Expert Speak
Office 365 Threats and Inversion of the Corporate Network
Written by Oliver Tavakoli, CTO, Vectra AI
2020 presented a tidal wave of challenges for businesses in every sector — from healthcare to hospitality to aviation. Every organization was forced to adopt some aspect of its strategy, whether by reducing spending, cutting staff, madly hiring, or changing operating models.
While the impact the 2020 COVID-19 pandemic had on the technology industry lags in comparison to other sectors, there was still a significant amount of change. Many organizations were forced to implement and accelerate digital transformation initiatives to cater to a rapidly deployed remote workforce.
Organizations that had invested heavily in developing and creating robust on-premises security architectures had to significantly transform and update their security strategy to protect against threats on assets used outside of office walls. In fact, one of the biggest security realizations and lessons learned in 2020 is that the security of protecting an employee’s device, interaction with the internet, and access to corporate applications must be able to travel with them, independent of where they happen to be at a given point in time.
As a direct result of accelerated work-from-home initiatives, the adoption and daily use of cloud and SaaS (software-as-a-service) applications surged in 2020, presenting many new threats. Attacks that target SaaS and cloud user accounts were among the fastest-growing and most prevalent problems for organizations, even before COVID-19 forced the vast and rapid shift to remote work.
With organizations having increased their cloud software usage, applications such as Office 365 dominated the productivity space. The Office 365 platform experienced more than 250 million active users each month and became the foundation of enterprise data sharing, storage, and communication – also making it an incredibly rich treasure trove for attackers.
It was no surprise then that Office 365 became the focus of attackers in 2020, leading to some massive financial and reputational losses, despite the increased adoption of multifactor authentication and other security controls intended to serve as roadblocks to attackers. Among the breaches involving Office 365, account takeovers were the fastest growing and most prevalent attacker technique.
Attackers now focus on account takeovers rather than email compromise to gain initial access in an environment. According to a recent study, lateral movement is the most common category of suspicious behavior inside Office 365 environments, closely followed by attempts to establish command-and-control communication. Two Office 365 tools that have emerged as valuable to attackers are Power Automate and eDiscovery Compliance Search.
Microsoft Power Automate, formerly Microsoft Flow, automates day-to-day user tasks in both Office 365 and Azure and is enabled by default in all Office 365 tenants. It can reduce time and effort to accomplish certain tasks for users – but similar to PowerShell, attackers tend to want to automate tasks as well. With over 350 application connectors available, the options for cyberattackers who use Power Automate are vast. Office 365 eDiscovery Compliance Search enables the search for information across all Office 365 content using one simple command. All these techniques are actively used now, and they are frequently used together across the attack lifecycle.
The number of threats targeted towards Office 365 users and other similar platforms will undoubtedly continue to grow in 2021. Identifying user access misuse has traditionally been tackled using prevention-based, policy-centric approaches or have relied on alerts that identified potential threats as they occur, leaving little time to respond appropriately. These legacy approaches will continue to fail as they only show that an approved account is being used to access resources and do not provide any deeper insight into how or why resources are being utilized and whether the observed behavior might be useful to an attacker.
In 2021, security teams must focus on implementing measures that provide a more detailed overview of how their users utilize privileged actions — known as an observed privilege — within SaaS applications like Office 365. This translates into understanding how users access Office 365 resources and from where. It is about understanding the usage patterns and behaviors, not defining static access policies.
The importance of keeping a watchful eye on the misuse of user access to SaaS data cannot be overstated, given its prevalence in real-world attacks. SaaS platforms are a haven for attacker lateral movement, making it paramount to monitor users’ access to accounts and services.
As we look ahead to 2021, what are some of the other security considerations organizations should prepare for? The inversion of the corporate network will remain predominant as many enterprises around the world focus on adopting a more permanent hybrid or completely remote work structure to increase productivity, reduce overhead, and provide employees with better flexibility. It is no longer the case that highly sensitive and confidential data is only kept on-premises, where a small number of exceptions are made in the protective firewall policies to allow for outbound communication.
In 2021, de-perimeterization of the organization’s networks will finally be accepted as the norm, something which has been anticipated for years and that the pandemic has accelerated. One of the leading indicators for this is companies who are ditching Active Directory (on-premises legacy architecture) and moving all their identities to Azure AD (a modern cloud-enabled technology).
One of the best things an organization can do to prepare for security challenges in 2021 is investing in network detection and response (NDR) and deliver user access via a Zero Trust architecture. Enterprises should think about where their most important data is located (most likely in the cloud and SaaS applications) and determine how efficient their security team is at ferreting out attackers from all these places before they do any substantial harm.
Expert Speak
Shadow IT – Is It Really a Problem?
Personally, I love shadow IT—most employees do. But is it a problem? Let’s explore.
Wondering what shadow IT is? Shadow IT refers to the use of software and hardware tools or services by employees without the knowledge of the organization’s IT department.
