Enhancing Security with Microsoft 365 Ransomware Protection

Enhancing Security with Microsoft 365 Ransomware Protection

by | Apr 2, 2024 | Microsoft 365

Boosting Your Defenses: The Multilayered Ransomware Protection Method of Microsoft 365

The two main reasons why businesses have embraced Microsoft 365 so rapidly are hybrid working and reduced capital costs.

However, due to its sizable user base and quick subscriber growth over the previous two years, the subscription-based suite, which includes Exchange Online and other Office 365 productivity programs, OneDrive for Business, SharePoint, and Teams, is an alluring target for hackers.

You should be monitoring more than just the number of users and collaboration minutes if your company uses Microsoft 365 (M365). There has been an increase in ransomware attacks over the last few years, and your M365 sensitive data will be targeted more frequently.

Malicious actors are already trying to encrypt your data and infect it with malware, then demand a payment to unlock it.

Beyond that, hackers will be hoping that your sensitive data in M365 is not fully protected so they can steal (called exfiltrate) it and then use it to demand ransom in order to keep it from being released to the public.

The adoption of the tactic in “double-extortion” ransomware operations is growing rapidly. Operators using ransomware may severely impact your company’s finances and reputation, regardless of their strategy, so your best bet is to continue to plan ahead as it is not a matter of ‘if’, it is a matter of ‘when’.

Microsoft’s advice for fending off ransomware that targets your M365 data is straightforward: Make frequent data and content backups, and use third-party apps and services to store it. This is good advice, but it’s likely not enough.

Comprehending the Concept of Shared Responsibility

Operating on a shared responsibility paradigm, Microsoft is a hyperscale cloud and application provider. In real terms, that means Microsoft pledges strong infrastructure security, high infrastructure dependability, and restricted data protection, which includes certain data retention guidelines and versioning, which we’ll talk about next.

It never promises that your material will always be accessible. That’s a general assessment of its portion of the responsibility.

Maintaining the trust of your customers and the reputation of your brand depends equally on you. Your business data is yours. It is therefore your duty to safeguard your cloud data both now and in the future to ensure compliance with legal and business standards.

If your data is compromised, it is also your organization’s responsibility to promptly restore it. The main justification for abiding to best practices and adding third-party apps and services that shield your data from ransomware assaults in addition to basic M365 protection is your internal share of responsibility for M365, a mission-critical environment.

Microsoft does include certain built-in features for storing data after it has been deleted or modified, but these aren’t reliable, unchangeable backups, more on that later.

Ransomware Around The Corner

Before launching a full-scale attack, malware or attackers might penetrate a system and hide for a few weeks or months in order for it to spread to other systems.

Furthermore, as you’ll see, versioning isn’t appropriate for ransomware recovery since, in order to guarantee that your restored data is free of ransomware infection, restores must occur from a specified point in time on the full data set rather than on individual files.

The threat of Ransomware-as-a-Service (RaaS) affiliate models facilitates threat actors’ ability to expand their operations and target businesses of any size or industry.

Can Ransomware Infect Files Stored in OneDrive?

Yes, files kept on OneDrive can become infected with ransomware. This is due to the fact that cloud data accessed through the OneDrive sync application that is installed on your machine is directly accessible from the endpoint, which facilitates the propagation of ransomware and its ability to corrupt all of your OneDrive files.

It’s crucial to remember that if you haven’t taken any precautions to secure your system or are using an out-of-date version of the program, your risk increases. To defend against online attacks, it is crucial to utilize additional tools like Microsoft Defender or a third party Endpoint Detection and Response (EDR) tool.

OneDrive offers built-in capabilities to restore from a previous version of your cloud data, even if you have been attacked with ransomware. This enables you to recover from a state that existed before the ransomware assault. Additionally, there are solutions for backing up your Microsoft 365 data to an independent cloud backup repository, giving you a backup copy in the event that OneDrive’s restore points become unavailable.

Backups VS Versioning

If you require additional proof that native M365 data protection isn’t reliable enough for your data, think about the way it stores data. M365, in contrast to actual backup systems, employs a method more akin to version control, which is the management of several revisions of the same data or files, Microsoft calls this in place retention.

Stated differently, versioning occurs at the file level, with each file having a unique file version history. This method has the drawback that ransomware attacks targets all files at once and occur at a specific time.

Backup shouldn’t be considered the primary method of retention in use. Rather than being your “officially retained record,” backup has always served as the “copy of last resort that always exists.”

Since this was the sole copy of the content available for the retention period, backed-up content search and retrieval sadly had to be integrated into the backup or archival system as this was the only copy of the content available for the retention period.

When versioning is enabled, you may track, store, and restore files in a library and items in a list as they change.

You have control over the material that is posted on your website when you use versioning in conjunction with other settings like checkout. Versioning can also be used to view or restore previous iterations of a library or list.

You can use versioning to:

  1. Track History of a version: You can see when and by whom an item or file was modified when versioning is enabled. Additionally, you may view the dates of changes to the file’s properties. For instance, the version history contains information on changes made to a list item’s due date. Additionally, comments made by users upon checking files into libraries are visible.
  2. Go back to an earlier version: You can replace the current version with a prior one if you made a mistake in the current version, if the current version is corrupt, or if you just prefer the earlier version. The version that has been restored is now the latest one.
  3. Examine an earlier version: Viewing an earlier version won’t cause your current version to be overwritten. You can compare the two versions to see the differences if you are viewing version history in a Microsoft Office document, such as a Word or Excel file.

