We’ve had a surprising number of incident response engagements involving Office 365 lately, and I’d like to discuss some best practices to keep you from an incident. There are also some actions that should be taken to allow effective investigation if you should suspect a user or resource is compromised.
The single most important thing that would have kept most of these incidents from occurring? Enable multi-factor authentication. Period.
Yes, I know. But our users complain! It’s a hassle! It’s an extra step!
Let’s consider carefully. Look at each user in the organization. Consider what they have access to, if their credentials are compromised. Look at these resources in your organization:
- Exchange
- All Office 365 documents
- Sharepoint
Weigh out the user inconvenience vs. the loss of any and all data that they have access to….and discuss with your risk and compliance staff.
Still with me? Here’s how to enable multifactor authentication in Office 365.
If you are on a hosted Office 365 infrastructure, your service provider should be ready and willing to help with this if you do not have access in place to enable the option.
Next, let’s talk about investigating an actual compromise. Microsoft has some fairly robust mailbox audit capability for user access, etc. And…it’s not turned on by default.
Crazy, you say? Just a bit!
First, you need to turn the options on – instructions to do that are here.
Then you need to enable it for mailboxes. Instructions to do that are here.
Please note that this second step requires Powershell access – so if you are in a managed Office 365 environment, your service provider will likely need to assist. (and don’t take no for an answer!)
There are a number of other options that are useful for fine-tuning the spam and malware settings, enabling DLP, and other useful things that are not on by default – or not configured for the most optimal settings.
Would you like an audit of your Office 365 environment? Our engineers can help you fine tune your settings to optimize the available options. Reach out, we’d love to help.
Questions, comments? Twitter – @TheTokenFemale, or lwallace@microsolved.com. I’d love to hear from you!