The features, called \u201cautomatic disruption\u201d use \u201chigh-confidence Extended Detection and Response (XDR) signals across endpoints, identities, email, and SaaS apps\u201d, Microsoft explained, saying they\u2019ll help contain active security attacks \u201cquickly and effectively\u201d.<\/p>\n
They\u2019ll work by automatically disabling, or restricting, devices and user accounts that the threat actors have compromised and are actively using in an attack.<\/p>\n
By shutting off this access, Microsoft hopes the attackers won\u2019t be nearly as effective as they should be, and at the same time, SOC teams get more time to deploy additional countermeasures.<\/p>\n
As a result, ransomware and BEC attacks should have a more limited impact on the target organization, the company claims.<\/p>\n
Automatic attack disruption operates in three stages. In the first stage, the attack is detected, and \u201chigh confidence\u201d is established. In the second stage, different scenarios are classified, as well as assets that the attackers are currently controlling. Finally, in the third stage, automatic response actions are triggered via Microsoft 365 Defender, containing the attack and minimizing its impact.<\/p>\n
As the name suggests, the activity of these new features is automatic, which might not sit well with some cybersecurity professionals. Microsoft seems to be aware of this fact, stating that the number of signals used should ease anyone\u2019s anxiety around automation:<\/p>\n
\u201cWe understand that taking automatic action can come with hesitation, given the potential impact it can have on an organization,\u201d the company said. \u201cThat\u2019s why automatic attack disruption in Microsoft 365 Defender is designed to rely on high-fidelity XDR signals, coupled with insights from the continuous investigation of thousands of incidents by Microsoft\u2019s research teams.\u201d<\/p>\n
Ransomware continues to be one of the most disruptive forms of cybercrime out there. Businesses are advised to train their employees on the dangers of phishing and to make sure they set up a robust backup solution. An antivirus, a (opens in new tab), and multi-factor authentication are also considered best practices.[\/vc_column_text][\/vc_column][\/vc_row]\n","protected":false},"excerpt":{"rendered":"
[vc_row type=”in_container” full_screen_row_position=”middle” column_margin=”default” column_direction=”default” column_direction_tablet=”default” column_direction_phone=”default” scene_position=”center” text_color=”dark” text_align=”left” row_border_radius=”none” row_border_radius_applies=”bg” overflow=”visible” overlay_strength=”0.3″ gradient_direction=”left_to_right” shape_divider_position=”bottom” bg_image_animation=”none”][vc_column column_padding=”no-extra-padding” column_padding_tablet=”inherit” column_padding_phone=”inherit” column_padding_position=”all” column_element_direction_desktop=”default” column_element_spacing=”default” desktop_text_alignment=”default” tablet_text_alignment=”default”…<\/p>\n","protected":false},"author":1,"featured_media":6950,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[35,52],"class_list":{"0":"post-6634","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security","8":"tag-cyber-attack","9":"tag-vulnerabilities"},"yoast_head":"\n