Susan Bradley here for CSO Online with one of the ways that I think is so important to
keep your email clients clean and safe.
And that's preventing malicious links and email.
At the present time Office 365 advanced threat protection safe links and safe attachments
are not in every single Office 365 subcription out there.
If you want this option you can actually add it later on to different subscriptions.
You actually may have seen this already in action in the plane outlook or Hotmail implementations.
You've seen it before where you hover over somebody's email and instead of the actual
URL.
It's this huge long link and what its doing is it's actually going through a Microsoft
implementation of a scanning engine to make sure that those links are scanned before your
end users click on it.
Advanced Threat Protection is by default included in Office 365 E5 subscription, Microsoft 365
business and the Microsoft 365 enterprise.
You can add this protection to other 365 plans for minimal fee.
So let's get started by setting up a sample policy.
We're going to go to the security site and we're going to sign in with our admin account.
In the left hand side under threat management.
We're going to choose policy.
As you can see over on the right hand side we have ATP safe attachments and safe links.
And again this is the extra scanning engine that pre scans those links before they get
into your user's inboxes.
We're going to start with safe attachments first.
And by default we're going to turn on it ATP for SharePoint one driving Microsoft teams.
We can also specify a separate new policy.
Again you can click on the plus button to start building a new policy.
And again if you want to check it.
With nearly everything in Office 365 if you want to do an auditing first.
Before you do an implementation of pure blocking you could actually set it up to monitor before
you actually enable it fully.
As you can see here there's different options down here and it warned you ahead of time
that if you choose block replace or dynamic delivery options and malware is detected in
the attachment the message will be quarantined and can only be released by now.
Now we're going to talk about ATP safe links.
And before you do the implementation on this you actually might want to warn your end users
of a little bit different behavior in their email.
So when they get an e-mail from somebody.
When they hover over the link you can see that it's got a redirect or rather it rewrites
the URL link that you were going to, to scan through the scanning engine first.
So especially if they forward this link on to anybody it's going to give an additional
link you'll see seen in just a second.
This has the rewrite attached to it as you can see here.
If you actually look at the actual link if you would forward onto somebody else you can
see it's actually going through Microsoft's implementation of a scanning engine.
That's what that safe links protection outlook.com is all about.
It then allows you the admin to track what the e-mail it went through you can see it
actually.
It flags the user and the domain and then it adds an GUID access code on there so you
know exactly what email had that malicious attachment.
So we're going to choose Safe links and set it up.
We're going again set up a brand new policy.
And this time we're going to say a new policy just to certain recipients.
We're going to call it a name.
Once again we can choose to monitor.
We can choose do not trackYou can also even say don't rewrite the URL if that's a concern
to people in the office or if there's some reason that you cannot allow that rewrite.
So hit save.
Then you go down here and you pick the recipient.
Or a specific user in your domain or the entire domain.
So we're going to pick the recipient.
In this case just for a test.
And we're going to pick that user.
If we wanted to make any exceptions let's say we didn't want for certain e-mails.
We could do that here too.
Then we save that policy.
You can actually see it in action by going into the Security and Compliance Center report
and actually seeing the email that it pulls up.
It will identify if it's found any malicious attachments and what's going on there.
And there you have it.
If you want to give additional protection to your end users.
Take a look at advance threat protection.
Until next time this is Susan Bradley.