Microsoft Cloud App Security Archives

How do I protect company data when my team works from home?

Cyber security, Data Loss Prevention, Microsoft 365, Microsoft Cloud App Security, SharePoint

Many companies are allowing staff to work from home and remote indefinitely, raising questions about how they can protect work data on personal or uncontrolled devices.

As IT experts for working remote Gold Coast IT Support offer the following information to help.

Because we can lose company data in a variety of ways across different devices, we need to apply a variety of protection measures. Let’s take a look at the features in Microsoft 365 that can allow companies to protect their data while users are working remotely.

Use Mobile Application Management

Despite the name, mobile application management doesn’t just apply to mobile devices, it can also protect Windows 10 devices. Mobile Application Management policies can protect company data on both managed and unmanaged devices.

It works by applying protections to the apps your teams use to access company data, like Outlook, Teams, OneDrive and SharePoint.

You can enforce restrictions on these apps to prevent data being saved, cut, copied or pasted.

You can also require a PIN when the app starts or block the app from running on a jailbroken phone or tablet.

This feature can be used to selectively wipe company data from a users device, without affecting their personal files. This is handy for organisations where staff use their personal computers and mobile devices to access company information remotely.

Set up conditional access policies

We can use Conditional Access to enforce restrictions on non-compliant or unmanaged devices. Such as blocking access entirely, or preventing particular actions like stopping users from saving attachments in Outlook on the web or syncing files to OneDrive

We can apply these protections in other ways to apps like OneDrive and SharePoint. Preventing users from syncing data to their personal devices by either blocking access or only allowing limited web only access

Expert IT advice for working remotely

Use Cloud App Security to protect data on third-party apps

These protections don’t just relate to Microsoft 365 apps like OneDrive, SharePoint and Outlook; we can use Microsoft Cloud App Security to apply additional protections to apps like Dropbox Business too. Applying protection to a third-party app like Dropbox Business can prevent users from downloading your company data to unmanaged devices.

Apps like Dropbox Business also provide their own security measures, allowing you to block access and wipe company data when a device next comes online.

Configure idle session time outs

To lessen the likelihood of the wrong people accessing company information on a shared device, we can configure idle session time outs. These will sign users out after a period of inactivity, just like your bank does.

Get alerts on suspicious activities

Cloud App Security includes built-in alerts that trigger on potentially suspicious activities. We can use these to get notified about things like mass deletions, mass downloads and unusual volumes of external sharing

Protect sensitive data with Data Loss Prevention

We can use data loss prevention to restrict or impose conditions on the sharing of sensitive information. These policies can trigger on certain keywords like project names or sensitive information types like credit card numbers, driver’s license details or tax file information. Once a file containing this info is detected, it can display a warning, be blocked from being sent or have encryption applied.

Using Cloud App Security, we can apply additional data loss prevention measures to third party apps like Box and Dropbox Business

Use Sensitivity Labels

But what happens if this all fails, and someone downloads company data to a personal, unmanaged device. To protect against this, we can apply sensitivity labels. These labels define how sensitive a particular piece of content is and in turn can enforce protections on our data. What’s more, these protections apply no matter where it ends up. These baked-in protections can limit who can access the file and what they can do with it. Preventing the wrong people from opening, copying, saving, forwarding or printing sensitive documents or emails.

In many cases, these protections can be applied automatically by scanning for those same keywords and sensitive information types that data loss prevention uses.

As you can probably tell by now, there’s a lot you can do to protect your sensitive data when people are working from home. If you need help with any of this, reach out to us below.

April 14, 2021/0 Comments/by Elliot Munro

How do I stop phishing emails?

Exchange, Malware and Security Threats, Microsoft 365, Microsoft Cloud App Security

What are phishing emails?

Phishing emails are fake messages, designed to look legitimate.

They cost businesses around the world billions of dollars each year. And they get opened by about 30% of people. These emails will generally impersonate a person or company that you trust or deal with, and attempt to trick you using one of three things:

They’ll use a fake person – someone pretending to be someone you know, so that you share information or transfer money into an attacker’s bank account.

They’ll set up a fake site – So that you enter your private information, like passwords or credit card details, or provide a rogue app with permission to access your data.

They’ll create fake attachments – attackers will disguise malware in fake invoices and shipping notification to remotely access your computer or encrypt your files.

How can I prevent phishing emails with Microsoft 365?

