mobile devices can be achieved with three services: a Unified Endpoint Management (UEM) service such as Microsoft Endpoint Manager, inclusive of both Microsoft Intune and Configuration Manager, an Identity and Access Management (IAM) service such as Azure Active Directory (AD), and a network-based risk management service such as the Wandera Mobile Security Suite that protects against cyber threats and usage risks.

Organizations looking to adopt this suite of services for unified policy should seek solutions that are deeply integrated in order to achieve a fully secure and manageable mobility stack. Wandera and Microsoft have partnered together to offer an integrated secure technology stack:

  • UEM services bridge the management gap between Windows and mobile devices. Microsoft Endpoint Manager enables administrators to push applications and configuration profiles to enable homogeneous management across both mobile and Windows devices.
  • Pairing Microsoft Endpoint Manager with Azure AD means that the profiles can be managed at a user level, instead of at the device level, further improving management consistency.
  • Wandera Mobile Security Suite allows administrators to define security and acceptable use policies at the network level, agnostic to the device that is being used. This means that applications and websites can be whitelisted or blacklisted, preventing users from using dangerous or unapproved services regardless of device type.

For example, a business may choose to use OneDrive for storing files in the cloud and want to prevent other file sharing services from being used. Microsoft Endpoint Manager and Azure AD can be used to push and configure the OneDrive application to the Windows and mobile devices, enabling employees to use this service. Wandera Mobile Security Suite can then be used in tandem to prevent employees from using other services such as Dropbox, preventing the user from accessing shadow IT in the form of application and web browser versions.

Many organizations have found that the lack of consistent controls create new attack surfaces that hackers use to penetrate the organization and mischievous employees abuse to circumvent IT policies. It is not uncommon for users to be blocked by acceptable use policies as they browse to unsanctioned content from a desktop computer, only to enable tethering on a mobile device to circumvent the policy.

Managing different technologies and applying different policies creates undue complexity for admin teams and prevents business flexibility, potentially leading to overlooked security gaps. Wandera Mobile Security Suite’s in-network security technology allows content security policies to be applied consistently across different device types. This means that phishing attacks, which are how 90 percent of data breaches begin, can be prevented regardless of device type. Mobile Security Suite is also able to block spam sites and stop malware communicating with command-and-control (C2) servers.

Mobile data management is another area of disparate control for businesses. The rich set of features in Wandera Mobile Security Suite for managing data usage on mobile devices can help an organization prevent bill shock caused by data overages or roaming on any iOS, Android, or Windows 10 device, with detailed and holistic reporting so businesses can understand how they use data and where risk may enter through mobile usage.

Better together—Microsoft and Wandera

Businesses can benefit from the strong integration between Microsoft Endpoint Manager, Azure AD, and Wandera Mobile Security Suite, making device management processes seamless. The combined solution streamlines device lifecycle management, involves a single source-of-truth for users and roles that is applied consistently between products, and makes security policies more intelligent and effective by ensuring that all components in the solution are sharing intelligence to remediate threat as soon as it’s detected.

Using Azure AD to centrally manage user identities simplifies administration, as credentials do not need to be created across multiple systems. When an employee is added in Azure AD, a profile will automatically be created in Microsoft Endpoint Manager, enabling their devices to be managed. In turn, Wandera Mobile Security Suite can be integrated with Microsoft Endpoint Manager so that the same acceptable use, content security, and data management policies can be applied seamlessly. This workflow functions when an employee leaves the business, unenrolling them from all services, making integration of services an easy way to manage a device’s lifecycle and ensuring that sensitive data remains secure

The integrated solution also enables differentiated access for users through applying policies by role. The three services can be linked directly so that an organization’s directory hierarchy can be shared, and acceptable use policies applied to the user level simply and easily.

Enabling employees is very important for productivity, but equally as important is preventing unwanted parties accessing confidential information and critical systems. Infecting an endpoint is an easy way for malicious parties to infiltrate a businesses’ technology systems.

The integrated solution also incorporates risk signals from a variety of sources to ensure that the user, device, and data are safe. Microsoft Endpoint Manager provides a risk assessment of the device configuration, including whether the lockscreen is configured properly. Azure AD is able to determine when sign-in behavior is anomalous or risky, through signals integration with Azure AD Identity Protection. Wandera Mobile Security Suite provides an added set of security assessments on the device that includes vulnerability scans, app vetting, and Man-in-the-Middle checks. All of these risk signals are brought together through a single Conditional Access policy.

Best practices for mobility management with iOS, Android, and Windows 10 devices

As mobile employees are enabled with mobile iOS, Android, and Windows 10 devices, businesses need to embrace technology that will give admins the necessary controls to effectively manage employee devices consistently. Businesses need to be able to manage productivity tools, by providing access to acceptable applications and blocking unwanted applications. Organizations need to provide strong security across devices to close gaps in their defenses and prevent common threats from impacting business operations. Finally, businesses should ensure that Windows devices do not cause unexpected data charges by employing cost control tools.

