In 2020, Microsoft expanded their plans for Microsoft Defender. To unify their security offerings across Microsoft 365 and Azure, they introduced new functionality and capabilities for Defender. This would allow an organisation’s security team to theoretically manage large portions of their cyber security systems from one dashboard.
Despite trying to simplify their security offering, though, the unification of Microsoft’s cloud security into Defender created some difficulties for users. The many different iterations or segments of Defender can be very confusing for newcomers. Seeing the many different names that Defender has, alongside all the acronyms associated with them, is enough to confuse even seasoned cyber security veterans.
We understand the confusion, so we have decided to create a brief guide that covers what Microsoft Defender is as well as some of the key stacks within it. Whilst we can’t cover everything in this blog, keep an eye out for more content in the future which will further discuss Microsoft Defender’s complexity.
What is Microsoft Defender?
Simply put, Microsoft Defender is an extended detection and response (XDR) solution, made up of two security stacks: Microsoft 365 Defender and Azure Defender. Its main aim is to protect every aspect of an organisation’s IT infrastructure from cyber threats, both on-premises and in the cloud.
Practically speaking, Defender is composed of the products and services within Microsoft 365 Defender and Azure Defender. Each of these products and services protects a different aspect of an organisation’s infrastructure. Depending on the requirements of your business, you almost certainly won’t use every product and service within each stack. Instead, you will use the ones that you need to ensure unprotected aspects of your IT infrastructure are secure.
What is Microsoft Defender for Endpoint?
Previously known as Defender Advanced Threat Protection, Microsoft Defender for Endpoint provides cloud-based protection, threat investigation, detection, and response for every endpoint within an organisation. Defender for Endpoint is a complete endpoint detection and response (EDR) solution.
When combined with the other aspects of Defender, Defender for Endpoint ensures that cyber threats can’t breach your organisation’s endpoints through a variety of means. It also reduces the ability for threats to spread between endpoints.
What is Microsoft Defender for Identity?
Previously known as Azure Advanced Threat Protection (noticing a trend here?), Microsoft Defender for Identity actively protects on-premises active directories from compromise by employing cloud-based learning algorithms.
It achieves this by monitoring all your active directory accounts for suspicious activity and alerting your security team to any threats that might need investigation. It also protects against well-known cyber threats that specifically target active directories.
What is Microsoft Defender for Office 365?
Microsoft Defender for Office 365, previously called Office 365 Advanced Threat Protection, protects against and investigates malicious emails, URLs, and files stored in cloud services. These can include OneDrive for Business, SharePoint, and more.
This kind of cloud storage protection is vital, as more and more businesses rely on a workforce that operates in a hybrid environment. Employees need to be able to access files and emails from anywhere in a safe and secure way. Microsoft Defender for Office 365 provides this, and then some.
What is Microsoft Cloud App Security?
Microsoft Cloud App Security (MCAS) is the only aspect of Defender on this list that hasn’t changed its name. Classified as a cloud access security broker, MCAS is tasked with protecting SaaS applications present within your Defender environment. This includes any third-party applications, such as Amazon Web Services, which is especially useful for organisations that rely on a variety of different applications for their day-to-day business.
MCAS is capable of detecting and investigating suspicious behaviour before alerting your security team to the potentially dangerous activity which could be associated with a cyber threat.
We’ve chosen to cover several of the most important aspects of Microsoft Defender, but there are many more. Are you looking to experience the benefits Microsoft Defender can bring to your business? Are you struggling to set up Defender and want to know where to start? Or do you just need some advice on how to get the most out of Defender?
Get in touch with Wizard Cyber today. Our Microsoft-certified cyber security experts will be happy to walk you through what Microsoft Defender can do for your business, as well as answer any questions you might have.
