The Biggest Security Concerns with Microsoft 365

Microsoft 365 (formerly named Office 365) is a great cloud solution for organisations of all sizes. It is especially convenient for small- and medium-sized businesses since it provides enterprise-level productivity tools in an easily deployable package. Many organisations have taken advantage of Microsoft 365 to deliver email, chat, file sharing, video conferencing, and other collaboration applications, all via a single user account and for a fixed monthly cost. Add to this the fact that Microsoft is continuously improving and adding to the suite (Microsoft Viva being the latest addition), then you can understand why so many organisations have adopted it.

Like many things in business, the power and ease-of-use delivered by Microsoft 365 comes with increased responsibility and risk. While Microsoft does a great job at providing layers of security for their cloud services, the final responsibility for the data stored on the service, and the emails and other messages flowing through it, are the responsibility of the organisation who owns the data. If there is a data breach under GDPR for data stored in a Microsoft 365 service, then it is the organisation that put the data there, and not Microsoft, who will be liable.

Thankfully there are third-party tools available that augment and enhance the built-in security provided by Microsoft. When these add-ons are done well, they don't make it harder to deploy and use Microsoft 365 applications, but they do make them more secure and robust. Censornet has a toolset that makes it easy to secure Microsoft 365 and the data stored in it. The Censornet platform is cloud-hosted and provides the ability to monitor in real-time and provide enhanced security for Microsoft 365 emails, user identities, data stores, and more. All from a platform that can also protect many non-Microsoft cloud applications if you have any in use.

Renaissance are the Censornet partner and distributor in Ireland. Together we can help you assess your current Microsoft 365 security posture, and make suggestions on how you can make it stronger. Contact us today to find out more and read on for more information on the vulnerability areas where Censornet's products can increase protection levels.

Advanced Email Protection

Email is still the primary communication technology in use today despite the rise in collaboration suites like Microsoft Teams, or the Yammer chat tool (both of which are part of specific Microsoft 365 subscriptions).

Microsoft includes two levels of email protection in Microsoft 365 - Exchange Online Protection (EOP) and Advanced Threat Protection (ATP). These provide essential defence such as anti-spam and malware protection, but they do not give the enterprise-level security that modern businesses and other organisations need.

Email is a prime target for cybercriminals. It is often the entry point in multi-layered attacks. Attack methods such as phishing, spear-phishing, domain-spoofing, and social engineering, use email to try and trick people into providing information that they shouldn't. Information that is often used to facilitate further attacks, such as installing ransomware, which has had a considerable increase over the last year.

Account Takeover and Phishing Attacks

Phishing and social engineering attacks are often precursors to cybercriminals tricking someone into giving them a login for a system, usually via a spoofed web site that mimics a legitimate service using a domain name similar to the real one.

Once they have a legitimate login, cybercriminals can use it to access many other services on the network and in the cloud. This security breach is particularly dangerous on Microsoft 365 as many services are accessed via a single login. And in many deployments, Microsoft Active Directory is used for authentication and authorisation to non-Microsoft applications. So, gaining access to a Microsoft 365 logon can be a skeleton key to everything. Obviously, this needs extra protection, which Censornet's Multi-factor Authentication solutions provide.

Protecting Data in Microsoft 365

In addition to protecting email on Microsoft 365, there is a need to protect data. Microsoft protects data files at rest in SharePoint, Teams, and OneDrive. But data can easily travel. People can, and do copy data to other places, such as a personal Dropbox account or similar, for many reasons. Often with the best of intentions. But this is a risk to the data and should be prevented.

In other non-benign scenarios, people may copy data to steal it. Also, if an account login is compromised, cybercriminals will have access to data that they can steal for their own use or to sell on the dark web.

Organisations can use data loss prevention solutions to stop this data leakage from file stores, SharePoint, Teams, and email.

Dealing with Data Growth and Sprawl

Another aspect of data management beyond protecting it from leaking or being stolen is limiting the somewhat inexorable growth and sprawl that seems to occur. Creating files in Microsoft Office and storing them on OneDrive or SharePoint is simple. Over time the number of files grows, and no-one knows what data is in what file or folder.

Only giving users the ability to create files where they are relevant, and preventing them from creating to many layers of folders, can go a long way to preventing data sprawl. Which, in turn, makes it easier to protect the data from leakage or malicious attackers.

Single Cloud Security Platform

Censornet Cloud Access Security Broker (CASB) can provide real-time protection against file data loss and other security vulnerabilities in a cloud-based application. Not just for Microsoft 365, but also other cloud-based services such as Salesforce, LinkedIn, and other web-based tools. It can prevent data transfer from an official cloud service to one that the organisation does not provide.

Censornet CASB enables your organisation to discover, analyse, secure, and manage user interactions with numerous cloud applications. Achieve complete visibility and control while protecting your workforce. It is integrated with web security for visibility and protection at every stage of a cyberattack.

Conclusion

Censornet solutions provide the security for Microsoft 365 (and other web-based solutions) that is required in the current, every changing, cybersecurity threat landscape. Deploying the Censornet tools alongside Microsoft 365 will deliver the security you need, without compromising the ease of use of the Microsoft productivity suite. Contact Renaissance to find out more.