Office 365 Security and You - Access Control

YouTuber JackSkepticEye plays Papers, Please. What does this have to do with Office 365 security, read on and find out! This is the second part of a series on cloud security topics. In the first part, I discussed the threat that has Ransomware over people and companies. I started this series to book-end around my appearance as part of the SharePoint security panel at this week's Federal IT Security Conference. Since that conversation unfolded, I think we'll do a Part 3 next week to cover the topics discussed at the panel, which were very different that I imagined they would be.

PART 2: 12 Ways to Control When and Where People Access Office 365

Recently, many of our customers who are interested in migrating to Office 365 have been asking us questions about whether it's possible to control when, how, and where their employees can access their data.

While there are some technical approaches that may work, the unfortunate news is that there's no "silver bullet", at least as far as we've been able to find - yet. Many possible solution feel like kludgy work-arounds, temporary half-measures, partial solutions, or something created only for larger organizations.

I thought I'd take the opportunity to put together a list of possible ways to tackle this challenge. Even though no option is a complete answer, it's possible that some of these may be a good fit for your specific circumstances. I'll do my best to go over the pros and cons of each option.

Is this necessary? Depending on who you are and what you do, maybe not. Overkill? A bit heavy handed? Perhaps. Thus the graphic above, which (for those of you who may not be gamers) parodies an Arstotzkan border guard from the dystopian job simulator game classic "Papers, Please". Understand though that in some cases it may be reasonable, since many industries are subject to regulatory compliance requirements that might not always be perfectly aligned with a cloud based IT strategy.

Fair warning, this is a pretty complex topic. Hopefully everyone has gotten over their election night hangover and is ready to dig in. So, without any more fanfare, let's check out some methods to implement extreme vetting in Office 365.

Access Control - The Basics

When we think about granting access, we're basically describing the five W's that need to be addressed in order to make a decision about letting a person have access to information. A perfect access and identity system would answer all the questions below before letting someone in to the system - and may even use some of the answers to put a limit on what they can access at any given moment.

Who

  • Is the user logging in actually who they say that they are?
  • How confident are we in that?
  • Have they been educated and informed about security and privacy policies?
  • Is their ability to act responsibly expected?

What

  • What is being accessed; is it email, documents, some other data?
  • Is accessed content subject to regulation such as HIPAA, SOX, or GLBA?

Where

  • What network are they connected from?
  • Do we have any geo-location data?

When

  • Is it the normal workday or after-hours?
  • How does "now" jive with past or expected work patterns?

How

  • Is it a known PC, mobile device, or something new/different?
  • Are they using a browser (that can run JavaScript or CAPTCHA test), or could this be a bot?

Why

  • What's the business purpose behind needing the information?
  • Is it reasonable to expect responsible behavior?
  • If the behavior is unusual, is it known in advance or has it been vetted?

Okay, so now that we've been over what sorts of things go into granting access, let's get specific. The answers to "who" and "what" are already largely covered by conventional authentication and authorization systems. The topic in question - the one we're hearing about from our customers - specifically addresses the "when", "where", and maybe "how" above.

So, without further ado, here's my list of 12 things that can be done to control access to Office 365 and other resources in the cloud. Some are cheap. Some are definitely not. None are perfect for everyone. That's just life, I guess. If you'd like help finding a solution that will work for you, please talk to us about it, because that's what we do at Liquid Mercury Solutions.

Option 1: Just don't share the password with the user

It sounds stupidly easy, but if you don't want somebody to login from home, don't give them their own password. You can handle this in a couple of different ways. Either set up the Office 365 account on their work PC and save the credentials to it without telling them the password, or go ahead and give them their own account but have another account that is only used for access to important or sensitive information, and then keep that one under lock and key.

Plus side:

  • 100% effective once stored on the local PC.
  • Cheapest option available.
  • Can work even with Cloud Only users. No AD domain controller required.

Down side:

  • Creates a feeling of oppression and lack of ownership.
  • Ties access to a single person; people can't get access when people who know the password aren't there.
  • Tendency to use the same password on multiple logins is a bad idea.
  • Tendency to use the same login for multiple people is a worse idea.
  • These factors together mean that this approach may be abused in ways that are worse than the problem that its trying to prevent.

Option 2: Trust but verify

You know, I really think we spend too much time thinking about all the ways that people are going to steal from us. When you consider it, it's amazing how rarely someone actually does.

