Virtually Yours..

Artificial Intelligence and Machine Learning for NextGen Threat Protection

IftekharH — Sun, 25 Feb 2018 20:05:37 GMT

Traditionally detecting and responding to cyber threats always relied on understanding precedence, matching patterns, writing definitions and configuring rules based actions for mitigations.

Given the kind of sophistications, polymorphism and expedited rate of change in threat landscape seen nowadays, traditional methods involving human touch at each and every point proving to be inadequate and inefficient.

Rule based action can only scale up to manage commodity attacks but whenever there is a slight difference in the attack technique the whole rule falls apart.

Machine learning and Artificial Intelligence can achieve high rate of precision of detecting and responding to a threat by analyzing various datasets with lots of dimension which human cannot scale.

Just to give you an idea and how polymorphic pattern of threats are emerging :

Machine Learning models can uncover blind spots by removing human bias that comes with expertise, such as confirmation bias to reveal greater insights.

Machine learning for building Threat Intelligence: The Intelligence Security Graph (ISG)

In reducing the time it takes to detect an attack and its techniques, enterprise companies are struggling with a contradictory dilemma between having too much security-related data to process yet still not having enough information to separate the signal from the noise and understand an incident quickly. The challenge here is not just sheer volume, but also separation. Many indicators of attack either seem innocent on their own, or are separated by industries, distances and timeframes. Without clear insight into the whole dataset, early detection becomes a game of chance. Even the largest enterprise companies are facing these limitations:

Real threat intelligence requires more data than most organizations can acquire on their own.
Finding patterns and becoming smarter in that huge data pool requires advanced techniques like machine learning along with massive computing power.
Ultimately, applying new intelligence so that security measures and technologies constantly improve requires human experts who can understand what the data is saying, and take action.

As a platform and services company, Microsoft’s has a wider optics of threat and activity data comes from all points in the technology chain, across every vertical industry, all over the world. This enables us to diagnose attacks, reverse engineer advanced threat techniques, and apply that intelligence across the platform. Following image shows how ML can see various signals across the technology chain and helps building threat Intelligence which can help detect attacks much faster and help mitigate. For nearly two decades, Microsoft has been turning threats into useful intelligence that can help fortify its platform and protect customers. Since the Security Development Lifecycle born from early worm attacks like Blaster, Code Red and Slammer, to modern security services woven into our platforms and services, the company has continually built processes, technologies and expertise to detect, protect, and respond to evolving threats. These threat intelligence has helped Microsoft to work with law enforcements in various countries in taking down some of the major global botnets like Citadel, Ramnit, Dorkbot, and very recently Gamarue. Today, with the immense computing advantages afforded by the cloud, the Machine learning and Artificial Intelligence is finding new ways to use its rich analytics engines and by applying a combination of automated and manual processes, machine learning and human experts, we are able to create an intelligent security graph that learns from itself and evolves in real-time, reducing our collective time to detect and respond to new incidents.

The Game of Phishing – How to beat your Opponent

IftekharH — Mon, 18 Dec 2017 19:26:08 GMT

With more than 1.4 Billion clear text user credentials accumulated and up for grabs in the dark web clearly indicates that the hunt for credentials from genuine users/Organizations is the most important phase of the the cyber kill chain. Verizon Data Breach Investigation report 2017 says that 81% of breaches that have occurred involved compromised credentials and in 75% of them perpetrators were outsiders. Phishing emails are proving to be most effective way to grab credentials of users and then use them to carry out attacks on them and their organization. If you are new to this term, This should help.

The Mind Game

Over the years, the art of phishing has evolved and adversaries are now using more sophisticated ways to trick human mind in making a wrong judgement. If you are fan of National Geographic’s popular show “Brain Games” like me, they've showed how amazing ways human brain functions. How a part of brain questions everything, sees with suspicion before making any decision and how another part of brain which simply accepts the fact and assumes it as true and takes the action. For E.g, When you are about to cross the road, A part of brain looks at this scenario with suspicion and caution. It only makes decision to cross the road after determining that there is no threat to life from incoming vehicle. Lets call this part of the brain – Part 1 However on a different scenario, when you pickup a TV remote and about the press the power button, does you brain sees this act with same level of caution and suspicion? No, right? This time the other part of the brain makes the decision by assuming that when you press the button, the TV will turn on and nothing bad will happen. Lets call the part of the brain Part-2. Adversaries are now using various physometeric tactics to let your Part 2 of brain acts and makes you take quick decision to act swiftly on the email and supress your other side of the brain which makes you question it.

