Microsoft and Modern Cybersecurity Threats
It’s useful to understand the state of cybersecurity as a backdrop when beginning or continuing any journey with Microsoft 365 Defender, which this book will help you master as a defender. The threats that organizations face continue to change across all industries and scales. The threats are considerably different from those experienced as long ago as the beginning of Windows’ mass adoption by the workplace, or even 5 or 10 years ago, far into IT maturity in many organizations. Nowadays, attackers’ budgets, capabilities, and demands outstrip those of a time when a conventional anti-virus and gateway firewall was all you had to consider.
Now we live in an era where the workforce has left the confines of the office or VPN; where data has jumped from your data center to someone else’s; and where hybrid identities unleash access to organizations’ apps anywhere, on any device, including that one constant across eras: email.
In this chapter, we’re going to cover the following topics:
- The cybersecurity threat landscape
- The cyber kill chain and MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)
- Microsoft and Zero Trust
What you learn in this chapter will paint the background of modern threats facing organizations’ IT, including the cyber-attack kill chain that Microsoft 365 Defender can be used to protect against and respond to.
It is impossible to avoid the elephant in the room: Microsoft security software.
Just as threats have changed, so has the biggest dog in the yard (and, incidentally, the company that created the yard where many of those security problems occur). Microsoft invests billions of dollars per year into security services, research, and development. The Defender of Windows XP and Vista is not the Defender of this era. We’ll conclude the chapter with what this translates to in terms of winning back your trust in the Defender brand and, no pun intended, the Zero Trust strategy that Microsoft advocates.