To give our teams the best chance of avoiding phishing emails, not only do we need to make people aware of the methods above, we need to configure the features in Microsoft 365 that address them. Starting with Office 365 Advanced Threat Protection

Start with Office 365 Advanced Threat Protection

This is your companies primary defence against phishing emails. While all Office 365 plans come with a built-in anti-phish policy, it’s not even close to what’s offered in Office 365 Advanced Threat Protection, also known as Office 365 ATP.

Once you’ve purchased Office 365 ATP, you should jump into the Security and Compliance centre and check out your anti-phishing policy.

Its default controls are pretty good for detecting phishing emails that impersonate your users, your domains and external contacts. It develops an understanding of how your users and their contacts interact, the addresses and sending infrastructure they use, and identifies anything out of the ordinary. If it detects an impersonation attempt, the message is either quarantined or delivered with a warning.

You can enhance your protection by adding users in roles like CEO or CFO to the targeted user protection feature. You can also add external domains, that you frequently interact with, to the targeted domains feature.

Use a mail transport rule to warn on external impersonation

You can configure a mail rule that applies a warning to messages where an external sender uses a display name that matches someone internally in your company. We have an example rule on our website that has been pretty popular amongst smaller organisations.

So that helps address fake senders, how about fake attachments and fake websites? Office 365 ATP addresses these with the Safe Attachments and Safe Links policies.

Detect malicious attachments with Safe Attachments policy

The safe attachments policy can protect your users from malware sent by phishing emails, like the COVID-19 phishing campaign that used Excel files to install a malicious remote access tool. The Safe Attachments feature analyses your attachments in a separate environment, running a bunch of checks for malware then blocking the email or removing the unsafe attachment.

Detect malicious websites with a Safe Links Policy

The Safe links policy scans your URLs in emails for links to malicious sites. If a malicious website is detected, Safe Links blocks users from visiting it.

Remove phishing emails from mailboxes after delivery

These tools work by analysing messages for known malware, bad links or untrusted senders and stopping them arriving. But what happens if a bad email gets through, and the system doesn’t realise until later?

You should configure Zero Hour Auto Purge. Zero Hour Auto purge removes bad messages from your mailboxes retroactively and sends them junk, quarantine or deleted items.

Set up Office 365 ATP and Exchange Online Protection with recommended best practices

I’ve just discussed four different security policies in a few minutes. If you’ve spent any time looking at ATP or Exchange Online Protection policies, you’ll probably notice there’s a lot of policies, and most of them are already set up. Should you change anything or leave them as they are?

It would help if you changed them, and Microsoft has two levels of recommended best practices that they say will prevent most unwanted messages from reaching your team.

These two levels are called Strict and Standard. In our experience, Strict is very strict, but it’s a good starting point that you can enable first, and adjust later.

Test users by simulating a phishing campaign

Once your policies are set up, you should test your users. If you purchase Office 365 ATP Plan 2, you can run attack simulations against your team. Attack Simulations can help you identify and find vulnerable users before a real attack impacts them.

Protect your accounts if your team gives up their credentials

But what happens when messages get through? What happens when users get duped and provide their login details to attackers?

Protect your accounts. If a user enters their credentials into a fake website, we need to make sure an attacker can’t use these credentials alone to log in. All Office and Microsoft 365 plans allow you to configure multi-factor authentication; this will ensure that attackers can’t log in without having access to an additional form of verification such as a phone or authentication token.

If you have a plan that includes Azure Identity Protection, you should set up a sign-in risk policy to monitor for unusual logins. These policies use machine learning to detect suspicious activity and can temporarily block sign-ins and accounts if something’s amiss.

Monitor for unusual applications with access to your users’ data.

Now that accounts are getting more secure by default, attackers are requesting access to user data via apps. And it’s worse if they manage to trick an admin user because then attackers can have longstanding access to an entire organisation that persists even when passwords are changed.

It can be challenging to detect if a user clicks a phishing link and provides a rogue app with access to their mailbox, OneDrive or SharePoint data. So you use Microsoft Cloud App Security to get alerted to unusual oAuth applications with access to your teams’ information.

Be extra vigilant if your data has been exposed in the past

Take extra care if you, or companies you regularly interact with, have been breached before. If attackers have had access to your company data and know who usually communicates with who, and for what purposes, they will try to exploit that information by setting up fake emails to hold their fake conversations with their fake invoices to get your real money.

Need help with phishing in Office 365 or Microsoft 365?

If you need assistance setting-up these policies in your organisation or need a hand cleaning up after a successful phishing attack in Microsoft 365, we’d be happy to help. Reach out to us via chat, or using the form below.

