Microsoft's Cyber Defense Ops Center Shares Best Practices

Microsoft gets a birds eye view of the various types of cyber threats that happen around the world because of their vast cloud service portfolio, data centers that support those cloud services, and the customers using those services. That unique perspective allows the company to fine tune their approach to monitoring and responding to these threats each day.

Richard Hay, Senior Content Producer

January 18, 2017

2 Min Read
Microsoft's Cyber Defense Ops Center Shares Best Practices
Microsoft Cyber Defense Operations Center (Image courtesy of Microsoft)

According to Microsoft, they have a view of the ever evolving cyberthreat landscape because of the fact they oversee more than 200 cloud based services, more than 100 datacenters, millions of devices, and over a billion customers around the globe.

All of this data and experience comes together in one place for Microsoft at the companies Cyber Defense Operations Center, CDOC for short, where they perform 24/7 monitoring to detect these cyber attacks in real time. This facility was opened in November 2015 and their automated platform can respond to a detected DDoS attack within 90 seconds while the team members work to mitigate the attack vector and sources.

"In the year since opening, we have advanced the policies and practices that accelerate the detection, identification and resolution of cybersecurity threats, and have shared our key learnings with the thousands of enterprise customers who have visited the CDOC. Today, we are sharing a Cyber Defense Operations Center strategy brief that details some of our best practices for how we Protect, Detect and Respond to cyberthreats in real time."

The company breaks down those three key areas of response for these cyberthreats like this:

Protect

  • Extensive monitoring and controls.

  • Software-defined networks.

  • Multifactor authentication.

  • Non-persistent administration using.

  • Proper hygiene.

  • Microsoft Malware Protection Center’s.

  • Threat modeling and attack surface analysis.

  • Classifying data.

  • Awareness training.

Detect

  • Monitoring network and physical environments.

  • Identity and behavioral analytics.

  • Machine learning.

  • Advanced analytical tools and processes.

  • Automated software-based processes.

  • Data scientists and security experts.

Respond

  • Automated response systems.

  • Well-defined, documented and scalable incident response processes.

  • Subject matter expertise.

  • Wide enterprise searching.

  • Deep forensic analysis.

  • Microsoft’s security software tools, automation and hyper-scale cloud infrastructure.

I am sure many of your organizations are looking to improve your own plans for dealing with any cyberthreats or other attacks against your own infrastructure so be sure to check out the full Cyber Defense Operations Center strategy brief (PDF, 1.88MB, and nine pages).

This document contains even more background and details about Microsoft's own experience and responses to attacks and other online threats.

----------

Looking for an awesome, no-nonsense technical conference for IT Pros, Devs, and Devops? Check out IT/Dev Connections!

IT/Dev Connections

Read more about:

Microsoft

About the Author

Richard Hay

Senior Content Producer, IT Pro Today (Informa Tech)

I served for 29 plus years in the U.S. Navy and retired as a Master Chief Petty Officer in November 2011. My work background in the Navy was telecommunications related so my hobby of computers fit well with what I did for the Navy. I consider myself a tech geek and enjoy most things in that arena.

My first website – AnotherWin95.com – came online in 1995. Back then I used GeoCities Web Hosting for it and WindowsObserver.com is the result of the work I have done on that site since 1995.

In January 2010 my community contributions were recognized by Microsoft when I received my first Most Valuable Professional (MVP) Award for the Windows Operating System. Since then I have been renewed as a Microsoft MVP each subsequent year since that initial award. I am also a member of the inaugural group of Windows Insider MVPs which began in 2016.

I previously hosted the Observed Tech PODCAST for 10 years and 317 episodes and now host a new podcast called Faith, Tech, and Space. 

I began contributing to Penton Technology websites in January 2015 and in April 2017 I was hired as the Senior Content Producer for Penton Technology which is now Informa Tech. In that role, I contribute to ITPro Today and cover operating systems, enterprise technology, and productivity.

https://twitter.com/winobs

Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like