Before we dive into a demonstration on Microsoft Defender for Identity,
I would like to spend a few minutes just looking at a quick
overview of what Defender for Identity actually is.
You may recall a solution called Azure Advanced Threat Protection, or prior
to that, it used to be called Advanced Threat Analytics.
As the product evolved,
the name has changed, and it is now known as Microsoft Defender for Identity.
Essentially, it is a cloud‑based solution that leverages your signals from your
on‑premise Active Directory in order to identify,
detect, and allow you to investigate advanced threats on compromised identities.
Essentially, it is broken up into four key pillars.
The first one relates to monitoring. What this solution does is it
actually goes and monitors and analyzes your user's behavior and
activities from a credential point of view. For example,
it'll look at what permissions your user has,
the groups that the user is part of, and it will leverage that
information to create a baseline for each user.
It'll also take a look at what the user logs into, how often
the user logs into a certain resource,
the times that the user logs in, and so forth.
By combining all of these signals, Defender for Identity provides you with
insight into any type of suspicious activities or events, ultimately
revealing advanced threats on a compromised user.
It is also a good way to highlight any type of insider
threats that may face your organization.
For example,
think of a server admin that logs only into a specific server, and
that is part of their day‑to‑day job; however,
they may start logging into a server which has no
relevance to their day‑to‑day job.
That type of activity would be flagged by Defender for Identity.
The next pillar is protection. By making use of security reports
and user profile analytics, Defender for Identity can help you
dramatically reduce your attack surface.
A typical type of attack is lateral movement. With the
protection pillar of Defender for Identity,
lateral movement paths can be quickly established, allowing
you to understand exactly how an attacker can move
laterally within your organization.
From a security report point of view,
it'll help you identify users and devices that may be
authenticating using clear text passwords.
This will help you address that and reduce your security
exposure. From a detection perspective,
Defender for Identity is able to detect various types of suspicious activities.
For example,
reconnaissance attacks, such as domain enumeration or DNS
enumeration, those are types of attacks that Defender for Identity
would detect. If we move to more advanced attacks,
for example,
a DCSync or a DCShadow attack, those types of attacks which are
really advanced can really wreak havoc to your organization.
Fortunately, it's one of the detections that Defender for
Identity is capable of detecting.
You may also be thinking, what about exfiltration attacks?
Well, those types of attacks that involve exfiltration
capabilities can also be detected.
A typical type of exfiltration activity would be things like
suspicious communication over DNS, or data.
exfiltration over the SMB protocol. And as we move to response capabilities,
Defender for Identity provides you all of this insight
in a really simple attack timeline.
Since Defender for Identity operates within the Microsoft 365 Defender suite,
it's able to leverage signals from other Defender
solutions to augment its detection and alerts.
This ultimately gives you a clear picture of what happened,
who the users are,
and, therefore, allowing you to concentrate on what you need to mitigate.
So that was just a quick overview of what Defender for Identity is.
Let's move on to the next video, where I will show you how we can set up a Defender for Identity sensor on our domain controller.