Microsoft 365 Defender Review

We use the 365 Defender tool and a few other 365 tools to monitor data in motion. We get triggers for emails that may have PCI data or card data on it. If the system intelligently thinks that this could be a positive, it quarantines that email, and sends a trigger alert to us so that we can review that email and determine if it contained PCI data, so that way we can scrub it. We can then send a violation notice to the team member who sent it and give them a coaching session so it doesn't happen again. We don't get very many repeat offenses, and it improves our security posture around managing PCI Data in our environment, specifically helps to keep it out of our environment. As far as the positive things, it reduces our PCI compliance scope quite greatly, which I'm very happy about. But on the downside we get too many false positives and one of the things that we tried to look at was trying to do a BIN range check, which supposedly is set up in the background, but we found cases where it wasn't properly detecting BIN ranges. So either the BIN range database was out of date or the process where it does check BINs did not work accordingly. So that's the downside that we had

Because we already had a pre-existing solution, we just did a swap (one for one). So we didn't go from not having anything to then having Microsoft, we just swapped the product. So that unfortunately doesn't really apply in our situation.

No. We tried to and it wouldn't work. It wasn't able to properly detect whether a 16 digit number was a valid card number or not. We have to do that ourselves manually. The good thing is that we have refined our rules so we do not get many emails to research.

I think our DLP team is in the process of doing that now. We're trying to centralize everything within Microsoft's cloud, so I think that's part of that structure, but I'm not a hundred percent sure.