Speaker 1: Okay, so get ready to dive headfirst into the world
Speaker 1: of cybersecurity. We're talking about prepping for the Microsoft SC
Speaker 1: two hundred exam, becoming a Microsoft Security Operations analyst.
Speaker 2: You got it.
Speaker 1: And let me tell you, this is way more than
Speaker 1: just building firewalls these days. It's like being like a
Speaker 1: digital detective, right, We're piecing together clues from all these
Speaker 1: cyber threats that are constantly changing.
Speaker 2: Yeah, and this deep dive is perfect for that because
Speaker 2: we're going way beyond just like passing the exam. We're
Speaker 2: going to actually be applying these concepts to, you know,
Speaker 2: what's happening in the real world. You'll see how this
Speaker 2: stuff from the SC two hundred material actually translates to
Speaker 2: what someone's doing every day defending against like real cyber
Speaker 2: threats exactly.
Speaker 1: And like, one thing that really jumped out of me
Speaker 1: when I was looking at this was this whole shift
Speaker 1: right from like the old way of doing security, perimeter
Speaker 1: based security, to what everyone's calling zero trust. And it
Speaker 1: kind of makes sense when you think about it, right,
Speaker 1: Like in the past, it was all about protecting the
Speaker 1: castle wall, but nowadays these attackers are like what finding tunnels,
Speaker 1: they're flying over the walls. It's a whole different game now.
Speaker 2: It's a great analogy, and honestly, that old perimeter focused
Speaker 2: model where you're just relying on firewalls and VPNs, it's
Speaker 2: just not enough anymore, especially in a world with cloud computing,
Speaker 2: everyone's working remotely, bring your own device, right, You can't
Speaker 2: just assume that everything inside your network is self and
Speaker 2: trustworthy anymore.
Speaker 1: Yeah, you're right, you can't. You just can't, so enter
Speaker 1: zero trust, right, It's like instead of blind faith, it's
Speaker 1: verify and then trust. Every single access attempt has to
Speaker 1: be validated. I'm talking users, devices, applications, no exceptions.
Speaker 2: And that's where it gets really challenging for security analysts
Speaker 2: these days, because they're no longer just watching the perimeter.
Speaker 2: They're dealing with this constant flood of data from every
Speaker 2: corner of the network. It's like trying to, I don't know,
Speaker 2: drink from a fire hose and figure out which drops
Speaker 2: of water are actually going to hurt you.
Speaker 1: That's intense and that's got to be where tools like
Speaker 1: Microsoft Defender for Endpoint or MD come in, right. Yeah,
Speaker 1: Because from the stuff you shared, it sounds like these
Speaker 1: solutions are using AI and all this behavioral analytics to
Speaker 1: kind of make sense of all that data and highlight
Speaker 1: the truly suspicious activity exactly.
Speaker 2: Instead of relying on like static rules that attackers can
Speaker 2: pretty easily bypass, MD is looking at normal user behavior, okay,
Speaker 2: normal device behavior. It figures out what's normal, and then
Speaker 2: it flags anything that deviates from that norm makes sense,
Speaker 2: that's how you catch those insider threats, right, or those
Speaker 2: compromised accounts that might totally you know, go under the
Speaker 2: radar of your typical security tools.
Speaker 1: Yeah. Yeah, And it's not just about the devices themselves, right,
Speaker 1: what about all the different identities like employees, partners, even
Speaker 1: outside vendors who are constantly trying to access the network.
Speaker 1: I mean, that's a lot of potential ways in for
Speaker 1: an attacker.
Speaker 2: Oh absolutely, because even if your devices are locked down tight,
Speaker 2: a single compromised user account that's all it takes. That's
Speaker 2: like a golden ticket for these guys. Yeah, and that's
Speaker 2: where Microsoft Defender for Identity comes in MDIA. It's like
Speaker 2: having you know, a security guard posted right at the
Speaker 2: entrance to your active directory watching for anyone trying to
Speaker 2: sneak in with fake credentials.
Speaker 1: So it's like that extra layer of protection specifically for.
Speaker 2: Active director exactly exactly an early warning system, you could say,
Speaker 2: because we're talking about those sneaky tactics, right, the ones
Speaker 2: attackers use to get a foothold account enumeration, root force attacks,
Speaker 2: pass the hash, they even try to create those golden
Speaker 2: tickets that give them access to everything.
