Blog

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7xfm0ra’ sc_version=’1.0′ admin_preview_bg=”]

The 4 Most Common Ways Hackers Target Microsoft 365

As we all know, Office 365, or M365 as it’s now called, is probably the leading productivity suite used by organisations of all shapes and sizes. Because of its popularity, it’s a frequent target for cyberattacks and, although thankfully rare, operational incidents.

From our research of recent high profile breaches and incidents, we’ve identified the following themes that you need to be aware of:

Phishing and Business Email Compromise (BEC)

Phishing remains the most common attack vector against M365. Criminals continue to improve the quality of their malicious campaigns to create  convincing emails which are designed to trick users into revealing credentials, approving fraudulent actions or clicking on compromised or malicious websites. Business Email Compromise, is considered a subset of phishing and involves attackers trying to gain access to business email accounts in order to intercept communications, redirect payments, or exfiltrate sensitive data. Whilst Microsoft doesn’t publish these statistics, it’s been reported by industry experts that they detect over 150,000 BEC attempts every day, with, phishing regularly cited as the initial access method in many breaches.

Credential Theft and Account Takeover

M365 accounts are constantly being attacked through the form of credential stuffing (where an attacker uses leaked email addresses and passwords from other breaches), brute force, or exploiting weak authentication. Once they’ve successfully logged in, they can access emails, files, and sensitive business information. The lack of enforced multi-factor authentication (MFA) makes it easier should they obtain the password. Microsoft observes thousands of password-based attacks per second on cloud identities.

Exploitation of Misconfigurations and Legacy Authentication

Misconfigured M365 environments, including things as simple as excessive admin privileges, unintended or unauthorised external sharing, and enabled legacy authentication are the primary cause of breaches. Legacy authentication, which does not support MFA, is too often exploited as it enables attackers to bypass security controls. Misconfigurations can also lead to data leaks as it facilitates unauthorised access to sensitive information and resources.

Abuse of Third-Party Integrations and Legacy Authentication

Many third party applications require a user with privilege to consent which enables the application to interact with your M365 service. Without appropriate due diligence and approvals taking place, an attacker could trick them into authorising a malicious application. These apps can then access mailboxes, files, and other resources, often without triggering traditional security alerts. Unrestricted or over privileged third-party app access is a significant risk, as it can lead to large-scale account compromise or data exfiltration.

What Next?

These themes all highlight the importance of robust security practices, including enforcing MFA wherever possible, minimising elevated or admin privileges, disabling legacy authentication when it’s not required (and if it is, manage and review who has access on a frequent basis), and monitoring third-party app access.

By taking some basic steps, you can make it a lot harder for a simple attack to be successful and still have time to focus on your primary job of supporting your customers and growing your business.

Engaging with Somniac Security, can help secure your services leaving you safe in the knowledge that you won’t suffer from these common attacks.  Contact us at info@somniacsecurity.com today to help safeguard your business against tomorrow’s challenges!
[/av_textblock]

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7xfm0ra’ sc_version=’1.0′ admin_preview_bg=”]

Preventing Abuse of Third-Party Integrations and OAuth Applications

Microsoft 365 is now the foundation of productivity for countless organisations across the United Kingdom. As reliance on this suite grows, so too does the risk posed by third-party integrations and OAuth applications. Abuse of these integrations is now considered one of the top security threats to M365 environments, with the potential for serious consequences for your businesses.

Understanding the OAuth Threat Landscape

OAuth 2.0 is an open authorisation framework that enables third-party applications to access user data without sharing passwords. While this has driven innovation and seamless integration, it has also created a substantial attack surface. Cybercriminals are increasingly exploiting this by launching attacks such as “consent phishing”, where users are tricked into granting permissions to malicious applications disguised as legitimate ones.

Once a user approves such permissions, the attackers may gain access to sensitive resources including emails, contacts, files in OneDrive and SharePoint, calendar data, Teams communications, and even administrative controls if a privileged accounts was used to approve. The danger lies in the fact that these applications operate with explicit user consent, often bypassing traditional security controls and making detection significantly harder.

How to Mitigate OAuth Abuse

The most effective way to defend against OAuth-based threats is to implement robust controls, such as the following.

