How to start working with Attack Surface Reduction rules like a boss

The modern IT Admin needs to accept that they will do more and more security related actions.
The modern world requires us to take part of defending our business against bad guys.
Kent and I discuss the new world using Microsoft Intune and Microsoft Defender for Endpoint together.

Why should we use Attack Surface reduction rules?
It sounds difficult to setup, but is it?
What kind of rules do we have available?
How do I get started?
How do I get ASR rolled out?

Don't be afraid. We got you covered!

Get much more info in this interview with Microsoft Regional Director Kent Agerlund.

Twitter:

Linkedin:

#MDE #msintune #AttackSurfaceReduction

[karthikeyanv]

Thank you both, excellent walkthrough.

[edemfromeden]

It always amazes me how much MSFT is NOT aligned in regards to best practices. The speaker advice goes like this "don't play around with ring1, ring2 deploy to all". At the same time offical ASR docs state the opposite O_o.

[Rahgozar]

Hi, thank you for the informative video. I have a question that wasn't answered by Microsoft either. Sometimes, certain executable files that attempt to access LSASS are blocked on some devices, even though these files can run without issues on other devices. What could be the reason behind this if the file isn't malicious?

[aneeshnicola]

@MSEndpointMgr


Do we need to enable cloud block level as high to receive the toast notifications on the enduser device level for asr warn mode .Is this any prerequisiste ? Looking for assistance pls since im not receiving the notifications which allow me to bypass despite configuring warn mode