Workforces are becoming more distributed due to the pandemic or the desire to hire the best talent wherever in the world it may be. In turn, many are moving their operations into the cloud, starting with email, being one of the most common applications. Many companies that use Microsoft Exchange on-premises are naturally choosing Microsoft Office 365 (O365) in the cloud. However, security in the cloud is different from on-premises. The administrative interfaces for cloud applications are quite different than their on-premises counterparts, and they have different configuration options. If you are planning on using O365, these are the things you need to do to secure your O365 accounts.
The top three threats to O365 accounts are password-based attacks, credential phishing, and consent phishing (for more details see our Threat Insight report). The following configuration recommendations are based on Microsoft best practices and assume only the entry-level edition of O365 and the edition of Azure Active Directory (AAD) included with O365. Premium editions of AAD provide more advanced options, but we will only refer to them without going into details. Even the basic options, however, provide good protection against these threats.
The three most common password-based attacks for O365 are credential stuffing, brute-force, and password spray.
The two most important things you can do to protect your O365 accounts from password-based attacks are: (1) turn on Multi-factor Authentication (MFA) and (2) turn off Legacy Authentication for all user accounts (use long complex passwords for service accounts). Both can be configured through “Properties > Enable Security defaults > Manage Security defaults” in the Azure Portal. The “Multi-factor Authentication” feature in “Security defaults” requires users to authenticate using the Microsoft Authenticator application after they enter their passwords. The Microsoft Authenticator application is the only additional means of authentication available via “Security defaults.”
Multi-factor authentication however cannot be used with Legacy Authentication. Older versions of Office clients or any other client that uses legacy mail protocols like IMAP, SMTP, or POP use Legacy Authentication. You can find out whether any of your applications are using Legacy Authentication by doing the following:
These applications must be updated to versions that use “Modern Authentication” (e.g. Outlook 2013 or later) before turning off Legacy Authentication. Applying these two configuration changes will stop the vast majority of known attacks on O365 accounts.
Here are some additional features that can protect your O365 accounts from password-based attacks. Note that they do require Premium editions of Azure Active Directory.
Premium P1 Edition
Premium P2 Edition
Turning on MFA and turning off Legacy Authentication are sufficient for most small-to-medium or mid-market businesses without special security requirements. However these features can make protecting your O365 accounts more convenient and effective. The one exception to this rule is service accounts, as they cannot use MFA. AAD connect health may be especially useful for businesses that use service accounts.
Phishing attempts often appear as a pop-up or an email indicating that account credentials are ‘suspended’, need to be ‘verified’ or ‘reset’. Unsuspecting users follow the prompts, landing on a well-crafted page where they are prompted to enter credentials. Attackers then have the login credentials and access to the account.
In addition to turning on MFA as mentioned above, the following features available in Premium editions of AAD help protect against credential phishing.
In general, MFA should be enough protection for most companies. However, MFA can be bypassed by particularly determined attackers. For those that need additional protection, the Premium editions of AAD may be worth the expense.
Sometimes known as ‘App Attacks’, OAuth attacks occur when threat actors leverage an O365 app created using information stolen from a legitimate organization. The attacker sends an email, text, or other communication purporting to be from Microsoft asking users to complete an action. After the user signs into their O365 account, they’re redirected to the official O365 consent process that prompts them to grant permissions to the actor’s application. Once permission is granted, the attacker will have persistent access to the O365 account(s).
You can limit the ability of users to add applications, as well as limit the permissions that those applications have when added. Here are three of the four options:
The fourth option is custom app policies, but that's outside the scope of this blog post.
Once you decide which option is right for your business, you can configure it by doing the following:
The limits you apply to the ability of users to add applications do not affect the ability of admins to add applications, and sometimes even admins make mistakes, or apps can get compromised. So, we recommend you regularly audit all of the permissions consented to by admins and users for all applications. You'll need to review both delegated and application permissions. You can look up the applications to which any individual user has granted permissions by using the Azure Active Directory Portal.
This will show you the apps that are assigned to the user, and what permissions the applications have. Here are some things to keep an eye out for:
If you see any of these things, follow up with the approver to determine whether these applications are legitimate. If not, immediately remove them.
These configurations will reduce risk, though monitoring for suspicious activity in your O365 account will still be necessary. To see how ActZero helps detect and respond to threats like these, check out our product page.