Today, our reporting tools are much better than our access controls, so it's much easier for us to build a solution that will help create accountability than it is to enforce compliance by making it impossible to violate policy. Instead of spending lots of money on IT, trying to fit a square peg in a round hole by making cloud services act like old-school computers, why not focus that same energy on making sure employees know their responsibilities to protect data.

If employees know that they are not supposed to access HIPAA sensitive documents from home - and that you can tell when they have done so and will fire them for it - chances are very good that nobody will ever cross that line. The hard part is making sure there is a system in place that makes you aware if there is a problem, and that your employees know they're accountable too.

Plus side:

  • Simply modifying employee policy to allow remote access can be cheaper than any technical solution.
  • Having HR policies in place should probably be done anyway to make sure users understand their responsibilities.
  • While not the cheapest option, no or very little IT cost required compared to other options.
  • Provides maximum flexibility in unusual or unplanned situations.

Down side:

  • There are a few options for decent reporting, but not as many as we'd like.
  • Taking the time to audit usage can be just as taxing as blocking it.
  • By itself, this does nothing to prevent an account from being used improperly.

Option 3: Use ADFS

If you absolutely need to make sure that nobody can login to Office 365 from home, there's one absolutely foolproof way to go about it and that's to federate with an ADFS server located in your office. Then, all you need to do is not expose the ADFS server to the internet and your users will never be able to get to anything in Office 365 - period.

This is actually a "broken" version of a typical ADFS configuration, since usually most folks want to be able to allow access from home. We know it works, because when the power or internet goes down at the main office where ADFS is running, people working from home can't login.

Of course, if you absolutely need remote access, or some users need cloud access, you can configure a second DNS domain for them and not enable it for SSO. Without ADFS, this second domain and its users would use the regular login process for Office 365, and thus be able to get in from anywhere.

Unless you are such a small company that you can't afford to maintain a domain controller in your office, this may very well be the best solution for you. I'd be hesitant to recommend it to companies of less than 25 employees unless they have a very compelling reason, like HIPAA for example. It does take an experienced IT person to get it set up and correctly configured.

Plus side:

  • Well established solution; well documented.
  • ADFS comes free with Windows Server.
  • Absolutely effective as preventing outside access; if you don't want users outside your network, simply don't expose ADFS to the internet.
  • Flexible enough to work in a variety of scenarios.

Down side:

  • ADFS has a high technical debt.
  • Requires a Windows AD domain controller; many small companies would rather eliminate on-premises servers.
  • Adds to technical complexity, especially if you also have some cases where access to Office 365 from outside the network is allowed.
  • Doesn't readily distinguish between access to e-mail and documents, so you may need multiple accounts if you want to access some systems remotely but not others.

Option 4: Lock account based on login times using a script

It's possible to enable and disable logins using PowerShell. It's also possible to run PowerShell as a scheduled task in Windows. Both of these can be done from a workstation computer and do not need a server or other fancy hardware. Using PowerShell, you could "open the cloud store" in the morning and close it in the evening. In this case, nobody but you would be able to sign in unless you logged into the web site and overrode the settings.

This is a sort of weird scenario, really. I don't know very many people willing to go to these lengths to keep people out of Office 365 when they aren't at work. Also, then they wouldn't be able to check email either. It might have an application against a special-access account that only gets used during the day, like the one I talk about above in Option 1.

I probably should mention that if you go with Option 3 and use ADFS, it will automatically follow login times configured in Active Directory, making this totally unnecessary. So, unless your company is very small, I'd probably recommend doing that instead.

Plus side:

  • This can be run from any Windows machine, even a workstation
  • Can work even with Cloud Only users. No AD domain controller required.
  • Easy to automate based on a schedule.

Down side:

  • Prone to problems if the script fails to fully "open or close the store".
  • Not a good fit for people who need around the clock access, but only from certain locations - or other scenarios that are not strictly time based.
  • Will take extra time and effort to manage and support.
  • Doesn't distinguish at all between access to e-mail and documents.

Option 5: Tie Office 365 Multi-Factor Authentication to a device that's only available in the office.

This is a lot like not sharing the password for an account, except that really what you'd be doing is withholding the second layer of authentication. Since the second factor authentication may not come up all the time, this would be more transparent and thus less destructive to employee autonomy than not giving them their own password.

