In the previous blog in this series, we explored what Cloud computing is, how to work out what Cloud environment you need to improve your work functions, and what the different options are when working in the Cloud.
In this, the second and last blog in the series, we will explore Cloud security, some of the ways cyber criminals may attempt to target you, and how to combat any threat.
The security of the Cloud
Security within an organisation is integral - it is arguably the most important of any concern that any business owner should have, and this is why it is worth knowing the common misconception about the Cloud (that you are always backed up and secure)- unfortunately – is not true. Yes, your data is in the Cloud, and yes, your provider is keeping a watchful eye on it, but your users still have access to that data and when working remotely they could potentially be saving to an insecure browser. There is also the risk of human error allowing access to your system (more on this coming up).
Let’s explore some of the ways that cyber criminals can hack their way into your systems.
Ransomware is designed with the intention of removing your access to your data. It does this by encrypting your files behind a secure ‘key’. The aim of the cyber attacker is to hold the ‘keys to your system’ and then ransom your files – demanding money in exchange for returning your access.
Phishing scams involve an individual impersonating a known and trusted organisation. The message they send to their target will convey a sense of urgency in an attempt to panic the victim into disclosing sensitive information (usually account logins). The email may contain a message along the lines of “Your account has been breached, please login to verify your account”, or “Your account password is due to expire in 2 hours, follow the link below to create a new password”. The messages will be accompanied by a link that redirects you to a login portal that is designed with the sole intention of hijacking your data.
These are just some of the ways that cyber criminals can gain access to your data. It is imperative that you educate your employees on the dangers of their activities online. Most of it boils down to vigilance and ‘trusting your gut’ - if something doesn’t feel right, ask! (More on this later in the blog.)
There are technical security measures that can be taken to better protect you, your users, and -arguably most importantly - your data when online. Let’s say, for example, you have chosen the Microsoft suite of applications as your Cloud platform - a popular choice, combining the familiarity a lot of users around the globe have with the platform along with the increased levels of productivity, collaboration, and communication that can be achieved through the applications such as ‘Microsoft Word’, ‘Excel’, ‘Planner’, and arguably most impressively ‘Teams’ (Teams has amassed a daily active user count of over 115 million as of January this year). Microsoft takes security seriously. Let’s take a look at some of the technical measures available for securing it.
How to better secure your Microsoft 365 suite of applications
There are two key areas to address to reduce risk of data breach and best secure Microsoft 365 in the Cloud:
1) Implementation of technical controls, policies, filters, and defences.
2) Policy changes for how the users access and use 365.
Technical defences exist within Microsoft 365 to overcome a variety of different security threats, including preventing:
• Email content or attachments from being intercepted or able to be viewed by unauthorised parties.
• Your domain from becoming a victim of a ‘spoofing’ attack, with cybercriminals purporting to be your business.
• Phishing attacks being received or having their links clicked upon within email.
• Malware, Ransomware, and other malicious file attachments being received or downloaded from malicious emails.
As we touched on briefly earlier in the blog, the users of a system can be both the final line of defence for your business in preventing a system breach or the inadvertent cause of a breach. The fragility of your system is clear when you consider it is as simple as clicking on a malicious link in the wrong email for the whole system and, in turn, the entire organisation to come crumbling down.
There are a number of risks posed by the way users access and interact with Microsoft 365, that depend upon:
• The complexity of their password and whether this password is unique to 365 or used as a general password across other services.
• The ability to share files and documents, and with whom.
• The ability to share potentially sensitive information within email messages.
• The level of system access and permissions assigned.
Security options in Microsoft 365
Reduce the risk of individual user accounts from becoming breached by cyber criminals as a result of exposed credentials on the dark web or due to accounts being secured with only basic common password formats.
Overcome the risks
A secure password policy is defined by default within Microsoft 365 and is designed to direct the user to use a complex password. A complex password is one that cannot be easily guessed, being a random mixture of letters, of a certain length, and including special characters and numbers.
Password best practice has evolved over recent years. Traditionally, managers were encouraged to enforce users to change their passwords on a cycle of a certain amount of time, and in some cases enforce that the passwords get longer and more complex every time you change them.
In modern times, this has been rethought. Enforcing longer passwords with a regular password renewal policy on a cycle subconsciously forces users to use old passwords again or essentially recycle the same core lettering, but simply extend it by adding a number of further characters at the end to make it easier to remember. This makes the entire process a waste of time and resources as the account is essentially no more secure than before.
Multi-Factor Authentication (MFA) / 2-Factor Authentication (2FA) is the better approach. Applying an additional layer of login security is the new modern approach.
MFA is a second authentication step that takes place after a user has entered their password. Accounts are further secured by requesting the user input a randomly generated code which changes on a cycle – usually every few seconds or a couple of minutes. The code is provided to the user via their mobile device through text message, by accessing an authentication app, or via email, constantly layering the security offered by needing multiple devices to gain access. In this way, even if the cyber criminal has your main password to the account, they may not have access to your device.
MFA, among other login security best practices, can be enforced for your tenancy through Microsoft 365 security defaults.
What are Microsoft 365 security defaults?
To define security parameters that apply to all of your users wherever they are globally, you can activate security defaults that enforce a number of policies automatically.
Security defaults are available to all users of Microsoft 365 at no extra cost, provided you are an organisation that utilises at least the free tier of the Azure Active Directory service.
Security defaults include:
• Blocking legacy forms of authentication
• Requiring users to perform MFA procedures upon certain actions.
• Requiring all system administrators to perform MFA.
• Requiring all users to register for MFA.
How do you implement security defaults on Microsoft 365?
1. Visit your Azure Portal (https://portal.azure.com).
2. From the main menu scroll to ‘properties’.
3. Click ‘Manage security defaults’.
4. Move the slider across by clicking ‘Yes’.
Once having completed this, it is worth noting that the next time your users log in to the system they will be forced to activate MFA on their accounts by entering a mobile number / email address or use it via another method, such as selecting an authentication application to use on their device.
This blog series has highlighted the importance of taking ownership of your own cyber security when using the Cloud, the range of choices there is available in regards to the Cloud, and the considerations you need to make in your own business before making the change.
Your Cloud transition made easy
Cloud Services from BCNS make it easier and more cost-effective to protect and manage your data. Our team of experts will assist you throughout the transition to be sure you get exactly what you desire – at the same time, we can reduce your expenses, and improve your security as well as performance! Contact us now and find out how we can help you with a conversion to Cloud computing and move into a more productive future.