One of my earlier posts talked about how enabling Multi-Factor Authentication across your organisation can dramatically reduce your risk of attack/breach or data theft by Identity Compromise however after reading some of the comments and talking to some other IT admins and CSOs, I felt this needed a Part #2.

According to Symantec, 91% of all Cyber Attacks start with a spear phishing email  

Protecting Corporate Email

Its fair to say that “most” organisations who use Microsoft Exchange Online for their corporate email services use some form of additional security or protection…. 

Exchange Online Protection

Microsoft provides Exchange Online Protection (EOP) as a standard service with Exchange which essentially is an anti-spam and antivirus service.

Every and any mail security company, Symantec, proof point, mimecast, you name it, will heavily criticise Microsoft for its “lack” of protection against modern and zero-day threats and to be honest they are quiet right too but what many people aren’t aware of (and I don’t think Microsoft shout about it loud enough) – they have some pretty good advanced services you can enable (or buy).  Any security officer will tell you that they key to security is defence in depth and there isn’t a single  “master of all” platform or vendor out there that can protect an organisation from attack, regardless of what form it comes in.

Having multiple defences (not necessarily multiple vendors) in place helps because if spam sneaks by the first line, it might be stopped by the second. 

As you’d expect there are many 3rd party products and services available that complement the standard Exchange Online Protection services available including ProofPoint, Symantec, Mimecast etc, but if your organisation uses Microsoft Exchange Online then, depending on your licensing level, you have some pretty impressive advanced security features which to be honest, you should be using especially if you don’t use any 3rd party bolt-ons. This Office 365 ATP (note, its not specifically focuses on Exchange).

Hello Office 365 ATP

Microsoft Office Advanced Threat Protection (ATP), which is part of Office 365 E5 (or an add-on) builds on the Microsoft EOP and provides two key features aimed at protecting users from phishing attacks, malicious attachments and other advanced threat vectors which typically target users but getting them to click something, fill something in or download something. Again, according to Symantec 1 in 4 people will click a link in an email without checking the message header or checking it is from who they think it is.

Of course Microsoft claim Office ATP is the best line of defence for their Office 365 customers. As you’d expect, Third-party mail hygiene services beg to differ and say that their solutions offer better protection. Either way, you’re better protected when EOP is not the only line of defence.

So what’s Office ATP Include?

Office ATP delivers two key security enhancements for Exchange (and Office 365 in general) including ATP Safe Attachments and ATP Safe Links, both features designed to prevent or stop malicious content arriving in user mailboxes and indeed across the other key Office 365 services.

ATP Safe Attachments

The concept behind ATP Safe Attachments is fairly simple and is designed with protecting users against emails that may contain malicious attachments. ATP Safe Attachments helps here by intercepting all emails before they hit the users inbox, essentially detonates the attachment to makes sure its safe. ATP Safe Attachments also stops infections caused by malware being uploaded to SharePoint Online and OneDrive for Business sites, including the SharePoint Online sites used by Microsoft Teams (which is enough for Microsoft to claim ATP support for Teams).

There are a couple of configuration options around how Safe Attachments works which are mainly designed to control how attachments get delivered to users.

The options are relatively self explanatory. For avoidance of doubt, I’d strongly recommend using Dynamic Delivery, which means all users receive their email messages (at first) without the attachments (well, they get a place-holder) while those attachments are being scanned by Microsoft to check they are safe.

Safe Attachments doesn’t generally take long to process attachments and in my experience the delay is usually less than 30 seconds (though that can feel like ages if you are waiting for the scan to complete in order to open your attachment – especially if its a sales PO!). 

ATP Safe Links

ATP Safe Links as the name implies, provides “click-time” URL Protection to blocks malicious links by analyzing them at arrival time and also each and every time the user clicks on the link to protect against spear phishing attacks that weaponize a link after an email is delivered.

While links are being checked, users are prevented from getting to these to the sites. Yes, this can delay mail recipients from being able to get to information but given the amount of bad sites that exist on the internet (and that more than 91% of phishing attacks original from email), this is a fair compromise, even if users are sometimes frustrated when they can’t immediately reach a site because of a blocked link.

A newish feature in the ATP Safe Links policy allows Office 365 administrators to “delay message delivery” until all links in an email message are scanned (see below). This seems to be “off” by default but is definitely one I think should be enabled. 

Summary

Microsoft and also many 3rd parties provide Advanced Threat Protection services across Exchange Online . At time of writing, Microsoft, however, are the only vendor that extend these services across other Office 365 services including SharePoint Online, One Drive for Business and therefore Teams.