{"id":702,"date":"2018-05-16T21:00:55","date_gmt":"2018-05-16T21:00:55","guid":{"rendered":"https:\/\/cloudblogs.microsoft.com\/microsoftsecure\/?p=82701"},"modified":"2018-05-16T21:00:55","modified_gmt":"2018-05-16T21:00:55","slug":"securing-the-modern-workplace-with-microsoft-365-threat-protection-part-4","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/securing-the-modern-workplace-with-microsoft-365-threat-protection-part-4\/","title":{"rendered":"Securing the modern workplace with Microsoft 365 threat protection \u2013 part 4"},"content":{"rendered":"

This post is authored by Debraj Ghosh, Senior Product Marketing Manager, Microsoft 365 Security.\u00a0<\/em><\/p>\n

Responding to ransomware in the Modern Workplace<\/h2>\n

Over the last few weeks, we have shared the roots of Microsoft 365 threat protection<\/a> and how Microsoft 365 threat protection helps protect<\/a> against and detect<\/a> a modern ransomware attack. Today, we conclude our blog series by discussing how Microsoft 365 threat protection can help respond to attacks and also helps educate and raise awareness of threats to end users. In our ransomware scenario, once the threat has been detected, Microsoft 365 also helps respond and remediate with automation playing a key role in making the response more manageable, accurate, and less time consuming for administration. Microsoft 365 threat protection response and remediation services are shown in figure 1 below.<\/p>\n

Figure 1. Microsoft 365 threat protection helps detect threats to the modern workplace<\/em><\/p>\n

In our ransomware scenario, Windows Defender Advance Threat Protection (WDATP) alerts security operations teams about suspicious activities such as programs launching self-replicating copies. If the ransomware does manage to infect multiple devices, WDATP automatically investigates alerts, applies artificial intelligence to determine whether a threat is real and then decides what action to take. It then automatically remediates the threat from affected endpoints to stop further damage as shown in figure 2.<\/p>\n

\"\"<\/p>\n

Figure 2. WDATP automation mapping the propagation of a threat<\/em><\/p>\n

WDATP provides manual machine level responses, such as isolating a machine to contain the threat. Further, forensic data is collected to better understand the attack and the attacker. WDATP also includes file level response by quarantining or blocking malicious files. Azure Security Center also leverages automation by helping orchestrate these common security workflows:<\/p>\n