Microsoft 365 Ransomware Protection

Microsoft offers a range of capabilities and services through the Office 365 platform to assist your company in defending against ransomware threats.

Start with ensuring that all accounts use Multi Factor Authentication, as identities is the main target for modern criminals – they don’t hack in, they sign in. Defender for Office 365 assists in thwarting the spread of ransomware through email.

Microsoft Defender for Endpoint, on the other hand, is a cutting-edge antivirus and EDR program made to identify and neutralize threats directly on Windows (and MacOS, Linux, iOS and Android) devices. Combining these capabilities with other Microsoft 365 solutions offers a comprehensive approach to strengthen your company’s cybersecurity posture and stop malware threats all around.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

Although the possibility of a ransomware attack on Microsoft 365 is increasing, you are taking precautions to make sure your data is safe by adhering to best practices for data security and learning how ransomware attacks arise and may be avoided.

It is important to put more sophisticated techniques like network segmentation and fundamental procedures like multi-factor authentication into practice.

Your best line of defense against a ransomware assault on your Microsoft 365 data is knowledge.

You can greatly lessen your vulnerability to these kinds of attacks by being aware of the dangers, training your users regularly, typical attack vectors, and countermeasures. Furthermore, being aware of what to do right away in the event that you become a victim can significantly reduce harm and possibly even help you retrieve any lost data.

FAQ

Does Office 365 have ransomware protection?

Yes, Microsoft 365 has built-in safeguards against ransomware. It uses cutting-edge threat prevention techniques to identify and eliminate ransomware attacks in all of its apps.

Should I set up OneDrive for ransomware protection?

In addition to providing basic backup and recovery features, OneDrive has the capability to protect your files from ransomware attacks by using file versioning and sophisticated threat detection.

Does Microsoft Defender protect against ransomware?

Microsoft Defender provides ransomware protection. It uses cutting-edge threat prevention techniques to identify, stop, and handle ransomware threats.

The Importance of Backup in Microsoft 365

The Importance of Backup in Microsoft 365

by | Mar 29, 2024 | Microsoft 365

In this article we look at the need for data protection in Microsoft 365 – what Microsoft is responsible for – and what your organization is responsible for.

Native Data Resiliency

As any capable cloud service, Microsoft takes the availability of customers data in M365 very seriously. As previously mentioned, Exchange mailboxes have four copies, three up to date ones and a fourth, lagged copy (up 24 hours behind).

This last copy is used in case of a systemic corruption of the other three copies. These four copies are distributed across at least two datacenters. All of this is handled automatically by the system and not something end users will notice.

SharePoint and OneDrive for Business storage similarly relies on data being stored in two separate Azure regions – a write will only be considered completed if it’s successfully written to both regions. And the underlying storage uses AppendOnly, ensuring that earlier data can’t be corrupted or encrypted by an attacker.

This versioning also allows the restore of previous versions of files.

Sounds good right? Microsoft clearly takes steps to protect my data, so I don’t have to worry about it? Not so fast – everything described above is about data resiliency, and high availability of your data. What it doesn’t provide, outside of some limited options, is backup of your data.

Backup are copies of your production data, in a separate system, that’s regularly (every hour, every day) copied from production data to the backup location. This provides the following features:

  • The ability to “go back in time” and restore emails / documents / mailboxes / sites to a previous point in time – either to a production location, or a separate export location.
  • The ability to access your production data in case of a catastrophic failure or outage of services in Microsoft 365.

In other words, data resiliency / high availability is not the same as backup. They’re related but serve different purposes. Depending on your business needs or which compliance regulations you must comply with, you may need both.

Let’s cover your native options for restoring earlier versions of data. With Exchange items (emails, contacts, calendar appointments), when they’re deleted you can recover them from the Outlook Deleted Items folder.

They’re kept there indefinitely unless you change the policy in your tenant. If they’re deleted from the Deleted Items folder, you can recover them for up to 14 days from the Recoverable Items hidden folder.

You’ll need to train your users how to do this themselves, or make sure your helpdesk team is prepared to assist on a regular basis as the user interface isn’t exactly intuitive.

In SharePoint / OneDrive for Business deleted documents are kept by default for 93 days, first in a user accessible recycle bin, and if they’re purged from there, in an administrator accessible recycle bin.

Again, the restore process for a document deleted by mistake isn’t straightforward so some training will be required.

To alter the defaults, you can use Retention Policies to keep items for longer (they’re available for restore, even if users delete them out of their Deleted Items folder), these can be applied to both Exchange and SharePoint data.

For Exchange you also use In-Place and Litigation Holds for select mailboxes to manage retention.

365 Total Backup

If you’re looking to alleviate the challenges with using the built in data protection features as a recovery solution, Hornetsecurity provides a comprehensive M365 backup and recovery solution 365 Total Backup or as part of 365 Total Protection Compliance & Awareness.

This protects mailboxes, Teams Chat, OneDrive for Business storage, SharePoint sites, plus Windows endpoints. It’s simple to set up and provides comprehensive protection across your entire tenant.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

In summary, while Microsoft 365 ensures data resiliency, other backup substitutes exist. Backup solutions offer crucial benefits like restoring data to previous states and accessing data during outages. Consider options like Hornetsecurity’s 365 Total Backup for comprehensive protection.

FAQ

Does Microsoft 365 have a backup?

Microsoft 365 provides basic data retention features but doesn’t offer a comprehensive backup solution (although one is in preview from Microsoft at this time). While it retains deleted items for a limited time, a dedicated backup strategy is recommended for robust data protection.

How do I set up a Microsoft 365 backup?

