What are phishing emails?

Phishing emails are fake messages, designed to look legitimate.

They cost businesses around the world billions of dollars each year. And they get opened by about 30% of people. These emails will generally impersonate a person or company that you trust or deal with, and attempt to trick you using one of three things:

They’ll use a fake person – someone pretending to be someone you know, so that you share information or transfer money into an attacker’s bank account.

They’ll set up a fake site – So that you enter your private information, like passwords or credit card details, or provide a rogue app with permission to access your data.

They’ll create fake attachments – attackers will disguise malware in fake invoices and shipping notification to remotely access your computer or encrypt your files.

How can I prevent phishing emails with Microsoft 365?

To give our teams the best chance of avoiding phishing emails, not only do we need to make people aware of the methods above, we need to configure the features in Microsoft 365 that address them. Starting with Office 365 Advanced Threat Protection

Start with Office 365 Advanced Threat Protection

This is your companies primary defence against phishing emails. While all Office 365 plans come with a built-in anti-phish policy, it’s not even close to what’s offered in Office 365 Advanced Threat Protection, also known as Office 365 ATP.

Once you’ve purchased Office 365 ATP, you should jump into the Security and Compliance centre and check out your anti-phishing policy.

Detect User Impersonation Phishing Emails in Microsoft 365

Its default controls are pretty good for detecting phishing emails that impersonate your users, your domains and external contacts. It develops an understanding of how your users and their contacts interact, the addresses and sending infrastructure they use, and identifies anything out of the ordinary. If it detects an impersonation attempt, the message is either quarantined or delivered with a warning.

You can enhance your protection by adding users in roles like CEO or CFO to the targeted user protection feature. You can also add external domains, that you frequently interact with, to the targeted domains feature.

Protect CEO And CFO From Phishing Emails

 

Use a mail transport rule to warn on external impersonation

You can configure a mail rule that applies a warning to messages where an external sender uses a display name that matches someone internally in your company. We have an example rule on our website that has been pretty popular amongst smaller organisations.

Warn On External User Impersonation For Phishing

So that helps address fake senders, how about fake attachments and fake websites? Office 365 ATP addresses these with the Safe Attachments and Safe Links policies.

Detect malicious attachments with Safe Attachments policy

The safe attachments policy can protect your users from malware sent by phishing emails, like the COVID-19 phishing campaign that used Excel files to install a malicious remote access tool. The Safe Attachments feature analyses your attachments in a separate environment, running a bunch of checks for malware then blocking the email or removing the unsafe attachment.

Block Malware With Safe Attachments in Office 365 ATP

 

Detect malicious websites with a Safe Links Policy

The Safe links policy scans your URLs in emails for links to malicious sites. If a malicious website is detected, Safe Links blocks users from visiting it.

Block Malicious Site With Safe Links In Office 365 ATP

 

Remove phishing emails from mailboxes after delivery

These tools work by analysing messages for known malware, bad links or untrusted senders and stopping them arriving. But what happens if a bad email gets through, and the system doesn’t realise until later?

You should configure Zero Hour Auto Purge. Zero Hour Auto purge removes bad messages from your mailboxes retroactively and sends them junk, quarantine or deleted items.

Remove Phishing Emails From Mailboxes With Zero Hour Auto Purge

 

Set up Office 365 ATP and Exchange Online Protection with recommended best practices

I’ve just discussed four different security policies in a few minutes. If you’ve spent any time looking at ATP or Exchange Online Protection policies, you’ll probably notice there’s a lot of policies, and most of them are already set up. Should you change anything or leave them as they are?

It would help if you changed them, and Microsoft has two levels of recommended best practices that they say will prevent most unwanted messages from reaching your team.

Configure Best Practices For Phishing In EOP and ATP

These two levels are called Strict and Standard. In our experience, Strict is very strict, but it’s a good starting point that you can enable first, and adjust later.

Test users by simulating a phishing campaign

Once your policies are set up, you should test your users. If you purchase Office 365 ATP Plan 2, you can run attack simulations against your team. Attack Simulations can help you identify and find vulnerable users before a real attack impacts them.

Simulate Phishing Attack With Office 365 ATP

 

Protect your accounts if your team gives up their credentials

But what happens when messages get through? What happens when users get duped and provide their login details to attackers?

Protect your accounts. If a user enters their credentials into a fake website, we need to make sure an attacker can’t use these credentials alone to log in. All Office and Microsoft 365 plans allow you to configure multi-factor authentication; this will ensure that attackers can’t log in without having access to an additional form of verification such as a phone or authentication token.

Set Up Multi Factor Authentication

If you have a plan that includes Azure Identity Protection, you should set up a sign-in risk policy to monitor for unusual logins. These policies use machine learning to detect suspicious activity and can temporarily block sign-ins and accounts if something’s amiss.

Configure Sign In Risk Policy In Azure Identity Protection

 

Monitor for unusual applications with access to your users’ data.

Now that accounts are getting more secure by default, attackers are requesting access to user data via apps. And it’s worse if they manage to trick an admin user because then attackers can have longstanding access to an entire organisation that persists even when passwords are changed.

