Security in Microsoft 365 (part 3 of 3)

 

To read part 1, please click here

To read part 2, please click here

Data Deletion 

It happens when an attacker deletes your data, often making it difficult to recover the data if not impossible. Ransomware is one of the types of data deletion attacks which helps a hacker to compromise the network, encrypt the data, and then demanding a payment to get the key to decrypt the data. Attacker's motivations for data deletion includes covering the tracks of an attack, attempting to do irreparable harm to your business, or simply trying to spite you or your employees. 

Preventing Data Deletion

Besides using the other data prevention mechanisms, your main strategy should be to make sure that you have enough redundancies built into your data management processes to minimize the impact of data deletion. Although the data in Microsoft 365 is automatically backed up and made redundant for maximum availability by the service, but it's still possible for an attacker to delete data from SharePoint sites and recycle bins making it almost impossible to recover. Hence, it's very important to have a process for backing up missing critical data to offline stores that you know how to store. 

Data Spillage

It happens whenever a data that is transferred to a system doesn't get the same level of protection as the source which can be caused by both malicious as well as non-malicious behavior. Leakage of credit card or social security numbers are also very common and spillage of this type can threaten your compliance with government health as well as financial regulatory standards.

Preventing Data Spillage

Implementing a solution like Azure Information Protection Policies, which can be easily used to classify, protect, and monitor the lifecycle of documents as well as files, is considered as one of the most effective methods for preventing the unexpected or malicious exposure of data outside your tenant. Documents that consists of regular expressions like credit card and social security numbers can be secured with the help of Data Loss Prevention policies.

Coin Mining

Cybercriminals are known for always figuring out various ways to make money and with the introduction of digital currencies called cryptocurrencies, criminals sees a unique opportunity to infiltrate in an organization to secretly mine for coins by reconfiguring malware.

How coin miners work?

Many infections starts with:

1. Email messages with attachments that try to install malware.
2. Websites hosting exploit kits that attempt to use vulnerabilities in web browsers and other software to install coin miners. 
3. Websites taking advantage of computer processing power by running scripts while users browse the website.  

Mining is a process of running complex mathematical calculations mandatory to maintain the blockchain ledger. This process can generate coins but requires significant computing resources. However, not all coin miners are malicious, some of them invests in hardware and electric power for legitimate coin mining operations, on the contrary, the others always seek for alternate sources of computing power as well as ways into the corporate network. These coin miners are unwanted in enterprise environments as they tend to eat up precious computing resources.

Other Attacks

Other types of attacks that are worth mentioning are Password cracking and Malicious insider because both of them are used in the kill chain of events.

Password Cracking

This means that an attacker has successfully acquired access to an application, service, or data store that permits him or her to try many different password combinations for an account in a very short amount of time, with the help of a specialized software. Hence, if the password is very short, very weak, very common, or the same as another account's password owned by the user, then the chances of an attacker to successfully guess the password and compromise the account is very high.

Preventing Password Cracking

Microsoft 365 generally uses Azure AD for authentication when federation is not enabled which will temporary disable an account after multiple logon failures. This is termed as smart password lockout. It is recommended to enable directory controls against multiple failed logon attempts to disable an account after several failed attempts, if you are not using Azure AD for authentication. 

Malicious Insider

As the name suggests, in this scenario, one of your approved users is performing illicit activities in your tenant and can be very damaging as the user already knows a lot about your company as well as ways to to maximize the negative impact to the company and its data. The common motivations of a malicious insider are:

1. Disgruntled employees looking for ways to make extra money.
2. Before leaving the company, they want to create issues for the others.
3. To simply spite specific individuals or the organization as a whole.  

Backdoor accounts built up or go straight to exfiltration or deleting sensitive data can also be done by the malicious insider to ensure long term damage. Users having administrative rights are typically the most dangerous malicious insiders. 

Preventing malicious insider scenario

As done before with the other scenarios, you have to make sure that your accounts are secure, your privileges are well-managed, and that your data is well protected. As, in this case, the attacker has gained all the necessary prerequisites to execute any attack, then, you must have processes that allows you to discern motive, making sure to have ways to identify disgruntled or unhappy employees, and ways to secure yourself from short-term vendors as well as contingent staff by implementing access controls and auditing.   

To read part 1, please click here

To read part 2, please click here