The Curious Engineer

Microsoft Security Blog

2006–2018

312 posts

2019–2026 →

2018 116

December 2018

  1. The challenges of adopting a consistent cybersecurity framework in the insurance industry
  2. Windows Defender ATP has protections for USB and removable devices
  3. Tackling phishing with signal-sharing and machine learning
  4. The AI cybersecurity impact for IoT
  5. Zero Trust part 1: Identity and access management
  6. Step 2. Manage authentication and safeguard access: top 10 actions to secure your environment
  7. Microsoft AI competition explores the next evolution of predictive technologies in security
  8. The evolution of Microsoft Threat Protection, December update
  9. Voice of the Customer: The Walsh Group found that Azure Active Directory gives them a competitive edge
  10. CISO series: Strengthen your organizational immune system with cybersecurity hygiene
  11. Step 1. Identify users: top 10 actions to secure your environment
  12. Insights from the MITRE ATT&CK-based evaluation of Windows Defender ATP
  13. Kicking off the Microsoft Graph Security Hackathon
  14. Analysis of cyberattack on U.S. think tanks, non-profits, public sector by unidentified attackers

November 2018

  1. CISO series: Secure your privileged administrative accounts with a phased roadmap
  2. Windows Defender ATP device risk score exposes new cyberattack, drives Conditional access to protect networks
  3. How to help maintain security compliance
  4. What’s new in Windows Defender ATP
  5. The evolution of Microsoft Threat Protection, November update
  6. CISO series: Lessons learned—4 priorities to achieve the largest security improvements
  7. Attack uses malicious InPage document and outdated VLC media player to give attackers backdoor access to targets
  8. CISO series: Build in security from the ground up with Azure enterprise

October 2018

  1. How to share content easily and securely
  2. Windows Defender Antivirus can now run in a sandbox
  3. CISO series: Partnering with the C-Suite on cybersecurity
  4. Top 10 security steps in Microsoft 365 that political campaigns can take today
  5. Voice of the Customer: Walmart embraces the cloud with Azure Active Directory
  6. CISO series: Building a security-minded culture starts with talking to business managers
  7. How Office 365 learned to reel in phish
  8. Secure file storage
  9. Making it real—harnessing data gravity to build the next gen SOC
  10. Microsoft partners with DigiCert to begin deprecating Symantec TLS certificates

September 2018

  1. Out of sight but not invisible: Defeating fileless malware with behavior monitoring, AMSI, and next-gen AV
  2. Delivering security innovation that puts Microsoft’s experience to work for you
  3. Get deeper into security at Microsoft Ignite 2018
  4. Office VBA + AMSI: Parting the veil on malicious macros
  5. Small businesses targeted by highly localized Ursnif campaign
  6. Practical application of artificial intelligence that can transform cybersecurity
  7. Protecting user identities

August 2018

  1. Building the security operations center of tomorrow—harnessing the law of data gravity
  2. Partnering with the industry to minimize false positives
  3. How Microsoft 365 Security integrates with your broader IT ecosystem—part 3
  4. Cybersecurity threats: How to discover, remediate, and mitigate
  5. Protecting the protector: Hardening machine learning defenses against adversarial attacks
  6. Building on experience: a framework for cybersecurity policy
  7. Protecting the modern workplace from a wide range of undesirable software
  8. Protect your data in files, apps, and devices

July 2018

  1. How Microsoft 365 Security integrates with your broader IT ecosystem—part 2
  2. Attack inception: Compromised supply chain within a supply chain poses new risks
  3. March-April 2018 test results: More insights into industry AV tests
  4. Jumpstart your Microsoft Graph Security API integration with the new JavaScript sample app
  5. Enable your users to work securely from anywhere, anytime, across all of their devices
  6. Microsoft Intelligent Security Association expands with new members and products
  7. How Microsoft 365 Security integrates with the broader security ecosystem—part 1
  8. Hawkeye Keylogger – Reborn v8: An in-depth campaign analysis
  9. P = NP: Cloud data protection in vulnerable non-production environments
  10. Assessing Microsoft 365 security solutions using the NIST Cybersecurity Framework
  11. Perspectives of a former CISO: Disrupted security in digitalization
  12. Taking apart a double zero-day sample discovered in joint hunt with ESET