To set up a Microsoft 365 backup:

  • Consider third-party backup solutions like Hornetsecurity.
  • Select a solution that aligns with your backup needs.
  • Follow the provider’s instructions to configure and schedule backups.

How do I backup my OneDrive in Microsoft 365?

To backup your OneDrive in Microsoft 365:

  • Choose a backup solution compatible with OneDrive.
  • Install and configure the selected backup tool.
  • Set up backup policies, including frequency and retention.
  • Monitor and verify backups to ensure data integrity.
Advanced Threat Protection in Microsoft 365

Advanced Threat Protection in Microsoft 365

by | Mar 21, 2024 | Microsoft 365

There are many security tools built into the O365 platform, but when you move to M365 E3 or E5, you unlock a whole new set of advanced features for securing your business.

In this article, we’re going to look at these tools, except for Endpoint Manager, which we have covered here, and Windows 11, which we covered in this article.

Microsoft 365 Defender

Nearly all of Microsoft’s M365 focused security products have the Defender brand, and the central console to work with them is security. microsoft.com.

Here you’ll find a comprehensive Extended Detection and Response (XDR) service that collects data from email, identity, endpoints, cloud services and alerts you to intruders across your M365 digital estate.

Here’s a rundown of the different Defender services:

Microsoft also offers Microsoft Sentinel – a cloud based SIEM; Microsoft Defender for Cloud (for Azure, AWS and GCP IaaS and PaaS workloads) and Entra for identity management and protection.

Microsoft Defender for Endpoint (MDE)

Microsoft Defender for Endpoint (MDE) is a full-fledged Endpoint Detection and Response (EDR) security solution using Machine Learning (ML) behavior analytics for Windows, MacOS, Linux servers, iOS, and Android devices.

It inventories installed applications (Windows and MacOS) and through Threat and Vulnerability Management (TVM) prioritizes which applications bring the most severe risks to your organization based on how widely deployed each application is and the severity of the disclosed vulnerability.

MDE also provides Attack surface reduction rules and Next generation protection, along with many other security features. MDE is available with, M365 E5 / E5 Security or as a standalone license.

Microsoft Defender for Identity (MDI)

With M365 E5 you can step up to Defender for Identity (MDI) which monitors your Active Directory Domain Controllers, and your Active Directory Federation Servers with only lightweight agents, the rest is taken care of by the cloud service.

Any attacker that establishes a foothold on a device in your network must touch AD to move laterally and escalate privileges and MDI will catch them when they do.

Microsoft Defender for Cloud Apps

Once upon a time when your users stayed in the corporate office all you needed to protect them was a good firewall but in today’s world of “work anywhere, on any device” you need a new type of tool to protect them, a cloud access security broker.

Microsoft Defender for Cloud Apps (MDA) is part of M365 E5 and protects your users in real time when they access cloud services. The catalogue of over 31,000 different cloud services gives IT a way to discover and manage Shadow IT (cloud services that users have provisioned without the IT department knowing) across your user base.

Secure Score

How do you know what’s most important to attend to? And where in all the different portals (or PowerShell) do you go to configure each setting? The answers to these questions are in Secure Score, now part of the Security portal.

Here you see an overall score for your tenant (for Identity / Data / Device / Apps and Infrastructure controls) and can compare it to the global average across M365, the average for your industry and for businesses of the same size.

As you implement more controls you score increases (it can take 24-48 hours), and you track your progress on the History tab. Secure Score is the BEST place to start improving your tenant’s security posture.

I’d like to highlight another control (apart from MFA) that’ll gain you a quick win to improve overall security – blocking legacy authentication. This is because even if you have enabled MFA, attackers can still access your user’s accounts with just a username and password through older protocols that don’t support MFA.

To investigate if there are any legitimate connections using these older protocols (which will need to be upgraded or exempt from your block legacy authentication policy) go to the Azure AD portal, click on Sign-ins under monitoring, click Add filters, pick Client app, then click “None selected” and add all 13 legacy connection options.

Once you’re certain there are no legitimate needs for legacy authentication, use CA policies to block it.

The concept of Secure score has spread to other parts of M365, in Compliance Manager there’s Compliance Score to indicate how compliant your business is with regulatory frameworks you have to comply with.

Microsoft has recently added hundreds of additional regulations from all over the world to help you track your compliance, assign tasks users to achieve and maintain compliance.

To manage compliance for your SharePoint and OneDrive sites and their security posture / sharing settings using the built in tools is an exercise in frustration as they’re spread across several portals.

In contrast, Hornetsecurity’s 365 Permission Manager provides a single pane to see the settings for every site in your tenant, apply policies, remediate compliance violations, see all access that a particular user has, produce reports and much more.

Security Is Everyone’s Responsibility

The sad truth is that most small to medium businesses don’t implement nearly enough of the features they have already paid for and even large enterprises struggle to get these protections in place for all their users.

This is partly due to the inherent complexity of many of Microsoft’s native security features – remember the saying, “Complexity is the enemy of security”.

That’s why many organizations are turning to third-party security solutions like Hornetsecurity to help them make key security features more accessible and reduce complexity.

On the other hand, security neglect is also due to a certain carelessness, which stems from the fact that in many businesses a mindset from the on-premise era still prevails, in which it was thought that (almost) everything was already done with a firewall – and IT shops will take care of it.

The world is a different place today: We must understand that the responsibility for security is in all of our hands and that our cyber defense chain can only be as strong as its weakest link.

Consider security awareness training for employees since it is essential to reduce the risk of cyberattacks, prevent data breaches, and ensure compliance with regulations. It empowers employees to recognize and respond to security threats, fostering a strong cybersecurity culture and protecting both company assets and reputation.

