Office 365 Security – Capabilities & Planning

Written by Keith Tuomi on March 19, 2018. Posted in Cloud, Compliance, Office 365, Security, Security. Leave a Comment

Moving to the Cloud can introduce new concerns. In this post, i’ll help you address your unique organizational security standards, framed against the products and capabilities of your Office 365 services.

While Microsoft has invested heavily in securing their platforms against cyber attacks, they operate with a shared responsibility model in which the customer is responsible for ensuring their users take precautions to protect information. Many organizations have an information gap where the IT security team does not have visibility into everyday high-risk activity occurring within these services. They often do not know about misuse until it escalates into a major data loss incident.

As a result, many IT security teams need actionable intelligence around a wide range of internal and external threats and security vulnerabilities that can lead to data loss including:

Employees downloading sensitive corporate data with the intention of taking that data with them when they leave to join a competitor
Malicious administrators accessing data out of policy or data not related to their role, intentionally degrading security settings, or creating dummy accounts for unauthorized third party access
High-risk user behavior such as downloading data from company-sanctioned cloud services and uploading it to high-risk shadow IT services
Third parties logging into cloud service accounts using stolen or guessed login credentials in order to steal sensitive data
Dormant administrator accounts belonging to former employees that can be de-provisioned to eliminate the latent risk of account compromise
Data leakage from users due to improper configurations/permission management

The information gathered in this report can help mitigate those types of scenarios, based on Microsoft’s own best-practice foundational security goals:

Simplify and protect access
Allow collaboration and prevent leaks
Stop external threats
Stay compliant
Secure administrative access

Introduction to Office 365 Security

Let’s assess risk and implement the most critical security, compliance, and information protection controls to protect your Office 365 tenant. The goal is to prioritize threats, translate threats into technical strategy, and then take a systematic approach to implementing features and controls.

At core to Office 365 Security:

Data Loss Prevention

Malware and targeted attacks can cause data breaches; however, user error is a much greater source of data risk
DLP identifies, monitors and protects sensitive data and helps users understand risks

Auditing and Retention Policies

Allow logging of events including viewing, editing and deleting content such as email messages, documents and calendars

eDiscovery

A single experience for searching and preserving email & documents

Data Deletion

Clear commitments and procedures for end-of-life and data destruction

Data Spillage Management

Hardware with your data is locked down

Question: “What are the main differences between security on-premises and security in the public cloud?”Answer: “You still need to do most of what you’re doing now.

Ensuring that the data and its classification is done correctly, and that the solution will be compliant with regulatory obligations is the responsibility of the customer. Physical security is the one responsibility that is wholly owned by cloud service providers when using cloud computing.

The remaining responsibilities are shared between customers and cloud service providers.

Responsibility Zones

Security Responsibilities Managed by Office 365

Threats Managed by Office 365

Implications

Considering the aforementioned Security Responsibility & Threat patterns, a key conclusion can be drawn as to what your Organizational security focus with Office 365 should be:

Authentication Security is critical
Tenant Security Configuration is critical

Security Capabilites Plan

Start with a set of standards that can be applied across your organization. Here is an example of what this can look like.

Set Information Protection Standards

Start with a set of standards that can be applied across your organization. Here is an example of what this can look like:

Goal	Description
Establish information protection priorities	The first step of protecting information is identifying what to protect. Develop clear, simple, and well-communicated guidelines to identify, protect, and monitor the most important data assets anywhere they reside.
Set organization minimum standards	Establish minimum standards for devices and accounts accessing any data assets belonging to the organization. This can include device configuration compliance, device wipe, enterprise data protection capabilities, user authentication strength, and user identity.
Find and protect sensitive data	Identify and classify sensitive assets. Define the technologies and processes to automatically apply security controls.
Protect high value assets (HVAs)	Establish the strongest protection for assets that have a disproportionate impact on the organizations mission or profitability. Perform stringent analysis of HVA lifecycle and security dependencies, establish appropriate security controls and conditions.

Classify Data by Sensitivity Levels

Four levels is a good starting point if your organization doesn’t already have defined Data Sensitivity standards:

Sensitivity Level	Description
Confidential	Only those who need explicitly need access must be granted it, and only to the least degree in order to do their work (the ‘need to know’ and ‘least privilege’ principles).
Restricted	Subject to controls on access, such as only allowing valid logons from a small group of staff. ‘Restricted’ information must be held in such a manner that prevents unauthorised access i.e. on a system that requires a valid and appropriate user to log in before access is granted
Internal Use	Can be disclosed or disseminated by its owner to appropriate members of your organization, partners and other individuals, as appropriate by information owners without any restrictions on content or time of publication
Public	Can be disclosed or disseminated without any restrictions on content, audience or time of publication. Disclosure or dissemination of the information must not violate any applicable laws or regulations, such as privacy rules.

Map Service Capabilities to Data Sensitivity Levels

This table is an example of how capabilities can be mapped to data sensitivity levels:

Service Capability	Description
Data is encrypted and available only to authenticated users	Provided by default for data stored in Office 365 services. Data is encrypted while it resides in the service and in transit between the service and client devices.
Additional data and identity protection applied broadly	Capabilities such as multi-factor authentication (MFA), mobile device management, and Exchange Online Advanced Threat Protection increase protection and substantially raise the minimum standard for protecting devices, accounts, and data.
Sophisticated protection applied to specific data sets	Capabilities such as Azure Rights Management (RMS) and Data Loss Protection (DLP) across Office 365 can be used to enforce permissions and other policies that protect sensitive data
Strongest protection and separation	Customer Lockbox for Office 365, eDiscovery features in Office 365, and use of auditing features to ensure compliance to policies and prescribed configurations.

Office 365 Secure Score

Secure Score analyzes your Office 365 organization’s security based on your regular activities and security settings and assigns a score. Think of it as a credit score for security.

Anyone who has admin permissions (global admin or a custom admin role) for an Office 365 Business Premium or Enterprise subscription can access the Secure Score at https://securescore.office.com. Users who aren’t assigned an admin role won’t be able to access Secure Score. However, admins can use the tool to share their results with other people in their organization.

Secure Score figures out what Office 365 services you’re using (like OneDrive, SharePoint, and Exchange) then looks at your settings and activities and compares them to a baseline established by Microsoft. You’ll get a score based on how aligned you are with best security practices.

Using Secure Score helps increase your organization’s security by encouraging you to use the built-in security features in Office 365 (many of which you already purchased but might not be aware of). Learning more about these features as you use the tool will help give you piece of mind that you’re taking the right steps to protect your organization from threats.

If you want to improve your score, review the action queue to see what you can do to help increase security and reduce risks.

Expand an action to learn about what threats it’ll help protect you from and how you’ll get the job done.

To see the impact of your actions on your organization’s security, go to the Score Analyzer page and review your history.

Click any data point to see a breakdown of your score for that day. You can scroll down to see which controls were enabled and how many points you earned that day for each control.

Add Secure Store to Office 365 Security and Compliance Center Dashboard

Office 365 Secure Score is a great security analytics tool that you can access at https://securescore.office.com. However not everyone knows how to access Secure Score. You can make it easier to discover and quickly review your security position by adding a Secure Score widget to the home page of the Office 365 Security and Compliance Center.

The widget will show your latest score and the maximum points you can obtain. To get more information about your score you can click the “Go to Secure Score” link and it will take you directly to Secure Score to review the additional details.