June 2018

  1. The need and opportunity for adaptive prevention in the cloud
  2. Driving data security is a shared responsibility, here’s how you can protect yourself
  3. New FastTrack benefit: Deployment support for co-management on Windows 10 devices
  4. Building Zero Trust networks with Microsoft 365
  5. Updating your cybersecurity strategy to enable and accelerate digital transformation
  6. Machine learning vs. social engineering
  7. Cybersecurity Reference Architecture: Security for a Hybrid Enterprise
  8. Virtualization-based security (VBS) memory enclaves: Data protection through isolation

May 2018

  1. From the ground up to the cloud: Microsoft’s Intelligent Security supporting CISOs’ cloud transformation
  2. Adding transparency and context into industry AV test results
  3. Want better apps? You need a (agile security) hero!
  4. Data classification and protection now available for structured data in SQL
  5. Now that you have a plan, it’s time to start deploying
  6. Securing the modern workplace with Microsoft 365 threat protection – part 4
  7. Use Windows Information Protection (WIP) to help make accidental data leakage a thing of the past
  8. The final compliance countdown: Are you ready for GDPR?
  9. Enhancing Office 365 Advanced Threat Protection with detonation-based heuristics and machine learning
  10. Here is Homeland Security, black swans, and thwarted cyberattacks
  11. Securing the modern workplace with Microsoft 365 threat protection – part 3
  12. Securing the modern workplace with Microsoft 365 threat protection – part 2
  13. Building a world without passwords
  14. First things first: Envisioning your security deployment

April 2018

  1. Securing the modern workplace with Microsoft 365 threat protection – part 1
  2. Teaming up in the war on tech support scams
  3. Introducing Windows Defender System Guard runtime attestation
  4. Connect to the Intelligent Security Graph using a new API
  5. Tapping the intelligent cloud to make security better and easier
  6. Microsoft to deliver new products and strategies for security innovation at 2018 RSA Conference
  7. Announcing: new British Standard for cyber risk and resilience
  8. Hunting down Dofoil with Windows Defender ATP
  9. Take these steps to stay safe from counterfeit software and fraudulent subscriptions

March 2018

  1. Working towards a more diverse future in security
  2. Why Windows Defender Antivirus is the most deployed in the enterprise
  3. Accelerate your security deployment with FastTrack for Microsoft 365
  4. Microsoft Security Intelligence Report volume 23 is now available
  5. Sharing research and discoveries at PWN2OWN
  6. Poisoned peer-to-peer app kicked off Dofoil coin miner outbreak
  7. Invisible resource thieves: The increasing threat of cryptocurrency miners
  8. Behavior monitoring combined with machine learning spoils a massive Dofoil coin mining campaign
  9. How Office 365 protects your organization from modern phishing campaigns
  10. Tips for getting started on your security deployment
  11. FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines

February 2018

  1. Best practices for securely moving workloads to Microsoft Azure
  2. How to mitigate rapid cyberattacks such as Petya and WannaCrypt
  3. How a national cybersecurity agency can help avoid a national cybersecurity quagmire
  4. How artificial intelligence stopped an Emotet outbreak
  5. Developing an effective cyber strategy
  6. Overview of Petya, a rapid cyberattack

January 2018

  1. Protecting customers from being intimidated into making an unnecessary purchase
  2. IGF proves the value of bottom-up, multi-stakeholder model in cyberspace policy-making
  3. Now you see me: Exposing fileless malware
  4. Overview of rapid cyberattacks
  5. Microsoft offers several mechanisms to protect against ransomware
  6. How to disrupt attacks caused by social engineering
  7. A worthy upgrade: Next-gen security on Windows 10 proves resilient against ransomware outbreaks in 2017
  8. Understanding the performance impact of Spectre and Meltdown mitigations on Windows Systems
  9. Application fuzzing in the era of Machine Learning and AI

2017 68

December 2017

  1. How Microsoft tools and partners support GDPR compliance
  2. How public-private partnerships can combat cyber adversaries
  3. Detonating a bad rabbit: Windows Defender Antivirus and layered machine learning defenses

November 2017

  1. Office 365 Advanced Threat Protection defense for corporate networks against recent Office exploit attacks
  2. New tech support scam launches communication or phone call app
  3. #AVGater vulnerability does not affect Windows Defender Antivirus, MSE, or SCEP
  4. Detecting reflective DLL loading with Windows Defender ATP

