Office 365 is a great cloud productivity suite that brings benefits to all its users – I use it myself and I love it. As with any technology it’s important to evaluate cyber security risks and take appropriate measures to reduce risk and improve security. Based on my experience and what we’ve seen in client engagements, here are my top 5 cyber security recommendations for Office 365:
- Use multi-factor authentication (MFA) for all users, and especially for Office 365 admin accounts. MFA secures your Office 365 login and protects you from most account takeover attack risks. For an easy to use and affordable MFA, we recommend AuthPoint by WatchGuard.
- Enable mailbox auditing for each user to help combat business email compromise attacks, and to give you valuable insight into account activity. Microsoft How To setup mailbox auditing article
- Enable unified audit logging in the Security and Compliance Center. Unified audit logging lets you search for different types of user and admin activity across all applications in Office 365, including email, SharePoint, Teams, Yammer – and all other components. Article on Audit Logging from Microsoft.
- Ensure Azure AD password hash synchronization is configured correctly and working for all users. Link to Microsoft How To setup AD synch article.
- Disable legacy email protocols to help prevent password spray attacks. If you require legacy protocols for any reason you must limit its use to specific users, setup alerts, and closely monitor audit logs. Link to Microsoft How to disable legacy protocols article.
If you’ve already taken all these 5 steps, and you want to rachet up your security to an even higher level, I highly recommend this Email Phishing Protection Guide published on the Microsoft Cloud Ready Blog. This article includes 20 parts, each with its own how to guide.
Email phishing attacks and business email compromise attacks often lead to very damaging security incidents and financial loss. By implementing these first 5 security steps you can dramatically improve your Office 365 email security and reduce the risk of business email compromise attacks.
As always, if you need additional help, or if you’d like assistance implementing these steps – or if you’d like someone outside your organization to validate your security posture, we are here to help.
Verteks Consulting – A Leading Provider of Cyber Security For Business and Government
www.verteks.com
877-VERTEKS