Ultimately, investing in awareness training leads to cost savings and a safer digital environment.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion – Keeping Microsoft Honest

If the thought of paying for the underlying platform from Microsoft, and then paying again for the additional security features on top doesn’t sit right with you, consider a third-party solution for your M365 security and compliance needs.

Hornetsecurity offers several different plans with powerful Advanced Threat Protection for your email, data loss prevention (DLP), security awareness service (end user phishing simulation and training), email encryption, email archiving and more.

Hornetsecurity also offers an entire free eBook focused on securing a Microsoft 365 tenant, The Microsoft 365 Security Checklist. It covers all the security settings and configurations you need to know for each M365 license to properly secure your environment and goes into more detail of the actual settings than outlined here.

FAQ

What is Microsoft Defender for Office 365?

Microsoft 365 Defender for Office 365 (MDO) is a cloud-based security service that helps safeguard against advanced cyber threats in emails and Teams communications. It provides protection against malicious links, attachments, and phishing emails, enhancing the overall security posture of Microsoft 365 environments.

What is Microsoft Defender XDR?

Microsoft Defender XDR combines Defender for Endpoint (Windows, MacOS, Linux, iOS and Android), Defender for Office 365, Defender for Identity and Defender for Cloud Apps into a single console, and single comprehensive protection platform.

What does Defender for Office 365 provide?

Defender for Office 365, offers several key functions:

  • Safe Attachments: Scans email attachments for malicious content before delivery.
  • Safe Links: Checks and rewrites URLs in emails to protect against phishing and malicious websites.
  • Anti-Phishing Policies: Detects and mitigates phishing attempts through machine learning and user-reported signals.
  • Real-time Threat Intelligence: Utilizes cloud-based intelligence to identify and respond to emerging threats.
The Importance of Security in Office 365

The Importance of Security in Office 365

by | Mar 19, 2024 | Microsoft 365

In the early days of cloud computing there was a lot of concern around the security of data moved to “someone else’s datacenter”. I think it’s clear to most CISOs today that the big providers do a much better job of it security than most businesses can do (or have the budget to do).

Their incentive is also strong, if a large breach happened it could affect many thousands of businesses and so they spend a lot of money on making sure their clouds are as secure as they can be.

That doesn’t mean however that you can leave it all to Microsoft, there’s something called the Shared Responsibility Model and all cloud providers have some version of this.

There are some areas that are still your responsibility such as the endpoints that your users use to access cloud services, any on-premises infrastructure that’s operating in a hybrid mode with O365 and user provisioning and de-provisioning.

There are also many security controls in O365 that you need to customize to suit your business, where you and Microsoft share the security responsibility. In this article we’ll look at these controls and where and how you configure them.

A New Approach to Cloud Security

The foundation for “how you think about security” should be Zero Trust, instead of trusting a connection based on where it’s coming from (“if it’s on the internal LAN it’s safe, from the outside it’s dangerous”), every access is checked against your Conditional Access rules which gives you a much better security posture.

And base your security on identity which is the new firewall and keep up with new features in the security space.

When thinking about how to defend your systems, don’t forget to take into account attackers moving from on-premises to the cloud, as we saw in the SolarWinds breach.

If you have M365 E5 licensing, you can use attack simulation training to test your users with fake phishing emails and provide bite sized training automatically to them based on their propensity to fall for them. If you’d like more control and optimization, try out Hornetsecurity’s Security Awareness Service which delivers fully automated benchmarking, spear-phishing-simulation and e-training to sensitize and protect employees against cyber threats.

Remember Entra ID Premium P1 & P2 which you can purchase as add-ons to O365 (included in M365), we covered their security features in this article.

There’s a strong argument to be made that relying on Microsoft both to provide the platform (Office 365) and also paying extra for advanced security features from the same company is a conflict of interest.

After all, Microsoft could include more security features in the base platform (Office 365 E3 and Microsoft 365 E3 for example), rather than charging extra for them.

As such, many enterprises choose to opt for a third-party service for advanced security services on top of the base platform, such as Hornetsecurity’s 365 Total Protection.

365 Total Protection

365 Total Protection is a cloud-based security solution that covers all aspects of an organization’s Microsoft 365 security management and data protection: email security, backup and recovery, compliance, permission management and security awareness.

The solution is specifically developed for Microsoft 365 and requires no hardware, software, or maintenance, while providing much-needed layers of additional security and data protection against spam, malware, and advanced threats.

365 Total Protection from Hornetsecurity comes in four different plans:

  1. 365 Total Protection Business gives you state of the art email security, spam and malware protection, signatures, and encrypted email.
  2. 365 Total Protection Enterprise adds email archiving, 10-year retention, eDiscovery, Advanced Threat Protection (ATP) sandboxing of suspect emails, URL scanning, QR code analyzer.
  3. 365 Total Protection Enterprise Backup adds automated backup of mailboxes, Teams, OneDrive and SharePoint and easy recovery, Windows endpoint backup and recovery.
  4. 365 Total Protection Compliance & Awareness adds Permission Manager, Security Awareness Service and AI Recipient Validation to the offering.

This wide range of Microsoft 365 security and compliance features is available in one package and in one license.

365 Permission Manager

One of the three pillars of Zero Trust, using least-privilege access, is remarkably hard to achieve at scale. This is particularly evident in SharePoint and OneDrive where you not only have a complex set of overlapping permission options, but also sharing of files and sites with external users, either through SharePoint, OneDrive, and now also commonly through Teams.

