Securing your O365

E-mails are the most used productivity tool by employees. They are also a treasure trove of information and are a lucrative target for hackers as all your data – company, employee, client, etc. are present in one place.

Microsoft’s O365 has been a gamechanger in the world of e-mail. It’s easiness, mobility & ready-to-use ability has led to its popularity. With more than 150 million active users, this is a very lucrative target for attackers.

Recently, the US Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has published security advice for organisations that may have rushed out Office 365 deployments to support remote working during the coronavirus pandemic. This coincides with their notification last year on Microsoft Office 365 Security Observations.

Why is securing your O365 important?

Most organisations assume that complete responsibility & onus of securing their O365 lies with Microsoft. The reality is that Microsoft secures the COTS application and underlying network infrastructure. On the flip side, the instance has 100s of settings & controls to be picked, applied, managed & maintained by the end client.

In the wake of COVID 19, many organisations would’ve overlooked important security configurations due to hurried implementations. This could be exploited by attackers to gain access to your data.

It is always important to understand the reality that it’s your data after all. Hence, it’s your responsibility to secure O365.

How can you commence your journey to a Secure O365?

  1. Implement Microsoft recommended Security Defaults : This includes switching on MFA (Around 90% of organizations have not turned on this setting), blocking of legacy authentication & protocols (IMAP, SMTP, POP3), resetting default account credentials, protecting privileged actions, etc.
  2. Enabling Unified Audit Logging & mailbox auditing for each user. Reviewing all actions periodically either manually or, through automated tools or, security monitoring partners.
  3. Ensure Azure AD password sync is planned for and configured correctly, before migrating users
  4. Implementing musts like disabling auto-forwarding, spam filters, using dedicated admin accounts, managing user & object permissions, custom permissions, secure external sharing controls, etc.  and additional measures like frequent security awareness training’s, third party tools like spam gateway, DLP, etc.
  5. Enabling O365 add-ons like ATP Safe Attachments – protection against malicious attachments & files, ATP Safe Links – protection against phishing attacks, Office Message Encryption, Microsoft 365 Secure Score, etc.
  6. Conducting frequent audits across all security settings & configuration against the likes of CIS Benchmark, Microsoft Security Defaults, CISA Advisories, etc.

Subsequently, it is critical to engage a third-party security vendor to conduct an assessment for your O365 environment. They will aid in identifying gaps & risks in your current O365 configurations and providing advisory on mitigation. Thus, enabling you to safeguard your data & employees.

Accorian has years of expertise in delivering technology & security services. They are a full-service technology & cybersecurity partner to enterprises & SMBs around the US. They have aided multiple organisations in successfully implementing and securing their O365 environment.

Risk Management Framework – Managing & Measuring what matters

A risk management program allows you to manage overall information security risk.  It is an approach to identify, quantify, mitigate, and monitor risks.  The reason to look at risk in a comprehensive manner is to make sure no one area is getting too much attention or, too little. Frameworks also help you identify the bigger elements of risk that need review and mitigation. Additionally, it help you to prioritize the treatment of certain risks. The adherence to risk frameworks also helps give your customers comfort that a standard risk management is in place and hence, reduce your audit burden. 

Typically, a Risk Management program comprises of the following phases:

  • Risk identification
  • Risk analysis
  • Risk evaluation
  • Risk treatment
  • Risk Monitoring

A good risk management framework will have the following characteristics:

  • Comprehensive in types of risks it covers
  • Practical for an organization to implement
  • Updated with current real-world risks
  • Based on controls that can be reviewed and audited
  • Reliable so that your vendors and customers can accept it

There are many risk management frameworks that one can choose from and it important to understand the advantages of each.

Common risk management frameworks include:

NIST (National Institute of Standards and Technology) framework is a comprehensive cybersecurity framework (CSF).  It is very widely accepted across different company sizes and business domains. Most cyber-security professionals are well aware of this framework as it is readily available.  Although widely available and very popular there is no certified third-party audit mechanism. Hence, it can only be self-assessed.  

SOC 2 Type 2 is an internal controls report based on the scope you define.  It is widely used in the United States to show the maturity of your controls.  A CPA firm that is part of the American Institute of CPAs (AICPA) conducts the audit & issues an assessment report.  The AICPA does not audit/review the assessment for completeness or quality. 

HITRUST CSF is a framework that came leverages NIST, SOC, and ISO along with others to create a more comprehensive standard.  It is widely implemented in the United States by organisations in the healthcare space.  Unlike others, although there are external assessors that are involved in the certification process, HITRUST reviews all assessments and issues the certificate. Additionally, among all the frameworks above it tends to be the most expensive to implement. 

It is important to choose a framework that matches your long-term security goals & needs.  At Accorian, we work with all of the above frameworks. We help organizations choose the right framework and aid with the implementation. This is done by augmenting our team into your security team to help steer the rollout, aid with query resolution, choosing of the right controls & workaround during mitigation advisory, facilitating the selection of vendors & products and end to end program management. 

    Ready to Start?

      Download Case study

        Download Guide

        Human Resources Director

        Posted On: 09 May, 2022

        Drop your CVs to

          Interested Position

          First Name

          Last Name


          Total Experience

          Mobile Number

          Upload Resume