The holiday season is coming up and the cyber-attack threat is increasing. It’s not hard to understand that the average person can fall into a phishing attack during the holidays. For example, when you receive a “Merry Christmas” email or a seasonal discount offer. Email phishing is one of the most common ways for hackers to sneak into your system. If an employee is hit by such a scam, especially if the malware is executed and spread throughout the corporate system, the entire company is at risk.
In the event of a ransomware attack, the data is encrypted and reserved as a ransom, which can result in millions of losses. However, it’s not just the lack of alertness of workers that makes businesses more vulnerable to cyberattacks during the festival. IT and security operations teams are often understaffed during Christmas and New Year, making enterprises inadequately prepared in the event of a cyberattack. In other words, the full storm of the situation at this time makes it much easier for a malicious attacker to attack and do damage.
Microsoft 365 Defender
What is Microsoft 365 Defender?
Microsoft 365 Defender is a unified pre- and post-breach enterprise defense suite that natively coordinates detection, prevention, investigation, and response across endpoints, identities, email, and applications to provide integrated protection against sophisticated attacks.
With the integrated Microsoft 365 Defender solution, security professionals can stitch together the threat signals that each of these products receive and determine the full scope and impact of the threat; how it entered the environment, what it’s affected, and how it’s currently impacting the organization. Microsoft 365 Defender takes automatic action to prevent or stop the attack and self-heal affected mailboxes, endpoints, and user identities.
What features does Microsoft 365 Defender include?
Endpoints with Defender for Endpoint – Defender for Endpoint is a unified endpoint platform for preventative protection, post-breach detection, automated investigation, and response.
Email and collaboration with Defender for Office 365 – Defender for Office 365 safeguards your organization against malicious threats posed by email messages, links (URLs) and collaboration tools.
Identities with Defender for Identity and Azure Active Directory (Azure AD) Identity Protection – Defender for Identity uses your on-premises Active Directory Domain Services (AD DS) signals to identify, detect, and investigate advanced threats, compromised identities, and malicious insider actions directed at your organization. Azure AD Identity Protection automates the detection and remediation of identity-based risks in your cloud-based Azure AD.
Applications with Microsoft Defender for Cloud Apps – Microsoft Defender for Cloud Apps is a comprehensive cross-SaaS solution bringing deep visibility, strong data controls, and enhanced threat protection to your cloud apps.
For more details, please click here.
Microsoft 365 Defender In-Depth
You can access Microsoft 365 Defender Portal at https://security.microsoft.com/.
Attack Simulation Training
Attack simulation training with Microsoft Defender for Office 365 Plan 2 or Microsoft 365 E5 allows you to perform harmless simulations of cyber-attacks within your organization. These simulations test security policies and practices, raise staff awareness, and train staff to reduce their vulnerability to attacks. This article describes how to use attack simulation training to create simulated phishing attacks.
To directly launch the attack simulation, go to https://security.microsoft.com/attacksimulator?viewid=simulations.
How to set up the attack simulation
1. On the Simulations page, Click Launch a simulation.
You can select a social engineering technique here.
You can check more details if you click on View details link in the description.
2. Assign a name to the simulation
3. Select the payload
On the Select payload page, you can select an existing payload from the list, or create a new payload.
4. Specify Target Users
5. Assign Training
You can assign a simulation training course on the Training Assignments page. It is recommended that you assign training to each simulation, as trained employees are less susceptible to similar attacks.
6. Landing Page
You can select training preferences, content, and customize a landing page for this simulation.
7. Select End User Notification
Select end user notification preferences for this simulation.
8. Launch Details
Configure when you want this simulation to launch, and if you’d like to remove the payloads from user inboxes.
9. Review Simulation
Review the simulation settings before sending the simulation phishing emails to end-users.
What happens next?
Let’s say users were phished. They will be required to complete the training course sent from Microsoft Admin. This course includes 3 minutes length of the video.
For administrators, they can monitor the status of the simulation from the overview page.
You can directly access the overview page at https://security.microsoft.com/attacksimulator?viewid=overview.
Click on the simulation you created and check the status.
For more IT tips & information, please visit these blogs
INTRODUCTION OF CYBERSECURITY FRAMEWORK
A cybersecurity framework is a framework defined by security policies and procedures for the purpose of strengthening an organization’s cybersecurity system. It is important to prepare a threat-based security management process that reflects the business environment well and to secure step-by-step response procedures.
BUSINESS CONTINUITY PLAN (BCP)
BCP (Business Continuity Plan) refers to the procedure for a business and employees to keep in touch and continue work in the event of a disaster or emergency such as a fire at the workplace. However, many companies do not have a BCP in place since they do not think it is necessary. A comprehensive BCP should be in place to develop the capacity to resume business as usual after a serious situation or occurrence of business disruption occurs.