Here's how it works: create an account in Office 365 and configure a password to use while you set it up. Then, configure multi-factor authentication and enroll the user against a device that's only in the office, like a desk phone or their supervisor's cell phone. Once they are enrolled, reset their password to a temporary one and share that with the user so they can pick one of their own. Now, you've effectively prevented them from logging in at home, since it will be an unfamiliar device and network, which would trigger the MFA.

Before you count on this method, you might want to test it for yourself. There are different flavors of MFA in Office 365, and some of them only come with E3 / E5 / EMS plans. The enforcement options, triggers, behavior, and configurability may all be different if you're using the vanilla MFA that comes with a Business Premium plan, for example.

Plus side:

  • Allows people to know their own password.
  • Adapts well to contingencies such as having to arrive early / work late.
  • MFA settings can be configured per user and overridden as needed.

Down side:

  • Requires a cell phone or voice phone to be present in the office; Most people have a voice line though.
  • You can't let users self-enroll in this scenario.
  • Takes about 1 to 2 minutes longer to login to the system each time.
  • May require multiple accounts/licenses per user if some information needs to be controlled but other information does not. For example, if you need MFA for access to HIPAA sensitive documents, but not to e-mail.

Option 6: Customize SharePoint to Increase Security

Most folks who want to protect documents from their own employees are not actually interested in preventing them from accessing emails. But, most security solutions for Office 365 are applied against all the Office 365 services. If the documents you need to protect are in SharePoint, there may be better ways to go about this that wouldn’t impact other aspects of your service.

Of course, the ultimate solution would be to deploy CipherPoint Eclipse. You can think of that as the very best form of SharePoint customization there is, because it will let you encrypt documents and then use a variety of different policies to determine whether they can be decrypted. It's an expensive option, comparatively, but also a good one that offers true security (rather than security through obscurity). And now that I'm done plugging for our partner, I'll tell you about a slightly cheaper one.

Microsoft won't actually let us run server side code in SharePoint Online as they once did. So, our options are limited from being able to control the users access and experience on the site. Even so, it's not too difficult to do some rudimentary access control using JavaScript in the browser. For example, you can hide the page contents and display apocalyptic warnings instead. In some cases, you can also end a user's login session.

However, it is important to understand that code that works this way can be circumvented by those with a moderate amount of computer savvy. If you're going to rely on sleight of hand tricks to protect your information, you'd better also back it up with a clear employee policy, firm contractual agreement, audit logs, and regular reviews for bad behavior.

Plus side:

  • Significantly easier (and cheaper) than implementing security at the login prompt
  • Relatively easy to track both IP address and login time when using SharePoint.
  • Transparent to non-SharePoint Office 365 services, so if you're just trying to protect HIPAA documents, but still allow email access, this may be the way to go.

Down side:

  • To be fully effective, use of OneDrive sync and the SharePoint API will need to be blocked in sites that have sensitive documents, and this can limit how you customize SharePoint.
  • Requires documents to be stored in SharePoint. Other Office 365 services can't be protected this way.
  • Can be defeated by a determined intruder; many would say this does not offer true security but is more "security theatre".

Option 7: Encrypt It!

Most people don't need to protect literally everything they store in Office 365. Further, not everyone needs to protect what they store in SharePoint lists too, or implement complex policies to determine which employees should have access to what documents. Thus, solutions like CipherPoint that I mention above would probably be a bit heavy handed for most small businesses. (If you fit the above description, we'd still love to hear from you, because there's a lot more we can do in these cases.)

If your need to protect sensitive information is moderate and limited to a particular site, document library, or classification of content, then Microsoft's solution that comes with the E3 plan is probably good enough for you. I'm talking about Azure Rights Management, and while it won't keep an employee from viewing a document on their home computer, it can keep them from downloading it to their phone, printing it, or copying its contents to an email. Also, should the unfortunate need arise to fire their ass, it can also let you take access to that information away after the fact - no matter how many times or places they've copied that file.

While I wasn’t a huge fan or early versions of ARM, it has matured a lot. It's easier to set up now than it used it be, which is good if you don't have a huge budget for IT. Since it can be purchased a la carte, you can let Business Premium users access ARM protected documents when necessary, without having to upgrade them to the E3. (Unless you want to. I'm totally cool with upgrading if you want to. Have you met the E5?)

Plus Side:

  • Encrypted documents are useless, even if copied off the network
  • Even your IT admin (or Office 365 support partner, like us) can't read the encrypted document.
  • Easily restrict who can read or edit a document - as well as some other things they can do with it (e.g. print, copy/paste)
  • Access can be revoked after-the fact.
  • A good solution if you only have a sub-set of documents you need to protect.

