1.1 Microsoft 365 Security

Microsoft considers Zero Trust an essential component of any organization’s security plan. Today’s organizations need a new security model that more effectively adapts to the complexity of the modern environment, embraces the mobile workforce, and protects people, devices, apps, and data wherever they’re located.

With over 90% of threats surfacing through email, it’s critical that organizations can configure security tools in a way that works for their environment. Over time, settings can age, new attack scenarios develop, and new security controls are available, necessitating regular review, upkeep, modifications, and even removal of old configurations. Microsoft is on a journey to make it easier for users and customers to understand configuration gaps in their environment with?recently launched features ?like?preset security policies, Configuration Analyzer, and override alerts in Microsoft Defender for Office 365. Essentially, when Microsoft is confident that an email contains malicious content, they will not deliver the message to users, regardless of tenant configuration.?They also recently announced their?Secure by Default capabilities that eliminate the risks posed by legacy configurations.

Exchange Online Protection (EOP) is the cloud-based filtering service that helps protect your organization against spam, malware, and other email threats. EOP is included in all Microsoft 365 organizations with Exchange Online mailboxes.

Microsoft Defender for Office 365 (MDO) helps organizations secure their enterprise with a comprehensive slate of capabilities across prevention, detection, investigation and hunting, response and remediation, awareness and training, and secure posture.

New Security Controls Microsoft Defender for Office 365 employs a multi-layered protection stack that is always being updated to meet the needs of their users/customers. As they introduce new capabilities and make improvements to existing ones, it’s important that their customers are able to take advantage of these capabilities. That sometimes requires frequent evaluation of settings to ensure the latest protections are turned on. Failing that discipline, it’s possible that the latest protections are not being applied to all users in the organization.

Naturally, these three challenges signify the importance of secure posture. It’s more important than ever that configuring protection against threats is easy to achieve and maintain.

Microsoft 365 Email Protection Basics

Top security tasks

Microsoft recommends that you complete the tasks ? listed below:

1. Set up multi-factor authentication
2. Train your users
3. Use dedicated admin accounts
4. Raise the level of protection against malware in mail
5. Protect against ransomware
6. Stop auto-forwarding for email
7. Use Office Message Encryption
8. Protect your email from phishing attacks
9. Protect against malicious attachments and files with Safe Attachments
10. Protect against phishing attacks with Safe Links

Compromised Accounts

Investigation and data gathering

? How to determine whether your Office 365 account has been compromised

? Audited activities that will end up in the Unified Audit Log

? Detailed properties of an audit item in the Unified Audit Log

? Contextualizing Attacker Activity within Sessions in Exchange Online

? Sign-in logs in Azure Active Directory

Incident response

? Responding to a Compromised Email Account in Office 365

? O365 Security Incident Response

? Detect and Remediate Illicit Consent Grants in Office 365

? Detect and Remediate Outlook Rules and Custom Forms Injections Attacks in Office 365

How to stop an active user session in Microsoft 365

In situations involving compromised user accounts simply disabling an account may not be sufficient to mitigate the threat. Especially, if the account is actively being using to send spam or phish or to download data.

In Office 365 Admin Center under Home >Active Users - Select a user, Click on Account and Sign out of all sessions. This performs a one-time sign-out for that user that revokes active sessions across Office 365 services, including Exchange Online.

Security Resources

• Protect against Threats
• Migrate from a third-party protection service to Microsoft Defender for Office 365
• Recommended settings for EOP and Microsoft Defender for Office 365 security
• Threat Explorer and Real-time detections basics in Microsoft Defender for Office 365
• Investigate malicious email that was delivered in Microsoft 365, Find and investigate malicious email
• Address compromised user accounts with automated investigation and response

User Education

• Protect your privacy online
• Office 365 Security - Microsoft Security Blog

Microsoft Defender for Cloud Apps:

Microsoft Defender for Cloud Apps is a Cloud Access Security Broker (CASB) that supports various deployment modes including log collection, API connectors, and reverse proxy. It provides rich visibility, control over data travel, and sophisticated analytics to identify and combat cyberthreats across all your Microsoft and third-party cloud services.

Microsoft Defender for Cloud Apps natively integrates with leading Microsoft solutions and is designed with security professionals in mind. It provides simple deployment, centralized management, and innovative automation capabilities.

For more information, please refer to Introducing Microsoft Defender for Cloud Apps

A Light Overview of Microsoft Security Products