• Strict App Consent Policies – Begin by restricting who can authorise third-party applications. In Azure Active Directory, disable the ability for users to consent to apps accessing company data on their behalf. Prevent standard users from registering applications and establish a clear, admin-led approval process for all app integration requests. This ensures that every new integration is scrutinised before being granted access to your environment.
• Audit and Manage Existing OAuth Applications – Regularly review all applications that already have access to your M365 environment. Pay particular attention to those with high permission levels, mail access, or admin privileges, as well as apps authorised by only a handful of users, which may indicate targeted attacks. Remove or restrict any suspicious or unnecessary integrations, and conduct thorough quarterly audits as part of your security routine.
• Deploy Microsoft Defender for Cloud Apps – Microsoft Defender for Cloud Apps provides advanced protection against OAuth-related threats. It enables you to discover and manage OAuth apps, implement policy templates to detect suspicious behaviour, configure alerts for high-risk permissions, and monitor for misleading app names or publishers. Network monitoring for traffic to Azure AD authorisation endpoints adds another layer of defence.
• Disable Unnecessary Integration Points – Reduce your attack surface by disabling unnecessary integration options within the M365 admin portal. Restrict user-owned apps and services, disable the ability for users to decide on third-party app access, and consider disabling Microsoft Graph Data Connect. Where available, use settings that prevent non-admin users from integrating third-party applications1.
• Comprehensive Identity Management – Enforce multi-factor authentication for all users, especially for consent operations. Apply conditional access policies to restrict when and how application consent can be granted. Implement privileged identity management for admin accounts and use risk-based authentication to flag suspicious consent requests.
• Building User Awareness and Resilience – Technical controls alone are insufficient. User education is vital in preventing OAuth-based attacks. Develop tailored training to help staff recognise consent phishing attempts and understand the implications of granting permissions to applications. Conduct regular phishing simulations that include OAuth scenarios, and provide clear guidelines on which apps are approved for organisational use. Establish straightforward reporting procedures for suspicious app requests, and foster a culture where users feel empowered to report anything unusual.
• Monitoring and Detection Strategies – Continuous monitoring remains essential. Configure automated alerts for high-level permission requests, multiple users authorising the same new app in a short period, or the appearance of apps with suspicious names or publishers. Conduct regular reviews of all authorised applications, checking for those with little recent activity or permissions that do not align with their stated purpose. Maintain clear documentation of approved apps and their expected usage patterns.
• Response and Remediation – If a suspicious or malicious OAuth application is detected, act swiftly. Revoke the application’s permissions, identify affected accounts, reset credentials, and block the app at the tenant level. Investigate the extent of access and data exposure, review audit logs, and preserve evidence for regulatory or legal purposes. Update your security policies and user training based on lessons learned, and consider implementing additional monitoring solutions as needed.

The Importance of a Multi-Layered Approach

Protecting your Microsoft 365 environment from the abuse of third-party integrations and OAuth applications demands a comprehensive, multi-layered strategy. Combining strong technical controls, ongoing user education, continuous monitoring, and rapid response capabilities enables UK organisations to significantly reduce their vulnerability to these advanced threats. Security is not a one-off task but an ongoing process, requiring vigilance and adaptability as attackers continually develop new techniques to exploit any available weakness.
[/av_textblock]

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7xfm0ra’ sc_version=’1.0′ admin_preview_bg=”]

Preventing Exploitation of Misconfigurations and Legacy Authentication

Preventing the exploitation of misconfigurations and legacy authentication within Microsoft 365 (M365) is a pressing issue for UK organisations. With the majority of UK businesses now relying on M365 for productivity and collaboration, the platform has become a frequent target for cyber attackers. While research suggests that misconfigurations are a common factor in security incidents, it is important to note that the precise proportion of breaches linked to misconfiguration versus more advanced threats can vary between sources. Regardless, both misconfiguration and legacy authentication remain well-recognised risks that require ongoing attention.

