Published: October 9, 2020 on our newsletter Security Fraud News & Alerts Newsletter.
The popularity of Microsoft Office 365, especially among enterprise worldwide, is a force to be reckoned with. Designed with business in mind, the office suite offers applications that helps an enterprise keep track of itself, its customers, and the bottom line. Apps like Word, Excel, PowerPoint, Outlook, and OneNote help keep many millions of businesses humming and have become a mainstay of enterprise everywhere. But what makes Office 365 a must-have for so many in the business community also makes it an appealing and expanding target for cybercriminals.
Recent statistics show how integrated Office 365 has become in the business world. Up to 90% of Fortune 100 companies depend on the software every day. The global share of the market for Office 365 is approximately 38%, with over 42% of U.S. companies as regular users. In China, the software dominates the market share with over 57% of their enterprise.
Statistics aside, security researchers at FireEye Mandiant believe that due to its massive popularity, the enormity of data stored in the Office 365 cloud provides an irresistible target for hackers everywhere. Easy to get, an email address is often all that’s needed to gain system access. Successful email phishing campaigns can result in brute-force attacks that find and exploit weak and reused passwords, paving the way into a data system. Gaining access to Office 365 with stolen login credentials can provide VPN and administrative access. Once done, a hacker is free to roam a system, including data held in the cloud.
FireEye Mandiant researchers note that bad actors are not exploiting a weakness or security flaw in Office 365. What they are exploiting, however, is how commonplace the suite is throughout the world, and the tempting allure of all those data-packed clouds.
Since we know how easily an enterprise email account can be breached, there are security steps that can help stop a phishing attack cold in its tracks.
It starts by using strong, unique passwords that can’t be easily cracked. These should always include a combination of upper- and lower-case letters, as well as numbers and special characters. They should also be required to be changed regularly.
Remember, just one employee acting on a phishing email can ultimately lead to the take down of an entire enterprise network. Ongoing cyber security awareness training should be an important part of your security strategy.
Adding MFA (multi-factor authentication) to logins can help stop successful attacks by adding layers of identity verification to the login process. There are several options for this including using key fobs with random numbers, one-time text, or email codes, or even a physical ‘key” that unlocks the login.
Putting limits on who has administrative rights can provide more obstacles for a hacker to overcome. Only those who need it should have it.
Also, monitoring network activity can alert an IT department to suspicious anomalies before they cause further damage. There are many tools to help with this. It’s worth the effort to check into what’s right for your organization.
Keep up to date: Sign up for our Fraud alerts and Updates newsletter
Want to schedule a conversation? Please email us at advisor@nadicent.com