October 2017

  1. SSN for authentication is all wrong
  2. Windows Defender Exploit Guard: Reduce the attack surface against next-generation malware
  3. Making Microsoft Edge the most secure browser with Windows Defender Application Guard
  4. Introducing Windows Defender Application Control
  5. Hardening the system and maintaining integrity with Windows Defender System Guard
  6. Cybersecurity in a modern age
  7. Advanced Threat Analytics security research network technical analysis: NotPetya

September 2017

  1. Announcing the Windows Defender Advanced Threat Protection ISO 27001 audit assessment report
  2. Stepping up protection with intelligent security
  3. New Microsoft 365 features to accelerate GDPR compliance
  4. 3 key tenets to help with security management
  5. New IIS functionality to help identify weak TLS usage
  6. Ransomware 1H 2017 review: Global outbreaks reinforce the value of security hygiene

August 2017

  1. Microsoft Security Intelligence Report Volume 22 is now available
  2. Microsoft to remove WoSign and StartCom certificates in Windows 10
  3. Links in phishing-like emails lead to tech support scam
  4. Top 5 best practices to automate security operations
  5. Windows Defender ATP machine learning: Detecting new and unusual breach activity
  6. 5 Reasons why Microsoft should be your cybersecurity ally

July 2017

  1. TLS 1.2 Support added to Windows Server 2008
  2. Windows Defender Antivirus cloud protection service: Advanced real-time defense against never-before-seen malware
  3. Detecting stealthier cross-process injection techniques with Windows Defender ATP: Process hollowing and atom bombing

June 2017

  1. Exploring the crypt: Analysis of the WannaCrypt ransomware SMB exploit propagation
  2. New ransomware, old techniques: Petya adds worm capabilities
  3. Tips for protecting your information and privacy against cybersecurity threats
  4. Windows Defender ATP Fall Creators Update
  5. Tips for securing your identity against cybersecurity threats
  6. Partnering with the AV ecosystem to protect our Windows 10 customers
  7. TLS 1.2 support at Microsoft
  8. Analysis of the Shadow Brokers release and mitigation with Windows 10 virtualization-based security
  9. Cybercrime and freedom of speech – A counterproductive entanglement
  10. The CISO Perspective: Putting lessons from WannaCrypt into practice to avoid future threats
  11. Windows 10 Creators Update provides next-gen ransomware protection
  12. NIST Cybersecurity Framework: Building on a foundation everyone should learn from

May 2017

  1. More than just an ocean separates American and European approaches to cybersecurity
  2. How the Asia-Pacific region is advancing cybersecurity
  3. WannaCrypt ransomware worm targets out-of-date systems
  4. Use Enterprise Threat Detection to find “invisible” cyberattacks
  5. Singapore: Realizing that for the future to be smart, it needs to be secure
  6. Mind the air gap: Network separation’s cost, productivity, and security drawbacks

April 2017

  1. Supply chain security demands closer attention
  2. How future policy and regulations will challenge AI
  3. 4 steps to managing shadow IT
  4. Is social engineering the biggest threat to your organization?
  5. The two-pronged approach to detecting persistent adversaries
  6. Tech support scams persist with increasingly crafty techniques

March 2017

  1. How to solve the diversity problem in security
  2. World Backup Day is as good as any to back up your data
  3. Giving CISOs assurance in the cloud
  4. Detecting and mitigating elevation-of-privilege exploit for CVE-2017-0005
  5. A new best practice to protect technology supply chain integrity
  6. Uncovering cross-process injection with Windows Defender ATP
  7. Breaking down a notably sophisticated tech support scam M.O.