Understanding the Security Risk

Legacy authentication protocols, such as IMAP, POP3, and SMTP, are still present in many environments. These older protocols do not support modern security features like Multi-Factor Authentication (MFA) and can allow users to bypass conditional access policies, making them attractive vectors for attackers. However, it is also acknowledged that some organisations may still rely on legacy protocols for specific business or technical reasons. Where this is the case, it is essential to carefully document and manage these exceptions, ensuring that any continued use of legacy authentication is tightly controlled and monitored.

Best Practices for Securing Microsoft 365

Microsoft has disabled legacy authentication by default across the entire service, these protocols may still be enabled on a per-user or per-application basis in some environments. It is advisable to regularly audit which users and applications rely on legacy authentication, migrate to modern authentication where possible, and use Azure Active Directory Conditional Access policies to restrict their use to only those cases where it is absolutely necessary. This approach balances the need for security with the operational realities many organisations face.

Modern authentication methods provide enhanced security by supporting MFA, conditional access, and risk-based authentication decisions. Transitioning to modern authentication is widely recommended, but it is important to test changes thoroughly and communicate with affected users to minimise disruption during the migration process.

Misconfigurations in M365 can include excessive administrative privileges, overly permissive external sharing, weak password policies, and inadequate email authentication. Addressing these issues involves reviewing and adjusting default settings, implementing the principle of least privilege for administrative accounts, and enforcing strong authentication policies. Proper email authentication, using protocols such as SPF, DKIM, and DMARC, helps reduce the risk of spoofing and phishing. It is generally recommended to start with monitoring DMARC policies before moving to stricter enforcement, allowing you to assess the impact and adjust configurations as needed.

Microsoft Defender for Office 365 offers a range of features designed to protect against email-based threats, such as phishing and malware. While many organisations find Defender for Office 365 effective and value its integration with the broader Microsoft ecosystem, some may prefer to supplement or replace it with third-party solutions, depending on their specific risk profile and requirements. It is important to evaluate Defender’s capabilities in the context of your organisation’s needs and consider independent testing or expert advice where appropriate.

Conditional Access Policies provide granular control over access to resources, based on factors such as location, device compliance, and user risk. These policies can help reduce unauthorised access, but should be tailored to the organisation’s operational needs and regularly reviewed to ensure they remain effective and appropriate.

Administrative accounts should be managed with particular care, applying the principle of least privilege, mandating MFA, and using tools such as Microsoft Privileged Identity Management (PIM) to enable just-in-time access. Creating dedicated admin accounts, separate from standard user accounts, is also considered best practice.

External sharing and collaboration features in M365 can introduce data exfiltration risks if not properly controlled. You should try to use tenant or site-level policies to manage sharing, limit access to trusted domains, and implement Data Loss Prevention (DLP) policies where appropriate. Labelling and protecting your sensitive data using Microsoft Information Protection tools can further reduce risk.

Monitoring and response capabilities are crucial for detecting and responding to threats. Microsoft Secure Score is a useful tool for assessing your security posture and identifying areas for improvement, but it should not be seen as a comprehensive measure of security. Secure Score is most effective when used alongside other monitoring tools and regular security audits, as it primarily focuses on Microsoft’s own best practices and may not account for all aspects of your organisation’s risk landscape. Tracking your Secure Score over time can provide valuable insights, but it is important to interpret the results within the broader context of your overall cyber security strategy.

Regular security audits, including simulated attacks and user access reviews, help identify emerging risks and ensure that security policies remain up to date. These activities should be scheduled at intervals appropriate to the size and complexity of your organisation, with findings used to inform continuous improvement.

Building a Resilient Microsoft 365 Security Posture

Preventing exploitation of misconfigurations and legacy authentication in M365 requires a balanced, risk-based approach. While best practices and technical controls are essential, it is equally important to acknowledge operational realities and tailor recommendations to the specific needs of your organisation. By remaining vigilant, regularly reviewing security settings, and fostering a culture of security awareness, UK businesses can strengthen their defences against evolving threats.

By engaging with Somniac Security we can help you to secure your M365 service leaving you safe in the knowledge that you won’t suffer from these common attacks.  Contact us at info@somniacsecurity.com today to help safeguard your business against tomorrow’s challenges!
[/av_textblock]

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7xfm0ra’ sc_version=’1.0′ admin_preview_bg=”]

Best Practices to Prevent Credential Theft and Account Takeover

In this, our second blog in the series where we delve into the top issues which impact your M365 service, we look into how you can help to protect yourself from having your credentials being stolen or your accounts being taken over.

