Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Threat Intelligence

4/19/2018
09:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Microsoft CISO Talks Threat Intel, 'Data Inclusion'

Dark Reading caught up with Microsoft's Bret Arsenault to discuss intelligence, identity, and the need to leverage more diverse datasets.

RSA CONFERENCE 2018 – San Francisco – The need to simplify security drove Microsoft to break its strategy into three distinct parts: platform, intelligence, and partnerships. It was the importance of data that CISO Bret Arsenault focused on during an interview with Dark Reading this week at the RSA Conference. 

"Intelligence, in general, is a big differentiator in how we think about security now, versus what we could do five years ago or ten years ago," Arsenault said. While Microsoft is securing everything in its Windows platform by default establishing partnerships in the public and private sector, it's the company's massive, diverse data store that's shaping its strategy.

The effectiveness of artificial intelligence and machine learning, two of the biggest buzzwords circling the security industry (along with blockchain), heavily rely on data, Arsenault said. Threat intelligence became core to Microsoft's plans fifteen months ago, following a $1 billion investment to integrate security across its products and services.

Throughout 2016, those funds went toward projects such as doubling the number of security execs and launching the Microsoft Enterprise Cybersecurity Group (ECG) and Cyber Defense Operations Center (CDOC). By the end of the year, Arsenault said, Microsoft had seen a shift away from the "spray and pray" approach to security and toward better detection and response, fueled by threat intelligence. The need for data has only intensified.

"What I know about artificial intelligence and machine learning is the accuracy of those things is very highly correlated to the amount of the data you have," he explained. However, while the size of the dataset certainly matters - Microsoft's data repositories more than double each year, he noted - even more important is the information's quality.

Data Diversity vs. Inclusion

"A diverse workforce creates better products," said Arsenault. "Diversity of data is equally, if not more important than the amount of data."

Some companies mostly handle a single data type; he pointed to telecom companies, which primarily handle network traffic, as an example. Microsoft, with a large and varied portfolio of products and services, collects network data, device data, and identity data, Arsenault noted. The company has data on the one billion machines it updates each month. It gathers cloud data, which is pulled from Azure business services and varies across industries.

Yet it's not enough to only be diverse, Arsenault pointed out. Having a rich set of data means little without inclusion, or putting it to practical use. "Diversity is interesting, but inclusion has created a whole new priority," he added. Businesses often place more emphasis on diversity of data than inclusion.

Looking ahead, Arsenault touched on an idea that was top of mind for many security pros during RSA: the rise of cloud and disbanding of the traditional perimeter. As we operate in a client-to-cloud world, the idea of the network as a control point has eviscerated in its effectiveness, he explained. Now the most effective control point is users' identities.

"You have to go really hardcore at the device piece, because the network is dissolving," he said. One of Arsenault's priorities is to eliminate passwords within Microsoft, where in the past year 66% of users log into Windows Hello for Business with biometrics or PIN. Employees are encouraged to shift away from passwords, which they are only required to change once a year.

Related Content:

Interop ITX 2018

Join Dark Reading LIVE for an intensive Security Pro Summit at Interop IT X and learn from the industry’s most knowledgeable IT security experts. Check out the agenda here.Register with Promo Code DR200 and save $200.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/20/2018 | 8:41:15 AM
Passwords
Glad to hear MS is trying to shift away from passwords. They are inherently insecure and without a password policy driving complexity and password expiration they become eternally instantiated.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
4/20/2018 | 8:44:02 AM
Discovery vs Inclusion
Discovery and Diversification are helpful when trying to shape intelligence but similar to unreviewed logs lack of inclusion into practical process limits their effectiveness. The transition from non-inclusion with D&D to inclusion can be described as the transition from satisfying a compliance check-box to more of a security best practice approach.
Edge-DRsplash-10-edge-articles
7 Old IT Things Every New InfoSec Pro Should Know
Joan Goodchild, Staff Editor,  4/20/2021
News
Cloud-Native Businesses Struggle With Security
Robert Lemos, Contributing Writer,  5/6/2021
Commentary
Defending Against Web Scraping Attacks
Rob Simon, Principal Security Consultant at TrustedSec,  5/7/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-16632
PUBLISHED: 2021-05-15
A XSS Vulnerability in /uploads/dede/action_search.php in DedeCMS V5.7 SP2 allows an authenticated user to execute remote arbitrary code via the keyword parameter.
CVE-2021-32073
PUBLISHED: 2021-05-15
DedeCMS V5.7 SP2 contains a CSRF vulnerability that allows a remote attacker to send a malicious request to to the web manager allowing remote code execution.
CVE-2021-33033
PUBLISHED: 2021-05-14
The Linux kernel before 5.11.14 has a use-after-free in cipso_v4_genopt in net/ipv4/cipso_ipv4.c because the CIPSO and CALIPSO refcounting for the DOI definitions is mishandled, aka CID-ad5d07f4a9cd. This leads to writing an arbitrary value.
CVE-2021-33034
PUBLISHED: 2021-05-14
In the Linux kernel before 5.12.4, net/bluetooth/hci_event.c has a use-after-free when destroying an hci_chan, aka CID-5c4c8c954409. This leads to writing an arbitrary value.
CVE-2019-25044
PUBLISHED: 2021-05-14
The block subsystem in the Linux kernel before 5.2 has a use-after-free that can lead to arbitrary code execution in the kernel context and privilege escalation, aka CID-c3e2219216c9. This is related to blk_mq_free_rqs and blk_cleanup_queue.