Maintaining Security Hygiene and Threat Awareness

Death, taxes, and threats. These are the three inevitabilities of life that anyone in cybersecurity is familiar with. The first two aren’t something you’ll get help for from here, but we can try to help with the latter with three capabilities: Microsoft Defender Vulnerability Management (MDVM), Microsoft Secure Score (shortened to Secure Score), and Threat Analytics.

In this chapter, you’ll learn how MDVM and Secure Score contribute to your proactive and ongoing cybersecurity posture management, sometimes referred to as security hygiene. The hygiene metaphor is a cliche, but it illustrates the challenge well: we can’t set and forget our hygiene and we cannot do the same with our security posture. Without consistent maintenance, we’ll find that our attack surface increases over time; MDVM and Secure Score can help us with that consistent maintenance. You’ll also learn about using Threat Analytics...

Introducing Secure Score

Secure Score is a service that measures your environment against good security practices. It provides metrics to track your successes (the score), a list of recommendations, and tracking capabilities for those recommendations.

Although it’s managed through the Microsoft 365 Defender portal, even customers without Microsoft 365 Defender licensed features can benefit from Secure Score. That’s because Secure Score is a service that draws data from various parts of the entire Microsoft 365 stack. When you have Microsoft 365 Defender licenses, this includes MDE, MDI, and MDA (and some of the MDA-connected cloud apps). But it also includes Azure Active Directory, Exchange Online, Microsoft Purview Information Protection, and Microsoft Teams.

Score, score, score!

If you’re a Microsoft Defender for Cloud (MDC) user, you’ll also have a secure score in the Azure portal, but this is different from the Microsoft Secure Score. Think...

Exploring the basics of MDVM

Let’s start by considering key information about MDVM before taking a deep dive into using it.

The group of features that are now grouped into MDVM were previously branded Threat & Vulnerability Management (TVM) and are available in MDE Plan 2. As the number of capabilities in TVM grew, it branched out into its own separately marketed product, but MDE P2 customers retained the features originally available in TVM.

Language is a funny thing

At the risk of being pedantic, you need to be aware of the two ways you’ll see TVM mentioned. One refers to a service name, while the other refers to a practice.

Threat & Vulnerability Management (notice the title case) was the previous group name of several MDVM features. In contrast, threat and vulnerability management (notice the lack of title case) is the general term for the practice of managing environmental threats and vulnerabilities.

The evolution of TVM brought with it three...

Understanding your MDVM inventories

Defenders need to know what they’re defending against. As an organization’s scale and complexity increases, so too does tracking your assets and inventories. In Chapter 8, you learned about using device discovery to track hardware assets. MDVM extends this line of defense with its Inventories page (seen in Figure 17.5), which has subsections for Software, Browser extensions, and Certificates to track these in your environment.

When devices are MDE onboarded, this inventory information is fed to the service. To see the software, browser extensions, and certificates across your tenant, head to security.microsoft.com, navigate to Endpoints | Vulnerability management | Inventories, and click on the appropriate tab at the top of the page:

Figure 17.6 – Software, certificate, and browser extension inventories

Alternatively, you can check inventories for an individual device on the device page in its...

Establishing compliance with security baseline assessments

As part of the MDVM add-on capabilities, you can use industry benchmarks to monitor endpoint security posture. Microsoft's own Security Baselines, CIS, or STIG options are available. At the time of writing, CIS can be applied to Windows 10/11 and Windows Server 2008 R2 or later; however, STIG benchmarks are only available for Windows 10 and Windows Server 2019. As time goes on, you can expect to see more benchmarks and OSs being supported.

Security baseline assessments are managed at security.microsoft.com under Endpoints | Vulnerability management | Baselines assessment. You’ll land on the Overview tab which, to start with, will be empty. To get started, go to the Profiles tab and click + Create. The steps that follow will guide you through the profile creation process:

1. The first wizard page lets you enter a Name and Description (optional). You can choose Activate profile or leave this unticked, which...