Lets play a game.

Can you tell which of the following screenshot of the Office 365 Logon Page is a Phishing Page and which one is authentic webpage? Fig.1 Fig 2 If you happen to land on one of these webpages and provide your credentials, You have just made a life of a attacker easy by handing over one of your organizations critical asset, your Username and Password.

So what could really happen when someone else have your credentials?

1. They can logon to your mailbox and use your email account to send with emails with Malicious attachments to all your colleagues. Since all your colleagues trusts you they will not use their Part 1 of brain to think twice before opening those attachments. 2. They can use your mailbox to attack your friends/family similar way. 3. They can use your mailbox to spear phish senior leaders of your organization to grab their credentials and elevate privileges. 4. They can VPN and connect to your corporate network as you and initiate exploration and then exploitation activities or just spreading a worm based ransomware in the network. 5. and much more

How to be better than the game?

Detecting Signs on a Phishing Email 1. Sense of Urgency - Look for the sense of urgency in the email. If the email is asking you take an action in hurry with words like immediately, Urgently etc, be cautious. 2. Grammatical errors or spelling mistakes- More often or not, attackers from non native English speaking regions tend to make spelling or grammatical mistakes in their emails or on the Phishing site. 3. Spoofed Email Sender - Do not trust the email sender name on your email header. While it might look its coming from known sender but when you expand the Email Name, you may see a different email address (spoofed) 4. Obfuscated URLs : What you see my not be what you get. Hover your mouse on the Links to see the actual URL its taking you to. If you see Base64 in URL, move away. 5. Detailed Email Header – If you are ready to dive deep, Look at the detailed email header to review the complete mail flow and sender Info including IP address and Sender Domain. 6. Email formatting – Emails coming from various reputated organizations goes through multiple review w.r.t formatting. if the email looks weirdly formatted it may be anomalous. Detecting Signs of a Phishing website. If you do end up on a site by clicking on those URLs in your email, following tips can help detecting it a Phishing Site. Yes, it would be really taxing to check every email with suspicion and open every links in the email and verify the webpage for signs of phishing. If you are an Office 365 customers, Advanced Threat protection of O365 protects against phishing attacks by analyzing the URLs in the emails and blocks the access to the malicious website at the time of click. If you’d like to see a short demo on how Office 365 ATP Safe link protects against Phishing attack, check this video To learn more about the Safe Link capabilities of Office 365 ATP, check here PS: If you have not been able to figure out yet, Figure 2 is a phishing page :) Cheers Iftekhar

My Article on CIO Review Magazine : Stay Updated, Stay Protected

IftekharH — Sun, 19 Nov 2017 16:57:49 GMT

In the increasingly dynamic world of cyber threats where threat landscape is changing by seconds, staying updated breaks the ROI of the attackers. If you are a reader of CIO review magazine hope you'll like my this article published in the October 2017 edition. You can read the full CIO review Digital Magazine here with some other great articles. https://www.cioreviewindia.com/magazines/cloud-software-solution-special-october-2017/ Cheers Iftekhar

My Book Project : Windows 10 for Enterprise Administrators

IftekharH — Thu, 28 Sep 2017 18:35:57 GMT

With more and more customers adopting Windows 10 as preferred Operating System as their preferred platform for their Endpoint Devices, the need of upgrading skills for our IT administrators with the know how of new tools, upgrade strategies, deployment of new features/capabilities and ongoing management of Windows 10 devices is definitely catching up. Windows 10 brings a whole lot of new capabilities both from Manageability and Security perspective for IT administrators. If you haven't read some of my previous posts around Security with Windows 10, following articles will give you some insight.