Detect Phishing Attacks Via OAuth Apps Microsoft Cloud App Security

It can be challenging to detect if a user clicks a phishing link and provides a rogue app with access to their mailbox, OneDrive or SharePoint data. So you use Microsoft Cloud App Security to get alerted to unusual oAuth applications with access to your teams’ information.

Ban Uncommon Apps Via Microsoft Cloud App Security

 

Be extra vigilant if your data has been exposed in the past

Take extra care if you, or companies you regularly interact with, have been breached before. If attackers have had access to your company data and know who usually communicates with who, and for what purposes, they will try to exploit that information by setting up fake emails to hold their fake conversations with their fake invoices to get your real money.

Need help with phishing in Office 365 or Microsoft 365?

If you need assistance setting-up these policies in your organisation or need a hand cleaning up after a successful phishing attack in Microsoft 365, we’d be happy to help. Reach out to us via chat, or using the form below.

  • This field is for validation purposes and should be left unchanged.

Australia’s reported data breaches increased by 19% in the last quarter of 2019. In this short post, we break down what caused them and how you can protect your business.

Australian organisations are now subject to Notifiable Data Breach laws. These laws attempt to drive better security standards for protecting personal information, and they require organisations to disclose breaches to the Office of Australian Information Commissioner (OAIC).

Companies who fail to disclose may be subject to hefty fines which also extend personally to company directors.

 

Want to protect sensitive information in Microsoft 365? Download our free Microsoft 365 Data Protection guide.

 

How were Australian companies breached?

The OAIC releases a quarterly report on reported data breaches. The latest contains records up to December 2019 with a total of 537 reported breaches which break down into the following categories:

  • Malicious or criminal attack – 64%
  • Human Error – 32%
  • System Fault – 4%

Causes of Australian Data Breaches December 2019

To adequately protect your business against data breaches, you need to implement a system that addresses all three categories.

Protecting your organisation against malicious or criminal attacks

Let’s look at the methods hackers used to breach Australian businesses.

Methods Of Malicious Or Criminal Attack

Of the ‘Malicious or criminal attack’ category, 74% of breaches involved compromised credentials. These are known as identity attacks because they use a compromised identity to gain unauthorised access. According to Microsoft, by implementing Multi-Factor Authentication across all users, an organisation can defend itself against 99.9% of identity-based attacks.

Ransomware and Malware made up another 16% of ‘Malicious or criminal attack’ breaches. These can be prevented by implementing a capable desktop and email threat protection engine such as:

  • Office 365 Advanced Threat Protection
  • Microsoft Defender Advanced Threat Protection.

Protecting your organisation against human error related breaches

Of the ‘Human Error’ category, 42% of breaches occurred using email. An example of this might be sending sensitive data to the wrong recipient. Companies can prevent this kind of breach by implementing a system which scans outbound email.

If the system determines that the email contains sensitive information, it can immediately block the mail delivery or alert a team member.

Protecting your organisation against System Fault breaches

Protecting your organization against system fault breaches relies on a combination of luck and due diligence. According to the OAIC, these types of breaches involve ‘disclosure of personal information on a website due to a bug in the web code, or a machine fault that results in a document containing personal information being sent to the wrong person.’

To defend against system faults, we recommend storing your sensitive data with reputable vendors only and choosing an IT partner who will regularly monitor and maintain your systems.

How can we help secure your environment against data breaches?

We use a combination of Microsoft 365 Business Premium and Microsoft Cloud App Security to implement enhanced cybersecurity for small businesses.

It’s not enough to simply buy the Microsoft licenses and apply them to your users.

To be effective in the modern threat landscape, these systems must be configured and monitored with policies applied and adhered to.

Want to learn more about protecting your data against breaches in Microsoft 365? Download our free guide on which features you should configure, or get in touch today.

  • This field is for validation purposes and should be left unchanged.

Office 365 Advanced Threat protection and Office 365 threat intelligence logs can now be integrated into your SIEM solution.

Threats discovered by these services can be made available on the audit.general workload of the Office 365 Management APIs.

What are the Office 365 Management APIs?

The Office 365 Management APIs are essentially the API version of the Office 365 Unified Audit Log

To get your Office 365 ATP info into your SIEM, you’ll need to have the Unified Audit Log enabled for your tenant. Unfortunately, it’s not enabled by default.

How to enable the Office 365 Unified Audit Log

The Office 365 Unified Audit Log is an important and useful tool which can help you secure your Microsoft Cloud environment. If you’re a Microsoft Partner, we have a longer article on enabling this for your customers’ tenants here, but to enable it for a single tenant, you have two options.

Enable the Office 365 Unified Audit Log via the Security and Compliance Center

  1. You can log into the Security and Compliance Center at protection.office.com as a global or security administrator.
  2. You’ll find the setting under Search and Investigation, Audit Log Search.
  3. If the audit log isn’t enabled, click Start recording user and admin activities

Enable the Office 365 Unified Audit Log via Powershell

  1. Connect to Exchange Online via Powershell
  2. Type: Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Connect your SIEM to the Office 365 Management APIs

Once the audit log is enabled, threats discovered by Office 365 ATP and Threat Intelligence will be available on the audit.general endpoint of the Office 365 Management API. For more information on setting this up, see the official Microsoft documentation here.