Addressing security vulnerabilities and recommendations

Throughout this chapter, you’ve learned about MDVM features and examples of how you can use them in operations. In this section, we’ll continue to explore how MDVM gives you tools to stay on top of security recommendations and vulnerabilities, from finding out about them to resolving them.

Identifying vulnerabilities and recommendations

As MDVM converts MDE telemetry to discover vulnerabilities, you can track new vulnerabilities over time at security.microsoft.com by navigating to Endpoints | Vulnerability management | Event timeline. You can think of this as a news ticker or an RSS feed for apps in your tenant with new exploits and vulnerabilities:

Figure 17.12 – The MDVM event timeline

Optionally, you can click the Email notification settings button and follow the wizard to get email alerts about new entries.

A centralized view of security recommendations across MDE...

Using Threat Analytics

Microsoft security experts tune Microsoft 365 Defender to detect and remediate threats. It’s important to consider everything you learn about in this book as part of your defense, but not your defense in its entirety. Your environment is unique, threats change, and recommended practices change with it.

To keep you on top of the changing cybersecurity landscape and emerging threats, Threat Analytics, included in MDE P2, offers the following:

• Detailed analyst reports for noteworthy threats identified by Microsoft
• Contextual information for your environment, such as tenant assets/devices identified as being at risk, or Microsoft 365 Defender alerts
• Email notifications for new or updated reports

Threat Analytics exists to make you a better defender. In addition to seeing if your tenant is at risk, you’ll learn about the latest threats with highly detailed reports, including analysis, detection methods, and mitigation options...

Summary

This chapter has taught you about the Microsoft 365 Defender capabilities to control your cybersecurity hygiene, become aware of detected weaknesses, and remain up to date with the changing cybersecurity landscape.

To kick off, you learned about Secure Score, which acts as a foundational metric and tool for tracking your posture against Microsoft recommendations. You then learned about MDVM: the different versions of its licensing, its inventory benefits, baseline assessment options, and how its security recommendations can be managed from the first point of review to mitigation and remediation. Finally, we concluded this chapter by introducing Threat Analytics, which you can use to keep in the loop about noteworthy threats.

Everything we covered in this chapter can be described as contributing to your proactive security defenses. The benefit of this is that you can prevent attacks rather than only respond to them. To complete the picture, the next chapter, Extended Detection...

Questions

A great way to learn is to test yourself. Take a shot at these questions and see how much you’ve learned:

1. You use a third-party inbound email security tool that rewrites URLs, but Secure Score is penalizing you for not using Microsoft Defender for Office 365’s Safe Links features. Which of the following steps would be appropriate? Choose all that apply.
   1. Set the status to Risk accepted
   2. Set the status to Resolved through a third party
   3. Add a tag with the name of the third-party tool
   4. Set the status to Planned
2. True or false: you can block the execution of known vulnerable apps on macOS.
   1. True
   2. False
3. Which of the following scenarios are supported for browser extension inventories? Choose all that apply.
   1. Windows running Brave
   2. Windows running Edge
   3. Android running Edge
   4. macOS running Edge
4. Which of the following most accurately describes how vulnerable app mitigation works? Choose one.
   1. When you choose to warn or block an app, the local MDAV definitions are updated...

Further reading

Want to read even more about Secure Score, MDVM, or Threat Analytics? Check out the following links:

• Jan Bakker, Microsoft MVP, has a 15-part series that dives into some important Secure Score recommendations, so you can read about what they mean before implementing them: janbakker.tech/category/secure-score.
• Want to experience the MDVM add-on benefits but don’t have the license yet? Check out the official documentation on getting started with a trial: learn.microsoft.com/en-us/microsoft-365/security/defender-vulnerability-management/defender-vulnerability-management-trial.
• Microsoft updates the Secure Score scope regularly, so you can expect its recommendations and therefore your effort in investing in it to improve. You can track the additions to Secure Score here: learn.microsoft.com/en-us/microsoft-365/security/defender/microsoft-secure-score-whats-new.