Down Side:

  • While you can control a lot of access, that does not necessarily include when or where users are allowed to read or edit a document.
  • Doesn't protect SharePoint data stored in lists or web pages, OneNote Notebooks etc.
  • Azure Rights Management is only included in E3 plan and above.
  • Third party solutions such as CipherPoint can be costly.

Azure AD Premium

Before I go on, here's a few notes about Options 8, 9, and 10 below regarding leveraging Enterprise Mobility + Security, Azure AD Premium, and Azure Advanced Security. These were things I think apply in general to the entire suite that go beyond the specific applications I mention in my list.

  • There will be additional monthly costs for service, and you may need on-premises hardware too.
  • Some solutions are simple while others can be quite technically complex.
  • While there may be features we're not aware of yet, there really doesn't seem to be the kind of access control our customers have been looking for, particularly for end-users. (See Identity Protection and Privileged Account Management below.)
  • Many scenarios, especially AD Premium, don't have a large user base yet outside a few big orgs and aren't well proven especially for in smaller companies.

Option 8: Registered Devices and Workplace Join

This is Microsoft's solution for adding PCs and mobile devices into Azure AD. And it's not a bad fit if you're interested in Windows as a Service, Intune, and the like. Joining devices to Azure AD basically makes it possible to login to your "domain" even when you're out of the office. It can also, conversely be used to require users to login only from approved hardware.

Plus side:

  • Prevents users from working on unapproved hardware, such as personal computers.
  • Controls access by physical device; if you want to control access by location, don't let the physical device leave the desired location (e.g. use desktop computers not tablets)

Down sides:

  • This is a fairly complex deployment, possibly requiring help from experienced experts, and may not be suitable for small businesses.
  • Requires modern PCs (the Windows 8.1/10 scenario is better than Windows 7/8)
  • Requires a modern (2012 R2) Windows Active Directory domain controller
  • Requires configuration of ADFS server, which need to be accessible form the internet
  • Requires a license to Azure AD Premium
  • Relies on AD Connect / Sync so it can take quite a while for hardware info to be fully synchronized.
  • This solution can't really distinguish between user access to e-mail and user access to documents, so if you need mobile access to mail but not sensitive documents, this isn't your best option.

Option 9: Azure AD Premium w/ Identity Protection

I actually like this option a lot, because of its simplicity. It's not easy to take something as complex as access security and make it as easy to set up and manage as Identity Protection is - especially if you're Microsoft who seems to thrive on complexity and options. It's a really good system, and they've done a good job of providing a solution to help users deal with the identity theft threats that are becoming increasing common nowadays.

But - and I'll cook my hat and eat it if I ever say these words again - Microsoft may have gone a bit too far into easy-to-configure territory, because there are a lot of options missing from Identity Protection that I would've thought would be obvious.

For example, where's my option to say "my employees only work in the United States, and for that matter they're only in Maryland for the most part." Or, how about, "We really don't work later than 8pm EST, so could any midnight logins please be labelled 'high risk'?" Why not let the admin get a notification in addition to blocking access or triggering MFA? All these things were missing, and I was really surprised by that.

Otherwise, it's pretty good and you should totally buy it. Maybe they'll improve it later. If not, please see Option 11.

Learn More about Identity Protection from Microsoft's Blog

Side note: We had a case recently where a client has an employee who was being targeted by a cybercriminal who had taken their credit card data and was trying very hard to target their email account in Office 365 too. Fortunately, Microsoft was diligent in locking the account after many successive failed attempts. However, it is important to understand that information which may have helped to lead to an arrest in this case was not being captured until we activated Azure AD Premium and Identity Protection for the customer. If you're locked out of your Office 365 account and you have good reason to think it was because of a hacking attempt, I strongly suggest that you do not wait, but go ahead and start the free trial for AD Premium and turn on all Identity Protection's logging features. From there, if you simply want to protect yourself, you can set up MFA - or consider setting up a honey pot if you want to try and catch the would-be thief.

Plus side:

  • No local server required.
  • Can work even with Cloud Only users. No AD domain controller required.
  • Microsoft Add-on for Windows Azure AD Tenants
  • Remediate risk by requiring multi-factor authentication, force password updates, and/or blocking access entirely
  • Uses threat analytics which includes data from other Azure users, not just your own company
  • Protects from: sign in from infected devices, new/unfamiliar locations, impossible travel distances, anonymous IP addresses
  • Tracks leaked credentials
  • Doesn't seem to add much burden in the way of administrative overhead or management
  • Most of the MFA enrollment is intuitive (at least for an IT person) and can be self-service.