May 27, 2020/0 Comments/by Elliot Munro

How do I prevent staff accidentally sending personal information outside the organisation?

Data Loss Prevention, Microsoft 365, Microsoft Cloud App Security

While most organisations take measures to prevent and protect against external cyber-attacks, many don’t protect themselves against accidental leaks by their internal staff.

Accidental disclosure is the unintentional release or sharing of sensitive information. In Australia, human error was the cause of 32% of reported data breaches in the last half of 2019.

Sending private information to the wrong person can put an organisation’s reputation on the line and have a dramatic effect on the disclosed party. Under Australia’s Privacy Laws, businesses need to have security measures in place to protect personal data from being leaked unintentionally.

How does an accidental data breach occur?

It’s often a staff member sending an email to the wrong person or inadvertently attaching a document that contains sensitive information. It could also be sending Personally Identifiable Information like Tax File Numbers, Credit Card numbers or Medical information over insecure channels.

What steps can I take to prevent accidental data leakage?

It may be obvious, but it starts with user education.

Document your best-practices and train users on what types of information they can share outside of the organisation.

But what can we configure to make sure we detect and catch any mistakes before they go out?

Microsoft has tools that can prevent sensitive information from being sent unintentionally. Here is a brief list of each tool and what they can do:

Communication Compliance

Communication Compliance is the latest addition to Microsoft’s insider-risk toolset. Communication Compliance helps you detect, capture and take remediation actions when your team sends inappropriate messages.

So what’s an inappropriate message? It can be something that goes against HR policies, like the sending of harassment, inappropriate or offensive language. It can also detect adult, racy or gory images. You can use pre-configured templates to identify sensitive information types or create a custom policy that can detect references to confidential internal projects.

Once a message is detected, communication compliance triggers an alert for investigation and remediation.

Data Loss Prevention

While communication compliance can monitor messages for inappropriate or sensitive information, data loss prevention policies can prevent them from being sent. Data-loss Prevention policies allow you to block, or impose conditions on the sharing of sensitive information.

With DLP, you can specify types of content that cannot leave your organisation. Sensitive info types include credit card information, tax file numbers, drivers license information and more. Microsoft 365 scans the content of your email, attachments and shared files and can either notify you or prevent it from being sent.

Office 365 message encryption

You can encrypt email and attachments to ensure that only the intended recipients can view their contents. You can also prevent recipients from forwarding, saving, copying or printing your email and attachments. Encryption can be applied by default to all messages, enabled manually by users, or automatically based on the type of information you’re sharing.

Sensitivity labels

Your files can be labelled according to their sensitivity level, and policies can be applied relating to these levels. By appropriately labelling files and emails, you can ensure that your most sensitive information is only accessible by trusted recipients no matter where it ends up.

You don’t have to rely on a user labelling content based on an arbitrary choice. Automated file labelling scans the content of your file and applies a sensitivity label based on its content.

Use built-in external sharing alerts

Configure built-in alerts for external sharing. Alerts in Microsoft 365 can notify you each time a user shares information externally, or when an unusual volume of external sharing occurs.

Microsoft Cloud App Security

Cloud App Security can detect suspicious activities across Microsoft 365 and third-party cloud apps. For example, it can let you know if someone performs a mass delete or download of your information from SharePoint, OneDrive, Dropbox Business, Google Drive or Box.

Cloud App Security also provides detailed reports and insights into how your information is shared externally.

Share files via cloud storage

A better way to share data is via cloud storage rather than email attachments. Using cloud storage, you can create links to files, set access control and timed expiry – as well as revoke access. You can also view audit logs of file access to understand who is viewing your information. Sending files as attachments is a less secure way of sharing data – if you have to use it, you should ensure your encrypting messages with file attachments or using sensitive labels to protect them.

Need help protecting your sensitive data?

Naturally, there is significant consideration and configuration to apply these settings and privacy controls for your organisation. At GCITS, we have experience in cloud environments with complex security requirements. We have developed a typical security profile based on the Australian businesses that we most often service.

We can deploy these security solutions with minimal disruption. Your team can work with unimpeded access to clients, suppliers and teammates knowing that automated safety nets are in place.

May 22, 2020/0 Comments/by Elliot Munro

Microsoft Secure Score support for new controls

Azure Active Directory, Microsoft Cloud App Security, Office 365 Roadmap Updates

Microsoft Secure Score has added new controls to support Microsoft Cloud App security and Azure Active Directory.