I have been working as Tech Reviewer of this Book on Windows 10 for Enterprise administrators for few months now and its finally got published. As a Tech Reviewer my responsibility was to ensure that the Technical topics are explained accurately and has consistent information, with working set of scripts and codes. The sole objective of the book is to help IT administrators with the knowledge of new capabilities, Deployment tools, tips and tricks to manage a Windows 10 environment better. The Authors did a great job in bringing the right content and concepts to ensure our Windows 10 administrators are successful in their day to day job. Here are some screenshots of the book preface Book is available for Sale here : https://www.packtpub.com/networking-and-servers/windows-10-enterprise-administrators Hope you all will like it. Cheers

Windows 10 Device Guard against Malware Intrusion

IftekharH — Wed, 20 Sep 2017 18:27:37 GMT

I hope you all found my previous post on Threat Mitigation capabilities of Windows 10 helpful in how these capabilities enables a more secured computing by making things harder for attackers to exploit Windows. Today, I am going to write about another great feature of Windows 10 Enterprise known as Device Guard which helps a great deal against Malware attack. Device Guard is designed to lock down a PC to run only trusted applications and Code. Previous version of Windows has feature called KMCI – Kernel Mode Code Integrity, which allows only signed code to run in the Kernel Mode and protects the sanctity of the Windows Kernel against breaches and exploitation. With Windows 10, the Code Integrity is now extended to User Mode as well, which means organizations have now better control on the code that runs in the User mode of the OS and protects the device against Malware. You can configure Code Integrity Policy to run only signed code in the User Mode Environment, which means if there is an unsigned binary attached to an Signed Package, it would not be able to execute. As we speak today, more than 90 percent of malware out there are all unsigned, So if the policy on the system restricts the execution of Unsigned binary, malware would not be able execute their line of code. So think of a scenario, you receive a malware infected excel attachment in your Inbox and the email is crafted so well to trick you to open the excel attachment, This will allow the excel sheet to open as Excel.exe is a trusted code and signed by Microsoft, however if there is an attached code in the form of Macro which probably calls a malware executables from someplace else will not execute as that line of code is not signed by anyone. I have created this small demo video on how Windows Device Guard protects against malware intrusions including Ransomwares like WannaCry and Petya. In this demo, you’ll see how a well crafted phishing email will trick a user to enable the macro on a excel attachment and injects WannaCry Ransomware on a Windows 7 machine, We’ll then see how Windows 10 Device Guard blocks the attached code to this excel sheet and prevents the attack. Enjoy the video To Learn more about Windows 10 Device Guard. Click Here If you want to deploy Device Guard on your Windows 10 Enterprise fleet, check this deployment guide. Do share your comments and feedback Cheers.

Threat Mitigations in Windows 10

IftekharH — Mon, 28 Aug 2017 19:38:22 GMT

Traditionally Operating system releases from Microsoft used to happen once in few years and the time between releases, a lot of these exploitation techniques used to get developed. Most of these new exploitation techniques were used to carry out attacks on Windows platform which didn't have any mitigations and future release with the fix was few years apart. Some of the exploitation that exists today didn't even existed a decade before. Exploitations a decade before:

Stack overrun
Return Address Corruption
Shell Code

Exploitation techniques today :

ARW
Sandbox bypass
Heapspray
Memory Corrupt
CFG Bypass
ASLR Bypass
DEP Bypass
ROP Shellcode