Down side:

  • We thought that MFA enrollment left too many steps and choices to the end users and should be something admins could lock down or simplify.
  • Conditional access risks are managed by Microsoft and divided into low/medium/high; there does not seem to be a way to define things such as normal working hours or normal location.
  • Has a tendency to throw false alarms in some networks; for example whenever we visit the Microsoft office in Washington DC, it tells us we're trying to login from Redmond, WA.
  • Although you can resolve an event or mark it as a false alarm, there didn't appear to be anyplace for an admin to leave notes explaining why the login occurred, like the situation we describe above.
  • Despite some marketing materials that seemed to indicate this would be available in EMS E3 plan, it still required applicable users to have Azure Active Directory Premium Plan 2, which is part of the EMS E5 plan.
  • None of these Azure security and logging features are enabled until you activate this service.
  • We had to actually sign up for Azure AD Premium trial offer in order to get the system to recognize our existing AD Premium licenses from Office 365.

Option 10: Azure AD Premium w/ Privileged Identity Management

Okay, I'm going to sum this up nicely. If you're a Microsoft Partner, like us, supporting Office 365 customers, or if you have more than 2 Global Administrators on your Office 365 account - for whatever reason - this solution is for you. Everybody else will probably find this to be either too expensive or much too cumbersome to justify. It really only protects your admin accounts, so in most cases you'd probably do just as well to just configure MFA on them and be done with it.

Learn More about Privileged Identity Management from Microsoft's Web Site

Plus side:

  • No local server required.
  • Can work even with Cloud Only users. No AD domain controller required.
  • Microsoft Add-on for Windows Azure AD Tenants
  • Allows Just-in-Time Access to high level (e.g. global admin) accounts
  • Monitor how privileged access is being used
  • Notify other system admins in real-time when privileged accounts are used
  • Uses threat analytics which includes data from other Azure users, not just your own company.
  • Seems to have some really cool reporting capabilities, but they take time to populate.
  • Really the only way that I am aware you can give someone global admin access to Azure or Office 365 and still keep an eye on and require them to justify their use.

Down side:

  • Adds extra login steps and technical debt for admins.
  • There is significant complexity involved for those who will need to manage and support PIM.
  • Doesn't seem to provide an option for who should receive alerts about usage.
  • Does not provide JIT access or monitoring for regular user accounts.
  • The ticket number formats are a bit restrictive.
  • Required applicable users to have Azure Active Directory Premium Plan 2, which is part of the EMS E5 plan.
  • We had to actually sign up for Azure AD Premium trial offer in order to get the system to recognize our existing AD Premium licenses from Office 365

Option 11: Beowulf Identity Server

I’ve talked plenty elsewhere about how awesome Beowulf is, how it shuts the front door on SharePoint, and how it protects your public facing web sites and applications from unwanted access. You don't need to hear even more of that from me here, so I'll stick to what we haven't said before. (Aw, c'mon. You didn't think I was going to spend all this time and energy writing a two part blog about security without promoting my own product, did you?)

We’re working on a version of Beowulf that works with SharePoint Online and the rest of Office 365, which shouldn't be terribly difficult since we already fully integrate with ADFS which is what Microsoft is using for access control in the cloud.

Since others seems to have dropped the ball on some of the options and features we've talked about here, we're doing our best to include them in the new version targeted for release in early 2017. Well, that's the big problem isn't it. Unless you want to be part of our early adopter program - and get a big discount for helping us test these new features - you're out of luck.

Lean More about Beowulf Identity Server on Liquid Mercury Solutions' Web Site

Plus side:

  • Low cost cloud based solution
  • Transparent access layer between users and Office 365
  • Can work even with Cloud Only users. No AD domain controller is required.
  • Can block access or alert you (but not block access) when a user logs in from unexpected locations or at unusual times.
  • Configurable in a lot of ways that Microsoft's solution is not.
  • Has many of the same MFA capabilities as Azure AD Premium.
  • Integrates well with Azure AD, ADFS, and other MS solutions.

Down side:

  • There is an additional cost outside of the Office 365 subscription
  • Like many advanced security products, set up is relatively complex.
  • Though many of these features are available today, our full feature set for the next release will not be available until early 2017.

