Security Unlocked

Ever wonder why it's so difficult to really secure a network, systems or data? Cyber criminals are stepping up their game, even as security gets stronger and stronger, and they’re using all sorts of new techniques to break through enterprise walls. In this episode, hosts Nic Fillingham and Natalia Godyla speak with Donal Keating, Director of Innovation and Research for the Microsoft Digital Crimes Unit, about one of the key findings in the latest Microsoft Digital Defense Report: how attackers are adapting and becoming more sophisticated. Plus how social engineering is revealing the true weakest link in any security plan -- and it’s something you might not expect. 

Then they dive into what it’s like to hunt threats with Michelle Lam, who brings fresh eyes to every security problem she faces at Microsoft. She explains why not spending time in a SOC early in her career helps her spot potential attacks others might miss, and why she’s so passionate about helping serve under-represented communities and inspiring the next generation of security professionals. 

In This Episode, You Will Learn:

• How cyber attackers are using the cloud 
• Why humans are the weakest link in every security system 
• The new steps cyber criminals are taking to get people to trust them 
• How threat hunters look for malicious activity 
• How networking helps young security professionals 

Some Questions We Ask:   

• What new threat trends are emerging? 
• How should security professionals prepare for new threats? 
• What is a homoglyph? 
• Why is threat hunting a uniquely human-based activity? 

Resources

Microsoft Digital Defense Report, September 2020 

Donal’s LinkedIn

Michelle’s LinkedIn

Nic’s LinkedIn

Natalia’s LinkedIn

Microsoft Security Blog

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

In this episode, hosts Nic Fillingham and Natalia Godyla speak with Sharon Xia, a principal program manager for cloud and AI at Microsoft, about the role machine learning plays in security. They discuss four major themes, outlined in the Microsoft Digital Defense Report, including how to prepare your industry for attacks on machine learning systems, preventing attack fatigue, democratizing machine learning and leveraging anomaly detection for post-breach detection. 

Then they speak to Emily Hacker, a threat intelligence analyst at Microsoft, about her path from professional writing to helping find and stop attacks.

In This Episode, You Will Learn:

• How to prepare for attacks on machine learning systems 
• The dangers of a model poisoning attack 
• Why it’s important to democratize machine learning 
• How a humanities background helps when tracking threats 
• The latest methods attackers are using for social engineering 

Some Questions We Ask:

• Why are most organizations not prepared for ML attacks? 
• How do you assess the trustworthiness of an ML system? 
• How can machine learning reduce alert fatigue? 
• What kind of patterns are analysts seeing in email threats? 
• Why is business email compromise treated differently than other threats?  

Resources 

Microsoft Digital Defense Report, September 2020

Sharon’s LinkedIn

Emily’s LinkedIn

Nic’s LinkedIn

Natalia’s LinkedIn

Microsoft Security Blog

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

In this episode, hosts Nic Fillingham and Natalia Godyla speak with Mike Flowers and Cole Sodja of the Microsoft Protection Team, and Justin Carroll of the Microsoft Threat Intelligence Global Engagement and Response team, about how they’re using machine learning to identify and model lateral movement attacks.

Then they speak to Dr. Anna Bertiger, Senior Applied Scientist at Microsoft, on how she’s using math to catch villains and make computer networks safer.

In This Episode, You Will Learn:

• What are lateral movement attacks
• How machine learning helps address security challenges
• Why grouping attack data can help better prevent threats
• How math is used to help analyze attack trends
• How AI and ML help identify patterns that can stop attacks

Some Questions We Ask:

• What are the most challenging parts of identifying lateral movement attacks?
• How does machine learning help understand how attacks would happen in the future?
• How do attackers change techniques as security techniques change?
• How do you use math to determine if an action is dangerous or benign?
• What is so beautiful about math?

Resources:

Microsoft Security Blog

Mike, Cole & Justin’s Blog Post

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

In this episode, hosts Nic Fillingham and Natalia Godyla speak with Hardik Suri of the Microsoft Defender ATP Research Team about using behavior-based detection and machine learning to block attacks against Exchange servers, and why it’s so critical to patch and enable security capabilities.  

