Is our information secure? Who has access to it? What are our data privacy policies? How do these policies translate on how we manage and store data in the cloud? Let’s face it; it is not just large enterprises that are concerned about these questions. Small companies are increasingly more interested in finding solutions to problems regarding data that were not significant or not relevant to their line of business a few years ago.
As a matter of fact, electronic data doubles in size every two years and the chances of a third party attempting to penetrate your infrastructure are correlated. So how do we provide and secure access to the increasing storage of data? In an on-premises environment, this can be a rather daunting scenario, but if data is centralized in the Cloud, it can become a lot easier to control.
Is your Office 365 instance safe? Click here to learn more about Office Protect and how it can help secure your data from hackers.
6 Ways Office 365 Answers Security Issues
1) How Office 365 Is Helping to Cope with the Risks
Microsoft alone spends $1 billion every year on security R&D. This should come as no surprise since the estimated total cost of cyber security attacks in 2015 was $316 billion. The cost of a data breach in Canada increased in 2016 to $6.03 million per attack, on average.
Office 365’s security has earned a plethora of certificates ranging from ISO 27001 and ISO 27018 to SSAE16 and ISAE 3401. To those who don’t understand this gibberish, we can rest assured that Office 365 has a very robust service-level security.
2) How to Take Advantage of These Features
A good portion of the features is provided by default; you don’t have to touch some of the features. For example, for all customers, the service encrypts all the data in transit and saves it in the Cloud whether you want it to do so or not. However, for some features, it will require getting your hands dirty and the time and energy you spend will be justified.
In regards to identity management, Microsoft offers its own single sign-on solution using the Azure Active Directory, but it also supports popular third-party identity providers including Okta, Centrify, and One Login, as well as others. Any of these will allow your users to comfortably log in with the same credentials that they use in their on-premises environment. Companies that use single sign-on can immediately roll out to a fancier multi-factor authentication. Even without one of these SSO solutions, you will find multi-factor authentication options built into the platform. Using MFA makes it a lot more difficult for rogue third parties to gain access by requiring an additional authentication measure after submitting the username and password, such as using mobile phone SMS’ or notifications, PINs setup per device or app, etc.
Another effective way to mitigate the risk of your enterprise becoming compromised is to disallow extranet access to Office 365 using IP Filtering. For those precious customers or trusted partners, you always have the options to create a white list with their IPs.
3) How to Address Sensitive Data Leakage
In today’s world, message security is not just about hygiene, anti-malware, or pesky spams. It needs to address new concerns, such as protecting business and personal information using a data-loss prevention solution, or DLP, an instrument that uses much more intelligence to warn or block your users from disclosing sensitive data. A number of DLP solutions are available; Symantec has one, as well as Intel-McAfee, or EMC RSA, but the one that is most popular amongst the Office 365 customers is the one that Microsoft has built into their service. The DLP policies that you can apply can be based on regular expressions (e.g. part numbers), keywords (e.g. password, confidential) or on data identifiers (e.g. Social Security numbers, credit card numbers) or any combination thereof.
4) What Can Be Done for Email Encryption?
For confidential communication, in one way or another, you will have to use a solution to encrypt the data you send. One way is to use TLS, or Transport Layer Security, which is a cryptographic protocol that encrypts the connection between servers, thus securing the communication. Another is to use S/MIME, which is probably the most widely accepted method of encrypting sent emails. IRM, or Information Rights Management, is another great way of protecting information leakage. This functionality, part of Azure RMS, provides protection for sent emails and attachments both online and offline.
These, together with BitLocker that is used to encrypt data at rest, are your encryption options available with your Office 365 subscription.
5) How SharePoint and OneDrive Use Encryption for Your Data
An enterprise uploads, on average, close to 2 TB of data to SharePoint Online and OneDrive every month. Surely there must be some defense protecting it, right? You bet – and it has all the richness! Migrating your data from SharePoint on-premises to SharePoint Online is usually done in stages with organizations running in hybrid while they make their transition. A best practice is to verify the security controls in both on-premises and online and have them mirror each other.
Some of these controls are DLP and Azure RMS IRM, mentioned earlier, and they extend beyond messaging providing the same value to SharePoint and OneDrive.
OneDrive for Business is an integral part of Office 365, and it is worth mentioning that only this flavor provides encryption on rest, meaning that valuables stored on personal OneDrive accounts are vulnerable as they are not encoded. OneDrive for Business also offers per-file encryption so that ,once they put their hands on a key, malicious actors will have access to a single file, rather than the entire store.
6) How to inquire of Your Office 365 Security
A few months ago, Microsoft released a tool called Secure Score (https://securescore.office.com) that can be used by anyone who has admin privileges for an Office 365 subscription, not just to analyze, but also to implement best practices regarding their security.
Use What’s Best in the Market to Keep Your Data Safe
The benefits of using Office 365 to secure your data aggregated with the abundance of third-party security add-ons are very compelling and enterprises’ decision-makers are being increasingly called upon to consider adopting Cloud solutions. It’d be naïve to believe that, by doing that, you will abolish all the risks. However, implementing and setting up your Office 365 using the best of what today’s security has to offer removes some of the fears that may paralyze the decision-making.
Download Our Free PowerPoint Deck!
Find out what you can be doing to better protect your clients, why you should be taking these precautions and a step by step guide of how to implement these procedures.