Speaker 1: And speaking of sneaky, I was looking at the deployment
Speaker 1: guide you shared, Yeah, and it seems like setting up
Speaker 1: BENDII is not exactly a walk in the park, is it.
Speaker 2: Yeah, you're right, it's not just plug and play. You
Speaker 2: can't just install it and forget it, right. You got
Speaker 2: to tailor it to your environment. You know, understand your
Speaker 2: active directory. Traffic patterns involved, it's involved, But honestly, the
Speaker 2: insights it gives you they're worth it. Because it's analyzing
Speaker 2: user behavior, network traffic, security logs. It can pick up
Speaker 2: on those really subtle clues that might mean someone's trying
Speaker 2: to blend in with legitimate activity.
Speaker 1: It's like being able to see through a disguise.
Speaker 2: Almost exactly exactly.
Speaker 1: Okay, so we've got MD on the endpoints MBI watching
Speaker 1: over active directory, but what about the cloud. I mean,
Speaker 1: so much of what we do is in the cloud
Speaker 1: now Office three sixty five sales force. That's a whole
Speaker 1: other world that needs protecting.
Speaker 2: Oh for sure, in traditional security, it kind of falls
Speaker 2: apart in the cloud, you know, right, But that's where
Speaker 2: MDCA comes in Microsoft Defender for cloud apps. Oh, it's
Speaker 2: like your security watchdog in the cloud, basically monitoring how
Speaker 2: these apps are accessed, what data is flowing through them.
Speaker 1: And one thing that really stuck with me from the
Speaker 1: material you shared was this whole concept of shadow it,
Speaker 1: which sounds kind of terrifying to be honest.
Speaker 2: Yeah, it's a big problem.
Speaker 1: Employees using cloud apps that it doesn't even know about. Yeah,
Speaker 1: that's like a security team's worst nightmare. Right.
Speaker 2: It creates these blind spots, you know, and you can't
Speaker 2: protect what you can't see, right. But MDCA it shines
Speaker 2: a light on those blind spots. It can see those
Speaker 2: unsanctioned apps, figure out how risky they are, and then
Speaker 2: give you the control to do something.
Speaker 1: About it, so you can actually what block them.
Speaker 2: Block them, Yeah, implement stronger access controls, whatever you need
Speaker 2: to do.
Speaker 1: It's like regaining control over runaway train. There you go, Okay,
Speaker 1: so we've got our defenders in place d MDI, MDCA.
Speaker 1: But how does an analyst actually make sense of all
Speaker 1: this information? Where does it all come together?
Speaker 2: That's where Microsoft Sentinel comes in. It's a cloud native
Speaker 2: sign security information and event management. Okay, but forget the
Speaker 2: jargon for a second. Imagine a giant, high tech security
Speaker 2: command center.
Speaker 1: Right.
Speaker 2: All the alerts, logs, threat intelligence from all your tools,
Speaker 2: they all come together in Sentinel.
Speaker 1: So it's not just about collecting data, it's about connecting
Speaker 1: the dots right exactly.
Speaker 2: Instead of just looking at individual alerts, you see the
Speaker 2: big picture.
Speaker 1: I see.
Speaker 2: Sentinel pulls in data from everywhere, not just your Microsoft stuff,
Speaker 2: but your firewalls, servers, anything that's talking security in your environment.
Speaker 2: Then it uses AI and machine learning, and this is
Speaker 2: where it gets really cool. It starts correlating events, spotting anomalies,
Speaker 2: and showing you the really critical stuff, you know, the
Speaker 2: things that might have slipped through the cracks otherwise, so.
Speaker 1: You're not just like, you know, drowning in the sea
Speaker 1: of data. You can actually use Sentinel to cut through
Speaker 1: the noise and see.
Speaker 2: What's important exactly.
Speaker 1: That's pretty awesome, Yeah, but you know it's even cooler
Speaker 1: this whole thing with threat hunting, right, actively searching for
Speaker 1: threats that might have already slipped past your defenses. Yeah. Yeah,
Speaker 1: that's next level stuff. It's like you're not just a detective,
Speaker 1: you're like a proactive digital detective. Right.
