Story image

The good and bad of Office 365 security

19 Sep 2018

Despite the stigma that surrounds cloud security, the adoption of Office 365 is resulting in a positive advancement for security within most organisations. On the flip side, the challenge lies with the way it is being managed.

Running an email service is hard, very hard

Let’s start with the positives. Office 365 adoption, and going cloud in general, is good for security.

Running a mail server involves far more than just configuring user accounts. It means creating policies and managing servers, hardware and redundancy, including the design of the architecture.

That is all really hard. So hard in fact, most companies say “let’s outsource it to skilled architects and designers to get it right”. You need a team of administrators to keep a mail server running, and in this day and age that’s crazy.

At the end of the day, most organisations that run their own mail services it don’t run them well. Unless you are in large organisation you probably don’t do it well.

Cloud providers like Microsoft say “we can do security better than you” and I believe them. Office 365 is on the AustralianSignals Directorate’s cloud certification list, which means it has gone through lot of checking to show the processes are well managed. In fact, next week our company on-premises exchange server gets turned off permanently.

If you are not running a major enterprise with large teams, don’t run your own mail server.

The sky’s the limit for improvement

While Office 365 is a boon for end-users, it is a boon for criminals too.

Previously e-mail was internal to a company and it has slowly been expanding outside the organisation’s wall. Many organisations didn’t allow email access from outside the office and there was an inherent layer of security by excluding most of world. With the uptake of Office 365 we threw all that away.

With cloud-based services anyone can connect and that’s bad because of social networks like LinkedIn. Criminals start by targeting interesting people and these people are interesting because they put their hands up and say they are important.

In the cloud, the criminals can know more about your staff than you do.

Just this last week we had someone send an email to a sales manager purporting to be from the managing director. Luckily, they didn’t do a good job of impersonating the MD, but with Office 365 if someone managed to get hold of a user account there are no barriers to access and account control, so protecting access is imperative.

In another case, criminals read through a company’s emails and tried to scam $350,000 with one email.

If we are going to use Office365 then we need to start caring about user access management and anyone who works for a company gets turned off the day they leave. We need to change passwords often and implement multifactor authentication on cloud-based mail services.

A surprising number of businesses still don’t have forced password changes. If you have ever used a password anywhere it is possible it has been compromised, meaning criminals can log into a system, read emails and spend some time creating fake emails. We have run incident response for this very problem multiple times this year.

Another underused methodology is two-factor authentication and this is available free to Office 365 subscribers.

There is some setup for IT, but if anyone tries to connect to Office 365 from a new system it will send a request back to authenticate on the device. Someone has to say yes on an app to authenticate the user access so even if someone steals a username and password they still have to pass through another loop.

Speaking of two-factor authentication, SMS is another factor, but is not ideal as SMS porting is a real threat. By moving to authenticator apps for Office 365 you have raised the bar significantly for criminals.

Another underutilised technology is logging. There are logs available for “impossible travel”, whereby the service will detect if some has logged into the same account from different parts of the world within hours.

This is where we see all the cybercrime these days and it’s big business. The benefits of Office 365 adoption far outweigh the threats, but we must be prudent with the way cloud services are managed. Moving a service to the cloud does not mitigate every risk, and it is incumbent upon subscribers to demand more cloud security options.

Article by CQR Consulting chief technology officer and co-founder Phil Kernick.

Enterprise cloud deployments being exploited by cybercriminals
A new report has revealed a concerning number of enterprises still believe security is the responsibility of the cloud service provider.
Ping Identity Platform updated with new CX and IT automation
The new versions improve the user and administrative experience, while also aiming to meet enterprise needs to operate quickly and purposefully.
Venafi and nCipher Security partner on machine identity protection
Cryptographic keys serve as machine identities and are the foundation of enterprise information technology systems.
Machine learning is a tool and the bad guys are using it
KPMG NZ’s CIO and ESET’s CTO spoke at a recent cybersecurity conference about how machine learning and data analytics are not to be feared, but used.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.