Introduction

If your financial institution uses Microsoft 365 (also known as M365 and formerly branded as Office 365), it is in the Cloud, and inherently at risk of facing a broad spectrum of cyberattacks. Just like protecting assets within your institution’s network takes careful consideration and preparation, so do your assets in the Cloud.

Consider these statistics:

Cybercrime has increased exponentially since the start of the pandemic:

• The FBI’s Internet Crime Complaint Center (IC3) has received 4,000 cybersecurity complaints each day, representing a 400-percent increase from what they were seeing pre-coronavirus, and the FBI says it expects the surge to intensify.
• Cybersecurity Ventures estimates that there was a ransomware attack every 11 seconds in 2021, up from 39 seconds in 2019, CyberCrime Magazine reports. Cybercrime, in general, has increased exponentially since the beginning of the COVID-19 pandemic.

Compromised accounts are far more common than you might think:

• An analysis of account-takeover attacks targeted at Barracuda Network customers found that 29 percent of the organizations had their Office 365 accounts compromised by hackers in March 2019. The hackers set up malicious rules to hide their activity in 34 percent of the compromised accounts; in some cases, they used usernames and passwords acquired from previous data breaches.
• Ninety-two percent of companies have their cloud credentials for sale on the Dark Web, according to McAfee’s 2019 Cloud Adoption and Risk Report.

The good news is: It’s not difficult or expensive to get started securing your bank or credit union in the Cloud. Employing a technology solution that provides visibility into security settings for Microsoft Azure Active Directory (Azure AD), the identity platform for all of Azure, and M365 is an effective way to get started. This white paper covers various aspects of how organizations can optimize their Azure AD and M365 policies to get ahead of threats and enhance their security in the Cloud.

Understanding Azure AD and M365 Controls and Settings

When your financial institution purchased M365, it established a Microsoft tenant with Azure AD. Since that tenant belongs to you and your institution (not the licensing reseller), it is your responsibility to understand and administer Azure AD and its controls. Microsoft automatically enables many features that may not be desired, and this can create security and compliance concerns. More specifically, Microsoft’s default stance for settings and policies allows for open collaboration with external entities, which may violate or contrast with compliance policies for organizations in regulated industries.

Therefore, you must customize these settings to create more sophisticated and appropriate security, identity, and compliance policies for your institution. This should entail building policies around what users are allowed to do, what your institution’s risk assessment defines, what your institution’s compliance policies dictate, and what users will tolerate. Then once your institution has sufficient policies in place, it is essential to monitor for exceptions with reporting and alerting.

Customizing Security Settings

The following are some of the Azure AD, M365, and Exchange Online features you can adjust to fit your organization’s needs and preferences. They are organized by Azure AD functional level, license level, Azure administration portal, and general complexity of implementation.

Azure AD Basics:

Security Defaults

With identity-related attacks like password spray, replay, and phishing becoming more popular, managing security can be difficult. Security defaults make it easier for your institution to repel attacks by using preconfigured security settings. You turn on security defaults in the Azure AD portal. (If your tenant was created on or after October 22, 2019, security defaults may already be enabled in your tenant.)

Password Policy

A password policy is applied to every user account that is created and managed directly in Azure AD. If you have on-premises AD password policies governing password expirations, you should expect to manually synchronize your Azure AD password policy and your on-premises AD password policy.

Device Registration

If you prefer not to enable users to join devices on their own, you can configure Azure AD Device settings to restrict this capability for users. You may also use a setting in the Azure AD Device administration panel to require multi-factor authentication (MFA) to register or join devices with Azure AD. If you already use Conditional Access Policies, use them to implement MFA for this situation instead.

Enterprise Apps

Enterprise apps can pose a risk to any organization due to their versatility. They can have various levels of authorization within Azure AD, across M365, and across Azure AD Resource Management subscriptions. They can also allow for persistent connectivity, which can be used to functionally bypass MFA on user accounts. Lastly, users in Azure AD are authorized to install Azure AD Enterprise Apps and give authorization to the apps under their own authority context by default.

