Phishing, Spam, Security

[lftechnician]

We fall into the SME bracket with approx 200 employees. We use a mix of Business Basic and Business Standard licencing for our 365 provision.

My concern, since joining the business, is protecting this/us from phishing, scams, ransomware and whatever else bad players want to throw at us.

We use Sophos protection for our Endpoints, nothing on mobile devices (although they are all Knox Managed).

I am always of the opinion of not if it happens, it’s when it happens, and and such, I am looking into what we can put in place to protect our 365 tenant, emails etc, as soon as possible.

I’ve used Mimecast and Spam Titan in the past, but interested in what others do to protect their 365 tenants, and of course, cost is a major factor, although try telling the Board to place a value on the data we hold when they reject proposals…

[Rod-IT]

There are many spam filters out there, from free to paid, including Microsoft Defender at the tenancy level.

You should also consider backups as a way to recover, MS does not do this for you, they do however backup the data for their own DR and keep at least 3 copies of your data in 3 locations along with a 90day recovery window of deleted files.

You want to list what you need, what you want and what doesn’t matter to you, then have a budget for this. Once you have these lists, get some prices and demos if you can or feedback from users of those specific systems.

Personally, I use Defender for spam filtering and for my lab, I use Boxafe on Qnap to backup my 365.

[sbux2k]

Not sure if you already have a training regime for your users, but teaching your users how to identify what may be phishing can be very helpful in your security posture. We recently implemented a product called Phin, and have been very happy with it so far. It provides quick training videos from a few vendors, and also does automated phishing simulation testing that immediately gives feedback to the users in the form of what they term a “learning moment”.

Just thought I’d mention since it does help when people know what be on the lookout for.

Cheers.

[lftechnician]

@rod-it

There are many spam filters out there, from free to paid, including Microsoft Defender at the tenancy level.

You should also consider backups as a way to recover, MS does not do this for you, they do however backup the data for their own DR and keep at least 3 copies of your data in 3 locations along with a 90day recovery window of deleted files.

You want to list what you need, what you want and what doesn’t matter to you, then have a budget for this. Once you have these lists, get some prices and demos if you can or feedback from users of those specific systems.

Personally, I use Defender for spam filtering and for my lab, I use Boxafe on Qnap to backup my 365.

As mentioned, " interested in what others do to protect their 365 tenants", which kinda meant, “tell me what you are using”. I can then go and have a look see. I have no budget, because I currently have no informed clue what’s really out there. Hence my question.

It ain’t easy being Autistic and having ADHD when trying to research, as it can become overwhelming very quickly, which is why I turn to my peers who have probably been there, done it, and got several T-shirts along the way.

I would prefer to keep it “MS” when I can, e.g. use Defender, then it all lives under one roof, but again, that’s me not knowing what’s out there for this sort of thing.

[Rod-IT]

Your challenges we’re not known, so thanks for adding that part - while I sympathise with your situation, I noted my answers to your question, while hopefully providing some further insight, if that has only clouded what you wanted, your challenges should have been noted at the start to avoid people posting things that only hinder your searching.

[lftechnician]

@rod-it

Your challenges we’re not known, so thanks for adding that part - while I sympathise with your situation, I noted my answers to your question, while hopefully providing some further insight, if that has only clouded what you wanted, your challenges should have been noted at the start to avoid people posting things that only hinder your searching.

Oops, my bad… on the contrary there, you said you use Defender, which put a tick in a box for me. This is what I need, what others are using, so I can then go and investigate known solutions, rather than searching for something I’m not au fait with, and getting myself overwhelmed with the results. If 10 people say we are using solutions from A, B & C, that helps me, rather than getting to H and thinking, ‘I’ve had enough of this already’.

[Rod-IT]

Be mindful that if 10 people do say we use product A and your company doesn’t have the budget for it, it’s all for nothing.

So having some must haves from whatever product you want to use would be handy to work with.

[lftechnician]

If 10 people are using product A, then I will have a good business case for insisting the budget is found
I don’t really have any “must have’s”, except the obvious, like email protection, until such time as I find out what sort of features are available, that I perhaps haven’t thought of, and then I see if they align with our budget, and the way we do things.

[roger-knowbe4]

No matter what product or service you choose, do aggressive education of staff of how to recognize, mitigate, and appropriately report social engineering. Do training and simulated phishing at least once a month. You want to enable everyone to spot social engineering no matter how it arrives. If I had only one thing to communicate I would communicate this. If a message arrives unexpectedly and is asking the receiver to do something they’ve never done before (at least for sender), and if malicious could harm the receiver’s interest, then it is a high risk message and should be further investigated before performing. This is key.