Microsoft Office 365 is growing in popularity as one of the most professional and functional cloud software suites available.  Microsoft estimates it is now being used by 1 in 5 business users, putting this cloud-based service on the radar of cybercriminals.  The greatest popularity of Office 365 resides in the financial and professional services and manufacturing sectors, which are rich with potential plunder for these criminals.

How Do Cybercriminals Target Office 365 Users?
Phishing emails are designed to look like they are sent from a trusted individual or company.  Often these emails ask the recipient to provide a password or other sensitive information or request recipients to download a file that turns out to be malicious.  Phishing attacks against Office 365 users typically go a step further.  Once the cybercriminal has access to a user’s login, they may attempt to exploit this unauthorized access by sending messages from the legitimate account to the victim’s colleagues or contacts to defraud additional people.  This is called a business email compromise (BEC) and is a growing concern for small to midsize firms.  Alternatively, the cybercriminal may search through old or deleted emails for proprietary information and threaten to make it public unless a ransom is paid.

What Companies Can Do
Small and midsize businesses – especially those that deal with sensitive data – need to be concerned about cybersecurity.  Here are some ways every organization can protect themselves:

• Technology Policies. Choose technology policies that work best for your firm and then enforce these policies. For example, many companies still maintain webmail even though users outside the office prefer to access their email via remote access, smartphones, or tablets. If webmail is not being used, turn it off for the entire firm and close that additional digital pathway to your firm.
• Multi-Factor Authentication (MFA). MFA requires the user to enter a code or another form of authentication in addition to a password. This should be extended to your email, line of business applications, cloud services, and remote access systems. If a password is leaked, the second factor prevents access to your firm’s sensitive data.
• Email Security. Email security must encompass more than just the built-in spam filtering from your provider. Since mail is the fastest way into a company’s network, it is vital to have strong malware and content filters for both inbound and outbound email. To further combat phishing, a company should employ sandboxing where incoming attachments are held in a protected environment until it can be determined that there is no malicious code. 
• Education and Training. The weakest link in any IT environment is the person sitting at the computer.  Employees need regular training so they know what to look out for.  Testing should occur several times a year to ensure that employees are alert and to determine what additional or re-education is needed.

For more ways to safeguard your business, read 10 Simple Ways to Protect Your Business from a Cyber Attack.

Conclusion
Regardless what email platform your firm is using, it is essential to put safeguards into place to prevent cybercriminals from interfering with your business.  Security is a process and must evolve as the threat landscape changes.

Because of this constantly evolving threat landscape, Tabush Group is launching a comprehensive service to protect both your systems and your users.  Our Premium Defense Service offers additional security to anticipate and prevent cyberattacks.  For more information, send us a message or call 212.252.0571.