Given the kind of threats have increased multifold, waiting for couple of years to mitigate a particular exploitation technique is far from ideal and leaves our consumers and commercial users/organizations vulnerable. With Windows 10 as a Service where we keep releasing new features and capabilities every 6 months has reduced the shelf live of these techniques. Today we’ll go through these security mitigations enabled in Windows 10 and is enabled by default to all of our user irrespective of the Windows 10 editions you are using. Threat Mitigations in Windows 10 is set of features which helps to disrupt exploitation techniques and vulnerability classes harder or impossible to use. Lets go through some of these important mitigations 1. User Mode Font Driver ( UMFD ) : User mode font driver mitigation was added in initial version of Windows 10. This is towards isolating or containing the vulnerabilities. Font process was done in kernel mode, and these memory corruption could be hit remotely using untrusted fonts. The font processing code is very legacy code and it is also from different contributors as well. With UMFD the font processing is now moved into an App Container in user mode. This actually makes any of the vulnerabilities in font processing kind of use less. So, the EOPs or typically the sandbox escapes that were being targeted using vulnerabilities are no longer possible. All the processes gets benefitted from this mitigation. While we have moved the font processing to user mode to contain the vulnerability, it is also possible to disable processing of untrusted remote fonts for a process via the ProcessFontDisablePolicy process mitigation option. 2. Win32k Syscall Filtering : We all know that Win32k subsystem is the No.1 targeted component for achieving Sandbox escapes. It is a gigantic component because of its functionality, what ever you see is all mostly Win32k. It has a very huge attack surface, about 1200 APIs compared to about 400 NT APIs. With Syscall filtering Microsoft Edge tries to maintains a list of Win32k APIs that it needs and allows only those from the content process thus reduces the surface area. This mitigation removes a good set of Win32k APIs that can be targeted for any possible memory corruption. 3. Less Privileged App Container (LPAC): App Container has access to resources protected with ALL APPLICATION PACKAGES SID: This SID has read permission on all folders by default. LPAC is a more restricted version of the App Container. it denies access by default for everything. One can access only the secured objects that are granted explicitly to LPAC. 4. Structured Exception Handling Overwrite Protection (SEHOP) : this feature is designed to block exploits that use the Structured Exception Handler (SEH) overwrite technique. Because this protection mechanism is provided at run-time, it helps protect applications regardless of whether they have been compiled with the latest improvements. 5. Address Space Layout Randomization (ASLR) : ASLR loads DLLs into random memory addresses at boot time. This mitigates against malware designed to attack specific memory locations where specific DLLs are expected to be loaded. 6. Heap protections : Windows 10 includes protections for the heap, such as Heap metadata hardening for internal data structures that the heap uses, it also uses Heap allocation randomization, that is, the use of randomized locations and sizes for heap memory allocations, which makes it more difficult for an attacker to predict the location of critical memory to overwrite. Also Heap guard pages before and after blocks of memory, which work as tripwires. If an attacker attempts to write past a block of memory (a common technique known as a buffer overflow), the attacker will have to overwrite a guard page. Any attempt to modify a guard page is considered a memory corruption, and Windows 10 responds by instantly terminating the app. 7. Kernel pool protections, Windows 10 includes protections like Kernel DEP and Kernel ASLR for the pool of memory used by the kernel. For example, safe unlinking protects against pool overruns that are combined with unlinking operations to create an attack. 8. Control Flow Guard : Control Flow Guard (CFG) is a mitigation that requires no configuration within the operating system, but instead can be built into software when it’s compiled. It is built into Microsoft Edge, IE11, and other features in Windows 10. It can also be built into applications when they’re compiled. For example, it can be built into applications written in C or C++, or applications compiled using Visual Studio 2015. For such an application, CFG can detect an attacker’s attempt to change the intended flow of code. If this occurs, CFG terminates the application. Administrators can request software vendors to deliver Windows applications compiled with CFG enabled 9. Protected Processes : With the Protected Processes feature, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes. Less trusted processes are prevented from interacting with and therefore attacking more trusted processes. Windows 10 uses Protected Processes more broadly across the operating system, and for the first time, you can put antimalware solutions into the protected process space, which helps make the system and antimalware solutions less susceptible to tampering by malware that does manage to get on the system. 10. Universal Windows apps protections: When users download Universal Windows apps or even Windows Classic applications (Win32) from the Windows Store, it’s highly unlikely that they will encounter malware, because all apps go through a careful screening process before being made available in the store. Apps that organizations build and distribute through Sideloading processes will need to be reviewed internally to ensure that they meet organizational security requirements 11. No Child Proc : Attackers can trick a sandbox to create a child process to bypass mitigations. this feature prevents code execution via launching a child process. Here is the release cycles of various threat mitigation capabilities in every Windows 10 feature updates : The main objectives of implementing these threat mitigation capabilities in Windows 10 are :

Reducing the attack surface of Windows Platform
Takes soft target out of the picture
Eliminates existing exploitation techniques so that new techniques need to be found.
Reducing impact of vulnerability by isolation.
Make overall exploitation harder and expensive

These are all the more reasons to move to Windows 10 as quickly as possible to remain protected against modern cyber threats. Hope you liked the article, look forward to more later. Cheers.