As we’ve previously wrote about, Microsoft’s M365 service has become the backbone of productivity for a huge variety of organisations across the UK, not matter how big or small. As a consequence of the scale of adoption, it’s made your M365 accounts, especially those with elevated privileges, prime targets for attackers to compromise.

Published reports, including from Microsoft themselves, provide many statistics that regrettably reveal that too many organisations using M365 have been victims of these attacks already.

Understanding the Threat of Credential Theft and Account Takeover

Credential theft occurs when attackers obtain your login details through various means, whilst the account takeover is when they use the unauthorised access and take control of your M365 account. Once they have control of your login details, and depending on the amount of privilege your account has, it’s not unusual for attackers to try the following:

• Access and exfiltrate sensitive information from your M365 service
• Use your account to discover and compromise other accounts
• Impersonate staff to facilitate financial fraud
• Infiltrate and deploy ransomware or other malware
• Launch attacks against your customers, suppliers and business partners

The consequences from any number of these attacks can be devastating to your business – whether from an ICO reportable data breach, to financial losses, operational disruption and significant reputational damage.

Essential Security Measures for Your M365 Environment

Implement Multi-Factor Authentication (MFA)

MFA remains the one of the most powerful defence against account takeover, as it mandates an additional verification stage beyond your passwords. Published research indicates that more than 99% of account compromise attacks are stopped by MFA.

• Make MFA mandatory for all users, not just administrators
• Activate Security Defaults in M365 service to mandate the enforcement of MFA for all administrator accounts
• Prioritise using app-based authenticators from known companies (such as Microsoft, Google or DUO) rather than SMS, as they provide stronger protection

By implementing MFA across your organisation, your adding that extra lock to your front door, as even if the password has been compromised, they still have another barrier to overcome – it’s simple but extraordinarily effective.

Establish Robust Password Controls

While deploying MFA is critical, enforcing strong password practices remain your first line of defence:

• Enforce long passwords, 12 characters as a minimum, and if possible, no maximum
• Avoid making passwords to complex as it encourages bad behaviours (such as writing them down or incrementing numbers when changing)
• Encourage users to use websites such as what3words to generate passwords
• Educate users to not reuse password across different services
• Consider implementing a password manager to help users maintain unique their passwords
• Educate users to change their passwords if they think it may have been compromised or inadvertently shared
• Set automatic account lockout after several failed login attempts

Deploying strong and robust password practices for all your users, you’re making it that bit harder for the attackers to pick the lock in the first place.

Safeguard Administrator Accounts

Your admin accounts usually have elevated privileges and are very attractive targets for attackers, as once compromised, they’re seen as providing them with keys to the entire castle:

• Create separate admin accounts for administrative tasks only (don’t use them to surf the web if possible and be extremely careful when opening emails)
• Ideally, use dedicated, highly secured devices for admin activities
• Deprovision admin accounts promptly when staff leave your organisation
• Regularly audit admin privileges to ensure they’re assigned only to those who genuinely need them

The administrator accounts are the equivalent to someone having master keys to all your locks, so restricting who has access to it and how they can use it is crucial to protecting it.

Advanced Protection Strategies

Disable Legacy Authentication

Where possible, disable legacy authentication protocols (such as IMAP, POP3, and SMTP) which are unable to support modern security features like MFA:

• Block legacy authentication entirely where possible
• If legacy protocols are required for specific applications, limit their use to only those necessary accounts and implement additional security measures such as conditional access policies, or TLS encryption.
• Document all uses of legacy authentication protocols, assign an owner and review at least annually.