Option 12: Application Layer Security Enabled Next Gen Web Proxy/Firewall

You all knew I'd bring it up eventually. Why don't you just go out and buy an F-5 Big IP with the Access Policy Manager module on it? Then you can come back to us and hire us to configure it for you, and we can totally freak out because people hardly ever want to do that. Even so, this is a nice way to go if you have a lot of money lying around, and burning it would be inconvenient.

For large enterprises with hybrid cloud/on-premises deployments, I do recommend products from vendors like F-5, Kemp, or Cisco. This goes triply so if you run a large corporation with name recognition, store a lot of confidential customer data that hackers may want to steal, or your everyday business is something that might lead people wearing Guy Fawkes masks to try to ruin your holiday weekend. They offer security features that Microsoft doesn't even come close to having in Azure yet, but you can absolutely deploy them as Azure VMs in your environment or on-premises as real metal or VM.

But then, if you're going to go that far, why not also make sure you do all the other things I talked about too?

Plus side:

  • Really, really, configurable and powerful; can probably do anything you'd want in terms of limiting and responding to access requests and use.
  • Deployable in traditional on-premises and cloud-based scenarios.

Down side:

  • Really, really, complex to configure and expensive to implement.
  • Even cloud based subscription versions are going to cost a pretty penny.
  • It will require dedicated staff and constant upkeep, so probably only suited to large enterprises.

As you can see, Microsoft offers many choices - but none of them is the perfect solution for everyone. Better solutions I think will emerge in the coming months. I hope I've done a little here to shed some light on what is sadly a very complex answer to what seems like it should be a simple question. The most important thing to consider I think is that there are some low-cost things that you can do if you want to control how people use cloud services, starting with making sure that your employees know the rules.

Technology is always changing, and it often forces us to consider scenarios that previously were just impossible. If you're considering Office 365 as a solution, you may have concerns about people having access from home (or anywhere in the world really).

Office 365 provides a lot of security advantages compared to storing sensitive data on your laptop computer, a portable hard drive, or that server in the closet. Keep in mind that this is just one potential risk in a sea of others that we've all faced for a long time; the benefits should outweigh the risks if you approach the transition to cloud services with a little bit of thought and planning. We're here to make sure you don't have to go it alone.

Did I leave something out of my list that you'd like to add? Leave a message in the comments and I’ll reply.

Thomas is an acknowledged expert on information security, the creator of Beowulf Identity Server, and spoke on the SharePoint Security panel November 8th at the First Annual FITSI.org Federal IT Security Conference. You can follow him on Twitter and LinkedIn - but if you really want to connect, your best bet is probably to call us at 410-633-5959.

Office 365 Security and You - Ransomware

Minecraft creeper: 'That's a very nice file share you've got there - be a shame if something happened to it'

Since I'll be on a SharePoint security panel speaking at next week's Federal IT Security Conference, I wanted to do a couple blog posts this week about cloud security.

I'm going to leave discussion of Windows zero-days, Strontium / Fancy Bear / Apartment 2B etc. for another time. There's already plenty of FUD going around about that topic. If you're not sure whether you're protected, you can update to Windows 10 Anniversary Edition and you'll be covered. The easiest way I know to do that is to buy a Win 10 Enterprise E3 subscription from us for $6.50 a month; throw in Enterprise Mobility Suite and Symantec Endpoint Protection Cloud and you'd still be spending only $19 a month. That's about all there is to that, so let's move on.

Instead I want take some time this week to talk about recent (albeit non-federal) security challenges that we see our Office 365, and particularly SharePoint Online, customers facing. Specifically, two questions I'm being asked a lot lately are "Can Office 365 protect me from ransomware?" and "Can we control when and where people can connect to Office 365?".

Today, I'll be talking about ransomware. When I come back for Part 2 we'll talk about controlling access to Office 365. Part 3 will talk specifically about securing SharePoint in the cloud.

Part 1: All About Ransomware and Office 365

Q: "I've heard of this new thing called 'ransomware'. What is it?"

Firstly, for those of you who don't know, I'll explain what ransomware is all about, and then I'll tell you what you can do about it.

Maybe I should've done this post for Halloween, because ransomware is scary stuff. Ransomware is like other virus or malware, but with a twist. It does something much more insidious than just infecting your computer, turning it into a zombie, or deleting random files.

