Microsoft Defender Services

Common threats

Cyber security comes down to protecting against threats that seek to gain access to your environment, which could have a range of end goals, such as stealing data or tricking a user into paying a fraudulent invoice.

Cyber security is a business risk problem and should be treated as such; that is to say it is a whole business problem (not just for the IT team) and should be looked at like other risks. A successful cyber-attack can cause reputational, financial and operational damage, sometimes all together.

The three most common threats that need to be monitored for and defended against are:

• Ransomware - probably the biggest threat to all organisations, ransomware aims to get access to key assets within an environment and steal data and/or stop the victim from operating. Attackers demand a fee for a ‘key’ to decrypt files and get the operation back up and running. Whilst still significant, the ransom payments are often only a small percentage of the total costs, when considering the operational and reputational damage and time to recover, as Forbes reports. Ransomware is not solely the concern of larger businesses, in particular due to the advent of ‘Ransomware-as-a-Service’ (RaaS). RaaS has removed barriers to entry for attackers, with a ‘Ransomware kit’ costing as little as £50. As a result, some attackers have actively pivoted to target smaller organisations, using the equivalent of ‘mass marketing’ techniques, knowing that a percentage will fall victim and by charging relatively small ransom fees (in the tens of thousands often), most organisations will pay, giving a better return than going after a big target.
• Business Email Compromise (BEC) - BEC is a type of ‘phishing’ attack, with the goal being to target a few key individuals, such as the CEO or Finance team, tricking them into paying a phony invoice. BEC can be very sophisticated, with attackers gaining access to an organisations email and patiently building up a picture of how people interact with each other, their calendars and more, to make a request seem more legitimate. Often a BEC attack is timed well, for example when a CEO is in a meeting with a key customer or partner, the attacker may send an email or even instant message to the Finance Manager asking for an urgent payment, perhaps suggesting they’ve been embarrassed on the call by not paying.
• External Service Compromise - external service compromise can be a broad threat and is often linked to ransomware and/or BEC as a route in. In general, this relates to the exploitation of any external-facing asset, often related to a third-party vulnerability of a tool used by the organisation. The risk here can be reduced by regularly patching, external vulnerability testing (including ‘penetration testing’, although this is broader) And by reducing the internet-facing assets used and open.

• Discuss your challenges

Challenges

All organisations face the challenge of recruiting and retaining dedicated resource to meet the demands of constantly shifting Cyber Security landscape. This can best be broken down into time, people and expertise:

• Time - we know that cyber security is a business problem and all organisations, in particular those on a high growth curve will often face challenges with time. This can create an environment where unintentional insider threat is a big concern – people make mistakes when they don’t have time to think, even those well versed in cyber security. Building a company focus on cyber security and a ‘no blame culture’ will help with people coming forwards and flagging any potential concerns early. As will an effective cyber security monitoring service.
• People - even the largest organisations can struggle with not having enough cyber security professionals in their organisation. There’s a well-documented ‘cyber skills gap’ that affects everyone, including specialist companies, like e2e-assure. Even if there were enough people in the market, many smaller organisations naturally struggle with the fact that they can’t afford large teams. Whenever a successful attack happens, the technology in place invariably works and sets of hundreds of alerts – the problem is that there aren’t the right people (and/or processes) in place to react to them. There is also the challenge that attacks happen at all times, often in the early hours of a weekend morning. This requires 24/7/365 monitoring of your environment, which many organisations do not have the people for – the bare minimum would be 7 to allow for shifts, annual leave, sickness etc., but in reality, it is much higher to be truly effective.
• Expertise - linked to not having enough people, expertise in cyber security can be difficult to come by and many smaller organisations cannot afford a specialist. This could mean an IT professional also has responsibility for cyber security and may struggle with a lack of time, people (to support) and expertise. Often the noise will come from people complaining about IT not working and many companies can fall into the trap of not prioritising cyber security, especially if they haven’t been attacked yet.

To mitigate these challenges, the cyber security industry often tells organisations that simply buying their new technology will solve the problem, save them time and even do the work for them. Whilst this can be true, the key is to maximise the return on investment of your existing technology. During a successful cyber-attack, it’s usually the case that alerts and indications of a potential or actual attack are available but, it comes down to not having the people or processes in place to do something with this information or put the most appropriate response in place.

That’s why we’ve created our Microsoft Defender Services, to help organisations to do more with what they already have and allow 24/7 protective monitoring of your environment, set up within hours.

• Discuss your options

Core services

Our Microsoft Defender Services come with two options, allowing you to choose the right level of service for your organisation, requirements and budget.

Our Monitored service is perfect for small organisations looking for additional support with the cyber security monitoring, with 24/7/365 monitoring, analysis of alerts and remediation advice.

Our Managed service expands on the Monitored, with the addition of improved SLA’s, customer processes and additional Analyst support for incident response.

A top-level overview of the services is detailed below:

For more detail, download our data sheet, or get in touch to discuss the service.

• Download data sheet
• Discuss your options

Additional services

Whilst our core services offer a good starting point for many organisations by focusing on endpoints, we are aware that many organisations also deploy other Defender services. As part of the additional services, we can leverage other Defender tools to improve the correlation of security events and enrich the data Analysts have to investigate. Additional options include coverage for:

• Microsoft Defender for Cloud Applications (MCAS)
• Microsoft Defender for Identity
• Microsoft Defender for Office 365
• Microsoft Compliance Manager
• Microsoft Defender for Business*

In addition, we can offer pre-paid incident response days, to be called on for further support when it's needed, at a discounted rate, allowing you to focus on the incident at hand, with pre-agreed incident response plans.

We also have a roadmap to move customers to a bespoke managed Microsoft Sentinel service when they are ready, to both further improve their cyber security and maximise their investment in Microsoft technologies. As we don’t sell Microsoft licensing, our only objective is to improve our customer’s security and so we work with you to build a cyber roadmap, prioritising spend and proving ROI before investing in any future improvements.

*Microsoft Defender for Business is a version of Microsoft Defender for Endpoints, aimed at providing discounted Endpoint Detection & Response (EDR) for organisations with less than 300 users. This can be used in place of Microsoft Defender for Endpoints depending on your licensing agreements. It is currently being rolled out to Microsoft 365 Business Premium customers and will be available as a standalone subscription in the near future. More information can be found in Microsoft Docs.

• Discuss your options