If you want more control over Enterprise Apps in Azure AD, disable the ability for regular non-administrator users to consent to applications.

App Registrations

You can also modify your security features to prevent users from creating Registered Applications. These apps can pose the same type of risks as Enterprise Apps. Also, like Enterprise Apps, users are authorized by default to create App Registrations. If you want more control over Registered Apps, disable the ability for regular non-administrator users to create App Registrations.

External Collaboration

Azure AD’s business-to-business (B2B) collaboration allows you to invite guest users to interact with your organization. With this feature, which is located within External Identities, guest users can sign in to your apps and services with their own work, school, or social identities. By default, guest users’ access is restricted, and regular users are allowed to invite guest users for collaboration. Administrators can restrict both features even further to satisfy your institution’s unique requirements.

Administration Portal

By default, users have the ability to read data in the Azure AD Administration Portal. Typically, users do not need to view data in an administrative portal. If you prefer to only allow administrators access to the administrative portal, you can restrict normal users through a configuration option in Azure AD’s user settings.

LinkedIn

You may not want to allow end-users to connect to LinkedIn and share data with their work or school accounts. However, Microsoft enables this ability to share data by default. You can configure this feature in the user settings of Azure AD.

Hybrid Identity

You should generally strive to minimize the number of identities your users have across their various platforms. To accomplish this in Azure AD, you can use a hybrid identity architecture that will synchronize users from on-premises Active Directory to Azure Active Directory. Once identities are consolidated, you can keep usability high by also enabling password hash synchronization, which will generate a secured hash of a user’s on-premises AD password and synchronize a hash of that hash with Azure AD. It is important to note that passwords are never sent to Azure AD from on-premises AD.

Administrator Review

When planning your institution’s access control strategy, it’s best to apply the principle of least privilege, meaning you grant administrators only the specific permission they need to do their job. Microsoft also recommends limiting the number of static Global Administrator role assignments to fewer than five people in your organization. If more than five static assignments are required, you should look to implement Privileged Identity Management (licensed feature) in Azure AD.

Since Global Administrators hold the “keys to the kingdom,” it’s also in your best interest to keep the attack surface low and protected with MFA.

Azure RBAC

As an authorization system built on Azure Resource Manager, Azure role based access control (Azure RBAC) provides fine-grained access management of resources in Azure. It lets you exercise granular control over users’ level of access, which can be limited to four fundamental built-in roles. For instance, Azure RBAC lets you restrict one user to manage only virtual networks and another user to manage all resources in a resource group.

Partners

You can request to work with Microsoft-certified solution providers (i.e., partners, such as Navanta) to purchase and manage products and services for your financial institution. Depending on the request made by the partner, when you accept the invitation, you agree to give them Global and Helpdesk admin roles. When you grant admin roles to a partner, you also automatically delegate admin privileges in Azure AD. Be aware that the Microsoft Threat Intelligence Center (MSTIC) has detected nation-state activity that exploits partner-trusted relationships and admin privileges to gain access to downstream customers. These attacks (in this case, associated with the threat actor tracked as Nobelium) emphasize the need for administrators to implement strict account security practices and additional measures to protect their environments.

Note: Be aware of who your partners are in Azure and what permissions those partners have.

Protection Center

Global Auditing

The global auditing feature logs events that happen across Azure AD and M365, recording details about the health of your IT environment. It’s highly advisable to enable Global Auditing (which is disabled by default) because the information you gain can help you troubleshoot problems and investigate issues. Once the Global Auditing setting has been activated, it can take around 24 hours for the new setting to go into effect.

Alert Policies

Alert policies are a set of rules designed to help you monitor and alert on threats against your existing resources. It offers default built-in policies and lets you create additional custom policies on your own. You will need to set the target recipient(s) to receive email notifications triggered by policies.

