However, the increase in remote working and reliance on M365 has provided ample opportunities for cybercriminals to attack vulnerable cloud-based environments for many individuals and organisations alike. Although there are hundreds of configuration settings in each M365 tenancy, by default Microsoft do not apply the majority of security settings leaving users vulnerable and open to attack.
According to a survey by Sapio Research of businesses that use M365, 97% of the 1,112 IT security professionals surveyed said they’ve extended their use of M365 as a result of the pandemic. When reflecting on the past 12 months, 82% of respondents noted they have seen their organisation’s cybersecurity risk increase, with top security concerns being the risk of data compromise, risk of credential abuse leading to account takeover by unauthorised users and fears over the ability of hackers to hide their tracks using legitimate Microsoft tools such as Power Automate and e-Discovery.
These fears are completely understandable as navigating each configuration setting in M365 and determining if it needs to be configured can be a daunting prospect. If a setting is not in place or has been misconfigured, then you could be providing full access for anyone to view and delete your emails and documents. Keep your business secure and your data protected requires making use of the intelligent built-in Microsoft security features which are often not used to their full potential
We have invested in a dedicated cyber team at CSA that understand what it takes to keep your private data private. CSA's M365 Security Assessment solution is key for any organisation wanting to implement the best security practices whilst using M365.
First, CSA will assess your company’s M365 instance and ensure that you have all the necessary security controls correctly configured to appropriately protect your emails and documents. Following the assessment, you will receive a report on our findings, as well as a technical assessment on the specific controls that need to be changed (each control to be changed will be based on the criticality of exposure). They can also assist in implementing and amending the required controls on your M365 tenancy for added peace of mind.
CSA is passionate about providing high-level security solutions to organisations of all shapes and sizes, which is why its assessment is flexible to cater for any kind of company, from small businesses with less than 50 M365 accounts to large scale multinational companies.
Since Microsoft introduces new features and services regularly, we recommend that CSA’s M365 Security Assessment is performed at least every 6 months to ensure any new features have not impacted the security posture of your M365 service. Cybercriminals are always on the lookout for new weak spots, but regular reviews of your security status make sure the opportunity for an attack never arises.
To find out how we can help your business stay secure, get in touch
About the author
David Woodfine, Co-founder and Managing Director, Cybersecurity Associates
Dave is an ex Cyber Commander working for the Royal Air Force and GCHQ. Now with years of commercial experience, Dave is an expert in cyber risk management and shaping cyber security strategies.