Story image

The good and bad of Office 365 security

19 Sep 18

Despite the stigma that surrounds cloud security, the adoption of Office 365 is resulting in a positive advancement for security within most organisations. On the flip side, the challenge lies with the way it is being managed.

Running an email service is hard, very hard

Let’s start with the positives. Office 365 adoption, and going cloud in general, is good for security.

Running a mail server involves far more than just configuring user accounts. It means creating policies and managing servers, hardware and redundancy, including the design of the architecture.

That is all really hard. So hard in fact, most companies say “let’s outsource it to skilled architects and designers to get it right”. You need a team of administrators to keep a mail server running, and in this day and age that’s crazy.

At the end of the day, most organisations that run their own mail services it don’t run them well. Unless you are in large organisation you probably don’t do it well.

Cloud providers like Microsoft say “we can do security better than you” and I believe them. Office 365 is on the AustralianSignals Directorate’s cloud certification list, which means it has gone through lot of checking to show the processes are well managed. In fact, next week our company on-premises exchange server gets turned off permanently.

If you are not running a major enterprise with large teams, don’t run your own mail server.

The sky’s the limit for improvement

While Office 365 is a boon for end-users, it is a boon for criminals too.

Previously e-mail was internal to a company and it has slowly been expanding outside the organisation’s wall. Many organisations didn’t allow email access from outside the office and there was an inherent layer of security by excluding most of world. With the uptake of Office 365 we threw all that away.

With cloud-based services anyone can connect and that’s bad because of social networks like LinkedIn. Criminals start by targeting interesting people and these people are interesting because they put their hands up and say they are important.

In the cloud, the criminals can know more about your staff than you do.

Just this last week we had someone send an email to a sales manager purporting to be from the managing director. Luckily, they didn’t do a good job of impersonating the MD, but with Office 365 if someone managed to get hold of a user account there are no barriers to access and account control, so protecting access is imperative.

In another case, criminals read through a company’s emails and tried to scam $350,000 with one email.

If we are going to use Office365 then we need to start caring about user access management and anyone who works for a company gets turned off the day they leave. We need to change passwords often and implement multifactor authentication on cloud-based mail services.

A surprising number of businesses still don’t have forced password changes. If you have ever used a password anywhere it is possible it has been compromised, meaning criminals can log into a system, read emails and spend some time creating fake emails. We have run incident response for this very problem multiple times this year.

Another underused methodology is two-factor authentication and this is available free to Office 365 subscribers.

There is some setup for IT, but if anyone tries to connect to Office 365 from a new system it will send a request back to authenticate on the device. Someone has to say yes on an app to authenticate the user access so even if someone steals a username and password they still have to pass through another loop.

Speaking of two-factor authentication, SMS is another factor, but is not ideal as SMS porting is a real threat. By moving to authenticator apps for Office 365 you have raised the bar significantly for criminals.

Another underutilised technology is logging. There are logs available for “impossible travel”, whereby the service will detect if some has logged into the same account from different parts of the world within hours.

This is where we see all the cybercrime these days and it’s big business. The benefits of Office 365 adoption far outweigh the threats, but we must be prudent with the way cloud services are managed. Moving a service to the cloud does not mitigate every risk, and it is incumbent upon subscribers to demand more cloud security options.

Article by CQR Consulting chief technology officer and co-founder Phil Kernick.

Report finds GCSB in compliance with NZ rights
The Inspector-General has given the GCSB its compliance tick of approval for the fourth year in a row.
Preparing for e-invoicing requirements
The New Zealand and Australian governments are working on a joint approach to create trans-Tasman standards to e-invoicing that’ll make it easier for businesses in both countries work with each other and across the globe
5c more per share: Trade Me bidding war heats up
Another bidder has entered the bidding arena as the potential sale of Trade Me kicks up a notch.
Hootsuite's five social trends marketers should take note of
These trends should keep marketers, customer experience leaders, social media professionals and executives awake at night.
Company-X celebrates ranking on Deloitte's Fast 500 Asia Pacific
Hamilton-based software firm Company-X has landed a spot on Deloitte Technology’s Fast 500 Asia Pacific 2018 ranking - for the second year in a row.
Entrepreneur reactivates business engagement in AU Super funds
10 million workers leave it up to employers to choose their Super fund for them – and the majority of employers are just as passive and unengaged at putting that fund to work.
Tether: The Kiwi startup fighting back against cold, damp homes
“Mould and mildew are the new asbestos. But unlike asbestos, detecting the presence – or conditions that encourage growth – of mould and mildew is nearly impossible."
Capitalising on exponential IT
"Exponential IT must be a way of life, not just an endpoint."