Slashdot Mirror
Microsoft Brings Post-Breach Detection To Windows 10 (sdtimes.com)
mmoorebz writes: Microsoft is recognizing the increasingly sophisticated cyber attacks on enterprises, which is why it is taking a new approach to protect its customers. Today it announced its new post-breach enterprise security service called Windows Defender Advanced Threat Protection, which will respond to these advanced attacks on companies' networks. Attackers these days are using social engineering and zero-day vulnerabilities to break into corporate networks. According to Microsoft, thousands of attacks were reported in 2015 alone. The company found that it currently takes an enterprise more than 200 days to detect a security breach, and 80 days to contain it. When there is such a breach, the attackers can steal company data, find private information, and damage the brand and customer trust in the company.
Will Windows Defender Advanced Threat Protection flag Windows 10 itself as a security breach after just a few more Windows updates?
It'll be a great tool while Microsoft maintains it for six months, and then it will be even more worthless than Symantec antivirus but people will still trust it.
Just has been the case with every previous Microsoft antivirus/antimalware effort.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
Using Microsoft products is the way into the corporate network. Stop buying junk products with backdoors, air gap, hire good staff and then secure your networks.
Domestic spying is now "Benign Information Gathering"
this stuff already exists under other names.
they fix the symptom. That company is dying, and I see why most of their good employees have fled.
in 10 years they'll probably be selling hot dogs on the street
If you made it so programs couldn't access files outside their install directory, and didn't allow programs to run on startup except by user choice, that'd go a long way to making windows secure. You'd basically have to make an entirely new Os from the ground up, and have backwards compatibility via emulator, but it would be worth it to not easily get a virus with Windows.
If so, will it be renamed Microsoft Ouroboros?
From TFA: "After surveying its own customers, the company found that 90% of IT directors want an advanced threat protection solution that identifies an attack quick, before the breach actually occurs."
Presumably the remaining 10% of Microsoft customers surveyed felt that it is all so pointless, so futile. Windows is a seive. What's the use... we're all doomed... no... point... ... Daisy... Daisy...
I deny that I have not avoided attaining the opposite of that which I do not want.
Complete. Global. Saturation.
Any IT Director of a mid-to-large scale environment who does not have a dedicated intrusion-detection team running open source tools should have his ass fired. Out of a cannon. Into the sun.
Already getting down voted by shills ;)
Wouldn't the first step be to stop snooping through their user's information themselves?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Oh, I've got something here... ah it's on the tip of my tongue... can't quite put my finger on it... something about barn doors and horses... oh....dang it, I lost it.
If it could detect post breach, why couldn't it detect pre-breach?
More useless snakeoil
The reason why it takes so long to detect a breach is the lack of visibility of connections and users to a given computer, the lack of ability to short list suspicious connections in a proper UI, and a lack of tracking files, plus the route they take, if they leave the network.
Implement this and breaches will be a thing of the past.
No, you're getting down-voted because comments 1, 3, and 7 already said effectively the same thing and it wasn't particularly interesting or insightful those times, either.
You do not have a moral or legal right to do absolutely anything you want.
Your choices are rather limited.
like 'get windows 10' app and upgrade offer pop-ups.. always there, always nagging.... so they'll have a 96.734% detection rate just by doing that... not really that hard to code, either. why didn't they do that sooner?
It takes that long to pull the plug?
“He’s not deformed, he’s just drunk!”
but did they discover how quickly a company will ditch the disgusting garbage called windows 10?
Yes that is the standard response when idiots make benign anti-corporation comments that add no value to the discussion, "im being oppressed by corporate minions!" when in actuallity you're just a pointless moron. But by all means keep thinking companies actually care about your psuedonymous opinion in the comments on a website like this and you just keep fighting the good fight.
The hardest thing is to detect waves of attack organized by multiple cybercriminal groups, who agree to go at the same place at the same time. But it's possible to get some samples from competitive meetings, when certain groups compete who gets more information. This kind is usualy linked with online players, and since chat is where most often people with the same interests meet.. But still, it's always at the porno houses where those non sexed teenagers go exchange words.
Ah, I see you received Hillary's email directions for the week. Keep up the good work, comrade! You'll be the last sent to the work camp!
How are they going to extract anything useful from a compromised system, where the attacked can feed MS with fake normal status?
Even worse, a botnet can be used to push poisonous data at large scale
"Microsoft .. post-breach enterprise security service called Windows Defender Advanced Threat Protection"
How about designing a 'computer' that can't be compromised by opening an email attachment or clicking on a web link.
Nah, I would go with M$ marketdroids burning up their modding rights, clearly modding based upon comments not fulfilling M$ marketing requirements. Settle down, how many ad homini attacks by M$ marketdroids attacks are simply let slide because everyone has become so used to them as normal behaviour for M$ makertdroids they stop bothering modding them or replying to them, except when the mood strikes. Reality is any security software that does not skip past M$ antics as ask the end user whether they want to shut down all the probes is failed security software, suck up the criticisms, along with all the other private information being sucked up, want to be a perv expect to be treated like a perv http://www.urbandictionary.com... seriously look at that word association, nobody likes a perv. M$ is becoming the brand that everyone just looks at and goes ewww, perv and limit contact with them.
Chaos - everything, everywhere, everywhen
Whats funny is you think microsoft would actually care about what you think.
Julian Assange got some post breach detection, Swedish style :)
A bad joke, I know....
to FIX the security issues FIRST?
As long as Windows is the least secure system in common use, finding out after the fact is no help at all.
Not even closing the barn door.
just install debian and not an "os" with backdoors lol...
What happens when post-breach detection system is breached?
...they will finally come up with a solution to clean Conficker.B infections from corporate systems?
It will detect that windows was installed?
Sort of AutoStart message-box?
That has been the goal, the issue is that the goal posts are constantly moving. As soon as one hole is patched, at least one more is found elsewhere. No system is 100% secure, and never will be. There will always be exploits and ways in. Think of the bogus "Microsoft Support" phone calls that are out there. These are people initiating a connection to a remote "hacker". How do you secure against that at the OS level?