Use Cyber Uplift’s Microsoft Security Optimisation capability

The Microsoft products Cyber Uplift can help with are:

• Microsoft Sentinel
• Microsoft Defender
• Microsoft Purview

Microsoft Sentinel

Sentinel is a cloud-native Security Information and Event Management (SIEM) solution that delivers scalable, cost-effective security across multi-cloud and multi-platform environments. It provides automation and threat intelligence to support threat detection, investigation, response and proactive cyber threat hunting.

Cyber Uplift can:

• identify how existing Microsoft security and compliance features are configured
• provide collaborative licence recommendations based on best practice
• help organisations get more value from licences and improve security outcomes
• provide guided or hands-on support to implement recommended improvements
• support Business Premium, E3 and E5 licencing arrangements

We can help with the following:

• connector configuration, incident management and investigation workflows, MITRE ATT&CK coverage, pricing tiers and cost optimisation
• user and entity behaviour analytics, threat intelligence integrations, workbooks and reporting, log analytics, automation and orchestration
• access and permissions, alert tuning and optimisations, health monitoring and workspace management, and domain vulnerability integration

Microsoft Defender

Defender is a security platform that provides integrated protection across devices, identities, applications, email, and cloud services. It provides threat prevention, detection, investigation and response capabilities using analytics, machine learning and threat intelligence to identify known and emerging malware and phishing attacks.

Cyber Uplift can assist with the following Defender products:

• Defender for Endpoint
  Provides advanced threat protection for devices and endpoints, including detection, investigation and response capabilities.
• Defender for Office 365
  Protects against phishing, malware, and other email-based threats while securing collaboration tools like Teams and SharePoint.
• Defender for Identity
  Monitors and protects user identities by detecting and responding to suspicious activities and risky behaviours.
• Defender for Cloud Apps
  Safeguards cloud applications by providing visibility, control, and threat protection.
• Defender for Cloud
  Secures multi-cloud and hybrid environments through identifying vulnerabilities and protecting workloads.

Microsoft Purview

Purview is a unified platform for organisations to govern, protect, and manage data effectively. It addresses challenges related to data fragmentation, visibility and compliance, ensuring robust data management across various environments.

Cyber Uplift can assist with:

• information protection
  Provides a framework for discovering, classifying and protecting sensitive information across the enterprise digital landscape.
• data loss prevention (DLP)
  Offers comprehensive protection for sensitive data across the enterprise digital estate to identify, monitor, and automatically protect sensitive information.
• data life cycle management
  Provides managed retention and disposal of data across Microsoft 365.
• records management
  Provides management of the life cycle of records within Microsoft 365, including the ability to create and apply retention labels and policies.
• insider risk management
  Provides tools for monitoring user activity through identifying investigating and mitigating potential insider threats.
• communications compliance
  Helps organisations to monitor and manage their communications to ensure compliance with internal policies and regulatory requirements
• eDiscovery
  Provides tools to help organisations effectively manage legal and compliance related data requests.

We also provide a more comprehensive service for Purview’s DLP and information protection features.

DLP using Microsoft Purview Information Protection (MPIP)

We provide specialist support to help organisations design, configure and implement DLP capabilities using Microsoft Purview.

This service helps organisations improve how sensitive data is identified, classified, shared and protected.

The service can help organisations:

• reduce the risk of accidental data loss or disclosure
• apply consistent data classification and labelling
• protect sensitive information across Microsoft 365 services
• support compliance and information protection requirements

Support includes:

• data classification and sensitivity labelling
• data loss prevention policies
• information protection across email, files and collaboration platforms

This service can be delivered independently or alongside existing Microsoft Security Optimisation work.

Contact us

To enquire about Microsoft security services, email gcu-services@dsit.gov.uk

When you contact us, include:

• the name of your organisation
• the Microsoft security tools you use or plan to use
• whether you need support with planning, implementation or optimisation

We will review your enquiry and contact you to discuss the most appropriate support.

Find out more about Cyber Uplift.