The use of shadow IT tools has been a topic of discussion for years, with each company having its stance. Using these tools is often more about personal preference than anything else, and the same applies to how companies handle them. Most people lean toward shadow IT because official IT software tools often do not offer features that cater to individual preferences.
Some commonly used tools that fall under shadow IT include project management tools like Trello and Notion, messenger apps like WhatsApp, and file transfer apps like WeTransfer and Dropbox. The common factor? They’re all easy to access and use. However, with the rise of GenAI, everyone’s new shadow IT tool is ChatGPT.
The problems
I’m sure you already know the main issues that make companies dislike shadow IT tools: privacy and security.
Let’s look at ChatGPT. The use of ChatGPT isn’t regulated in most organizations, and many companies are still at a crossroads regarding GenAI tools. There’s a risk of employees unintentionally sharing sensitive information, leading to data leaks. This could include intellectual property, like code used to build applications, or personal information such as phone number, email address, house address, and more.
Whatever the sensitive information may be, it’s not safe to share it with tools like ChatGPT. Threat actors are constantly trying to breach systems, especially widely used tools like ChatGPT, where there’s much to gain. There’s still an obvious vulnerability here despite companies providing best practices to employees.
Another problem with shadow IT tools is that they restrict collaboration. If one team member uses a cool, new project management app to track progress and others use a different tool, it’s difficult to stay on the same page. For example, design and development teams often work together on the same project, such as designing web pages.
If the design team uses one project management tool and the development team another, how can they collaborate and work in sync to meet deadlines? It creates unnecessary friction. This is why organizations provide the same, approved project management tools for everyone. While using different tools might boost individual productivity, it can cause productivity issues within the project as a whole.
From a financial standpoint, companies pay for business tools that their employees use. If employees start using free online tools instead, the money spent on approved tools for a user who uses a shadow IT tool instead becomes a loss for the company.
Additionally, when organizations approve software solutions, those tools are vetted by a team of professionals and comply with the laws and regulations that the company must follow. However, we can’t be sure those tools are compliant when employees download apps on an ad-hoc basis, and employees usually don’t check for these things when they download or use shadow IT apps.
The good
Shadow IT tools are awesome. We all agree on that. The tools organizations give us, or approve, are often outdated. They’ve been around in the tech landscape for years (for good reasons, of course), but as technology advances, we don’t want to be tied to old tools that lack new features, which could make our work easier.
Restricting access to apps doesn’t feel great. We all work differently and have unique preferences. Using shadow IT tools that we like makes us feel more productive, and empowered, and allows for individuality in the workplace. When we use tools we love, we tend to be more efficient compared to when we’re stuck using approved, traditional tools that may lack the features we need.
The verdict
Shadow IT comes with many advantages, and dismissing it solely because of the risks isn’t wise. If we think about it, all tools carry some degree of risk. It’s up to us to be educated and understand how to use them securely and efficiently while benefiting the team and the company we work for. Shadow IT tools might benefit you individually, but what’s more important is to look at the bigger picture and ensure that your teamwork doesn’t get affected because of this.
Speaking of the financial loss that a company incurs while giving out tools that an employee may not need, what can be done instead is that organizations can avoid giving all the tools that an employee might need. Even if it’s a tool that employees may need regularly, us a request-based system so that employees reach out to get a paid tool by the company only if they need it and want to use it. This eliminates the unnecessary cost incurred by the company when an employee is provided with paid tools by default but chooses to use a shadow IT tool instead.
At first glance, shadow IT might seem like a problem, but with employee education and empowerment, it doesn’t have to be. Restricting shadow IT tools is easy, but educating employees is key.
ManageEngine is a company that believes in employee-driven innovation and encourages its employees to be aware of secure cybersecurity practices while allowing room for individuality. To learn more about ManageEngine and its offerings that allow you to have a secure and efficient IT infrastructure, click here.
Cyber Security
How to Decrease the Burden of Authentication Requirements
Written by Roman Cuprik, Content Writer at ESET (more…)
Cyber Security
Skills Gap Exposes Organisations to Risks
Written by Rob Rashotte, Vice President, Global Training & Technical Field Enablement at Fortinet (more…)
-
Cyber Security7 days ago
Tenable Urges Organisations to Reimagine Cybersecurity at GITEX 2024
-
Cyber Security7 days ago
Check Point Software to Emphasise its Prevention-First Approach to Cyber Security
-
GITEX1 week ago
OPSWAT to Showcase its Mobile Critical Infrastructure Protection Lab at GITEX 2024
-
GITEX1 week ago
Fortinet to Focus on Digital Transformation with Advanced Security at GITEX 2024
-
GITEX1 week ago
Snowflake to Demo its AI Data Cloud at GITEX 2024
-
GITEX7 days ago
Sophos to Highlight Advanced MDR Capabilities at GITEX Global 2024
-
Critical Communications3 days ago
Hytera to Show Off 4G and 5G Body Cameras for Law Enforcement at GITEX GLOBAL 2024
-
Artificial Intelligence6 days ago
Dataiku Launches LLM Guard Services to Control Generative AI Rollouts