When it comes to digital transformation, moving to the cloud is key. According to Gartner, over 95% of new digital workloads will be deployed on cloud-native platforms by 2025 and 63% of IT professionals identify cyber threats as the top obstacle to their cloud strategy.
Microsoft 365 is integral to a seemingly ever-increasing number of enterprises. Microsoft’s 365 commercial monthly active users reached nearly 345 million in 2022 . According to Microsoft itself, the majority of customers use Exchange Online in Microsoft 365 instead of Microsoft Exchange on premises.
Microsoft offers two levels of Microsoft 365 email security – Exchange Online Protection (EOP) and Advanced Threat Protection (ATP). Both of these are highly targeted by cyber criminals, so many organisations choose third party security solutions that are complementary. These third-party solutions can enhance the security of the Microsoft platform and alleviate Microsoft 365 email security concerns. An approach advocated by analyst firm Gartner.
Top Microsoft 365 email security concerns to be addressed:
Email continuity
A major Microsoft 365 email security risk for organisations adopting Exchange Online is service uptime and availability: keeping email up for your employees even when Microsoft goes down. In the event of an email outage, you need to maintain operations and user productivity. Email is a critical business application and most companies can’t afford to be without it, even for short periods of time.
Email continuity provides users with an ‘Emergency Inbox’ usually via a web portal that contains access to Inbox and Sent items from the last 7-30 days. This means that if the primary email provider (or server) fails, users can still read and respond to email until service is restored. This provides a level of reassurance for companies, particularly when moving email off premises.
Email archiving compliance
When it comes to archiving, organisations – especially those working in regulated industries – need to ensure that they comply with legislative and regulatory requirements.
Microsoft 365 does have email archiving, but it is not a best-in-breed product or fully compliant. Many organisations will require or desire additional features such as tamper-proof storage and functionality to quickly respond to ediscovery requests or warrants. A third-party archiving solution can provide assurance that you are supplementing Microsoft 365 and not compromising compliance.
Stopping advanced threats
While Microsoft 365’s email security tools provide a level of security from email-based attacks, even Advanced Threat Protection (ATP) does not include ultra-modern, multi-layered security that is common in third-party email security solutions. Microsoft’s email security features are powerful against traditional spam but less effective against the modern, highly-targeted email threats.
Today, more sophisticated threats need far more sophisticated tools. A common example is CEO impersonation attacks (also known as CEO Fraud or business email compromise). This is where an attacker uses a domain similar to the legitimate domain and sends a simple plain text email asking an employee to send them either money or sensitive data. Examples include asking an employee to settle an overdue invoice or to urgently purchase a large amount of iTunes gift cards and email them the codes.
Multi-layered email security solutions use a combination of technologies and techniques to protect against a wide range of threats. Technologies will include more traditional pattern or recurrent pattern matching alongside algorithmic analysis. These core capabilities will be layered on top of connection level analysis and sender/server validation. Threat intelligence is used to determine if a domain is owned or registered to an individual that has a history of using domains for cyber attacks or malware distribution.
The solution: Layering Microsoft 365 with best-of-breed security
Organisations using or considering Microsoft 365, need to be aware of Microsoft 365 security risks when it comes to email and data security. If best-of-breed security solutions are deployed alongside it, the cloud-based software can be used productively and safely for business. However, companies should not settle for the standard tools, but instead seek out advanced solutions to ensure best-in-class data protection and maintain the integrity of their compliance programs.
Visit our How to secure Microsoft 365 hub to find out more about additional layers of security to protect your organisation, whether you are preparing for, migrating to, or strengthening the performance of your Microsoft 365 environment.
