Top 5 Office 365 Security Best Practices

Microsoft has done its best to keep the Office 365 platform secure, but does that give you and your business the flexibility to ignore your part in protecting your Office 365 assets?

No!

It’s important to understand a few basic facts about Office 365.

Out of the box, while Microsoft tries to prevent breaches, it’s not secure as it can be. You need to have multifactor authentication (MFA), understand your password policies, and understand how your data is being stored in Office 365.

In fact, Office 365 in of itself does not have a backup. In other words, while Office 365 has some redundancies and is resilient to failures, it’s not set up to remediate against a cyber attack from a malicious actor who succeeds in damaging, destroying, deleting, or changing your data.

So, what steps must you take to secure your Office 365 assets?

1. Multifactor Authentication

First, Multifactor Authentication (MFA) is key. Using just a password to access Office 365 is not secure enough.

Your users are likely using the same password across different applications and portals, which may or may not be secure. You may be syncing your network password to Office 365.

There’s nothing inherently wrong with doing so, but it makes you more vulnerable because a number of your assets are protected by just one password — if it gets compromised, you’re in trouble.

Thus, something as simple as MFA prevents cyber attackers from using stolen passwords to access your Office 365 assets.

In fact, there are a number of effective MFA options that work on Office 365. Office is one of the most prevalent cloud suites in the world, so most large vendors not only work with them, but will also highlight it.

Opt is a great one. Opt integrates heavily with Office 365, and allows you to do a lot of different, interesting things. For example, you can self-provision Office 365 — i.e., when you add a user to your Active Directory network, Opt will automatically add them to Office 365 and provision them.

Opt will also add any groups and security policies you have, which might allow them access to SharePoint or other pieces of information inside of Office 365.

While that’s interesting and valuable at saving time, more importantly, it decommissions those users when you decommission them from your Active Directory.

You can also look at AuthAnvil, DUO, and even Microsoft’s own MFA suite. Each of these has some form of federation that leverages Microsoft’s ability to absorb your security policies into theirs and take-in whatever policies you have set in your internal network onto their network.

2. End-User Training

End-user security support & training is important.

For example, there is a new cryptovirus out there that with one click of a button on a link, can crypto-lock the email that you have in Office 365. Because Office 365 doesn’t have a backup by default, that data could be lost forever. You should train your users to avoid clicking such links.

Over 40% of breaches are caused by employees, which speaks to weak end-user training and email use. You must understand the threats your employees are facing when it comes to Office 365 and email.

Each day, your employees will receive emails, and they must understand how to identify spam, mark mail for spam, release and whitelist things that are not spam, etc.

You must also educate your employees on how to recognize malicious links and how to deal with them, i.e., not click on those links, but raise awareness about it, mark it as spam and to report it to supervisors (so that other employees who might have fallen victim can be made aware and the organization can take steps to remediate).