OFFICE 365 SECURITY
- 2. {elysiumsecurity}
cyber protection & response
2
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
• What is Office 365? • Misconception • Dual Factor
Authentication;
• Enable Audit Logs;
• Review Email
Protection Settings;
• Admin as a Separate
User;
• Limit Usage of Admin
Account;
• Microsoft Security
Score.
• Enforce Dual Factor
Authentication;
• Enable Advanced
Audit Logs;
• Advanced Threat
Protection;
• Create ATP Policies;
• Disable OWA by
default;
• Regular Log Reviews;
• Limitations;
• Where to start?
• What to look for?
CONTENTS
Public
- 3. {elysiumsecurity}
cyber protection & response
3
WHAT IS OFFICE 365
Public
EXCEL, WORD, POWERPOINT,
OUTLOOK/EMAIL
STARTED IN 2010
INTEGRATES WITH AZURE ACTIVE
DIRECTORY
MICROSOFT CLOUD OFFERING
FOR OFFICE TOOLS
Icons from the noun project unless specified otherwise
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 4. {elysiumsecurity}
cyber protection & response
4
MISCONCEPTION
Public
NO NEED FOR EXTRA SECURITY
CONFIGURATION
PHISHING ATTACKS AND
CREDENTIALS COMPROMISE ARE
NOT POSSIBLE
HOSTED MY MICROSOFT SO IT
CANNOT BE HACKED
MANY SECURITY FEATURES
TURNED OFF BY DEFAULT
RISK CAN BE REDUCED BUT NOT
REMEDIATED COMPLETELY
THERE IS NO SUCH A THING AS A
100% SECURE SYSTEM
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 5. {elysiumsecurity}
cyber protection & response
5
OVERVIEW
Public
ENABLE DUAL FACTOR
AUTHENTICATION
ENABLE AUDIT LOGS
REVIEW EMAIL PROTECTION
SETTINGS
SET YOUR ADMIN ACCOUNT AS A
SEPARATE USER
LIMIT USE OF ADMIN/ENTERPRISE
ACCOUNT
LOOK AT YOUR SECURITY SCORE
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 9. {elysiumsecurity}
cyber protection & response
9
ADMIN AS A SEPARATE USER
Public
STATUS: UNLICENSED
NO NEED FOR MAILBOX
NO NEED TO LOGON TO DOMAIN
ONLY NEED TO LOGON TO ADMIN PORTAL
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 10. {elysiumsecurity}
cyber protection & response
10
LIMIT USAGE OF ADMIN ACCOUNT
Public Images from Dreamstime
NO HUMAN RISK
NO HUMAN ERRORS =
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 11. {elysiumsecurity}
cyber protection & response
11
MICROSOFT SECURITY SCORE
Public
SECURITY COMPLIANCE HOME &
https://securescore.microsoft.com
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 12. {elysiumsecurity}
cyber protection & response
12
OVERVIEW
Public
ENFORCE DUAL FACTOR
AUTHENTICATION FOR ALL USERS
ENABLE ADVANCED AUDIT LOGS
INSTALL ADVANCED THREAT
PROTECTION
CREATE ATP POLICIES
DISABLE OUTLOOK WEB ACCESS
BY DEFAULT
REGULAR LOGS REVIEW
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 13. {elysiumsecurity}
cyber protection & response
13
ENFORCE DUAL FACTOR AUTHENTICATION
Public
https://blogs.technet.microsoft.com/office365/2015/08/25/powershell-
enableenforce-multifactor-authentication-for-all-bulk-users-in-office-365/
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 14. {elysiumsecurity}
cyber protection & response
14
ENABLE ADVANCED AUDIT LOGS
Public
READY?
DONE?
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
START POWERSHELL AS ADMIN1
Set-ExecutionPolicy RemoteSigned2
$UserCredential = Get-Credential3
NO
MFA!
$Session = New-PSSession –
ConfigurationName Microsoft.Exchange –
ConnectionUri
https://outlook.office365.com/powershell-
liveid/ -Credential $UserCredential –
Authentication Basic -AllowRedirection
4
Import-PSSession $Session5
CHECK
STATUSGet-Mailbox ”myname"| FL Audit*6
CHECK
STATUS FOR
ALL USERS
Get-Mailbox -ResultSize Unlimited -Filter
{RecipientTypeDetails -eq "UserMailbox"} |
FL Name,Audit*
7
ENABLE
LOGS FOR
ALL USERS
Get-Mailbox -ResultSize Unlimited -Filter
{RecipientTypeDetails -eq "UserMailbox"} |
Set-Mailbox -AuditEnabled $true
8
BY DEFAULT ONLY
UPDATEFOLDERPERMISSION IS ENABLED
FOR NORMAL USERS.
