Using Microsoft and Office 365, this article explains 10 ways to improve your Microsoft cyber security considering that 2019 saw a significant rise in the number of businesses that reported a breach.

- 16 April 2020. By Adriaan Bekker, Technical Director, Softwerx.

According to the UK Government’s annual Cyber Security Breaches Survey, the number of medium sized businesses reporting breaches or attacks jumped from 60% to 68% in 2019 alone. However with the right management, your business can help reverse this trend.

Here are our top 10 ways to secure your Microsoft 365 and Office 365 against attack:

1. Set up multi-factor authentication

When implemented correctly, multi-factor authentication (MFA) can become a strong line of defence between your organisation and remote cyber attacks. MFA works by using a 2-step verification process; when you log on to your device, multi-factor authentication means that you’ll receive a code sent to your phone in addition to your password as a way of verifying that it is really you. This can prevent hackers who know or can guess your password.

For businesses using Office 365 and Microsoft 365, Microsoft has a setting that requires your users to log in using multi-factor authentication.

To set up multi-factor authentication:

  1. In the admin center, select  Users > Active Users.
  2. In the Active Users section, select Multi-Factor Authentication.
  3. On the Multi-Factor Authentication page, select User if you are enabling this for one user or you can perform a Bulk Update.
2. Train your users

Even a good security system can be rendered meaningless if your staff are untrained. It has been found that human error accounts for most security breaches. To avoid this, keep your staff regularly trained.

Microsoft recommends that your users take these actions:

  1. Use strong passwords
  2. Protect mobile devices
  3. Enable security features on Windows 10 and Macs
3. Use dedicated admin accounts

It’s better for admins to have regular accounts that can be used when performing non-administrative tasks. Also, they should only use their administrative accounts when it’s necessary. This is because administrative accounts can become a prime target for hackers.

4. Raise the level of protection against malware in email

Microsoft 365 and Office 365 already have protection against malware but you can increase the effectiveness by blocking attachments with file types that are commonly used for malware.

Here are the steps to increase your malware protection in email:

  1. In the Office 365 Security & Compliance Center, in the left navigation pane, under Threat management, choose Policy > Anti-Malware.
  2. Double-click the default policy to edit this company-wide policy.
  3. Select Settings.
  4. Under Common Attachment Types Filter, select On. The file types that are blocked are listed in the window directly below this control. You can add or delete file types later, if needed.
  5. Select Save.
5. Protect against ransomware

Ransomware can not only make you unable to access your important data but it can also hold your organisation to ransom; it can extort money from you on the condition that it’ll give you back access to your data.

Creating one or more mail flow rules to block file extensions that are commonly used for ransomware or warning users who receive these attachments in email can help you prevent ransomware.

To create a mail transport rule complete the following steps:

  1. Go to the Exchange admin center.
  2. In the mail flow category, select Rules.
  3. Select +, and then Create a new rule.
  4. Select **** at the bottom of the dialog box to see the full set of options.
  5. Apply the settings in the following table for each rule. Leave the rest of the settings at the default, unless you want to change these.
  6. Select
6. Stop auto-forwarding for email

Hackers can gain access to your account and auto forward your mail without your knowledge; you can prevent this from happening by configuring a mail flow rule using the mail transport rule previously shown.

7. Use Office Message Encryption

Mail encryption is already included in the Microsoft 365 package and comes already set up. With this feature, your organization can send and receive encrypted emails not only from within the company but from people outside as well, this way only the intended receiver can view your message. This Office 365 feature works with Outlook.com, Yahoo!, Gmail, and other email services.

8. Protect your email from phishing attacks

You only really need this if you have configured a custom domain, but you can configure targeted anti-phishing protection (ATP). A feature of Office 365 Advanced Threat Protection, ATP can help protect your organization from many phishing attacks including malicious impersonation-based phishing attacks.

To create an ATP anti-phishing policy, complete the following steps:

  1. Go to https://protection.office.com.
  2. In the Office 365 Security & Compliance Center, in the left navigation pane, under Threat management, select Policy.
  3. On the Policy page, select ATP anti-phishing.
  4. On the Anti-phishing page, select + Create. A wizard launches that steps you through defining your anti-phishing policy.
  5. Specify the name, description, and settings for your policy as recommended in the chart below. See Learn about ATP anti-phishing policy options for more details.
  6. After you have reviewed your settings, select Create this policy or Save, as appropriate.
9. Protect against malicious attachments and files with ATP Safe Attachments

Office 365 Advanced Threat Protection can help protect your organization from malicious attachments, but this feature isn’t turned on by default. It is best to create a new rule to begin using this protection. This protection extends to files in SharePoint, OneDrive, and Microsoft Teams.

To create an ATP safe attachment policy, complete the following steps:

  1. Go to https://protection.office.com and sign in with your admin account.
  2. In the Office 365 Security & Compliance Center, in the left navigation pane, under Threat management, select Policy.
  3. On the Policy page, select ATP safe attachments.
  4. On the Safe attachments page, apply this protection broadly by selecting the Turn on ATP for SharePoint, OneDrive, and Microsoft Teams check box.
  5. Select + to create a new policy.
  6. Apply the settings in the following table.
  7. After you have reviewed your settings, select Create this policy or Save, as appropriate.
10. Protect against phishing attacks with ATP Safe Links

Part of the Office 365 Advanced Threat Protection package, Office 365 ATP Safe Links is the best solution to help protect your organization against malicious websites in links in email or other files by providing time-of-click verification of web addresses (URLs) in email messages and Office documents. Protection is defined through ATP Safe Links policies.

For optimum protection, do the following:

  • Modify the default policy to increase protection.
  • Add a new policy targeted to all recipients in your domain.

To get to ATP Safe Links complete the following steps:

  1. Go to https://protection.office.com and sign in with your admin account.
  2. In the Office 365 Security & Compliance Center, in the left navigation pane, under Threat management, select
  3. On the Policy page, select ATP Safe Links.

To modify the default policy:

  1. On the Safe links page, under Policies that apply to the entire organization, select the Default policy.
  2. Under Settings that apply to content except email, select Office 365 ProPlus, Office for iOS and Android.
  3. Select Save.

To create a new policy targeted to all recipients in your domain:

  1. On the Safe links page, under Policies that apply to the entire organization, select + to create a new policy.
  2. Apply the settings listed in the following table.
  3. Select Save.

In conclusion, don’t leave it until it’s too late to protect your IT infrastructure and risk becoming another statistic. By taking the 10 steps above, you will have enhanced the security of your Microsoft 365 environment and lowered your risk of a breach.

About the author:

Adriaan Bekker is Technical Director of Softwerx. He has over 20 years’ experience working with Microsoft. He advises companies at C-level on best practice for Microsoft licensing, as well as security and compliance. Adriaan’s deep technical knowledge is matched by his managerial insights and commercial acumen.

 

FOLLOW ADRIAAN ON LINKEDIN

Follow Softwerx on LinkedIn and Twitter for the latest updates:


Back to Blog