Unsafe passwords leaving the doors wide open are only a part of what makes a cybersecurity risk in the modern world. Add phishing emails, calls and the urgency of the business world to the mix and you have a whole spectrum of attack opportunities, to the point where someone seemingly “voluntarily” gives out their information. In this blog post, we'll address the threats and how your you can equip your colleagues with the knowledge to prevent cyber breaches
A Common Sense Approach to Cybersecurity
What Your Colleagues Actually Need
How to Support Your Team - Download Our Staff Guide
Put It to the Test - Run an Attack Simulation in M365
That’s how phishing attacks can have a snowball effect.
If your organisation has been using M365, you should be aware of the security features. You can dictate when staff need to update their password, if it needs to be a minimum length or meet other security requirements, if they need multi-factor authentication etc.
Also think of access rights, such as just-in-time access, granting someone access for a limited amount of time for a task and the general underlying Zero Trust principle.
Even if it’s not about giving away your credentials, you also want to ensure your colleagues share files safely, so you can e.g. restrict that files can only be shared internally via OneDrive – or implement data loss prevention policies that make it impossible for staff to send a specific file via email. Ensure anti-spam, anti-malware, and anti-phishing protection for email is in place.
But even if you have already actioned all of the above, it’s still on your staff to do ‘their bit’ where technology can’t protect from all cyberthreats.
General cybersecurity training is a given, but it’s often too technical and too long – or even seen as a tick-box exercise. Additionally, people forget policies but choose the “path of least resistance” – i.e. what’s easy to use.
It’s worth urging your colleagues to take a common sense approach when dealing with emails, especially the phishing kind: Think of the real example we mentioned further up in this article, or a phone call they may be receiving asking for assistance from a person they know. Prompt them to ask themselves questions like: “Have I dealt with this person before, why would they request this from me?” or “I know this person, that’s not what they sound like and why would they ask me for this?”
Unfortunately, phishing emails come in many forms, such as those that look like they're from Microsoft (or other software vendors/platform providers). Even then, ensure you check sender details and links before clicking, especially if the email relays a sense of urgency.
Check
In case of doubt - and if you know the person - get in touch in another way to check if it's really them who have sent the email. If you're interested in a more visual guide, download our Microsoft 365 Cybersecurity 101 Guide for Employees.
If you’ve been following recent news at all, you’ll have heard about the increase of AI use in cybercrime – we’re talking deepfakes, vishing attacks (voice cloning) and the like – for a malicious actor to pretend to be someone in a position of power to initiate a bank transfer or to obtain sensitive information. In this scenario, the same applies: What’s the rationale behind the request, does this sound like them? But there are other ways to protect yourself – such agreeing on a code word which can be asked for in a case of emergency.
Long story short: you’ll want to make cybersecurity accessible to create a habit of cyber hygiene and even more staff awareness. That means:
We’ve created a simple M365 Security 101 handout you can give directly to staff.
Covers the basics – without the tech jargon.
✔️ What phishing looks like and what to do if they receive a phishing email
✔️ Why MFA matters
✔️ How to share files safely
✔️ How to secure their own devices
In case you didn't know, Microsoft offers Attack simulation training to test users in your organisation (although you'll need a Microsoft 365 E5 or Microsoft Defender for Office 365 Plan 2 licence.) This way, you can test how cybersecurity aware staff in your organisation are. Follow the instructions here.