Joe Stocker - Securing Microsoft 365

Network Firewalls have been the de facto security perimeter since they were invented in the late 1980s Many go unreported to avoid damaging public reputation, although this is changing due to new global, federal, and state regulations that impose fines for not reporting breaches to personally identifiable information.

So, what changed?

As organizations began adopting Cloud Computing in general, or Software as a Service (SaaS) Ten years ago, an email address was typically different from the username, and so when organizations started moving to the cloud, they changed the username to equal the email address. This one change reduced the number of factors for an attacker to guess by 50%.

For Microsoft 365, the username is the email address of security tools, where junior-level hackers can leverage code written by skilled programmers (in the 2000s they were called script kiddies). Various studies have found that users will click on around 20% to 50% of phishing emails designed to trick the user into giving away their username and password.

Another thing that changed was the aggregation of password dumps for sale in dark corners of the internet, making it simple for newbie hackers to perform more effective targeted attacks using credential stuffing tools from all the hacked websites over the years and target a list of popular websites like Microsoft 365 or Google. These tools leverage a human weakness known as password recycling, where we often reuse the same password on sites like Netflix with other websites such as Spotify. If one of these sites is hacked and the credentials are obtained, hackers load these passwords into tools to see what other websites the email address and password combination will work on.

Are Network Firewalls still important? Absolutely! Researchers at the University of Maryland purposefully placed vulnerable computers on the Internet to see how often they would be attacked and observed one attack every 39 seconds.

For organizations that have adopted cloud technologies, their security perimeter is now the Identity of the user signing into the cloud service. Technically, this has been true for the past ten years and many organizations are just now realizing the need for additional layers of in-depth defense around identity.

So how do we prevent unauthorized access to Microsoft 365?

It starts with securing an identity to use other factors besides the password. While some security vendors are limited to just two factors of authentication (sometimes referred to as two-factor authentication or 2FA), Microsoft provides multiple factors of authentication (MFA). However, not all MFA options are created equally. We will describe the available options and point out the pros and cons of each.