Returning to Blogosphere

IftekharH — Sun, 27 Aug 2017 06:59:16 GMT

I know its been a while (read ages) I have blogged as I did let other things both at work and home kept me occupied but I have been interacting with few of you on twitter (@Iftekharh) and sharing lots of technical content relevant to the world of Windows and Security,

Recently my role got changed to be a Sr. Cyber Security and Threat Management Specialist and I will be working with our customers in helping them protect against modern cyber threats. It will not be just limited to Windows but even email and Infrastructure security.

I have been working on Windows (Endpoint) Security for quite sometime now and now will be able to extend those skills and knowledge to other areas of our computing environment.

I am excited with the opportunities we have together to protect our organizations against these threats.

Going forward I’ll try to be more regular on blogosphere and will bring you best practices, new capabilities and other threat detection and protection technologies coming from Microsoft.

Stay tuned.

Reimagining Enterprise Mobility – Part 2

IftekharH — Fri, 10 Oct 2014 11:38:53 GMT

In the Part 1 of this series, we discussed how Mobility and flexible workstyle investments are so integral in Windows Server 2012 and Windows 8 Operating Systems. Today I'll talk about the additional layer of services which are essentials in delivering successful Enterprise Mobility Solutions in an organization.

Identity and Access - With the emergence of Public Enterprise Cloud Applications like Safesforce.com, Dropbox, Jive, Amazon and more and of course Microsoft Services like Office 365, OneDrive for Business and Yammer, more and more organizations are now adopting public SAAS (Software as a Service) applications instead of writing their own LOB applications. When Organizations right their own LOB applications they mostly integrate it with Active Directory to avoid having multiple credentials and identities inside the organizations of an employee. Users access these LOB applications using a single credentials in the form of Active Directory domain User and Password which is the same for logon to their PCs and other systems.

Public Cloud SAAS applications often comes with their own Identity Services and then it creates a huge problem of having multiple Identities and credentials for each applications. So as an employee I would be using one credentials to access Internal Applications and different credentials for External SAAS Applications. Things gets worst when there are multiple SAAS applications you have to work with.

There is a strong need of an Hybrid Identity which allows you to have consistent persona inside your organization and outside with public SAAS Applications. So I should be using the same credentials to access Internal LOB App to raise my expense report and same credentials to access Salesforce.com. This concept of Hybrid Identify will also enhance users productivity as they don't have to manage and remember multiple credentials.

For IT team, it would be easier for them to manage one user credential and enables streamlining of provisioning and granting access to different applications depending upon users persona, roles and responsibilities in the organization.

Modern Device Management – As employees are now bringing their own devices and accessing internal & Enterprise Cloud applications and carry sensitive information in those emails, apps and files, there is a strong need for doing some basic device management of personal Devices. Since its BYOD and Personal Devices, organization may not be looking at putting in-depth restrictions on those devices like blocking the camera or SD Card but pushing some basic security policies like PIN and password policy should be Okay. It should be reasonable to expect that devices on which corporate data is residing it should not be naked (without PIN/Password protection) which anybody can pick and start interacting with the device, Apps and data on it.

With Modern device management its also important that Employees has all that on their devices which makes them real productive on the Go for e.g Native LOB Apps for Devices, VPN Profiles, Email Profiles, Corporate WiFi profiles etc. All these and more can be automatically provisioned on the device as and when they enrol their device to access corporate applications.

In Corporate Owned Devices which are given to employees to do specialised tasks, Organization may want to have more control on the devices like disabling the camera, SD card, Access to browser etc.

Information and Data Protection – BYOD and enabling access to corporate applications and data on personal devices does boost employee’s productivity but it does pose acute threat in leaking and lost of those sensitive, confidential data to wrong hands. In a successful Enterprise Mobility strategy Information and Data protection is a strong requirement. Often with the solutions available in the market, data security solutions are often really restricting which in return reduces flexibility, user experience and employee productivity. there is a need to strike the right balance with protecting the data on personal devices at the same time keep user experience and productivity intact.

In the next post, we’ll talk about how Microsoft is catering to these critical services over an above the investments in the Operating Systems.

Stay tuned and Cheers !

Microsoft unveils Windows 10

IftekharH — Tue, 30 Sep 2014 11:18:06 GMT

Today in San Francisco, Microsoft unveils Windows 10, the next Windows Operating System Platform.

You can read the Windows Blog post from details on what we announced today.