To be able to effectively enforce acceptable use, content security, and control costs across a device fleet with many different device types, businesses should utilize integrated solutions that can support consistent management. Microsoft Endpoint Manager, Azure AD, and Wandera Mobile Security Suite provide features that organizations need to embrace a mobile fleet. Bringing these three services together creates a powerful joint solution that can improve businesses’ lifecycle management, policy application, and identity and security management.

Bookmark the Security blog to keep up with our expert coverage on security matters. Check out our security solutions that help to address these issues. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

The post Unifying security policy across all mobile form-factors with Wandera and Microsoft appeared first on Microsoft Security.

Mobile threat defense and intelligence are a core part of cyber defense

December 19th, 2019 No comments

The modern workplace is a mobile workplace. Today’s organizations rely on mobility to increase productivity and improve the customer experience. But the proliferation of smartphones and other mobile devices has also expanded the attack surface of roughly 5 billion mobile devices in the world, many used to handle sensitive corporate data. To safeguard company assets, organizations need to augment their global cyber defense strategy with mobile threat intelligence.

When handled and analyzed properly, actionable data holds the key to enabling solid, 360-degree cybersecurity strategies and responses. However, many corporations lack effective tools to collect, analyze, and act on the massive volume of security events that arise daily across their mobile fleet. An international bank recently faced this challenge. By deploying Pradeo Security alongside Microsoft Endpoint Manager and Microsoft Defender Advanced Threat Protection (ATP), the bank was able to harness its mobile data and better protect the company.

Pradeo Security strengthens Microsoft Endpoint Manager Conditional Access policies

In 2017, the Chief Information Security Office (CISO) of an international bank recognized that the company needed to address the risk of data exposure on mobile. Cybercriminals exploit smart phones at the application, network, and OS levels, and infiltrate them through mobile applications 78 percent of the time.1 The General Data Protection Regulation (GDPR) was also scheduled to go into effect the following year. The company needed to better secure its mobile data to safeguard the company and comply with the new privacy regulations.

The company deployed Microsoft Endpoint Manager to gain visibility into the mobile devices accessing corporate resources. Microsoft Endpoint Manager is the recently announced convergence of Microsoft Intune and Configuration Manager functionality and data, plus new intelligent actions, offering seamless, unified endpoint management. Then, to ensure the protection of these corporate resources, the company deployed Pradeo Security Mobile Threat Defense, which is integrated with Microsoft.

Pradeo Security and Microsoft Endpoint Manager work together to apply conditional access policies to each mobile session. Conditional access policies allow the security team to automate access based on the circumstances. For example, if a user tries to gain access using a device that is not managed by Microsoft Endpoint Manager, the user may be forced to enroll the device. Pradeo Security enhances Microsoft Endpoint Manager’s capabilities by providing a clear security status of any mobile devices accessing corporate data, which Microsoft can evaluate for risk. If a smartphone is identified as non-compliant based on the data that Pradeo provides, conditional access policies can be applied.

For example, if the risk is high, the bank could set policies that block access. The highly granular and customizable security policies offered by Pradeo Security gave the CISO more confidence that the mobile fleet was better protected against threats specifically targeting his industry.

Get more details about Pradeo Security for Microsoft Endpoint Manager in this datasheet.

Detect and respond to advanced cyberthreats with Pradeo Security and Microsoft Defender ATP

The bank also connected Pradeo Security to Microsoft Defender ATP in order to automatically feed it with always current mobile security inputs. Microsoft Defender ATP helps enterprises prevent, detect, investigate, and respond to advanced cyberthreats. Pradeo Security enriches Microsoft Defender ATP with mobile security intelligence. Immediately, the bank was able to see information on the latest threats targeting their mobile fleet. Only a few weeks later, there was enough data in the Microsoft platform to draw trends and get a clear understanding of the company’s mobile threat environment.

Pradeo relies on a network of millions of devices (iOS and Android) across the globe to collect security events related to the most current mobile threats. Pradeo leverages machine learning mechanisms to distill and classify billions of raw and anonymous security facts into actionable mobile threat intelligence.

Today, this bank’s mobile ecosystem entirely relies on Pradeo and Microsoft, as its security team finds it to be the most cost-effective combination when it comes to mobile device management, protection, and intelligence.

About Pradeo

Pradeo is a global leader of mobile security and a member of the Microsoft Intelligent Security Association (MISA). It offers services to protect the data handled on mobile devices and applications, and tools to collect, process, and get value out of mobile security events.

Pradeo’s cutting-edge technology has been recognized as one of the most advanced mobile security technologies by Gartner, IDC, and Frost & Sullivan. It provides a reliable detection of mobile threats to prevent breaches and reinforce compliance with data privacy regulations.

For more details, contact Pradeo.

Note: Users must be entitled separately to Pradeo and Microsoft licenses as appropriate.

Learn more

To learn more about MISA, visit the MISA webpage. Also, bookmark the Security blog to keep up with our expert coverage on security matters and follow us at @MSFTSecurity for the latest news and updates on cybersecurity.

Microsoft Endpoint Manager

Transformative management and security that meets you where you are and helps you move to the cloud.

Get started

12019 Mobile Security Report, Pradeo Lab

The post Mobile threat defense and intelligence are a core part of cyber defense appeared first on Microsoft Security.