What are you responsible for?

You are responsible for who you give access to your data, whether willingly or unwillingly (client & end-point protection and identity & access management). This responsibility extends to all users in your organization.

You’re also responsible for data classification, meaning it’s on you to treat sensitive or classified data as such and put the proper controls in place to limit access. If you’re in a regulated industry, it’s your responsibility to handle your data in a way that meets industry regulations.

Some of the responsibilities change depending on the type of service. For example, if you have a Windows Server at your office, physical security of the server is your responsibility. If you’re using a cloud service like Office 365, physical security of the cloud server is their responsibility.

So, What does Microsoft do?

Basically, Microsoft protects your data from attack in their data centers and while it’s in motion.

The datacenters where your content is physically stored are guarded and monitored 24/7 and have strict security measures like biometric scanners to prevent unauthorized persons. Furthermore, the personnel onsite at the datacenters don’t have access to your data; they only protect it – a practice called ‘role separation.'

Microsoft uses ‘encryption in transit’ for all data, which means that your data in motion (as soon as you press send on an email or upload a document to OneDrive) is protected against eavesdropping.

Protecting Your Users' Accounts

The biggest and most prevalent threat to your Office 365 environment is an outside attacker trying to break into your users’ accounts. Once they’re in, they can use these accounts to launch more attacks, steal your information, and make money for themselves.

Phishing

The most common way cybercriminals target users is through email-based phishing attacks. Phishing was the #1 threat to Office 365 in the second half of 2017, accounting for 53% of threats detected by Microsoft.

Phishing is an email attack aimed at fooling the target into thinking that an email is from a legitimate source to gain access to personal or business information. The most common types of phishing attacks aimed at businesses try to steal your account credentials or get you to wire money to them.

Phishing attacks with the purpose of stealing your credentials will typically have a link that leads to a fake login screen. These usually look like a notification of some kind, like a fake shipping notification or a fake invoice notification. We’ve also seen a considerable increase recently in phishing emails that look like secure email notifications.

We've recapped many of these on our blog:

• Four Types of Phishing Emails Targeting Businesses
• Watch Out for These "Secure Email" Phishing Emails
• From the Trenches: Out of Office Phishing Scam
• Watch Out for These W2 Phishing Emails
• Watch Out for These Fake Social Media Security Emails

While these blog cover specific examples of phishing emails we've seen, these should be used as a general guide. Phishing emails are always evolving and can look like anything. 

Office 365 Phishing

A common tactic among cybercriminals is to target users based on software or apps they user. There are many, many variations of phishing attacks that target Office 365 users specifically.

Most of these look like notifications claiming your account has been or will be suspended. Some try to blend in with other notifications, like phishing emails that look like spam quarantine notifications. As cyber criminals get better, these get harder and harder to spot. 

Spoofing

Many phishing attacks rely on spoofing to succeed. Spoofing is when a cybercriminal makes it appear like an email is coming from someone else—basically, they’re forging the “From” address to look like it’s coming from a legitimate source.

A low-tech way to do this is to use a look-a-like email address—like Bob@Acnnecorp.com instead of Bob@Acmecorp.com. It is possible for cybercriminals to make it look like an email is coming from another sender's real email address, though.

Cybercriminals will use this in all kinds of phishing attacks. The tactic works for everything from fake Office 365 notifications to wire fraud emails that look like they’re from someone in your organization.

Combining Tactics

Recently, cybercriminals have started to combine these tactics into multi-step phishing attacks. They will use a phishing attack to steal a user’s login information—usually an executive level employee. Then, once they’re in the first victim’s account, they’ll use that to pretend to be the victim and get another person to wire them money.

Reusing Credentials

If you are like most people, you use the same, or similar password for all your accounts. Your employees likely do the same thing. Here’s the thing: cybercriminals know you do that, and can use that to access your account.

Every time a website or company gets hacked and their users’ account credentials are stolen, it puts your company at risk. Cybercriminals will use those stolen credentials to try to log into other accounts. It’s not hard to match up personal email addresses with professional email addresses.

To protect your Office 365 users, you need a multi-layered approach to security to guard them at multiple possible points of attack. Office 365 has built-in tools, along with dozens of security add-ons to help.

Where to Start

We typically recommend business start with a few security measures to proactively limit the chances of falling victim to an attack. 

Every Office 365 plan comes with Audit Logs, and every company running Office 365 should turn them on.

Audit logs record activities in your Office 365 environment (Exchange, SharePoint, OneDrive for Business, Yammer, PowerBi, Sway, and Azure Active Directory are all included). Activities recorded include:

• Login attempts
• Password resets
• Viewing and sharing documents
• Downloading files
• Changing settings, permissions, and policies
• Deleting files and folders
• Allowing and blocking computers from synching files

The list goes on and on.

It can feel a little Big Brother-ish, but you really should have Audit Logs turned on. Audit logs are one of the first places we check when helping customers diagnose if they’ve experienced a breach. They’re critical to figuring out what’s going on if someone has gotten access to your system—because the data is all in the logs.

Let’s look at an example: One common tactic cybercriminals use when launching wire fraud attacks is to get access to a high-level employee’s account. They’ll send emails from that account requesting wire transfers. They’ll also set up new folders and rules in Outlook to automatically send any replies to those folders. That way, the real owner of the account won’t see them and know something is up. Audit logs can capture that activity.

How to turn on Office 365 Audit Logs

Office 365 audit logs are not enabled by default, so to start using them, you'll need to turn them on and set up a few configurations (please note, your Office 365 Admin will need to do this):

1. Enable audit logs in the Office 365 Security and Compliance Center (an admin will need to do this step). On the Audit Log Search page, click "Start recording user and admin activity."
2. If you want to track activities in Exchange, you'll need to set up additional configurations. Read full directions here.
3. Set up permissions for your users. In the Exchange admin center, change the permissions for any users who will need access to audit logs. They will need to be assigned the ‘View-Only Audit Logs’ or ‘Audit Logs’ role. Please note, only users who are assigned these roles can get alerts.
4. Set up your alerts. To do this, in the Security & Compliance Center, go to the Audit Log Search (under Search & investigation), then click the "+Create an Alert" button under the search area.

Logs are only kept for 90 days, so if you don't set up alerts, it's a good idea to review them periodically for suspicious activity.

Keeping track of how you’re doing with security can be tough. Unless you deal with cybersecurity all the time, knowing what you need to do—and what’s most valuable to do—is difficult.

Microsoft does have a tool that can help, called Secure Score, which grades your security efforts in Office 365. It assigned a numerical value to security measures to give you your Office 365 Secure Score. Different activities have different numerical values, based on their potential impact.

You’ll also get a list of recommendations for what you can do to make your environment more secure (and in turn, increase your Secure Score). At the moment, it’s impossible to get a “perfect” Secure Score. Not all of the activities that Microsoft recommends currently have numerical ratings. This doesn’t mean you shouldn’t do them, though!

You'll also be able to compare your Secure Score with the average Office 365 Secure Score. This can be tricky, though—doing better than average doesn't mean you aren't vulnerable to attack. 

Looking at your Secure Score can be overwhelming, to say the least. There is a lot to look at, and if you’re not familiar with it—and not familiar with cybersecurity—it can hard to know what you need to do. We’re happy to help you navigate your Secure Score. Check the bottom of this page for more.  

Quick Note: You will need admin level access to see your company's Secure Score. If you try to access it and it tells you that you don't have permission, check with your company's admin.