Speaker 2: It's a different mindset. Right. You have to assume breach
Speaker 2: and start digging from there.
Speaker 1: Right, and you're not dusting for fingerprints. You're writing like
Speaker 1: special queries to try to uncover these traits of bad.
Speaker 2: Activity exactly, and thankfully, Sentinel gives you a really powerful
Speaker 2: tool for that, which is KQL w COUSTO query language. Okay.
Speaker 1: Yeah, I was wondering when KQL is going to make
Speaker 1: another appearance here, because it's more than just like a
Speaker 1: civil search bar.
Speaker 2: Oh yeah, way more. It's like KQL is how you
Speaker 2: unlock the real power of Sentinel for threat hunting.
Speaker 1: Okay.
Speaker 2: It's super versatile. You can use queries that other people
Speaker 2: have written the security community, they share them, okay, to
Speaker 2: find specific attack techniques, or you can even write your
Speaker 2: own custom queries right based on your environment, what you're
Speaker 2: worried about, So.
Speaker 1: You can actually have a conversation with your data basically,
Speaker 1: like you're asking it very specific questions to try to
Speaker 1: find these hidden patterns and anomalies. You got it, But
Speaker 1: wouldn't you need to really understand how attackers work to
Speaker 1: be able to write effective queries like that.
Speaker 2: Absolutely, That's why this job security operations analyst. It's not static.
Speaker 2: You always have to be learning up with the latest trends,
Speaker 2: how attackers are doing their.
Speaker 1: Thing right, and then you have to translate all that
Speaker 1: knowledge into these queries. Okay, that's how you find the
Speaker 1: really important stuff, you know, those little indicators that could
Speaker 1: mean a breach.
Speaker 2: It's like in those crime shows. They'll zoom in on
Speaker 2: some like tiny detail in a photograph exactly, and then
Speaker 2: suddenly the whole case breaks wide open.
Speaker 1: That's a great way to put it. And remember that
Speaker 1: scenario we talked about before with the weird DNS queries. Yeah, yeah,
Speaker 1: imagine we're not just reacting to an alert this time,
Speaker 1: we're going hunting for similar stuff that maybe we missed before.
Speaker 2: Okay, so we go into sentinel, we start writing some
Speaker 2: KQL queries. What are we looking for exactly?
Speaker 1: Well, we could start by looking for patterns in those
Speaker 1: DNS requests, things that look like, you know, data leaving
Speaker 1: the network, maybe command and control traffic, anything, suspicious, requests
Speaker 1: that weird, hours, requests for domains that look shady, even
Speaker 1: stuff like DNS tunneling, which is how attackers try to
Speaker 1: sneak past your defenses. And because Sentinel has its tentacles
Speaker 1: and everything, you can start matching up those DNS logs
Speaker 1: with other suspicious stuff like login attempts that MDI flagged,
Speaker 1: or file activity from MDE.
Speaker 2: Exactly, you're connecting the dots, okay, and maybe you find
Speaker 2: out that those DNS queries are coming from a machine
Speaker 2: that's already acting weird and it's talking to a known
Speaker 2: command and control server. Oh, that's when you know you've
Speaker 2: got a real problem on your hand.
Speaker 1: Red alert, red alert, right.
Speaker 2: And that's where your incident response plan comes in. You've
Speaker 2: got to contain the threat, fix the vulnerability, and figure
Speaker 2: out how to make sure it doesn't happen again.
Speaker 1: So it's constant cycle.
Speaker 2: Constant cycle, detection response learning. It never ends.
Speaker 1: Wow, this deep dive has been really eye opening. We've
Speaker 1: gone from like the basics of zero trust to threat
Speaker 1: hunting with KQL. It's a lot, Ye is a lot,
Speaker 1: but it's clear that you know, being a Microsoft Security
Speaker 1: operations analyst, It's not just about passing a test, right,
Speaker 1: You've got to be proactive, always be learning, and use
Speaker 1: your skills to defend against an enemy that never sit still.
Speaker 2: That's the truth.
Speaker 1: Well, there you have it, another deep dive complete and
Speaker 1: for everyone listening, I hope this is giving you a
Speaker 1: better sense of what it takes to be on the
Speaker 1: front lines of cybersecurity these days. Absolutely, until next time,
Speaker 1: stay curious, stay vigilant, and keep diving deep