Microsoft 365 Security

In the next instalment of our Microsoft 365 articles, we talk about the security features available as part of your subscription

I remember a time where law firms were a little suspicious of the “cloud”. How could entrusting your data to a third party be more secure than having it stored on your own servers, held in your own premises?

I was once told by a board member that he gained a degree of comfort seeing the little lights on the servers twinkling away whilst they processed the firm’s information. Indeed there is, what I hope is an urban myth, that one firm left old kit running just to give comfort to the managing partner who liked to check in on the “flashing lights” as he walked past each day.

Ten years ago, a law firm IT Director would be faced with a slew of challenges keeping those servers running within the four walls of law firm offices. Local power cuts, air conditioning failure, hardware failure and concerns about break-ins were always just around the corner.

When Microsoft finally gave me a platform that allowed me to move my firm’s email to the security of their multi-million pound highly resilient datacentres, I gasped a sigh of relief.

The Service Trust Portal provides access to each security related certification held by Microsoft and it’s here you can find anything from their ISO 27001 and PCI DSS security certifications to their penetration test results. There is a certain peace of mind when a company provides access to this type of information in a totally transparent manner. Admittedly, you will need to be a customer to view the content of these documents but sign up for a free trial of one of their cloud products and you will be able to view these documents at will.

If you are currently using an on-premises or Exchange platform hosted by any other MSP we would recommend you ask them for access to their certification, audit results and penetration tests.

Within Microsoft 365 though, there is an array of security related applications and features that provide a level of protection and assurance useful for law firms.

A great example of this is multi-factor authentication (MFA) technology. MFA is as a must-have for most firms. Used ubiquitously to protect individual’s online accounts, it provides an extra level of protection beyond the usual username and password.  MFA is provided as standard on all Microsoft 365 business subscriptions and can be switched on for all users.

MFA is most commonly used in conjunction with the Microsoft Authenticator app that can be easily downloaded to a smartphone.

The user will logon to the system as normal but before access is granted, the Authenticator app will prompt the user to approve an access attempt on their smartphone.

This minimises the risk of unauthorised access to their data even if their username and password have been breached.

Auditing also plays a key role in the management of Microsoft 365. Once firms have migrated to Microsoft 365 and start to use applications such as OneDrive alongside email, there can be a significant amount of data transferring in and out of the firm via these online services. Firms should take some reassurance that they can automatically log key events in Microsoft 365 to an audit file, which can then be easily searched from the main interface.  For example, we can check who has shared documents from OneDrive with external parties and the type of link they have used to do this, to ensure it meets with internal security policies.

One of my preferred Microsoft 365 add-ons is Advanced Threat Protection (ATP). ATP protects against malicious threats posed by emails, links (URLs) and collaboration tools. Phishing emails have been a serious threat to law firms for a number of years. ATP anti-phishing prevention will detect rogue emails that impersonate users and internal email domains. It uses machine learning models and advanced impersonation-detection algorithms to avert phishing attacks. Similarly, emails containing rogue attachments or those that entice you to click on a link have been at the heart of fraud that has impacted firms up and down the country.

For that reason, ATP features such as Safe Attachments which checks all email attachments for suspicious virus/malware signatures using machine learning techniques provides a degree of reassurance. Likewise, similar features can be switched on to protect OneDrive, Teams and SharePoint platforms too – so that any file that is shared is security scanned.

This is just a flavour of what Microsoft 365 has to offer. If you are using Microsoft 365 then I would recommend you check to see whether you have these security features enabled. It is easy to do so with the correct licensing and it could save you from a situation you may rather not find yourself in!

The main power of Microsoft 365 is the amount of development effort that has been poured into it. It is an IT strategy in its own right and will provide evolutionary protection that a traditional “point in time” solution simply cannot compete with.