To inventory all these permissions that have been granted and reporting on them requires browsing multiple screens or running PowerShell scripts.

There’s also no easy way to “right-size” permissions when they’re too broad, nor a quick way to revoke permissions quickly across all sites when a user account is discovered to have been compromised for example.

A unique product from Hornetsecurity, 365 Permission Manager alleviates all these issues, and more. A centralized dashboard shows you all your sites, and how compliant they are with your sharing policies.

To right-size permissions use the simple Fix button, or in the case of genuine business requirements for an exception to policy, Approve a special case.

Built-in or custom policies that control external sharing, internal sharing and associated settings can be applied to individual SharePoint sites or OneDrive locations, improving governance and risk management considerably.

You can also see permissions across SharePoint, OneDrive, and Teams for a selected user, very useful when you suspect an account compromise, or perhaps in the case of an insider risk investigation.

Another very useful feature is Quick Actions, which lets you perform bulk actions to manage permissions and maintain a compliant SharePoint, Teams and OneDrive infrastructure.

Microsoft Purview Information Protection

All the governance, Data Loss Prevention (DLP) and Information Protection features in M365 come under the Purview umbrella, with the portal located at compliance.microsoft.com.

Using labels to classify data, either manually or automatically through crawling documents or emails lets you start to govern your business information. Once a document has been labeled you can use MIP or OME to protect it (see below), or control access on Windows endpoints through policy as well as manage access in Office for Mac, Windows, iOS and Android.

Microsoft Information Protection

One of the most powerful and least deployed features is the ability to protect documents, no matter where they live. Traditional file / SharePoint document sharing tightly controlled access at the server level but as soon as a document is emailed to someone, or stored on a USB drive, that control is lost.

With Microsoft Information Protection (MIP) you can set up labels and rules that encrypt documents and that carry their user access with them so no matter how they’re shared, only the right people have access.

If you’re getting started with MIP, you’ll be using the built-in client in the Office apps on Windows, Mac, iOS and Android. It’s important to configure super user accounts so that you can access documents when a user leaves the company.

The list of sensitive information types (SITs) grows ever longer and it’s now possible to customize the confidence levels of rules, copy the built-in ones and customize them and create larger keyword dictionaries (catch every mention of a staff ID tag, or patient record number).

It’s possible to co-author protected documents in real time (with AutoSave support!) and in larger deployments you can use variables in MIP rules to facilitate per-app content marking.

You can apply labels (and optionally document encryption) to documents, SharePoint online sites, and on-premises SharePoint and file shares. You can also scan images using Optical Character Recognition (OCR) to catch sensitive information in screenshots and the like.

Sensitivity labels are now also available for SharePoint sites, M365 groups and Teams. This doesn’t apply to content stored in those locations but rather manages privacy of the container, external user access and can also integrate with Conditional Access policies to block access from unmanaged devices for example.

You can however configure a default sensitivity label for a SharePoint site.

Office 365 Message Encryption

In a similar way to how MIP allows you to share protected documents with anyone, you can use O365 Message Encryption to send emails to anyone and know that only that person can access that email.

Like MIP you can also set up rules so that emails with specific information in them (credit card numbers, social security numbers) are automatically encrypted.

Data Loss Prevention (DLP)

The aim of Data Loss Prevention (DLP) is to help users do the right thing by alerting them when they’re about to share sensitive data through email, SharePoint Online, OD4B or Teams.

It can also be integrated with MIP as Microsoft continues the journey of unifying labeling and protection across M365. DLP protection has been extended to Windows 10 and 11 with Endpoint DLP, which can block upload of documents with sensitive content to cloud storage, copying sensitive information to the clip board, USB storage, network shares or printing.

There’s also an extension for Google Chrome that extends DLP protection to browser tasks. DLP has also been extended to on-premises using the MIP Scanner to find sensitive documents and alert management for DLP violations is also vastly improved.

Exchange Online Protection (EOP)

Exchange Online Protection (EOP) is the mail hygiene solution for Office 365 and can also protect your on-premises Exchange mailboxes if you’re in a hybrid deployment (Exchange Online article).

There are a few settings you can control for EOP as well as some additional configuration you should consider for complete spam protection such as Sender Policy Framework (SPF), Domain-based Message Authentication, Reporting, and Conformance (DMARC) and Domain Keys Identified Mail (DKIM).

If you find that EOP isn’t catching enough malicious emails consider third party services, Hornetsecurity offers a free tool called Threat Monitor (requiring no changes to your MX records) that’ll identify advertising emails (spam), threats and advanced threats emails and also lets you delete them from user’s mailboxes.

Threat Monitor provides valuable email statistical data for your tenant as to what EOP is missing, making the case for upgrading email hygiene services easier.

Defender for Office 365

Defender for O365 protections (available in O365 E5 or as standalone add-ons) builds on top of EOP and gives you Safe Attachments where attachments in incoming emails that may be malicious are opened inside a VM and checked before they’re delivered to end users.

Safe Links checks that links in emails and Office files aren’t malicious at the time when users click on those links. Anti-phishing detects attempts to impersonate users, these protections also extend to SharePoint, OD4B and Teams.

If you find Defender for Office 365 too pricey (It’s included in M365 E5, E5 Security or as a separate add-on) have a look at Hornetsecurity’s 365 Total Protection which comes in a Business and an Enterprise flavor.

Business gives you granular control over email categories and content so that you can block unwanted emails.

You can set email signatures with company disclaimers and use either PGP or S/MIME for email encryption, with certificate handling built in.