9
- 15. {elysiumsecurity}
cyber protection & response
15
ENABLE ADVANCED AUDIT LOGS
Public
Get-Mailbox -ResultSize Unlimited -Filter
{RecipientTypeDetails -eq "UserMailbox"} | Set-
Mailbox -AuditOwner
@{Add="MailboxLogin","HardDelete","SoftDelete
", " Create", "Move", "MoveToDeletedItems"}
https://support.office.com/en-us/article/enable-mailbox-auditing-in-office-365-
aaca8987-5b62-458b-9882-c28476a66918#ID0EABAAA=Step-by-step_instructions
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
10
- 16. {elysiumsecurity}
cyber protection & response
16
ADVANCED THREAT PROTECTION
Public
OFFICE 365
ADVANCED
THREAT
PROTECTION
$2 user/month
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 21. {elysiumsecurity}
cyber protection & response
21
REGULAR LOGS REVIEW
Public
LOOK FOR UNUSUAL ACTIVITIES AND IP SOURCE
FOR KEY USERS
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 22. {elysiumsecurity}
cyber protection & response
22
LIMITATION
Public
POTENTIAL TIMEZONE
DIFFERENCE OF THE SERVER
CLOUD ENVIRONMENT MEANS
NO FULL ACCESS TO RAW DATA
INFORMATION LIMITATION
WEB REPORTS BUGS
ENABLE AUDIT LOGS
(Not a default option!)
NO OFFLINE LOGS BACKUP
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 23. {elysiumsecurity}
cyber protection & response
23
WHERE TO START
Public
https://protection.office.com
https://portal.office.com/adminportal
https://portal.azure.com
USE A GOBAL ADMIN ACCOUNT OR
PROVIDE ENOUGH ROLES/RIGHT TO
YOUR INVESTIGATION ACCOUNT
-> SECURITY & COMPLIANCE
-> REPORT DASHBOARD
-> SEARCH & INVESTIGATION
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 24. {elysiumsecurity}
cyber protection & response
24
WHAT TO LOOK FOR?
Public
MAIL FORWARDING RULES
ADMIN CENTERS -> EXCHANGE -> MAILBOXES -> Select mailbox /
double click -> mail box feature -> mailflow -> view details
Not part of the Audit Logs!
AUDIT SEARCH FILTER INTERESTING KEYWORDS
UserLoggedIn
New-Inboxrule
Set-InboxRule
Set-Mailbox
IP ADDRESS AND IMPOSSIBLE LOGINS
SUSPICIOUS ACTIVITIES
SUSPICIOUS DATE AND TIME
FORENSICS
ADVANCED
SECURITY
BASIC SECURITYRISKSCONTEXT
- 25. {elysiumsecurity}
cyber protection & response
A LOT OF THE TIPS DISCUSSED TODAY COME FROM THE EXCELLENT
“FORENSIC LUNCH” SHOW:
https://www.youtube.com/watch?v=WgRxPCofIrA
Presentation starts at 15 minutes in
Devon Ackerman
“Forensically sound incident response in Microsoft’s Office 365”
HIGHLY RECOMMENDED!
- 26. {elysiumsecurity}
cyber protection & response
© 2018 ElysiumSecurity Ltd.
All Rights Reserved
www.elysiumsecurity.com
ElysiumSecurity provides practical expertise to identify
vulnerabilities, assess their risks and impact, remediate
those risks, prepare and respond to incidents as well as raise
security awareness through an organization.
ElysiumSecurity provides high level expertise gathered
through years of best practices experience in large
international companies allowing us to provide advice best
suited to your business operational model and priorities.
ABOUT ELYSIUMSECURITY LTD.
ElysiumSecurity provides a portfolio of Strategic and Tactical
Services to help companies protect and respond against Cyber
Security Threats. We differentiate ourselves by offering discreet,
tailored and specialized engagements.
Operating in Mauritius and in the United Kingdom,
our boutique style approach means we can easily adapt to your
business operational model and requirements to provide a
personalized service that fits your working environment.