Security in Microsoft 365 (part 1 of 3)

 

To read part 2, please click here

To read part 3, please click here

Threat Vectors & Data Breaches

A threat vector is known as a path or means by which a hacker, or "threat actor", can gain access to a target which can be anything of value to the hacker. Generally, these targets include computers and servers, usernames and passwords, Personally Identifiable Information (PII), financial information, and an organization's plans for a new marketing campaign. The threat landscape has changed very much over the past several years as the hackers have started to use more advanced methods to compromise users as well as networks. Hence, Microsoft 365 successfully protects their users as well as their data from being compromised by cybercriminals.

The Workplace & Threat Landscape

Nowadays, companies have to consider various factors when dealing with different entities like users, devices, apps, and data as well as the requirements to mitigate the risks of providing flexibility and space while also maintaining the company's security policies and detecting threats, to grant workers a better and more productive experience. 

As today's world is cloud-centric, the organizations have to face the unregulated (like files on cloud storage services) and the unknown (like advanced threats targeting users' email) which is more difficult to protect as the data is now stored everywhere - it's on-premises, on PCs, on phones, and in the cloud. Microsoft is clearly invested in addressing these problems and in helping the organizations to be more secure by protecting against, detecting, as well as responding to a variety of threat vectors. 

Phishing

It's a technique used by a hacker to retrieve sensitive information like a user's account credentials or credit card number. Generally, phishing attempts entice the users to click on a link to a malicious website that appears legitimate except for the URL of the website in question and after entering the site, the users may be directed to enter personal information that hackers can then use to their advantage. The site can also be infected with malware that can infect the user's computer with a payload like:

• Virus- It's a type of malicious software program, or "malware" which when introduced to the system, replicates itself by modifying the other computer programs and inserting its own code, infecting files or even the boot sector of the hard drive. 

• Trojan Horse- They typically acts as a backdoor that allows a hacker to control or use the infected computer to their advantage. Trojans can perform many tasks like blocking an anti-virus software or the installation of applications, stealing passwords as well as credit card numbers, and infecting other computers and devices connected to the same network.

• Rootkit- It's a type of malware designed to provide a hacker with an administrative access to a computer that too without even being detected. Rootkit can offer a hacker with full access to the computer which can lead to stealing or falsifying documents, the ability to conceal other malware like password-stealing key loggers and viruses, and using the computer for attacks on the other computers.

• Spyware- As the name suggests, it's often used to collect information about internet activity, keystrokes, passwords, and the other sensitive data. Spyware can also be used as an adware, where the software delivers pop-up ads besides tracking a user's behavior.  

Spear phishing or whaling is a type of attack directed towards specific individuals generally targeting senior executives and other high-profile individuals, often for financial gain. As explained earlier, it usually masquerade itself as a legitimate email compelling the users to respond with sensitive information or to click a link that installs a malware to infect the user's computer with some type of payload.  

Spoofing

It's a technique which is used to forge an email header so that the message appears to the recipients as legitimate or sent from a trusted source. Although, the Simple Mail Transfer Protocol (SMTP) enables a domain to send messages on behalf of another domain as there are legitimate reasons in doing so, however, spoofing can also be used by the attackers to trick the recipient into divulging information like account credentials, credit card information, or any other sensitive information. When a user sees the sender information in the message, it looks like someone they know or a domain they trust, even though it's sent from an attacker. 

Spam & Malware

Spam and bulk email are considered as nuisance, but they often don't carry a payload that can cause harm to a user's system, rather, they are an unwanted email that gets in the way of a user's productivity. Whereas malware which is a short form of Malicious Software and is often received in email as either attachment or an embedded link to a malicious website or file, can cause great harm to an organization.

Malware typically works in following two stages:

1. Stage 1 is the attachment or website you visit that's infected. The malware then uses a code to exploit a user's computer using macros and JavaScript to plant a payload like Trojan Horse. 
2. Stage 2 is delivering this payload.  

To read part 2, please click here

To read part 3, please click here