Implement Email Authentication Protocols

Configure modern email authentication to help prevent email spoofing and phishing attempts:

• Deploy SPF (Sender Policy Framework), DKIM (DomainKeys Identified Mail), and DMARC (Domain-based Message Authentication, Reporting & Conformance)
• Set DMARC policy to “quarantine” or “reject” to prevent unauthorised use of your domain

Leverage Microsoft 365 Security Features

Utilise Microsoft’s built-in security capabilities where possible:

• Exchange Online Protection (EOP) service, is usually included in all M365 plans that offer Exchange Online, and provides a very effective baseline set of defences
• Microsoft Defender for Office 365 is a paid for service that offers advanced anti-phishing and anti-malware protection
• Use Safe Links and Safe Attachments to automatically scan for malicious content
• Implement Conditional Access policies to restrict access based on user, location, device, and risk factors

Education and Awareness

Regrettably technology is never the only solution, so you must continuously educate and reinforce the training so that your staff recognise and respond to these constantly evolving threats:

Deliver Regular Security Training

• Conduct phishing simulations, either with the Microsoft Attack Simulator or one of the many specialist services available
• Create clear and simple procedures which enable your users to report suspicious activities
• Provide specific training on how to recognise BEC attempts and credential phishing
• Where possible, ensure training incorporates real-world examples relevant to your businesses

Foster a Security Culture

• Encourage staff to question unusual requests, especially those involving financial transactions, credential verification or privileged actions
• Create a blame-free environment where security concerns can be raised without fear. By celebrating security-conscious behaviours, you’ll help to create and reinforce positive habits

Detecting the Undetectable

Despite best preventative efforts, some threats may still penetrate your defences so doing what you can to detect them as early as possible is your last line of defence:

Implement Continuous Monitoring

• Use Microsoft 365 Defender’s threat detection capabilities
• Set up alerts for suspicious login activities, particularly from unusual locations or devices
• Monitor for unusual mail flow rules or inbox configurations that could indicate compromise

Establish an Incident Response Plan

• Create a clearly documented incident response plan for handling suspected account compromises
• Assign specific roles and responsibilities within the incident response plan
• Include communication templates for internal and external stakeholder, and consider your regulatory requirements (informing the ICO, financial authorities, NHS England etc)
• Practise your incident response plan regularly with tabletop exercises which include the entire incident response team

A Layered Approach to Microsoft 365 Security

Although we’ve covered a lot in this post, you’ve hopefully seen that to prevent credential theft and account takeovers against your M365 service requires a sensible, layered approach. By considering the practices outlined above, with a focus on deploying MFA, strong password policies, and where possible, continuous monitoring, you can significantly reduce your risk profile against this type of attack.

However, as these threats continue to evolve so too must your strategies to resist, detect and counter them. We suggest that by executing regular security assessments, staying informed about emerging threats, and fostering a security first culture amongst all your staff will ensure your M365 service is protected as best as possible.

Much that we would all like a single technical solution to solve these problems, the strongest protection will always be derived from the deployment of multiple layers of sensible defensive controls, all working in tandem.

By engaging with Somniac Security we can help you to secure your M365 service leaving you safe in the knowledge that you won’t suffer from these common attacks.  Contact us at info@somniacsecurity.com today to help safeguard your business against tomorrow’s challenges!
[/av_textblock]

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7xfm0ra’ sc_version=’1.0′ admin_preview_bg=”]

Protecting your M365 service from Phishing and Business Email Compromise Attacks

This is the first in a series of four blog posts where we delve deeper into the themes discussed in our previous post where we highlighted the top 4 attacks that hackers are using when they try to compromise your M365 service. Regrettably Phishing and Business Email Compromise (BEC) remain amongst the most significant cyber threats facing UK organisations today. With the email and collaboration capabilities of M365 being critical to so many businesses’ communications, it’s vital to utilise a robust, layered approach to defend against these attacks. In this article we dive into what we can all do to reduce the risk of suffering from a phishing attack or being the victim of Business Email Compromise.

Leverage Microsoft 365’s Built-In Anti-Phishing Protections

Microsoft 365 comes equipped with a suite of features, designed to detect and block malicious emails before they reach users’ inboxes. The key features to help defend against phishing and BEC include:

• Exchange Online Protection (EOP): Provides baseline anti-phishing, anti-spam, and anti-malware protection for all M365 users.
• Microsoft Defender for Office 365: Offers advanced capabilities such as impersonation protection, machine learning-based detection, and campaign views to spot coordinated attacks.
• Spoof Intelligence: Identifies and blocks emails that attempt to impersonate trusted senders or domains.
• Safe Links and Safe Attachments: Automatically scans links and attachments in emails for malicious content, quarantining threats before they can do harm.

