Securing and Hardening your Office 365 Environment

Cyber Security Preventive Measures Use Strong Passwords:

1. Enable or enforce Multi-Factor Authentication. Keep all your Devices Secure: Keep device security up to date and enforce mobile device management policies for all devices.
2. Ensure Brand Safety Implement Anti-Phishing: Ensure anti-phishing measures to help protect your organization against malicious attacks impersonating your company.
3. Office 365 Activity Monitoring Azure OMS Integration: Use Azure OMS and Event Admin to detect and alert on a wide variety of Office 365 events.
4. Optimize Exchange Online Exchange Online Anti-Spam/Phishing: Aside from anti-phishing, activity log inspection can detect spam and phishing patterns that include fraudulent mail activity.
5. Group and Data Protection Hidden Membership Groups: Implement Office 365 hidden membership groups to minimize the visibility of these groups.
6. Address Management Address Management: Implement email address management via Active Directory Domain Services to control usage and ease inspection.
7. Exchange Management Best Practices: Secure mail routing and a secure mail exchange with other partners.
8. Optimize Office 365 Office 365 Configuration: Ensure Office 365 configuration is aligned with Microsoft cybersecurity best practices. A multi-discipline security and IT team: A multi-faceted team with cybersecurity expertise is needed for accountability and transparency. Familiarize yourself with the Office 365 Security and Compliance Center to stay up to date.

Introduction to Office 365 Security

While Microsoft provides a highly secure environment, the security configuration of these solutions is not enabled by default. It is your responsibility to first configure them properly along with any accompanying web servers, load balancers, and firewalls. This guide presents a number of best practices that can be followed to ensure user privacy and data protection. While many additional best practices are available, these practices are focused on ensuring that the services are configured to meet regulatory compliance obligations.

This guide uses the threat model categorization as discussed in the definition of threats, vulnerabilities, and risks chapter. This helps readers understand the types of best practices that address established threats. The following threat categorization is used: PowerShell abuse, brute force, password spray, exposure, email and spam, policy, email abuse, mail flow, country-specific threats, and organizational threats. Since this guide is initially focused on important anti-user risks, some traditional anti-admin or management risks are excluded. Please consult future guidance for protection against these additional threats. This is a living document and your feedback is appreciated.

Common Threats and Risks in Office 365 Environment

While Microsoft is constantly working to secure Office 365 and the services that run in your Office 365 environment, it is important to note that your organization's security is a shared responsibility and the organization's environment also needs to be secured. There are certain common issues that all organizations, both big and small, may face due to the size or the type of data that they work with. Office 365 is a huge source of productivity, and it's also a primary storage for an organization's most critical data. This also makes Office 365 an attractive target for unauthorized access to data and other security risks. Here are several common threats and risks in the Office 365 environment: Phishing and social engineering attacks: This threat is the most common. Generally, the approach is the same, with the company falling prey to a phishing attack. An email comes in to the finance team, a policy is sent to HR, or a new plan is sent to the manufacturing team—all with a malicious link. Groups and users do not often think, and malware or ransomware is now loaded into the organization. Configuring domains in Office 365 helps protect against phishing emails being sent from internal or external trusted domains that look similar to your own.

Best Practices for Securing Office 365: Authentication and Access Control

Authentication and Access Control

Do not use "user@domain.com" as the identity name for service accounts or accounts where the mailbox is not being used for email.

Use strong passwords of 14 or more characters with capital letters, numbers, and special characters. Before passwords are implemented, a different password should be used for each account.

Changing the service account password every 90 days is a good security practice. However, service account password changes are not tracked or logged, so what happens if an application stops working and it could be due to a password change? When it comes to staff, one strategy is to provide the password to the employee so that they don't have to call the Help Desk for a password reset.

It is essential to enable multi-factor authentication (MFA) for administrators, service accounts, and C-level staff. MFA requirements should also be enforced. Keep in mind that the majority of unauthorized access occurs after the account has been compromised. After MFA has been enabled, a record should be kept of the number of logins and where the failed login originates.

Data Protection and Compliance in Office 365

When you start to work in an Office 365 environment, data protection and compliance are of great importance for all responsible parties, from the business administrators to the end users. Security and privacy are accomplished through several functions within Office 365, not just the encryption features it has.

Security is a rich combination of physical, logical, and data security available in Office 365. Office 365 meets recognized industry certifications and standards, such as ISO 27001 for our information security management system and EUMC for the data processing contracts we offer for European Union model clauses. Some physical data centers are even located in the European Union’s region. Office 365 offers built-in security features, such as built-in defenses against email threats and other security tools that help protect your online information. Office 365 includes settings to configure the security policies of customer content that can help in a security breach or legitimate misuse of a user account. Office 365 applies broad regional coverage for certain data at rest scenarios through data residency and customer lockbox requests. With Office 365, you control all of your data, including your physical locations or regions. You retain the data that is written to core customer data from temporary storage in search infrastructure, which is stored by active and deleted Exchange and SharePoint items. These are subject to conditional policies for fast indexing and to store the data in a country or region. Be aware of the importance of considering data privacy and security for the success of your business.

Monitoring and Incident Response Strategies

Whew! You have successfully secured and hardened your O365 environment! You have implemented all the recommendations, purchased the best products, updated to the newest versions and patch levels, and trained your team! Finally, you have peace of mind and can relax... or can you? It is true because every day new vulnerabilities are discovered. It is getting harder to separate the good from the bad, and new tricks are learned. The time between when a vulnerability is discovered and when it is used in a widespread attack is dwindling and decreasing every year. To truly be secure, secure your organization's future integrity by preparing for a security incident.

In the event that something occurs, it is wise to keep a dialogue open with other computer security professionals, such as cloud providers and their business partners, to understand the impact and possible security response for future issues. They can give real-time advice and can share telemetry statistics, tell-tale signs, and recommendations about protecting your business using their resources. Additionally, it is a good practice to have a third-party testing group, or an individual with the ability to investigate methods of compromise, look into the environment to determine if it can be hacked. The best way to know if an environment is properly secured is to have a strong computer security posture and validate that fact by mimicking or bringing an outsider to behave in the same manner as the incident responder. Every security problem involves people, so when building tools, consider engagement factors and evaluate effective development strategies. Ensure that everyone involved is ready to respond and communicate in a normal, albeit stressful, way to unusual or unseen ways that a system is affected; hopefully, the only time in which they have to use those skills.