Office 365 is a tried-and-tested subscription service that enables businesses to save countless hours doing repetitive and manual work. With its programs such as Word, Excel, PowerPoint, OneDrive, and Teams, among many others, the platform allows users to access documents on mobile devices, organize teamwork, and analyze work activities.
There are currently 180 million active users of Office 365. With that many subscribers in consideration, threats have also grown by 63% in the last two years.
Cybercriminals are working overtime to devise new and clever ways to infiltrate systems and steal sensitive company information that can be used for financial and identity theft. So how do you stay secure in Office 365? Here are a few tips to consider:
#1. Use multifactor authentication (MFA)
Just recently, a new phishing campaign pretended to be from the Office 365 team, telling email recipients they have detected an unusual amount of file deletion requests occurring in their account and they should review the alerts. If the user falls for the trap, their login credentials will be sent to the hacker who will then gain full control of the account.
This is where MFA comes in handy. MFA involves the use of more than one means of verifying a user’s identity. For instance, after entering a password, you can require inputting a one-time code sent to a smartphone.
Alternatively, users can be prompted through their mobile device if they are really the one logging in. This technology is basically a secondary lock, so even if criminals get a hold of the user’s password, their hacking attempt will be futile without the code.
Admins must do their part as well. MFA isn’t enabled by default for administrator accounts using Azure Active Directory (AD). There’s a default Conditional Access policy available, but administrators must explicitly enable this to implement MFA for their accounts. If not enabled, the administrator account could be used to compromise user accounts during Office 365 migration.
#2. Enable mailbox auditing
Mailbox auditing logs actions that Office 365 administrators and users perform. Prior to January 2019, Microsoft did not enable this feature by default, forcing Office 365 users before this period to activate auditing themselves.
Furthermore, Office 365 doesn’t automatically enable the unified audit log, which contains user, group, application, domain, and directory activities performed in Exchange, SharePoint, OneDrive, Azure AD, Teams, PowerBI, and other Office 365 services. The unified audit log allows you to see if a certain document has been viewed or modified by a certain user. It can also be used to monitor malicious activities and easily point out areas of concern within your IT infrastructure.
Pre-2019 Office 365 customers need to enable mailbox auditing manually. Administrators can turn on unified audit logs in the Security and Compliance Center.
#3. Remove unnecessary account privileges
According to Skyhigh Networks, 49.5% of all unauthorized access on a network is caused by a user having account privileges higher than what is necessary. This might be an intern being granted permission to modify documents or a writer gaining access to sensitive system files.
This could be dangerous to your infrastructure as they could accidentally or intentionally compromise the security of your data. To counter this, regularly conduct a full audit of your user base and check whether their permissions are necessary to their job description. The highest privileges should only be given to executives, IT department leaders, and managed IT services providers (MSPs).
#4. Back up your files offline
Data security is non-negotiable, and you should do everything possible to ensure they won’t fall into the wrong hands. To prevent data from being compromised by malware such as ransomware and worms, it’s a good idea to keep an offline backup of your sensitive information. This acts as a failsafe in case your cloud infrastructure is attacked or a file is accidentally deleted. Your files are generally safe online, but it won’t hurt to take extra protective measures.
Security for your Office 365 subscription shouldn’t be difficult. Here at USWired, not only can we tailor the perfect productivity solution for all your needs, but we can also guarantee a 99.9% uptime and 24/7 support, so you’ll have peace of mind every day. Drop us a line today to learn more!