M365 Collaboration

OneDrive and SharePoint Sharing

Since Microsoft OneDrive and SharePoint were created to foster collaboration, their default share policies are normally set to enable external data sharing. This allows users to create anonymous access links that make it possible for anyone in any organization with OneDrive and SharePoint to sign in and view their information. You should review the level of sharing to control the flow of data based on what is appropriate for your institution. Not doing so can result in inappropriate access or misuse of confidential data.

Teams and External Collaboration

Microsoft Teams is set up to make it easy to connect with users anywhere in the world, including other organizations. You should review the platform’s security and compliance settings to ensure it meets your organization’s standards. If it doesn’t, you can block all external domains to keep users from communicating externally.

Exchange Online

Client access rules – These conditions help you control access to your Exchange Online organization based on client properties or client access requests. They allow you to keep clients from connecting to Exchange Online based on their IP address (IPv4 and IPv6), authentication type, and user property values, and the protocol, application, service, or resource that they are using to connect.

Receive connectors – Connectors, which are a collection of instructions, customize how email gets transmitted to and from your Microsoft 365 organization. Institutions with a third-party edge provider for emails should look to address a security risk presented by their organization’s specific SMTP relay for Exchange Online, which is open to the internet by default for anonymous email delivery to users within their email domains. You can mitigate this risk with a receive connector that can instruct Exchange Online to transmit emails only when they are delivered by the third-party edge provider.

Transport rules – In Exchange Online, you can use mail flow rules (also known as transport rules) to identify and act on messages moving through your organization. Mail flow rules are comprised of conditions, exceptions, actions, and properties.

Remote domains – Remote domains allow you to control the types and format of messages your users send from Exchange Online to recipients in external domains. The remote domain settings override configurations that users might establish in Outlook or Outlook on the web (formerly known as Outlook Web App) or that you configure in the Exchange admin center (EAC) or Exchange Online.

Mobile device management – If you are looking to control the devices or apps that can connect to Exchange Online, you can use Mobile Device Access Policies (MDAP) to manage different settings. In Microsoft 365 or Office 365, you can institute mobile device mailbox policies (MDMPs) to execute a common set of policies or security settings to a collection of users. A default MDMP is created in every Microsoft 365 or Office 365 organization. Please note: These policies will only help govern mobile devices/apps within Exchange Online. While they represent a good starting place, organizations with M365 licenses should look at MDM solutions that apply to the entire suite, not just Exchange Online.

Security Center

Anti-spam inbound policy – If you have Exchange Online, inbound email messages are automatically protected against spam by EOP. Exchange Online Protection (EOP) uses anti-spam policies or spam filter policies as part of your institution’s defense against spam.

Block emails based on country/region – Blocking emails based on their geography is a function of your Anti-spam Inbound Policy. You can alter this policy to take automated action for emails from other regions or countries.

Anti-spam outbound policy – Since email forwarding can lead to data leakage, it’s important for you to know all mailboxes that have forwarding enabled, and where the mail is being forwarded. To keep users from being able to auto-forward outbound emails, you can configure the automatic forwarding setting of the Outbound Anti-Spam policy. Please note: if you want to block automatic forwarding to external domains, don’t use mail flow rules. Despite the conditions being available for mail flow rules, the logic does not include all forms of automated email forwarding and therefore the controls are not effective at meeting this control objective.

Phish simulation – To protect your organization by default, EOP does not allow safe lists or the ability to bypass filtering for messages that are identified as malware or high confidence phishing. But if you have situations that necessitate the delivery of unfiltered messages (e.g. using a third-party for phishing simulations), you can apply the advanced delivery policy in Microsoft 365 to keep inbound messages in these specific scenarios from being filtered. Please note: Microsoft has changed the location and functionality of this unfiltered message delivery over the years, and this is just the latest implementation. You’re likely already familiar with handling this objective via Mail Flow rules. If the transport rules you have set up are failing to deliver your phish simulation emails, then try advanced delivery policies next.

