[Reading time: 2 minutes]
Remember the classic Monty Python sketch, ‘What Have the Romans Ever Done for Us?’
Did you ever ask the same question about your Microsoft 365 environment?
Because, really, what has Microsoft 365 ever done for us?
Email.
Yeah, Obviously. But apart from email, what has Microsoft 365 ever done for us?
Office.
Fine, fine. Besides email and the Office Suite (online versions of Word, Excel, PowerPoint), what has Microsoft 365 ever done for us?
OneDrive.
Yeah, yeah, I forgot about OneDrive. But apart from email, Office Suite, and OneDrive (which could be used to store lots of important files), what has Microsoft 365 ever done for us?
SharePoint.
Okay, Fair Point. Alright, apart from email, Office Suite, and SharePoint (which could be used to share important files with insiders and outsiders), what has Microsoft 365 ever done for us?
Microsoft Teams.
Ooooh, yes, Teams, the tool we all love to hate. Okay, okay! But apart from email, Office Suite, OneDrive, SharePoint, and Teams (which allows insider and outsiders to speak, see, and chat with us), what has Microsoft 365 ever done for us?”
Power Platform.
Bookings.
Forms.
Planner and To Do.
Single-signon to other systems.
Intune to secure your devices.
…
What’s my point?
Microsoft 365 is more than just email.
It’s an integrated platform offering an expansive range of functionality. Functionality that your colleagues are probably using more extensively than you would expect.
It’s your organisation’s Roman Empire.
And there are plenty of ways in and out of the Empire.
More ways than you would expect.
If your Empire’s defences are weak?
If a cyber Barbarian gains access to a Microsoft 365 account, there are many likely outcomes.
For example:
- Sensitive files in OneDrive or SharePoint, and confidential information in emails, would be at immediate risk of theft.
- Data on SharePoint sites or OneDrive could be altered or deleted. And you might never know.
- The attacker could impersonate the Microsoft 365 account owner, to share malicious files, reroute your payments, or use this as a stepping stone to attack one of your clients.
And let’s not talk about the damage if the compromised account has administrative privileges.
How do you defend your Empire?
Multi-Factor Authentication, tight control of administrator accounts, and regular reviews of active user accounts are all good starts.
But there are many other access points that need to be secured – e.g. application passwords, application consents, auto-forwarding, SharePoint site sharing, OneDrive file links, Teams collaboration settings.
So what?
When was the last time you checked all of your Empire’s defences?
PS I can assess the security of your Microsoft 365 environment. The assessment will show you how to align your defences to industry best practice, and reflect the recommendations of CISA, NCSC, and NIST CSF.
Microsoft 365 is your Roman Empire. Make sure it’s not wide open to an attack from cyber Barbarians.