Then they speak to Dr. Karen Lavi, a Senior Data Science Lead in the Microsoft Defender Research Team, on the neuroscience of threat detection, and how her team is using AI and machine learning to predict and prevent malware attacks. 

In This Episode, You Will Learn:  

• Why Exchange servers are so vulnerable 
• The best way to defend against web shells 
• The simple things security professionals can do to protect under-protected servers 
• How neuroscience factors into threat detection 
• How to catch ‘patient zero’ in an attack 

Some Questions We Ask:  

• How are techniques for detecting and blocking attacks evolving?  
• What’s next for behavior-based blocking?  
• How does machine learning benefit security?  
• How do you build a diverse team to catch threats?  
• What’s the next innovation in security research?  

Resources:

Microsoft Security Blog 

Hardik’s blog post

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

There are all kinds of powerful features baked into the Windows operating system. One of them is the Antimalware Scan Interface or AMSI. In this episode, hosts Nic Fillingham and Natalia Godyla speak with Ankit Garg and Geoff McDonald of the Microsoft Defender ATP Research Team to learn how AMSI operates, and how they’re utilizing ML to stop attacks. 

Then they speak with Dr. Josh Neil, a Principal Data Science Manager at Microsoft, about his unique path from music to data security, and why his team is sniffing through weak signals to detect attack patterns. 

In This Episode, You Will Learn:  

• How AMSI protects against threats 
• How machine learning makes it easier to catch attacks 
• The way security experts think about attack methodology 
• How computers can think unlike human brains to solve problems 
• The innovations coming to the world of data science 

Some Questions We Ask:  

• What is AMSI?  
• How do you differentiate between the benign and malicious?  
• What’s next for cloud machine learning?  
• How do define AI  
• How does music theory impact your work?  

Resources:

Microsoft Security Blog 

Ankit & Geoff’s blog post

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

In this episode, hosts Nic Fillingham and Natalia Godyla speak with Arie Agranonik, a Senior Data Scientist in the Microsoft Defender ATP Research team, about building models using deep learning to protect against malicious attacks. It’s complicated work, requiring huge computing power and even larger amounts of data, and it could be the future of threat protection. 

They also speak with Holly Stewart, a Principal Research Lead at Microsoft, on how building a security team with different perspectives helps to better understand and stop threats. Plus, her journey from the Peace Corps to Microsoft, and how that informs her decision-making. 

In This Episode, You Will Learn:  

• The difference between deep learning, machine learning and AI 
• Why it’s so difficult to program a computer to think like a human 
• How adversarial models learn from each other to prevent attacks 
• Why the best security teams are made up of those with different perspectives 
• How data science can train machines to find things humans were not thinking about 

Some Questions We Ask:  

• What is deep learning?
• Does a neural network mimic the way the human brain functions?
• How are behavioral observations evolving to combat sophisticated attacks? 
• How do AI and ML factor into solving complicated security problems?
• What’s next on the horizon for data science? 

Resources:

Microsoft Security Blog 

Arie’s blog post

View Arie Agranonik on LinkedIn

View Nic on LinkedIn 

View Natalia on LinkedIn 

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.

Security Unlocked explores the technology and people powering Microsoft's Security solutions. In each episode, Microsoft Security evangelists Nic Fillingham and Natalia Godyla take a closer look at the latest innovations in threat intelligence, security research, and data science, with a special focus on demystifying artificial intelligence and machine learning. Be sure to listen in and subscribe!

Related:

Listen to: Afternoon Cyber Tea with Ann Johnson

Listen to: Security Unlocked: CISO Series with Bret Arsenault 

Discover and follow other Microsoft podcasts at microsoft.com/podcasts

Security Unlocked is produced by Microsoft and distributed as part of The CyberWire Network. 

Produced by Hangar Studios

Hosted on Acast. See acast.com/privacy for more information.