How do we stop our team from receiving or responding to phishing emails?
Well what's a phishing email? It's just a fake message designed to look legitimate.
It costs businesses around the world billions of dollars each year, and these
emails will generally impersonate a person or a company that you trust or
deal with and attempt to trick you using one of three things. They'll use a fake
person. Someone pretending to be someone that you know so that you share
information or transfer money into the attackers bank account. They'll set up a
fake website so that you share your password or your credit card details or
provide a rogue app with permission to access your data, or they'll attempt to
get you to download a fake attachment which installs malware on your device so
they can remotely access your computer or encrypt your files. So that's fake
people, fake websites and fake attachments. If we're to give our team
the best chance of avoiding phishing emails we need to configure the features
in Microsoft 365 that address these three things. Starting with Office 365
Advanced Threat Protection. This is your organization's primary defense against
phishing emails. While all Office 365 plans have a built-in anti-phish policy,
it doesn't come close to what's offered in Office 365 Advanced Threat Protection
also known as Office 365 ATP. Once you purchase Office 365 ATP, you should jump
into the Security and Compliance center to check out your anti-phishing policy
its default controls are pretty good for detecting phishing emails that
impersonate your users your domains and your external contacts. It develops an
understanding of how your users and their contacts interact, the addresses
that they use, the sending infrastructure that they use, and it looks for anything
that's out of the ordinary. If it's detects an impersonation attempt it will
either quarantine the message or deliver it with an inline warning. You can
enhance your protection by adding users in roles like CEO or CFO, these highly
targeted users, to the targeted user protection feature and you can also add
external domains that you frequently interact with to the targeted domains
feature. An additional option to detect fake senders is to apply a mail rule
that triggers when an external sender sends a message where their display name
matches the display name of an internal user. So you can see when people outside
the company are trying to impersonate your internal
staff. We have an example rule for this on our website that has been pretty
popular among smaller organizations. So that helps address fake senders but what
about fake attachments and fake websites? Well, ATP addresses these with the safe
attachments and Safe Links policy. The safe attachments policy can protect your
users from malware sent by phishing emails just like the recent COVID-19
phishing campaign that used an excel file with macros to install a malicious
remote access tool. The safe attachments feature analyzes your attachments in a
separate sandbox environment running a bunch of checks for malware and then it
either blocks the email or removes the unsafe attachment. The safe links policy
on the other hand, scans your URLs in your emails for links to malicious sites.
So this is designed to protect against fake sites that phishers use to harvest
your users' credentials, and if a malicious web site is detected then safe
links blocks users from visiting it. So these tools work by analyzing messages
for known malware or bad links or untrusted senders and stopping them from
arriving. But what happens if a bad email gets through and the system doesn't
realize until later? Well in that case we should be using Zero Hour Auto Purge or
ZAP. Zap just removes bad messages from your mailboxes retroactively. Now I've
just discussed four different security policies in a few minutes, and if you've
used ATP or Exchange Online Protection you'll notice there's a lot of security
policies to configure, and a bunch of them are already set up. So what should
you do? Should you leave them as they are or should you make some changes?
Well according to Microsoft, you should make a few changes
Microsoft has two levels of recommended best practices that they say will
prevent most unwanted messages from reaching your team's mailboxes. These two
levels are called Strict and Standard. In our experience strict is very strict but
it's a good starting point that you can enable first and then adjust later on.
Once your policies are set up, you should test your users. Teach them how to
identify a phishing email and then run an attack simulation against them. With
Office 365 ATP you can run these attack simulations against your team to help
you identify and find vulnerable users before a real attack impacts them. But what
happens when messages get through? What happens when users get duped and provide
their login details to attackers? We should be protecting our accounts. If a
user enters their credentials into a fake website, we need to make sure that
an attacker can't use those credentials alone
to log in. All Office and Microsoft 365 plans allow us to configure multi-factor
authentication. This will ensure that an attacker can't log in without having
access to an additional form of verification such as a phone or an
authentication token. And if you have a plan that includes Azure Identity
Protection you should set up your sign-in risk policy to monitor for
unusual logins. These policies use machine learning to detect signs of
suspicious activity and then they can either block sign-ins or temporarily
block users if something's amiss. Now that accounts are getting more secure by
default, with multi-factor authentication and security defaults that Microsoft are
introducing, attackers are starting to request access to user data via apps. And
it's worse if they manage to trick an admin user because then attackers can
have long-standing access to an entire organization that persists even when
passwords are changed. It can be challenging to detect if your user
clicks a phishing link and then provides a rogue app with access to their mailbox
or their OneDrive or their SharePoint data so we need to use Microsoft Cloud
App Security to get alerted to unusual applications with access to our team's
information. And finally, take extra care if you, or a company that you regularly
interact with, has been breached before. Because if attackers have access to your
data and they know who's who in the company they know who interacts with who
and for what purpose, then they can try to use that information against you. They
can set up their fake accounts to start their fake conversations with their fake
invoices and get a hold of your real money. So if you need assistance setting
up any of these policies, get in touch with us today, we'd be happy to help. We
can also help with cleaning up after a successful phishing attack in Microsoft 365
You can get in touch with us today and GCITS.com