Ransomware uses our own security defenses against us, by applying encryption on us against our will and then attempting to extort money from us to undo the damage.

So how does that work? Well, what if somebody put a lock on your door and then demanded $100 from you to remove the lock so you can get inside your home? It's sort of the same thing. Once the ransomware infects your system, it will open whatever documents that it can get access to, scramble the contents with a secret key only known to it, and save them. It then sends the key to organized cyber-criminals, and alerts you to contact them and make payment arrangements to unlock your files.

Q: "Am I in danger from ransomware?"

Yes. Yes you are.

Be afraid. Be very afraid.

But seriously, Dusty, Seth, and I saw our first case of a client affected by ransomware back in 2014 - and it wasn't pretty. This was in the spring, around the time Microsoft ended support for Windows XP. We had a client who - despite our advice - was dragging their feet about buying new Windows 7 PCs because of the cost involved. As a result, ransomware got into one PC, spread to their other workstations and servers, and then proceeded to extort and threaten their employees. That's when we got the call for help.

For the three of us, it was two hellish days working double shifts to purge the virus (from slow outdated machines), restore backup files, and clean up the mess that totaled over 100 hours and ten thousand dollars in labor charges - services for which we were never fully paid. I would never wish this fate on any client, and I hope to never receive such an emergency call again in my lifetime.

Fast forward to two years later, we're seeing an increasing number of customers telling us that they have contracted ransomware. Everybody's reaction is a bit different. Some folks are willing and able to simply walk away from their lost files, while other businesses faced a real and existential threat to their continued operations.

Any way you look at it, ransomware is a very similar problem as having your hard drive crash.

But hard drives are pretty reliable; they tend to fail from heavy use, if they are dropped, or when they get very old.

Unlike hardware failure, ransomware *wants* to be a problem for you, and there are organized teams of cyber-criminals all over the world who are actively working every day to try and find new ways to infect you with it.

If you are not working to stay ahead of this threat, it will eventually get the better of you.

Q: "What kind of information is at risk from ransomware?"

Ransomware is smart enough to go after files that you use, like Word, Excel, or PDFs while leaving program files like EXEs and DLLs alone. It can also distinguish between files you access often and files that you haven't opened in years and aren't likely to ever notice.

Ransomware can detect attached portable USB drives and find network shared folders that you have access to, so if you're infected then any folder you have access to is at risk even if it isn't necessarily on your computer. I have personally witnessed ransomware that attacked a network file server at one company and scrambled their case files for literally hundreds of customers.

Q: "Should I pay the ransom?"

Generally speaking, I want to say that you should never negotiate with terrorists - or criminals. That's a nice sentiment, and it sounds good in the movies. But in reality I think maybe that's a bit naïve.

Your best bet of course is to have a backup strategy in place and simply recover a working copy of your files from the backup. Only do this after you have thoroughly scanned, found, and cleaned the ransomware from all of your computers. Otherwise, you're putting your backup copies at risk by accessing them, which may let the ransomware know where they are too.

If you don't have a backup of your files, then paying the ransom might be your only option.

In such a case, definitely do not give a criminal your credit card info when they ask you for it. That'd be dumb. Certainly if they run your card for the ransom, you can expect the info will also circulate into databases of cards that should be used for fraud later. If you must pay the ransom, purchase a pre-paid Visa gift card to do it. Some credit card companies will provide a temporary card number you can use for a one-time online purchase. If you have that option, it’s a good idea.

Q: "I already own a firewall. Doesn't that mean I'm protected?"

Having a firewall alone is not enough unless you also have anti-virus software on all your PCs and devices. More commonly these days it is called "endpoint protection", because the threat landscape has grown to include not only viruses but also malware, ransomware, zombies, and more.

Think of it this way. Your firewall is like building a wall around a city. It doesn't make sense to have a wall to protect yourself if you don't also have soldiers inside the wall who can react to intruders. In this case, the story of the Trojan Horse is very appropriate; you must have a layer of defense inside your walled city to protect yourself in case a threat does get a foothold inside the gates.

Having anti-virus software installed is like posting guards at important bases like your armory, grain store, or government center - or having a soldier boarding in each person's house. Anyone who has ever looked at how much CPU is used by their anti-virus software understands that it may be necessary, but it's also another mouth to feed.

