Protecting an organization from advanced attacks is no easy task. Year after year, breaches seem to get worse, even as we hear about improvements in security controls. CISOs are left to wonder if they need to spend more on cyber security, or if their tools or personnel are not performing as expected. Understandably, answers are unique to each organization and its security strategy.

According to Ernst and Young’s 2020 paper titled “How does security evolve from bolted on to built-in?”:

• 20% of organizations are extremely confident that cyber security risks and mitigation measures presented to them can protect the organization from major cyber attacks.
• 25% of organizations can financially quantify the effectiveness of their cyber spend.
• 26% of breaches in the past 12 months were detected by the security operations center (SOC).

This paper explores best practices for getting in front of these issues by measuring cyber security control effectiveness. It covers the origin, capabilities and selection criteria for security validation technologies.

This past winter, FireEye uncovered a widespread campaign conducted by a threat group we labeled UNC2452. In some of the intrusions linked with this campaign, the attackers used their access to on-premises networks to infiltrate Microsoft 365 environments. An estimated 60,000 organizations have been affected.

Because there is no formal security boundary between on-premises networks and cloud services provided by Microsoft 365, a thorough review of potentially affected cloud environments may be necessary.

This paper can help you understand the nature of this attack and outline steps you can take to detect and protect your potentially compromised environments. You can learn about:

• The four main techniques threat actors are using to exploit Microsoft 365
• Actionable detection and remediation strategies for each threat
• Hardening recommendations for your Microsoft 365 environment