February 2017

  1. Detecting cyber threats

January 2017

  1. Phishers unleash simple but effective social engineering techniques using PDF attachments
  2. Confidence building measures can make a huge difference to the global online economy
  3. Microsoft’s Cyber Defense Operations Center shares best practices
  4. Rules-making in technology: Examining the past and predicting the future
  5. Cybersecurity’s perfect storm
  6. Microsoft Enterprise Threat Detection
  7. Azure Backup protects against ransomware

2016 31

December 2016

  1. Twin zero-day attacks: PROMETHIUM and NEODYMIUM target individuals in Europe
  2. Microsoft Security Intelligence Report Volume 21 is now available

November 2016

  1. Disrupting the kill chain
  2. The four necessities of modern IT security
  3. Cybersecurity and cyber-resilience – Equally important but different
  4. Our commitment to our customers’ security

October 2016

  1. Office 2013 can now block macros to help prevent infection
  2. Use Security Education and Awareness Programs to Your Advantage
  3. Securing the Internet of Things: Introducing the Security Program for Azure IoT
  4. Beware of Hicurdismos: It’s a fake Microsoft Security Essentials installer that can lead to a support call scam
  5. Top Five Security Threats Facing Your Business and How to Respond
  6. Keeping Adobe Flash Player

September 2016

  1. Modern browsers are closing the door on Java exploits, but some threats remain

August 2016

  1. Top security trends in IoT

July 2016

  1. Kovter becomes almost fileless, creates a new file type, and gets some new certificates
  2. New Microsoft Azure Security Capabilities Now Available
  3. FedRAMP High: Trust is cloud security validated

May 2016

  1. Limited Periodic Scanning in Windows 10 to Provide Additional Malware Protection
  2. Cyber Resilience: rethinking risk management
  3. Microsoft Security Intelligence Report Volume 20 is now available
  4. Global cybersecurity policy: Finding a balance between security and competitiveness

April 2016

  1. A brief discourse on ‘Changing browsing experience’
  2. MSRT April release features Bedep detection
  3. What’s The Art of War got to do with cybercrime? Quite a bit, actually.
  4. Microsoft Cloud App Security is generally available

March 2016

  1. New feature in Office 2016 can block macros and help prevent infection
  2. Cloud Security Alliance Summit 2016: I Survived the Shark Tank
  3. The Trusted Cloud: what do privacy and control really mean?
  4. Secure Development Blog

January 2016

  1. The Emerging Era of Cyber Defense and Cybercrime
  2. What’s Next for EU Cybersecurity after the NIS Agreement?

2015 15

December 2015

  1. Keeping browsing experience in users’ hands
  2. Microsoft updates Trusted Root Certificate Program to reinforce trust in the Internet

November 2015

  1. New Microsoft Enterprise Cybersecurity Group to Provide Greater Security Capabilities
  2. Microsoft Security Intelligence Report: Strontium

October 2015

  1. Cloud security controls series: OneDrive for Business

June 2015

  1. Understanding type confusion vulnerabilities: CVE-2015-0336

May 2015

  1. Latest data shows newer versions of Windows have lower malware infection rates than older versions
  2. Latest Microsoft Security Intelligence Report Now Available

April 2015

  1. Cleaning up misleading advertisements

March 2015

  1. ABB Automation & Power World 2015 – Cybersecurity in the evolving threat landscape

February 2015

  1. Microsoft achieves globally recognized ISO/IEC 27018 privacy standard
  2. KRBTGT Account Password Reset Scripts now available for customers

January 2015

  1. The Importance of Effective Information Sharing
  2. Putting Information Sharing into Context
  3. MAPS in the cloud: How can it help your enterprise?

2014 24

December 2014

  1. Your Browser is (not) Locked

November 2014

  1. 7 Precautions for Protecting Against Perpetrators
  2. Your Antivirus protection has expired. So what? You might be surprised. Microsoft’s new cybersecurity report explains.
  3. Hundreds of Millions of Microsoft Customers Now Benefit from Best-in-Class Encryption
  4. Microsoft Antimalware for Azure Cloud Services and Virtual Machines now Available for Free

September 2014

  1. Microsoft cloud protection
  2. Looking Forward: Trustworthy Computing
  3. How do digital youth of the “app generation” learn, communicate, and express themselves
  4. Download at your own risk: Bitcoin miners bundled with game repacks
  5. Measure Twice, Cut Once, With RMA Methodology
  6. Industry Vulnerability Disclosures Trending Up

August 2014

  1. What is a trusted device?
  2. Strengthening encryption for Microsoft Azure customers

July 2014

  1. How to sign into devices that don’t accept security codes

June 2014

  1. Is that call from Microsoft a scam?
  2. Microsoft Interflow: a new Security and Threat Information Exchange Platform
  3. When Vulnerabilities are Exploited: the Timing of First Known Exploits for Remote Code Execution Vulnerabilities
  4. Microsoft is building a global online safety community, one tweet at a time
  5. New Guidance for Securing Public Key Infrastructure

