{"id":1505,"date":"2025-05-10T08:26:21","date_gmt":"2025-05-10T08:26:21","guid":{"rendered":"https:\/\/www.somniacsecurity.com\/?p=1505"},"modified":"2025-05-10T08:26:21","modified_gmt":"2025-05-10T08:26:21","slug":"protecting-your-m365-service-from-phishing-and-business-email-compromise-attacks","status":"publish","type":"post","link":"https:\/\/test.somniacsecurity.com\/?p=1505","title":{"rendered":"Protecting your M365 service from Phishing and Business Email Compromise Attacks"},"content":{"rendered":"

[av_textblock fold_type=” fold_height=” fold_more=’Read more’ fold_less=’Read less’ fold_text_style=” fold_btn_align=” textblock_styling_align=” textblock_styling=” textblock_styling_gap=” textblock_styling_mobile=” size=” av-desktop-font-size=” av-medium-font-size=” av-small-font-size=” av-mini-font-size=” font_color=” color=” fold_overlay_color=” fold_text_color=” fold_btn_color=’theme-color’ fold_btn_bg_color=” fold_btn_font_color=” size-btn-text=” av-desktop-font-size-btn-text=” av-medium-font-size-btn-text=” av-small-font-size-btn-text=” av-mini-font-size-btn-text=” fold_timer=” z_index_fold=” id=” custom_class=” template_class=” av_uid=’av-m7xfm0ra’ sc_version=’1.0′ admin_preview_bg=”]<\/p>\n

Protecting your M365 service from Phishing and Business Email Compromise Attacks <\/b><\/h3>\n

This is the first in a series of four blog posts where we delve deeper into the themes discussed in our previous post where we highlighted the top 4 attacks that hackers are using when they try to compromise your M365 service. Regrettably Phishing and Business Email Compromise (BEC) remain amongst the most significant cyber threats facing UK organisations today. With the email and collaboration capabilities of M365 being critical to so many businesses\u2019 communications, it\u2019s vital to utilise a robust, layered approach to defend against these attacks. In this article we dive into what we can all do to reduce the risk of suffering from a phishing attack or being the victim of Business Email Compromise.<\/p>\n

Leverage Microsoft 365\u2019s Built-In Anti-Phishing Protections<\/b><\/h4>\n

Microsoft 365 comes equipped with a suite of features, designed to detect and block malicious emails before they reach users\u2019 inboxes. The key features to help defend against phishing and BEC include:<\/p>\n

    \n
  • Exchange Online Protection (EOP): Provides baseline anti-phishing, anti-spam, and anti-malware protection for all M365 users.<\/li>\n
  • Microsoft Defender for Office 365: Offers advanced capabilities such as impersonation protection, machine learning-based detection, and campaign views to spot coordinated attacks.<\/li>\n
  • Spoof Intelligence: Identifies and blocks emails that attempt to impersonate trusted senders or domains.<\/li>\n
  • Safe Links and Safe Attachments: Automatically scans links and attachments in emails for malicious content, quarantining threats before they can do harm.<\/li>\n<\/ul>\n

    Actions:<\/b><\/h4>\n
      \n
    • Ensure anti-phishing policies are enabled and regularly reviewed.<\/li>\n
    • Configure impersonation protection for high-risk users, such as decision makers, finance staff, and IT administrators.<\/li>\n
    • Use the \u201cAggressive\u201d or \u201cMost Aggressive\u201d anti-phishing thresholds for users most likely to be targeted.<\/li>\n<\/ul>\n

      Enforce Multi-Factor Authentication (MFA) for All Users<\/b><\/h4>\n

      MFA is one of the most effective defences against account compromise. By requiring a second form of verification (such as a code sent to a mobile device), MFA makes it significantly harder for attackers to access accounts, even if they have stolen a password.<\/p>\n

        \n
      • Industry statistics show that over 99% of successful BEC attacks occur on accounts without MFA enabled.<\/li>\n
      • MFA can be enforced across all users on M365 service by using basic service configuration or conditional access policies.<\/li>\n<\/ul>\n

        Actions:<\/b><\/h4>\n
          \n
        • Mandate MFA for all users, especially those with access to sensitive data, financial systems or IT admin access.<\/li>\n
        • Use app-based authenticators or hardware tokens rather than SMS where possible, as these are less susceptible to interception.<\/li>\n<\/ul>\n

          Educate and Train Staff to Recognise Phishing Attempts<\/b><\/h4>\n

          Human error remains a leading cause of successful phishing and BEC attacks. Regular security awareness training tailored for your organisation is essential:<\/p>\n