We also need to account for the way that mobility has affected computer security. Today, we have laptops, tablets, and smart phones that come and go freely from within our fire-walled city and out into the wide, wide world. To extend our city metaphor, it is now a bustling metropolis with merchants and travelers coming and going at all times; and the freedom to travel has become a key aspect to life that we all benefit from. We connect to Wi-Fi networks at our friends' homes or the local coffee shop, as well as cellular data networks. Then we return to our own network, usually without much fuss. Unfortunately, we also potentially bring whatever plague we've exposed ourselves to from outside back with us when we return.

Protecting the desktop doesn't need to be an expensive proposition either. It costs only $4/month per user to purchase Symantec Endpoint Protection cloud, and Microsoft's advanced security tools that are part of Enterprise Mobility Suite and/or the Office 365 E5 plan each add only $8.70 and $15 (compared to E3 plan) respectively. This is something we can help you purchase and deploy, so please do reach out to us if you want to get this set up for your organization.

Modern IT security now also includes the concept of active network defense, which takes the fight from the PCs to the network itself. These are next generation Ethernet or Wi-Fi switches than can detect and block communications known to come from viruses, malware, etc. This is a lot like making the roads in your city unfriendly to invaders by having police guards on patrol. These new technologies haven't really filtered down to the consumer and small business market yet, but I expect that will happen fairly soon.

I hope that I've been able to explain why having a network firewall alone isn't enough to protect you from security threats out there today. While endpoint protection does add a cost and can sometimes limit PC performance, it's still very much a necessary evil. Meanwhile, new products are being developed that can do even more, so it may be time soon to start looking at replacing your old equipment.

Q: "Can ransomware affect files in Office 365?"

I get this question a lot, both from existing customers and from those considering Office 365 as a possible solution for protecting themselves from ransomware.

The answer is complicated, because really "it depends". I'm sorry if that sounds like consulting-speak, so let me explain what I mean.

Firstly, let me start by saying that we haven't observed yet any instance of ransomware in the wild that directly targets Office 365. But this alone doesn't mean these files are completely safe.

Let's say for example that you are using OneDrive for Business. You have a copy of your files in Office 365 and synced copy is also on your local C: drive. If the ransomware encrypts the file on your local drive, OneDrive for Business would simply see this change as being similar to if you had opened the file yourself in Word and then saved some changes. It would then sync the [bad] changes to the cloud and overwrite the file there.

Furthermore, if ransomware infects the Microsoft Office desktop software like Outlook, Word, or Excel, then it could theoretically corrupt the process by which files are saved, regardless of where you're saving them. In fact, Microsoft Office has its own layer of file encryption called Azure Rights Management. It's not difficult to imagine a possible exploit that might somehow subvert that mechanism - or replace it with one where you don't have the keys.

So in both cases, I would say that while we don't know of any ransomware - yet - that can log in to your Office 365 account and use that access to reach your emails or documents stored in SharePoint, it is still technically possible that your files stored in the cloud are not completely out of reach.

Q: "I was thinking of buying Office 365 and moving my files to the cloud to protect them. Does what you say mean that it won't work and I shouldn't do that?"

Not at all. Moving your files to Office 365 is a good first step, and it has lots of other benefits besides security.

For starters you'd be taking advantage of Microsoft's advanced Data Protection strategy. Microsoft also has a 15 day backup window on some types of data. As a first line of defense, these are going to be a lot more secure and reliable than saving files on a USB drive in your office - even if you just look at it from a hardware perspective.

To really cover yourself, you should always have a backup strategy in place.

If your needs are minimal and the cost is a big concern, that might just involve occasionally copying important emails or files to a local drive and then unplugging it from the network at sticking it in a drawer or safety deposit box. Of course, doing things this way takes time and work. There are better options.

Third-party backup solutions for Office 365 have been around for a while. These aren't expensive - most will back up both email and SharePoint/OneDrive for Business files for just $5/month/user. Compared to other cloud backup platforms, these can be cost effective alternatives. They also add the benefit that your data isn't entirely with Microsoft, so you can feel more secure knowing that you are not keeping all your eggs in one basket.

So, if you are looking for a way to escape the threat of ransomware, Office 365 may still be a good option for you - as long as you're prepared to purchase a bit more than just the basic Office 365 plan itself.

About the Author

Thomas is an acknowledged expert on information security, the creator of Beowulf Identity Server, and will be speaking on a panel about SharePoint Security November 8th at FITSI.org's First Annual Federal IT Security Conference. You can follow him on Twitter and LinkedIn - but if you really want to connect, you're best bet is probably to call us at 410-633-5959.