May 2014

  1. 5 ways to protect your Microsoft account

April 2014

  1. New Microsoft Threat Modeling Tool 2014 Now Available
  2. Adware: A new approach

March 2014

  1. Reliability Series #1: Reliability vs. resilience

February 2014

  1. How do I know if I already have antivirus software?

2013 14

December 2013

  1. Enterprise Threat Encounters: Scenarios and Recommendations – Part 1
  2. Detect and remove spyware
  3. Parental controls in Xbox One

November 2013

  1. Windows Defender and Microsoft Security Essentials: Which one do I need?

September 2013

  1. Check security settings in Windows Vista

August 2013

  1. 5 reasons NOT to share personal information on a website
  2. The Risk of Running Windows XP After Support Ends April 2014

July 2013

  1. Why does my AV software keep turning off?
  2. Can I use Microsoft Security Essentials with Windows 8?

June 2013

  1. Ad injection and you: How adware gets on your computer

February 2013

  1. What is a Microsoft account?

January 2013

  1. Microsoft’s Free Security Tools – Microsoft Assessment and Planning (MAP) Toolkit
  2. Watch out for fake Java updates
  3. Microsoft’s Free Security Tools – URLScan Security Tool

2012 18

October 2012

  1. Microsoft Free Security Tools – Microsoft Baseline Security Analyzer
  2. Fraud alert: Microsoft Services Agreement email scam
  3. Microsoft’s Free Security Tools – Summary
  4. Microsoft’s Free Security Tools – Portqry

September 2012

  1. “Fix it” available for Internet Explorer
  2. Microsoft’s Free Security Tools – Windows Defender Offline
  3. Fundamentals of Cloud Service Reliability

August 2012

  1. Microsoft’s Free Security Tools – banned.h
  2. Threat Modeling from the Front Lines

July 2012

  1. How do I get rid of all of these security warnings?
  2. Beginner’s Guide to BYOD (Bring Your Own Device)

June 2012

  1. Warnings, /sdl, and improving uninitialized variable detection

May 2012

  1. Windows 8 Release Preview Available for Download
  2. Microsoft Office 365 Receives FISMA Certification

March 2012

  1. Free PC safety scan
  2. Is my computer up to date?

February 2012

  1. Report scams in Hotmail, Xbox, and more

January 2012

  1. Secure Credential Storage

2011 2

October 2011

  1. TwC Releases New Online Safety Index

May 2011

  1. Conquering the Coreflood botnet

2010 7

August 2010

  1. How do spammers get my email address?

July 2010

  1. Writing Fuzzable Code

June 2010

  1. Use Microsoft Fix it to update Windows XP
  2. Get a Windows 7 security checklist

April 2010

  1. What is screen scraping?

March 2010

  1. Profile of A Global Cybercrime Business – Innovative Marketing

January 2010

  1. Free antivirus software from Microsoft: now available worldwide

2009 4

December 2009

  1. Follow our online safety team on Twitter
  2. If I have Microsoft Security Essentials do I still need Windows Defender?

September 2009

  1. What is Windows CardSpace?

March 2009

  1. Internet Explorer 8: Stay safer online

2008 4

December 2008

  1. President of France not immune to online theft

August 2008

  1. Free Microsoft antispyware site helps you protect your computer

May 2008

  1. Giving SQL Injection the Respect it Deserves
  2. What is a Windows Live ID?

2007 6

September 2007

  1. The Trouble with Threat Modeling
  2. Is it safe to install ActiveX controls on my computer?
  3. How to tell if Windows Defender is installed on your computer

July 2007

  1. Windows Defender for Windows Vista

February 2007

  1. What is a cookie?

January 2007

  1. Common Objections – Comparing Linux Distros with Windows

2006 3

June 2006

  1. Linus’s Law aka “Many Eyes Make All Bugs Shallow”

May 2006

  1. The Importance of the “Evaluated Configuration” in Common Criteria Evaluations
  2. Washington Post – A Time to Patch III: Apple

2019–2026 →