Community IT CTO Matthew Eshleman reviews security fundamentals in Office 365. Small and medium sized nonprofits are in a great position to take advantage of the native security tools offered in Office 365.
9. Why are attacks so successful?
30% 63% 58%It only takes hackers 4 minutes to get in your network,
but 99+ days for businesses to discover they’ve been
breached.
11. Simple
One solution
Cloud platform simplifies deployment
Reduces costs
Eliminates costs for multiple third-party
vendor solutions
Reduces maintenance and management costs
Aligns with business goals
Security built into your productivity platform
Don’t need to make trade-offs to justify
security investment
Protect business against risk-related costs
Microsoft 365 Business
Business savvy way to reduce risk
12. • Safeguard
• Keep credentials safe
• Limit use of credentials
• Confirm identity with multi-factor authentication (MFA)
• Prevent non-compliant devices from accessing system
• Monitor
• Audit data access
• Review login locations
• Respond quickly to detected threats
Control who has access to business information
81%
75%
17. Features
Feature License Bundle
Cloud MFA Included in Office 365 Part of all O365 subscriptions
Granular MFA Requires Azure AD P1 Part of EM+S E3
Password Writeback Requires Azure AD P1 Part of EM+S E3
DLP Requires Exchange P2 Part of O365 E3
Azure Identity Protection Requires Azure AD P2 Part of EM+S E5
Email and File Encryption Requires Azure RMS Part of O365 E3
Cloud App Security Requires License Part of EM+S E5 or Cloud App SKU
SSO Requires Azure AD P1 Part of EM+S E3
Manage Computers Intune Part of EM+S E3
19. What am
I missing?
E1 + Office ProPlus + EM+S does not include
• Information Protection
• DLP for email
• Unlimited email storage
• Litigation hold
https://technet.microsoft.com/en-
us/library/office-365-plan-options.aspx
21. Security
Checklist
View Your Secure Score
https://securescore.office.com
Enable Auditing in
https://protection.office.com
Message Trace
Get Signed up for EM+S
https://www.microsoft.com/en-
us/nonprofits/enterprise-mobility-security
Get Signed up for Azure Sponsorship
https://www.microsoft.com/en-
us/nonprofits/azure
Link Azure AD with PowerBi
https://app.powerbi.com
24. Admin
Security
Checklist
Have between 2-5 Global Admins
Turn on MFA for Staff
Complex Passwords for All
•Personally Identifiable Information
•Financial Information
Enable DLP in Office 365
•DMARC, DKIM, SPF
Secure Email
Require Disk Encryption
Review Audit data
25. End User Security Checklist
Pick a strong password
Chose unique passwords for each service
•Most recent breaches we've seen are probably email/password combinations
reused from previously compromised user account databases
Be cautious when clicking
•Learn the value of hovering over "friendly" link names
•Watch for domain names that look legitimate at first glance, but don't
actually match the real domain name of the destination you expect.
Report suspicious activity to your IT Team
28. Advanced Controls
• Information Rights Management: Define policies for
who can access data
• Restrict access to OneDrive and Control Sync
• Managed device access to organizational data
• Configure Advanced Threat Analytics: Integrate on-
prem with the cloud for unified management
• Use Defender Advanced Threat Protection