Hackers are Targeting Office 365 Accounts, are YOU Protected?
Office 365 is increasingly being targeted by hackers and there is a current large wave of phishing emails since the new year. Scammers are targeting companies using Office 365, and are looking to obtain login details to staff accounts.
One example scammer email circulating targets unsuspecting company employees using an email that is very realistic and looks as if it’s come from Office 365 saying “You have mail on the server that needs verification to download”.
Your diligent employee wants to ensure they have received all emails so clicks the link and enters his login information. Once this is done their Office 365 account could be instantly compromised, allowing access to vital business information.
How Can Scammers Use Your Information?
Once they have access, they can see all of your emails which is obviously a major security risk. They can also then send emails as if they were the employee. For example:
- A member of the accounts team email is compromised, the scammer scans the emails to find a known supplier.
- They then create a spoof email that looks like the supplier’s email and forward this to someone else in the accounts team from the hacked account.
- The forwarded email will be made to look like the supplier is notifying you of a bank account change for payments.
- As it is forwarded by another member of the accounts team, the recipients are misled into believing this is a genuine request and action it.
- They then just wait for you to make your next supplier payment with these new details and then receive the funds.
How Can I Ensure My Vital Business Information Is Protected?
The first goal of any data security feature is to act as a strong perimeter. Office 365 is no different and has taken many measures to ensure no unverified users can get into your system. This can be done with two-factor authentication.
This should be done be a relevant technical IT admin to ensure that the setting are correct and setup for maximum protection.
Two-Factor Authentication
The strongest defence you can employ against email scammers is two-factor authentication. Even if any login details are obtained, this will provide an added layer of protection against hackers.
Two factor authentication means when someone logs in they must have a device / app that generates a unique code they need every time they want to login to an untrusted device.
How Can Two-Factor Authentication Protect Me?
With two factor authentication enabled even if an account password is guessed the attacker would still be unable to login without access to the unique two-factor code.
These codes are single use and expire after short periods of time. Codes are often sent as text messages to your mobile phone meaning that only you have access to this code, without this second code the attacker will not be able to login.
Is Two-Factor Authentication Enough To Protect My Business?
Although Two Factor will secure your login, there are still other security considerations to keep in mind such as; enabling DKIM & DMARC alongside the SPF record to prevent spoofing attacks that can occur even without your login. Enabling this will validate outbound email to ensure that it is being sent from a trusted source.
Alternatively, book a cybersecurity audit today to ensure that your critical business information on Office 365 is protected.
Netmatters can implement two-factor authentication and DKIM & DMARC on your email accounts as part of our cybersecurity services. We provide audits of companies’ current cybersecurity processes, and can offer a variety of ways to safeguard important data.
If you are concerned about cybersecurity in your business, contact Netmatters today. We are on-hand to respond to any queries on 01603 515007.