The Enterprise flavor adds email archiving / journaling with up to 10 years retention, eDiscovery and sandbox analysis of attachments, URL rewriting and scanning (both in emails and in attachments) and Contingency Covering through an email failover environment when Microsoft 365 is down.

Auditing

One of the great features of the unified platform of O365 is the ability to audit user and administrator actions across the entire platform.

At a minimum you want to configure alerting on Entra ID actions, go to the Compliance portal – Search – Audit log search and see all the different activities you can audit and report on, as well as create Alert policies for.

By default, Office 365 audit logs are kept for 180 days (Entra ID logs for 30 days), which may not be sufficient for your business or regulations you must comply with.

You have two options, use a third-party service to continuously export the logs and archive them for the time period you require, or assign M365 E5 (or M365 E5 Compliance / Discovery & Audit) licenses to the users who’s logs you want to keep for longer. This unlocks the ability to keep the logs for 1 or 10 years.

Say Goodbye to Passwords?

Ultimately the best way to manage passwords is to not have any stored in your directory and not have your users use any – this is called passwordless.

There are many steps on the journey towards this end goal, today you can use the Authenticator app to sign in on an Azure AD account (not as a second factor but as the only factor), or Windows Hello for Business or a FIDO 2 hardware USB/NFC key.

In the meantime, enable Password protection to ban commonly used passwords (2000 in a list maintained by Microsoft plus up to 1000 custom words common in your organization/city/sports teams).

This works seamlessly for cloud only accounts and can easily be extended to on-premises AD. When you require your users to register for MFA, they also register for Self-Service Password Reset at the same time.

Block User Access

If you suspect or confirm that a user account has been compromised the first step should be to disable sign-in for the account in the Admin center.

You should be aware however that the user (or the attacker) isn’t immediately logged out from services they’re accessing, and it can take up to an hour until the block takes effect, due to the lifetime of refresh tokens.

The solution to this issue is Continuous access evaluation which today only applies to Exchange, Teams and SharePoint online connectivity and will block access in near real time (occasionally up to 15 minutes latency due to event propagation).

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

In conclusion, safeguarding your Office 365 environment is paramount in today’s digital landscape.

By leveraging advanced security features such as Defender for Office 365 and comprehensive solutions like Hornetsecurity’s 365 Total Protection, coupled with meticulous auditing practices, you can fortify your defenses and protect your organization from evolving cyber threats.

FAQ

Does Office 365 have security?

Yes, Office 365 incorporates robust security features to protect user data and ensure confidentiality, integrity, and availability of services. It includes features like threat protection, data loss prevention, multi-factor authentication, and more.

How do I enable security in Office 365?

Enable security features in Office 365 through the Security Center. Implement multi-factor authentication, configure threat protection policies, and use features like Purview Information Governance to enhance data security.

What is the best way to secure Office 365?

The best way to secure Office 365 involves a multi-layered approach:

  • Implement multi-factor authentication.
  • Configure Conditional Access policies in Entra ID.
  • Regularly update and patch software.
  • Educate users on security best practices.
  • Use advanced threat protection services.

How secure is the data in Microsoft 365?

Data in Microsoft 365 is highly secure. Microsoft employs encryption in transit and at rest, complies with industry standards, and offers features like Purview Information Protection and Data Loss Prevention to enhance data security. However, users should also implement best practices to ensure the security of their specific environment.

Mastering Endpoint Security with Microsoft Intune

Mastering Endpoint Security with Microsoft Intune

by | Mar 15, 2024 | Microsoft 365

M365 E3 and E5 brings you Microsoft Intune, Microsoft’s mobile device management (MDM) cloud service. In this article we’ll look at how it can help you manage devices and PCs, mobile apps, protect company data, and enforce security policies.

There used to be an on-premises product called System Center Configuration Manager (SCCM), now called Microsoft Configuration Manager, which you can integrate tightly with Intune.

There used to be a requirement that Intune administrators were licensed for Intune but this is no longer the case. Endpoint analytics is an interesting part of Intune, using signals from your devices to pinpoint problematic or slow PCs, it’s part of the overall Adoption score.

If you have Windows 10/11 devices that serve specific functions (on a factory floor, at a nurses station in a hospital for example), you can use Cloud Configuration to easily manage them entirely using Intune, with scripted, baseline configuration settings.

Mobile Device Management

There are a couple of ways you can use Intune, if you have devices (smartphones, tablets, laptops) that are company owned you can enroll them in Intune.

This gives you a great deal of control over the device, including the ability to manage settings, apps and the option to wipe the device should it be lost or stolen.

You can also use Intune to manage OS updates for Windows devices, push out applications to devices, configure Wi-Fi profiles and deploy certificates as well as block iOS jailbroken and rooted Android devices.

If the device is a personal device, owned by the employee, they may not be comfortable with enrolling the device so you can use Mobile Application Management (MAM) for those devices.

Mobile Application Management

This less intrusive approach lets you create app protection policies (APP) across specific applications, with email being the classic example.

Users want to access business email on their personal smartphone so you put policies around it where they can only use Outlook (free mobile app for Android and iOS), not the built-in mail apps and you can further protect corporate data so that a user can’t copy business data to a non-business app (personal email app etc.).

If the device is lost or stolen, you can wipe the corporate data off it while leaving personal photos etc. untouched.

Picking between MDM and MAM is going to depend on many factors such as your userbase, your employment contracts, business and security needs and more; make sure you spend some time in the planning phase to get it right.

Another part of managing mobile applications might be to connect them back to on-premises resources securely, Microsoft now offers their own VPN for iOS and Android called Tunnel – and it’s integrated into the Microsoft Defender for Endpoint.

