Hopefully, if you’re a 501c3 and using Office 365 you’re taking advantage of Microsoft’s not for profit pricing! If not, please reach out to us and we will happily point you in the right direction. But, that’s not what this article is about!
As I am sure you’ve been hearing, security has become so important these days. There is no shortage of information encouraging you and your staff to have regular cyber security training and implement Multi-factor Authentication (MFA) on all your cloud accounts. Despite these efforts, computer and email compromises are still happening.
Microsoft has a great tool that we use for a few of our nonprofits (as well as our for profit customers) called Microsoft Cloud App Security. With Cloud App Security we monitor notifications for our customers so we know when someone is trying to get into their account. Cloud App Security allows us to see if the attempt failed or was successful, because of this, we have stopped quite a few incidents from escalating into something bad! For non-profits the cost for this added security is $1 per user/month and is well worth the money spent!
Below is a summary of the basic policies we implement and monitor for your reference:
- Sign in from an infrequent country – (Most common notice we receive)
- Impossible travel activity (Login attempts from geographically impossible distances) – 2nd most popular notice we see.
- Multiple repeated failed sign-in attempts.
- Activity from an anonymous proxy.
- Suspicious Inbox Manipulation rules.
- Ransomware Behavior (I don’t have details on what this does exactly).
- Suspicious file deletion activities (Sharepoint\OneDrive).
Cloud App Security from Microsoft has many other features, but these alone make it worth the money to reduce the risk of a compromise causing real damage!
Another tool we like for Microsoft Office 365 (and Google Workspace) is called Ironscales. Ironscales is a “self-learning email security platform to stop tomorrow’s phishing attacks today.” In summary this tool integrates with Office 365 (web, outlook and mobile) to prevent most phishing emails from getting through, provides a tool for reporting if one does get through, removes those emails from the entire companies system and provides a tool for training campaigns to test and train your staff!
Between Cloud App Security and Ironscales email based hacking attempts are dramatically reduced!
As always, I hope this helps! Please feel to reach out to us via our contact form or call 303-415-0266 opt 2 if you have any questions.
Bob