Actions:

• Ensure anti-phishing policies are enabled and regularly reviewed.
• Configure impersonation protection for high-risk users, such as decision makers, finance staff, and IT administrators.
• Use the “Aggressive” or “Most Aggressive” anti-phishing thresholds for users most likely to be targeted.

Enforce Multi-Factor Authentication (MFA) for All Users

MFA is one of the most effective defences against account compromise. By requiring a second form of verification (such as a code sent to a mobile device), MFA makes it significantly harder for attackers to access accounts, even if they have stolen a password.

• Industry statistics show that over 99% of successful BEC attacks occur on accounts without MFA enabled.
• MFA can be enforced across all users on M365 service by using basic service configuration or conditional access policies.

Actions:

• Mandate MFA for all users, especially those with access to sensitive data, financial systems or IT admin access.
• Use app-based authenticators or hardware tokens rather than SMS where possible, as these are less susceptible to interception.

Educate and Train Staff to Recognise Phishing Attempts

Human error remains a leading cause of successful phishing and BEC attacks. Regular security awareness training tailored for your organisation is essential:

• Teach staff to spot common phishing tactics, such as urgent requests, mismatched email addresses, and suspicious links.
• Highlight the language and psychological tricks used by attackers, such as invoking panic or urgency (“Action required”, “Invoice attached”, “Verification needed”).
• Run simulated phishing campaigns to test and reinforce learning.
• Encourage users to report even if unsure, as its better to report a false positive than be compromised because they were scared to report in the first place.

Actions:

• Schedule regular training sessions and phishing simulations.
• Deploy Microsoft’s built-in attack simulation tools.
• Encourage a “think before you click” culture, where staff feel comfortable reporting suspicious emails without fear of reprisal.

Harden Email Authentication and Domain Protections

Preventing attackers from spoofing your domain is crucial in stopping phishing and BEC:

• Implement SPF, DKIM, and DMARC against your email domains: These email authentication protocols help ensure only authorised senders can use your domain, and that spoofed emails are rejected or quarantined.
• Regularly review and update DNS records to include all legitimate email sources, including third-party services.

Actions:

• Set DMARC to “quarantine” or “reject” to prevent unauthorised use of your domain.
• Check that only authorised domains are able to send emails on your behalf by correctly configuring your SPF and DKIM DNS records.
• Use Microsoft’s spoof intelligence insights to identify and address any gaps in your domain’s protection.

Disable Legacy Authentication and Restrict External Forwarding

Legacy authentication protocols (such as IMAP and POP3) do not support MFA and are frequently exploited by attackers:

• Disable legacy authentication across your M365 environment to ensure all logins require modern, secure methods.
• Block automatic external forwarding of emails, a common tactic used by attackers to exfiltrate data unnoticed.

Actions:

• Audit your environment for legacy authentication usage, document any, and phase it out if possible.
• Set mail flow rules to prevent or tightly control external forwarding.

Monitor, Respond, and Continuously Improve

No defence is perfect, so it’s essential to monitor for suspicious activity and respond swiftly:

• Use Microsoft 365’s Threat Explorer and reporting tools to investigate and respond to incidents.
• Encourage staff to report phishing attempts, and submit suspicious emails to Microsoft or NSCS’s anti-phishing service to improve filtering for all users.
• Regularly review and tune anti-phishing policies based on the latest threat intelligence and incident learnings.

Bringing it all together

Taking a step back and looking at the bigger picture when it comes to preventing phishing and Business Email Compromise on the M365 service, involves considering blending technology controls, policies, and your teams working practices. However by leveraging M365’s advanced security features, enforcing MFA, educating staff, hardening domain protections (DNS), and if possible, monitoring for these sorts of threats, you can reduce the risk of your M365 service being compromised. Staying proactive, keeping your defences (and software) up to date, and encouraging your users to become the first line of defence will pay dividends over the long term.

By engaging with Somniac Security we can help you to secure your M365 service leaving you safe in the knowledge that you won’t suffer from these common attacks.  Contact us at info@somniacsecurity.com today to help safeguard your business against tomorrow’s challenges!
[/av_textblock]