While Windows 10 brings back the Start Menu and other great enhancements from the UI perspective, its also going to great for Enterprises from Security, manageability and data protection perspective.

You can read more about the announcement from the enterprise perspective here on Official Windows for Business Blog.

Cheers.

Reimagining Enterprise Mobility: Microsoft Mobility Stack–Part 1

IftekharH — Mon, 01 Sep 2014 11:18:07 GMT

Enterprise mobility is more than a set of services which an organizations can deploy to enable a rich mobile work environment. There is a huge play of the Operating system platform you use to enable Mobility directly from the platform itself.

Today I am going to talk about how Windows 8.1 and Windows Server 2012 R2 is built on a strong foundation of this whole philosophy of Mobility, While Windows 8.1 has been around for a while and lot has been said and written about its capabilities but it doesn't hurt to review them again and how it enables a Flexible Workstyle or Mobility. If you are an IT PRO, it will help you take steps towards thinking about your Enterprise Mobility Strategy and enable your users to be more productive on the go by harnessing these capabilities out of the box.

Windows Tablets and 2 in 1 Devices: With Windows 8.1 now powering Tablets and 2 in 1 Devices (Hybrids) Computing has gone to a whole new level. Now you don't need a place to sit and a desk to place your mouse and keyboard to be productive. With these devices with Modern apps and touch optimized Interface of Windows 8.1 you can be productive while on the move (even when you are standing in the queue waiting to order your favourite coffee at Starbucks) and still is business ready so corporate IT teams can control it. In short, Windows 8.1 is the Business Personal device.

Windows To Go : Windows To Go is an enterprise feature of Windows 8.1 that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on any PCs that meet the Windows 7 or Windows 8 certification requirements, regardless of the operating system running on the PC. Windows To Go workspaces can use the same image enterprises use for their desktops and laptops and can be managed the same way. So next time you are traveling to your branch office and you are certain to find a PC Hardware, you can now travel light with your Windows to Go drive along with all your applications, customizations, data and settings.

DirectAccess: Windows 8.1 Enterprise provides capabilities like DirectAccess which allows you to seamlessly connect to corporate network without launching VPN client and dialing in. As and when you connect to a Internet connection whether at home or at public hotspot you’ll securely get connected to your corporate network. Trust me you’ll love this confidence of being “Always on LAN” while sitting at your favourite coffee shop.

Bitlocker and Bitlocker to Go : “Superpowers (read Mobility) often comes with great responsibility..!”. Responsibility to protect corporate sensitive and confidential data from leak and theft. With Bitlocker in Windows 8.1 PRO and Enterprise encrypts your hard disk and prevents data loss in the event of device theft or Loss. Bitlocker to Go allows you to also encrypt your mobile HDD and USB Flash drives while carrying sensitive data. I am not sure about you but I tend to loose those tiny little things all the time…

Workplace Join: A Windows 8.1 PC was either domain joined or not. If it was a member of the domain, the user could access corporate resources (if permissioned) and IT could control the PC through group policy and other mechanisms. With the advent of BYOD, Employees are now more comfortable with working on the devices of their choice even if it means non-corporate approved devices. Workplace Join allows a middle ground between all or nothing access, allowing a user to work on the device of their choice and still have access to corporate resources IT administrators now have the ability to offer finer-grained control to corporate resources. If a user registers their device, IT can grant some access while still enforcing some governance parameters on the device. One of the benefit of Workplace Join is single sign-on and access to corporate data and apps. Who likes entertaining multiple login prompts?

Oh did I mention, Workplace join is now not limited just to Windows 8.1. You can now Workplace join your Windows 7 and iOS and gain secure access to corporate resources.

Work Folders: With most of us now have more than 1 devices in our lives, there are more reasons than ever to have our documents and data synced across all those devices securely. One of reason of mobility is the freedom to use any device, right? Not every organisation has deployed SharePoint with OneDrive for Business to enable fidelity of documents on multiple devices. Work Folders allows your work documents to be available on all your devices from a centralized file share. So you create document on one device and consume it on a different device, while its fully backed up on your organizations file server.

In my next few posts, I'll talk about what are the other technologies from Microsoft helps you deliver an end to end Enterprise Mobility in your organization.

Till then, Cheers. !