Microsoft Configuration Manager

If you have deployed MCM on-premises to manage your servers and traditional client PCs you can integrate Intune into your management flow through Co-management to leverage the best of both worlds and prepare your environment for a gradual migration to cloud management.

Don’t confuse this with Hybrid MDM which is the older, deprecated approach to marrying SCCM and Intune.

Intune Suite

In true Microsoft fashion there are add-ons for Intune that you may want to consider for your business, if they solve a particular business problem for you.

There are stand-alone add-ons, an Intune P2 plan and the full Intune Suite, which includes the following: Advanced endpoint analytics to track and optimize end user experiences, Endpoint Privilege Management which lets end users perform certain administrative tasks on their Windows device without being a local administrator and Microsoft Tunnel for MAM which extends the per-app VPN feature for Android and iOS apps to MAM.

There’s also Remote Help, which is a secure way to allow helpdesk to access the screen of staff to assist them and Managing specialty devices such as AR/VR headset and large smart screen devices.

To properly protect your Microsoft 365 environment, use Hornetsecurity one-of-a-kind services:

To keep up with the latest Microsoft 365 articles and practices, visit our Hornetsecurity blog now.

Conclusion

We believe that now you can unlock enhanced security and efficiency with Microsoft Intune as one of your comprehensive solutions for device management and data protection.

FAQ

What is Microsoft Intune used for?

Microsoft Intune is a cloud-based service that provides mobile device management (MDM) and mobile application management (MAM) capabilities. It allows organizations to manage and secure mobile devices, ensuring compliance with security policies and facilitating remote management.

What does Microsoft Intune give access to?

Microsoft Intune provides access to features such as:

  • Mobile Device Management (MDM)
  • Mobile Application Management (MAM)
  • Conditional Access Policies (through Entra ID)
  • Endpoint Security
  • Device Compliance Monitoring
  • Application Deployment and Management

What’s the benefit of Intune for your business?

Intune is used to the security and management of both computers and smartphones / tablet devices within an organization. It helps enforce security policies, manage device configurations, and protect corporate data on both company-owned and employee-owned devices, contributing to a more secure and controlled IT environment.

Microsoft 365 Permissions and Copilot – a ticking time bomb for Security and Compliance

Microsoft 365 Permissions and Copilot – a ticking time bomb for Security and Compliance

by | Mar 12, 2024 | Compliance, Microsoft 365

File sharing in business is one of those technologies that mostly happens “under the radar”. New SharePoint sites are spun up for projects or groups, or new Teams are created with lots of files shared.

This sharing can be both with internal users and external users. And mostly, no one thinks twice about it, until sensitive documents and data end up in the wrong hands.

In this article, we’ll look at the challenge of data governance, document sharing in Microsoft 365 and how it applies to compliance regulations and getting your business ready for Copilot for Microsoft 365 – all with the help of Hornetsecurity’s 365 Permission Manager.

The Dangers of Unmanaged File Permissions

As CISOs and IT admins know – file sharing, both with internal groups and external collaborators is designed to be as easy and frictionless as possible to cater for the reality of the modern, mobile, collaborative digital workplace.

From a compliance point of view however, this approach can be a ticking time bomb, plus there’s a new player on the scene that might accelerate the timer on that bomb – Copilot. Microsoft is keen to push the value of Copilot for Microsoft 365 (at $360 USD per user, per year, you can’t pay per month) and here’s the rub – Copilot has access to the same documents as the user has.

Remember Delve? That was Microsoft’s earlier tech for suggesting documents to you, created by people you collaborated with that you might find valuable. Except sometimes business got a shock when they realized which documents were shared with different groups of people.

The Copilot situation is worse, because you won’t necessarily know which documents it has accessed to answer your prompt or create a new draft of a document for you.

Easy Sharing

Teams file sharing is possibly one of the most easily misunderstood avenues – when you share a file in a Teams channel, it’s actually stored in the team’s site in SharePoint. Whereas if you upload a file to a one-on-one or group chat, it’s stored in the Microsoft Teams Chat Files folder in your OneDrive for Business (which is actually a SharePoint site underneath the hood).

If you have a private channel, it gets its own, separate SharePoint site with a document library that only the members of the private channel have access to. So, the documents are all stored in various SharePoint sites, rather than in Teams itself.

And if you share a file with an external collaborator, depending on the settings your IT department has set in SharePoint online, this might send them an email with an invitation to create a guest account in your tenant.

YouTube

By loading the video, you agree to YouTube's privacy policy.
Learn more

Load video

If you’re a CISO, you’re probably concerned at this point. Business data is easily shared internally, possibly with staff that shouldn’t have access to it, and you have limited control over this sharing.

It’s also (likely) shared with external collaborators, and you don’t have a lot of insight into this sharing either. But you must thread carefully, a knee jerk reaction of locking down file sharing completely, with no external sharing and default tight permissions for internal sharing will just lead to users looking for an alternative way to get their job done.

Sensitive documents might then be shared via third party cloud storage, where you have even less visibility into the risks.

On the other hand, if you’re an IT admin, tasked with managing file sharing (on top of all your other duties) this can seem like an overwhelming challenge.

Where do you even begin? Even if you can produce reports on permissions granted, and files shared externally, you don’t know what’s oversharing and what’s legitimate business. You’ll have to work with various business departments to identify this, on a site-by-site basis.

Finally, if you’re an end user, understanding what control you have over sharing documents internally and externally (which will depend on the tenants configuration), and how you can inventory your own role in oversharing is near impossible to do with the built in tools.