Quarantined emails – If you have Exchange Online, potentially harmful or unwanted messages can be quarantined. Anti-malware policies automatically quarantine a message if any attachment is found to contain malware. They isolate phishing and high confidence phishing messages as well as send spam and bulk email messages to the user’s Junk Email folder.

Anti-spoof – If you have Exchange Online, EOP includes features to help protect your institution from fake email senders. EOP analyzes and blocks messages that can’t be authenticated by standard email verification methods and sender reputation techniques. Please note: Administrators need to review anti spoof domains and approve or disapprove them as required.

Note: Only administrators may release emails flagged as malware or high confidence phishing. Also, quarantined emails will automatically expire, and users are not sent a digest by default, though they do have authority to release them by visiting the web portal. Administrators should look to periodically review their quarantined emails for both validation and anomalous trends. Administrators may also wish to send the digest to their users to allow them to review their respective quarantined emails.

Protection Center

Basic mobility and security – The Basic Mobility and Security feature lets you manage and secure mobile devices when they’re connected to your Microsoft 365 organization. Smartphones, tablets, and other devices that are used to access work email, calendar, contacts, and documents play a key role in helping employees get their work done anytime and anywhere. However, it’s important to protect your institution’s information when people use mobile devices. Basic Mobility and Security allows you to set device compliance policies and access rules as well as the ability to wipe mobile devices if they’re ever lost or stolen.

Compliance Center

Retention – You can implement a retention policy to manage the data for your institution by proactively electing to retain content, delete content, or retain and then delete the content. A retention policy lets you handle this very efficiently by assigning the same retention settings at the container level to be automatically inherited by content in that container.

M365 Admin Center

Modern authentication – Modern authentication in Exchange Online lets you use multiple ways to enhance your institution’s security with features like conditional access and MFA. Once you enable modern authentication, Outlook 2013 for Windows or later versions will require it to sign in to Exchange Online mailboxes.

Basic authentication – A less secure method used by older client applications. Basic authentication typically involves signing in with only a password and username. Microsoft strongly recommends turning off basic authentication for your organization. To do this for all protocols, you can enable security defaults in the Azure portal or use controls to deactivate it for specific protocols.

MFA Versus Basic Authentication

You can choose various levels of authentication to verify people’s identity before allowing them to access sensitive data, account information, and other assets. While basic authentication requires simple credentials like a username and password, MFA goes a step further. It demands multiple elements: something the person knows (e.g., a password, personal identification numbers, or pre-selected image); something the person has (e.g., an I.D. card or smartphone); or something the person is (e.g., a unique physical characteristic such as face, fingerprint, or voice). MFA incorporates factors based on the user’s knowledge, possession, and biometrics, and in doing so it makes it more difficult for hackers to compromise someone’s identity. MFA is an ideal verification tool, and it serves as an invaluable security control for your institution’s internal and cloud resources.

According to Microsoft’s analysis, 99.9 percent of account compromises can be blocked with MFA, yet the overall MFA adoption rate we have seen is only 46 percent. MFA is an effective, low-cost option that can protect your financial institution from potential cyberattacks and other malicious activity. If you haven’t enabled MFA in Azure AD yet, examiners are increasingly likely to flag that gap.

Azure AD supports a broad variety of authentication protocols, including legacy authentication. These legacy authentication protocols, like ActiveSync, Exchange Web Services (EWS), and Simple Mail Transfer Protocol (SMTP), were developed during a time when MFA was not prevalent, and their current iterations simply cannot handle the additional factors.

