For the last WOOF of 2018, we return to the topic of email security. Next to Internet access, email is the most critical system in any business to protect.

Cybercriminals use it to steal data by the gigabyte, or hold your company hostage with ransomware.  The battle to protect email from them never ends.

Many businesses opt to let Microsoft fight that battle for them. They subscribe to Office 365 for email, and go about their day.

While Microsoft 365 is a strong and productive email system...it suffers from a serious security issue. One that Microsoft hasn’t fixed. But you can fix it, for all your email accounts, with one device.

That's what we're talking about in today's WOOF.

Isn't Office 365 Secure Already?

Microsoft designed their Microsoft 365 platform for productivity. It works well in this regard. It's also intended to keep email secure. However, this is where M365 can stumble.

M365 does have Advanced Email Threat Protection available with most plans (details here).  But it's an add-on you have to pay for; it's not enabled by default.

Even with the advanced protection, M365 email suffers from a structural security risk. A risk cybercriminals keep targeting.

Microsoft 365's Structural Vulnerability: It's a Self-Contained System

M365 routes emails within its own cloud system. From email server direct to email server. Along the way, M365 scans emails to check for spam, malware, & phishing.

It uses its own set of policies & controls to police the emails. Cybersecurity experts call this "internal scanning." If we were to chart the steps, they would look like this:

M365 Server → M365 Scans → M365 Server

The problem? This system is self-contained. It uses the same process every time, taking the same routes, applying the same policies at the same stages.

It's possible to code malware to bypass those policies. If you know what one system does, you can avoid it. The types of cyberattacks keep changing to exploit this. Examples:

• BRUTE FORCE—Pinging one email server with millions of requests until it crashes, letting the cybercriminal exploit the security hole this creates.
• TARGETED ATTACKS/SPEAR PHISHING—Mirroring an individual user's authorized emails so closely they bypass filters (and deceive the user).
  • Worse, if a cybercriminal infects one M365 account with malware, they can send phishing emails through it to other M365 accounts...and those phishing emails can easily bypass the M365 security!
• MUTATING MALWARE—Fooling the M365 link checkers, in order to slip emails with infected links through.

How to Save M365 Email Security with a "Detour"—A Cloud-Based Security Device

There is a way to keep cybercriminals at bay indefinitely: You put a detour in their way.

A 'detour' in this case is a third-party intermediary. You change your Microsoft 365 email system so it operates like this instead:

M365 Server → Third-Party Gateway → Third-Party Malware Scans → M365 Scans → M365 Server

This forces both internal and external scanning into the system. Each & every email must endure extra scrutiny, long before it hits your inbox. Creating a higher degree of security, by increasing the number of times spam or malware gets caught.

This is what modusCloud does. It's a cloud-based device that provides real-time threat protection again spam, phishing emails, and malware. modusCloud acts like a castle wall and a trapdoor at the same time.

If a cybercriminal attacks your Microsoft 365 accounts, they have to go through modusCloud to reach your email server. Since modusCloud uses different filters (more stringent than Microsoft's), they didn't prepare for those. Only the M365 self-contained internal scanners.

As a result, their attempts get stuck. Your email stays nice and secure...in fact, you'd never know anything happened!

Bonus: You can add modusCloud protections to your M365 email accounts for almost the same price as Microsoft's Advanced Email Threat Protection. Same price, but much more vigilant email protection.

More details about modusCloud at: https://www.vircom.com/office-365-email-security/

M365 Email Security is Good. Make it Better.

As Microsoft 365 has grown, so has the cybercriminal community attacking it.  They found the self-contained vulnerability, and began exploiting it.

So far, Microsoft's response has been lackluster, which is why we're talking about third-party devices like modusCloud. You cannot put a high enough emphasis on email security.

We wish everyone a safe and happy holiday!

Is your M365 email safe? Email us at sales@planetmagpie.com for a modusCloud quote!