            \n
          • Teach staff to spot common phishing tactics, such as urgent requests, mismatched email addresses, and suspicious links.<\/li>\n
          • Highlight the language and psychological tricks used by attackers, such as invoking panic or urgency (\u201cAction required\u201d, \u201cInvoice attached\u201d, \u201cVerification needed\u201d).<\/li>\n
          • Run simulated phishing campaigns to test and reinforce learning.<\/li>\n
          • Encourage users to report even if unsure, as its better to report a false positive than be compromised because they were scared to report in the first place.<\/li>\n<\/ul>\n

            Actions:<\/b><\/h4>\n
              \n
            • Schedule regular training sessions and phishing simulations.<\/li>\n
            • Deploy Microsoft\u2019s built-in attack simulation tools.<\/li>\n
            • Encourage a \u201cthink before you click\u201d culture, where staff feel comfortable reporting suspicious emails without fear of reprisal.<\/li>\n<\/ul>\n

              Harden Email Authentication and Domain Protections<\/b><\/h4>\n

              Preventing attackers from spoofing your domain is crucial in stopping phishing and BEC:<\/p>\n

                \n
              • Implement SPF, DKIM, and DMARC against your email domains: These email authentication protocols help ensure only authorised senders can use your domain, and that spoofed emails are rejected or quarantined.<\/li>\n
              • Regularly review and update DNS records to include all legitimate email sources, including third-party services.<\/li>\n<\/ul>\n

                Actions:<\/b><\/h4>\n
                  \n
                • Set DMARC to \u201cquarantine\u201d or \u201creject\u201d to prevent unauthorised use of your domain.<\/li>\n
                • Check that only authorised domains are able to send emails on your behalf by correctly configuring your SPF and DKIM DNS records.<\/li>\n
                • Use Microsoft\u2019s spoof intelligence insights to identify and address any gaps in your domain\u2019s protection.<\/li>\n<\/ul>\n

                  Disable Legacy Authentication and Restrict External Forwarding<\/b><\/h4>\n

                  Legacy authentication protocols (such as IMAP and POP3) do not support MFA and are frequently exploited by attackers:<\/p>\n

                    \n
                  • Disable legacy authentication across your M365 environment to ensure all logins require modern, secure methods.<\/li>\n
                  • Block automatic external forwarding of emails, a common tactic used by attackers to exfiltrate data unnoticed.<\/li>\n<\/ul>\n

                    Actions:<\/b><\/h4>\n
                      \n
                    • Audit your environment for legacy authentication usage, document any, and phase it out if possible.<\/li>\n
                    • Set mail flow rules to prevent or tightly control external forwarding.<\/li>\n<\/ul>\n

                      Monitor, Respond, and Continuously Improve<\/b><\/h4>\n

                      No defence is perfect, so it\u2019s essential to monitor for suspicious activity and respond swiftly:<\/p>\n

                        \n
                      • Use Microsoft 365\u2019s Threat Explorer and reporting tools to investigate and respond to incidents.<\/li>\n
                      • Encourage staff to report phishing attempts, and submit suspicious emails to Microsoft or NSCS’s anti-phishing service to improve filtering for all users.<\/li>\n
                      • Regularly review and tune anti-phishing policies based on the latest threat intelligence and incident learnings.<\/li>\n<\/ul>\n

                        Bringing it all together<\/b><\/h4>\n

                        Taking a step back and looking at the bigger picture when it comes to preventing phishing and Business Email Compromise on the M365 service, involves considering blending technology controls, policies, and your teams working practices. However by leveraging M365\u2019s advanced security features, enforcing MFA, educating staff, hardening domain protections (DNS), and if possible, monitoring for these sorts of threats, you can reduce the risk of your M365 service being compromised. Staying proactive, keeping your defences (and software) up to date, and encouraging your users to become the first line of defence will pay dividends over the long term.<\/p>\n

                        By engaging with Somniac Security we can help you to secure your M365 service leaving you safe in the knowledge that you won\u2019t suffer from these common attacks.\u00a0 Contact us at info@somniacsecurity.com today to help safeguard your business against tomorrow\u2019s challenges!
                        \n[\/av_textblock]<\/p>\n","protected":false},"excerpt":{"rendered":"

                        Phishing and Business Email Compromise remain the top threats targeting users of the Microsoft M365 service. By configuring the platforms anti-phishing tools, enforcing Multi-Factor Authentication, educating staff to spot scams, and securing your domain against abuse, you can dramatically reduce the risk of compromise and keep critical communications protected from today\u2019s most common and costly attacks.<\/p>\n","protected":false},"author":3,"featured_media":730,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[9],"tags":[16,17],"class_list":["post-1505","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-m365","tag-cyber-security-risks","tag-cybersecurity-attacks"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/test.somniacsecurity.com\/wp-content\/uploads\/2025\/03\/Somniac-Image.png","_links":{"self":[{"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1505","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1505"}],"version-history":[{"count":0,"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=\/wp\/v2\/posts\/1505\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=\/wp\/v2\/media\/730"}],"wp:attachment":[{"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1505"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1505"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/test.somniacsecurity.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1505"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}