Email is so ubiquitous in our everyday lives that it can be a challenge to always be on guard when receiving messages. Each day it’s not unheard of for each member of your team to have hundreds of messages land in their inbox. How do you make sure that none of those communications are harmful, directing employees to share security information or download damaging files?
What spam and phishing are–and why they are dangerous
A threat actor can deliver something via email that can then be downloaded and installed on the recipient’s computer, or convince unwary employees to take an action that could be detrimental to themselves or their company. These unwanted emails are called spam and the action of trying to engage people to perform dangerous activities is called phishing.
Often the nefarious entities sending this spam are looking for financial gain, but in the case of the defense industrial base (DIB), they could want to gain access to information in your possession that could benefit the entity that they may be working for.
There are different avenues they take, but it’s all about using email to get you to trust them and then take action. Here are a couple of examples.
- An email received from a Gmail account stating that it is from the CEO and he has been locked out of his account. The communication would then direct the reader to call a number or download software.
- A communication could mimic a partner company, perhaps misrepresenting themselves as Microsoft, and directing the recipient to download a software update to protect themselves from a threat.
Since life these days is chaotic and we are all engaged more hours than we are on the clock, we might not be sitting in front of our computers, but instead be rushing off on an important errand when we glance at our phones and notice an email, purportedly from our boss. Any one of us could take the action requested by the spammer, and not realize until much later the error in judgment.
Protecting your business from these threats
The solution is to limit the ability of these threat actors to send email to your employees by having the right spam tool with the right settings in place. In some cases, a company might have a good tool in place, but it might not be optimally deployed.
In a nutshell, companies should configure everything with ‘anti’ in the name (anti-malware, anti-phishing, anti-spam), and set up features with ‘safe’ in the name (safe links, safe attachments). These actions help ensure that attachments are scanned before they are delivered to your endpoint. Realistically speaking, you want to support digital interactions as you are mitigating risk through the proper setup of these types of tools.
Microsoft 365 Defender helps stop attacks
This solution, which is part of Microsoft’s XDR solution, leverages the Microsoft 365 security portfolio to automatically analyze threat data across domains, building a complete picture of each attack in a single dashboard. It offers two options.
- Plan 1 – This option provides configuration protection capabilities, such as establishing safe attachments and safe links. It also performs anti-phishing and real-time detections.
- Plan 2 – This option takes those basic anti-spam capabilities and layers on additional capabilities like automation investigation or remediation, and education capabilities. Since the education piece is critical, our experts recommend Plan 2. With the evolving security landscape, this solution has dynamic features which can accommodate the threats of today and meet future challenges.
As a Microsoft partner, we are skilled in implementing and optimizing Microsoft 365 Defender to help you safeguard your organization. Reach out to us to get a quote. We can provision licenses, implement the tool, and push out solid security policies in your Office 365 environment. If you already have the licenses, we can also maximize the entitlements that these licenses have. Contact us to get started.