Microsoft Rescues Acronym-Weary CISOs

For all the disruption the COVID-19 pandemic caused, it also served as a catalyst of sorts for CISOs that took time to step back and consider how their security investments to date had to change to support an increasingly cybercrime-filled new normal.

Vendors, too, were repositioning themselves and their offerings as the need to secure remote working became a rallying cry — and a common denominator around which a whole range of security products and technologies could be released, rebadged, and repackaged.

For a company like Microsoft, this change presented a golden opportunity — and Mark MacDonald, senior manager of product marketing with managed detection and response (MDR) vendor eSentire, believes the industry-wide pivot of the past two years proved especially beneficial as the company successfully repositioned itself for an audience of time-pressured, integration-weary CISOs.

“Any time there’s a large event that happens, it forces people to take a step back and reevaluate things,” MacDonald told Cybercrime Magazine, “and the pandemic served as a kind of logical reset for a lot of IT leaders and security leaders to rethink their strategy moving forward.”

Cybercrime Radio: The latest on Microsoft Security

eSentire’s MDR shines

That proved fortuitous timing for Microsoft — which, he said four years ago “levelled up their game when it came to security tools and their security strategy.”

That included, for example, an update of the company’s Cybersecurity Reference Architecture with a new version covering IT elements such as the Security Operations Center (SOC), Software as a Service (Saas), information protection, identity & access, hybrid cloud infrastructure, IoT, and clients.

This more coherent security framework had already begun refocusing Microsoft’s security value proposition by the time the pandemic hit — causing what MacDonald calls “security vendor fatigue” as CISOs were given additional budget and flooded with remote-working security pitches to spend it on.

“It was really a question of ‘what acronym do I buy this year?’” MacDonald explained, “and Microsoft bundling has simplified this by bundling security controls, threat-hunting tools, and XDR tools within the Microsoft 365 license that you’ve probably already invested in anyways.”

“It’s a consolidation play that will save you money and a lot of hassle in the end,” he continued. “You can very cost-effectively bundle security tools and threat hunting tools to the Microsoft 365 Defender stack, compared to going out and buying EDR, email security, a CASB, identity security, and so on.”

“You’re easily saving 50 percent versus going out and building your own stack of tools from individual vendors — and any time a CFO hears an opportunity to save 50 percent on IT spend, they’re going to listen.”

The power of integration

By building a security ecosystem across its products, MacDonald said Microsoft — whose Microsoft Defender security platform has been lauded as the best endpoint protection tool on the market — has distinguished itself from vendors that have, by design, tended to specialize in one particular area.

Ongoing merger activity has seen many security players silo-busting by consolidating their capabilities — Google’s $5.4 billion acquisition of cybersecurity stalwart Mandiant was just one of hundreds of deals over the past year or so — and Microsoft has responded in kind, last year committing to quadruple its security investment, to $4 billion per year.

For MDR providers like eSentire, a Microsoft partner that has distinguished itself in a competitive market with offerings such as a 4-hour incident response service, the tight integration across Microsoft’s existing stable of near-ubiquitous cloud and infrastructure platforms provides a unique offering that simplifies the process of managing an incident response.

“The thing that’s impressive from our perspective at eSentire, in terms of an MDR or threat detection and response standpoint, is how integrated these tools are,” said MacDonald. “They all connect and talk with each other very well, which is a challenge that security teams have pretty commonly when it comes to building systems from the ground up.”

The range of Microsoft Defender capabilities has covered what a self-professed “bullish” MacDonald sees as the three legs of the tripod that holds up modern security strategies: endpoint security, email security, and identity management.

“Identity ended up being the main connection between a lot of cloud systems,” he explained, “and Microsoft’s ability to tie those three things together is very impressive — and probably unmatched in the market.”

By leveraging the technical integration within Microsoft’s portfolio, CISOs can focus on deciding which response structure works better for their requirements — either hiring and training an internal incident response function to use the Microsoft tools, or bringing on a Microsoft-fluent MDR partner like eSentire.

“One strategy is obviously a lot faster than the other,” MacDonald said, “especially when you consider the very well-documented security skill shortage. Having to hire, train, and retain employees is definitely a challenge.”

That challenge has only increased over time, he added, because the ever-expanding spectrum of cybersecurity skills has required companies to add more and more skilled employees across a range of capabilities.

Yet not even Microsoft can provide every security capability, MacDonald said, which is why prospective MDR customers need to be careful that their eventual choice of providers is able to provide a broader detection and response capability.

“While an organization can be all in on Microsoft,” he explained, “Microsoft isn’t going to represent the totality of the security footprint when it comes to thinking about protecting their organization.”

“Microsoft covers and checks a lot of boxes, but not all of them — and even they claim this. So a strong question to ask MDR vendors is: what else can you handle? And what is your strategy for training and retaining your talent?”

“If they don’t have a good answer for that, you might be setting yourself up for some challenges in the future. Because, ultimately, a lot of these outcomes still require skilled people and it’s a very important ingredient — and that’s not going away.”

– David Braue is an award-winning technology writer based in Melbourne, Australia.

Go here to read all of David’s Cybercrime Magazine articles.

Originally posted on cybersecurityventures.com