Slashdot Mirror
Microsoft Brings Post-Breach Detection To Windows 10 (sdtimes.com)
mmoorebz writes: Microsoft is recognizing the increasingly sophisticated cyber attacks on enterprises, which is why it is taking a new approach to protect its customers. Today it announced its new post-breach enterprise security service called Windows Defender Advanced Threat Protection, which will respond to these advanced attacks on companies' networks. Attackers these days are using social engineering and zero-day vulnerabilities to break into corporate networks. According to Microsoft, thousands of attacks were reported in 2015 alone. The company found that it currently takes an enterprise more than 200 days to detect a security breach, and 80 days to contain it. When there is such a breach, the attackers can steal company data, find private information, and damage the brand and customer trust in the company.
Will Windows Defender Advanced Threat Protection flag Windows 10 itself as a security breach after just a few more Windows updates?
It'll be a great tool while Microsoft maintains it for six months, and then it will be even more worthless than Symantec antivirus but people will still trust it.
Just has been the case with every previous Microsoft antivirus/antimalware effort.
The Christian Right is Neither (Christian nor right). See: Matthew 23, Matthew 25, Ezekiel 16:48-50
Using Microsoft products is the way into the corporate network. Stop buying junk products with backdoors, air gap, hire good staff and then secure your networks.
Domestic spying is now "Benign Information Gathering"
If so, will it be renamed Microsoft Ouroboros?
From TFA: "After surveying its own customers, the company found that 90% of IT directors want an advanced threat protection solution that identifies an attack quick, before the breach actually occurs."
Presumably the remaining 10% of Microsoft customers surveyed felt that it is all so pointless, so futile. Windows is a seive. What's the use... we're all doomed... no... point... ... Daisy... Daisy...
I deny that I have not avoided attaining the opposite of that which I do not want.
Complete. Global. Saturation.
You always lose your best people after your stock prices goes up so much.
Any IT Director of a mid-to-large scale environment who does not have a dedicated intrusion-detection team running open source tools should have his ass fired. Out of a cannon. Into the sun.
Already getting down voted by shills ;)
Wouldn't the first step be to stop snooping through their user's information themselves?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I dunno, fixing symptoms can be pretty darn helpful to a patient when fixing the problem is a challenge (or even when it wasn't). If you send someone out the door with antibiotics and a 106F fever, you might be fixing the original problem, but I think they'd like a little help with the symptoms too.
I suppose it then matters what the product was before the sticker was slapped on it. Does anyone know who they bought out for this?
Problem: Humans make mistakes.
Solution: None yet
In all seriousness, companies need to make a tradeoff between security and productivity. The biggest security problem is social engineering. You can't solve this problem.
The reason why it takes so long to detect a breach is the lack of visibility of connections and users to a given computer, the lack of ability to short list suspicious connections in a proper UI, and a lack of tracking files, plus the route they take, if they leave the network.
Implement this and breaches will be a thing of the past.
No, you're getting down-voted because comments 1, 3, and 7 already said effectively the same thing and it wasn't particularly interesting or insightful those times, either.
You do not have a moral or legal right to do absolutely anything you want.
It takes that long to pull the plug?
“He’s not deformed, he’s just drunk!”
You don't make money selling another product or service if you fix the symptom.
How are they going to extract anything useful from a compromised system, where the attacked can feed MS with fake normal status?
Even worse, a botnet can be used to push poisonous data at large scale
"Microsoft .. post-breach enterprise security service called Windows Defender Advanced Threat Protection"
How about designing a 'computer' that can't be compromised by opening an email attachment or clicking on a web link.
Julian Assange got some post breach detection, Swedish style :)
A bad joke, I know....
Not everyone hated Vista. Many OEM's saddled it with 512-MB of RAM and single core slow CPU's. With 3 or more GB of RAM 64-bit Vista runs conventional programs as fast as Windows 7. Our shop only built custom PC's with 64-bit Vista that had 4-GB RAM or more. These ran circles around 32-bit XP machines, after fully booted. Vista is, and always will be, the slowest booting OS that MS every made. Once booted, it runs okay.
That has been the goal, the issue is that the goal posts are constantly moving. As soon as one hole is patched, at least one more is found elsewhere. No system is 100% secure, and never will be. There will always be exploits and ways in. Think of the bogus "Microsoft Support" phone calls that are out there. These are people initiating a connection to a remote "hacker". How do you secure against that at the OS level?