Data Governance

Getting a handle on your current file sharing situation (in most businesses this is something that’s been part of the landscape for so long, that no one has the full overview to see just how bad it is), using the built in tools is challenging.

Auditing hundreds of sites manually is impossible, and even scripting PowerShell reports to gather the data is difficult.

Certainly, take a look at your current settings and the options you have in the SharePoint admin center which we covered in this article. But even if you tighten those settings today (they’re tenant wide), they only apply to new sharing, not existing shared sites, and files.

Remember that one of the tenets of Zero Trust (and it has been around long before that) is least privilege access. In other words, only give users access to the data they need to do their job, no more. And keep this up to date as they change roles in the organization or are promoted.

This rarely happens, instead people keep existing access and just accumulate more permissions. And inventorying exactly who’s got access to what documents is hard to do with the built-in tools.

Different regulations that you might have to comply with have varying approaches to controls around file sharing, in ISO 27001:2022, “Information security, cybersecurity and privacy protection” there’s A.8.12 Prevent the sharing of sensitive information within business communication platforms and under A.8.3 there’s Block access to files for specific users and Create and manage access reviews.

In HIPAA, the Health Insurance Portability and Accountability Act in the US, under § 164.308(a)(4) Standard: Access control you have Review user groups and applications with access to ePHI for example.

In the US, organizations doing business with the Department of Defense need to comply with CMMC, Cybersecurity Maturity Model Certification with a new version v2.0 in the works, here for example, SC.L2-3.13.16 has controls for Data at rest, and AU.L2-3.3.1 has System auditing.

As a last example, the CCPA, California Consumer Privacy Act, control 1798.150(a)(1) Data Security Breaches involves audit logging and Data Loss Prevention policies.

These are just a few examples, depending on where your business is located, and what vertical you’re in and the type of data you store and process, different regulations will apply.

What’s common across many of them is that you not only must control access to data with least privilege access, and audit access, often with regular access reviews – you must also be able to demonstrate to an auditor that you’re doing so. It’s not enough to say you are, you must collect and present evidence for how you’re doing it.

365 Permission Manager

What’s needed is a scalable tool that can span large tenants with thousands of SharePoint sites, which is easy to use and gives you a centralized management interface to apply policies, find deviations from those and remediate over permissioned access in bulk.

We looked at the basics of how 365 Permission Manager works here and this great video animation shows it visually. Instead of having to visit several different portals in Microsoft’s native tools, an IT administrator has a single console, and a single most important page – the To Do list.

This lists all the violations of the policies applied to every SharePoint Online site and let’s you remediate in bulk, as well as provide exceptions when there’s a business justification.

To do list - the IT administrators best friend

To do list – the IT administrators best friend

There are a number of built in compliance policies that you can apply to SharePoint sites, and you can also create your own customized ones.

This is a fundamental difference between the native approach and 365 Permission Manager, instead of having a single tenant wide default for all sites, that you must then further customize for each site, you apply a policy to each site, out of a library that you have adapted to your business.

The concerned CISO we mentioned above, he’s going to love the three reports that’ll show Full Site Permissions, User & Group Access and External Access.

And end users are also involved, receiving regular emails if their sites are violating policy, with links to 365 Permission Manager to remedy issues.

End user email notification

End user email notification

365 Permission Manager was initially built at Hornetsecurity to manage our own SharePoint file sharing challenges, and our CISO, Olaf Petry, loves having such a powerful tool, saying:

It is critical for a CISO to effectively oversee the company’s strategy and programs to ensure adequate protection of information assets and technologies, and yet this process can be very complicated. My peers often discuss what a great pain point it is for them. Hornetsecurity’s new 365 Permission Manager will set CISO’s minds at rest by enabling security and compliance managers and administrators to efficiently and easily control Microsoft 365 permissions, and help prevent critical data from getting into the wrong hands.

The ability to enter a username and see exactly what sites and documents a user has access to also really helps with preparing for an audit.

YouTube

By loading the video, you agree to YouTube's privacy policy.
Learn more

Load video

To effortlessly manage Microsoft 365 permissions, enforce compliance policies, and monitor violations with ease, utilize Hornetsecurity’s 365 Permission Manager. Protect your Microsoft 365 environment and make admin tasks a breeze.

Conclusion

Whether you’re working towards compliance with a regulation, preparing your business for users with Copilot for Microsoft 365 or just want to make sure sensitive data isn’t shared too widely, the answer is simple – 365 Permission Manager.

FAQ

What are the risks associated with unmanaged file permissions in Microsoft 365?

Unmanaged file permissions pose a significant risk to data security and compliance. While file sharing is designed to facilitate collaboration, it can lead to sensitive documents ending up in the wrong hands. With the introduction of Copilot for Microsoft 365, the risks are further exacerbated, as it has access to the same documents as users, potentially compromising data privacy.

How does Teams file sharing contribute to data governance challenges?

Teams file sharing, although convenient, adds complexity to data governance efforts. Files shared in Teams channels are stored in SharePoint sites, while those uploaded to chats are stored in OneDrive for Business. Managing permissions for these shared files, especially when collaborating with external users, can be daunting for IT administrators, leading to oversight and potential data breaches.

How can businesses address data governance and compliance issues related to file sharing?

To address data governance and compliance challenges, businesses need effective tools like Hornetsecurity’s 365 Permission Manager. This tool offers centralized management of SharePoint permissions, allowing administrators to apply policies, identify violations, and remediate over-permissioned access. It provides customizable compliance policies, comprehensive reports, and end-user notifications to ensure data security and regulatory compliance.