What is Microsoft Secure Score?

Microsoft Secure Score is a solution that rates how well you’re leveraging security controls for Office 365, Microsoft 365 and Windows 10.

You can check your secure score, and see how you compare against similar businesses at https://securescore.microsoft.com.

New Azure Active Directory Secure Score controls

The new Azure Active Directory controls relate to how well your securing identities in your organization.

Enabling self-service password reset to empower users and reduce help desk costs

You can login to Azure AD to enable self service password reset for all, or just selected, users. You can choose the authentication measures (eg. phone number and alternate email) that users can use to reset their passwords. The policy can require that users register these details on next login, and also define a time period for users to reconfirm their info.

Require just in time access for global administrators using Privileged Identity Management

Privileged Identity Management works on the principal of zero standing access. In practice it means that by default, admins don’t have the ability to perform actions which expose sensitive data, or potentially cause harm. When an admin needs to perform one of these types of actions, they follow a set approval process and provide a justification. This process is audited, and upon approval, the admin is only granted access for a limited period of time. Privileged Identity Management can be enabled in the admin portal, provided you have a plan which includes Azure AD P2.

Turning on password hash sync

If you’re running a hybrid organisation, you can setup password hash sync. This will ensure that users can have the same password for Office 365 and Azure AD services that they use on-premise.

Enable user risk policies

Companies with Azure AD P2 can enable policies that can block access or prompt a user for MFA when a risky sign-in is detected. A risky sign in could be a login from an unexpected location or from a device infected with malware.

Some other important Azure AD controls include:

Require MFA for admins (and also users)

At Microsoft Ignite this year it was reported that only 2% of all admins in Office 365/Azure AD had multifactor authentication enabled. This control is scored quite high as multi-factor authentication makes your accounts 99.9% less likely to be compromised.

Every Office 365/Azure AD tenant gets a free conditional access baseline policy which requires MFA for all privileged roles in Office 365 and Azure AD. This policy will soon be enabled by default, however you can login here and require it be enabled immediately.

Disable stale accounts

Microsoft recommends that you disable any accounts that haven’t been used for the last 30 days. While there may be legitimate circumstances where an account is unused for 30 days, these accounts can also be targets for attackers who are looking to find ways to access your data without being noticed. See here for a list of inactive users in your organisation.

Have less than 5 global admins

You should designate less than 5 global admins in your organisation, even if they are all protected by MFA. The more admin users you have, the more likely it is that one of them is breached or ends up in the hands of a malicious insider. Admin roles in Office 365 should be assigned with the least privilege required for the admin to perform their tasks. Microsoft recommends that you do have at least 2 global admins however, to ensure you can recover from a breached account or rogue insider.

Don’t expire passwords

Setting passwords to expire encourages bad security practices when users store them unsafely or set insecure passwords with patterns. It’s best practice to require users to set stronger passwords which never expire.

What is Microsoft Cloud App Security

Microsoft Cloud App Security gives you a framework to secure your Microsoft and non-Microsoft cloud apps. You can use it to setup policies which alert on suspicious logins or behaviours are across apps like Office 365, Dropbox, Box, Salesforce and many more.

Microsoft Cloud App Security is available in Microsoft 365 E5 and in Office 365 E5 (as Office 365 Cloud App Security). We recommend you purchase it stand alone if you don’t have an E5 plan.

Here are the new Secure Score controls for Cloud App Security:

Reviewing permissions and blocking risky OAuth applications

You can visit the App Permissions page for third party apps in Cloud App Security to see which permissions have been granted to access your company’s Office 365 data. Here, you can revoke permissions and prevent users from authorising these apps to access company info.

Reviewing anomaly detection policies

Anomaly detection policies use machine learning to detect suspicious activities amongst your users. They help you understand if users are logging in from locations that they normally don’t log in from, using anonymous IP addresses, and have multiple failed login attempts. Review them here.

Discover risky and non-compliant Shadow IT applications

Upload your firewall and proxy logs and use the cloud discovery dashboard to discover which applications are in use within your company. Cloud App Security has a rating system that can help determine the risk level of each application. Create a report here.

Creating custom activity policies to discover risky behaviour

In Cloud App Security you can create custom policies as well as take advantage of some of the built-in defaults. These policies can detect and alert when there are suspicious activities like mass downloads or deletions across your Microsoft and third party cloud apps.

October 21, 2018/0 Comments/by Elliot Munro