Basic authentication protocols, with their inability to handle MFA, represent a risk to MFA-enforced environments where they can effectively be utilized to bypass MFA restrictions. Originally, to allow for more compatibility, Microsoft allowed the use of basic authentication protocols alongside modern authentication. However, the risk presented by basic auth protocols is so high Microsoft is taking global action against basic authentication attempts. “Effective October 1, 2022, we will begin to permanently disable Basic Authentication for Exchange Online in all Microsoft 365 tenants regardless of usage, except for SMTP Authentication,” Microsoft noted on its website. You should take immediate action now to reduce your dependence on basic authentication to avoid service disruptions.

Increasing Cloud Security

You can further increase your cloud security by customizing the following technology services, which correlate to three license functional levels: Azure AD Premium P1, Intune, and Azure Information Protection. You may purchase the licenses as individual or stand-alone licenses or as part of a license bundle.

Azure AD Premium P1

Branding

You can include your institution’s logo and specific color scheme on your Azure AD sign-in pages. This can create a consistent look-and-feel for users, reinforce your brand, and strengthen security. Your sign-in pages appear when users log into your organization’s web-based apps, such as Microsoft 365, which uses Azure AD as your identity provider. Keep in mind that all branding elements are optional and will remain as default when unchanged.

Hybrid-Azure AD Joined Devices

If you have an existing Active Directory implementation, you can take advantage of some of the functionality available in Azure AD by employing hybrid Azure AD joined devices. These devices are joined to your on-premises Active Directory and registered with Azure Active Directory. Please note: Hybrid Azure AD Joined devices will be denoted as such in Azure AD. They are not to be confused with Azure AD Registered devices which are a technically different classification of a device object in Azure AD.

Hybrid-Azure AD joined devices will periodically need a network line of sight to your on-premises domain controllers.

Conditional Access Policies

Today the security perimeter goes outside an organization’s network to incorporate user and device identity. To meet security, identity, and compliance needs, you can use identity-driven signals as part of your access control decisions. Conditional access, a key element of identity-driven control, brings signals together to make decisions and impose organizational policies.

Access controls will represent some of the strongest forms of control for identities because they are resolved upon sign-in attempt. For example, you can configure policies to deny sign-ins from outside of a geographic location like the United States. For a good example of combining signals, you can configure policies to deny sign-in attempts from computers that are not hybrid-Azure AD joined devices, effectively preventing users or attackers from signing in on unauthorized Windows computers.

Password Protection

You can use Azure AD Password Protection to identify and block common weak passwords and their variants as well as any weak terms that are specific to your institution. On-premises deployment of Azure AD Password Protection uses the same global and custom banned password lists that are stored in Azure AD. The deployment completes the same checks for on-premises password changes as Azure AD does for Cloud-based changes.

Intune Microsoft

Intune is a cloud-based service that focuses on the management of devices and applications. You can use Intune to configure policies to control how your institution’s devices and applications are used, including smartphones, tablets, and laptops. Intune integrates with Azure AD to enable a broad set of access control scenarios, such as requiring devices to be compliant with organizational standards before accessing network resources or locking down services, so they’re only available to certain mobile apps.

Azure Information Protection (AIP)

DLP

It’s critical for you to maintain data loss prevention (DLP) practices to protect your confidential information. Effective DLP can prevent users from inappropriately sharing financial, proprietary, personal, and other sensitive data. In Microsoft 365, you can minimize the loss of data by defining and applying DLP policies. A DLP policy allows you to use deep content analysis to identify, monitor, and automatically protect sensitive items to reduce risk.

AIP

The AIP on-premises scanner lets you scan your on-premises file repositories for sensitive content that should be labeled, classified, and/or protected. AIP extends the labeling and classification capabilities provided by Microsoft 365.

Conclusion

While the Cloud offers tremendous benefits, it can also expose your institution to diverse hazards. Cloud providers like Microsoft automatically enable new features, which can cause security and compliance concerns, and disable old features, which can cause business continuity concerns. Optimizing security, identity, and compliance settings for all the features of Azure AD, the identity platform for all of Azure, and M365 can be complex and challenging, but it is ok to ask for guidance when you need it.