{"id":36555,"date":"2020-08-11T17:43:48","date_gmt":"2020-08-11T17:43:48","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=91687"},"modified":"2020-08-11T17:43:48","modified_gmt":"2020-08-11T17:43:48","slug":"microsoft-office-365-do-you-have-a-false-sense-of-cloud-security","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/microsoft-office-365-do-you-have-a-false-sense-of-cloud-security\/","title":{"rendered":"Microsoft Office 365\u2014Do you have a false sense of cloud security?"},"content":{"rendered":"
<\/div>\n

Through difficult times, some adversaries will find opportunities and COVID-19 has proven to be a ripe opportunity for them to target a new, expanding, remote workforce. While these threats morph and evolve, Microsoft\u2019s Detection and Response Team (DART) finds ways to endure and help organizations become more resilient<\/p>\n

Cloud\u202fenvironments are\u202fcontinuously being put to the test during this challenging period.\u202fDART has seen various security configurations\u202fin our customers\u2019 cloud tenants.\u202fThe one\u202fcommonality:\u202f administrators flip the switch on a few security tasks without genuinely understanding the process and procedures needed to ensure everything works as designed and consequently create gaps in defenses and opportunities for attackers to circumvent security controls.\u202fWhen it comes to defense-in-depth, these controls must work in concert with one another.<\/p>\n

Three measures you should employ to improve the security of your cloud environment<\/h2>\n

This post describes three\u202fsecurity measures\u202fyou should employ for your Azure AD\/Office 365 environment when first\u202fsetting up\u202fa new tenant, or\u202fwhen\u202ftightening the reins on a well-established tenant.<\/p>\n

    \n
  1. Create an emergency Global Administration account.<\/li>\n
  2. Enable Multi-factor Authentication (MFA).<\/li>\n
  3. Block legacy authentication.<\/li>\n<\/ol>\n

    1. Create an emergency Global Administrator account<\/h2>\n

    An emergency Global Administrator account, also known as\u202fa \u201cBreak Glass Account\u201d, is critical to the overall security posture of your tenant, and it prevents you from being accidentally locked out of your Azure Active Directory (Azure AD). Think about the consequences of your administrators getting locked out; you cannot sign in, activate users, assign licenses, or validate the actions happening in your tenant. Emergency access accounts are highly privileged and not assigned to specific users. These accounts must be excluded from your current security controls, and must have compensatory controls. These controls might include the following:<\/p>\n