Why is Office 365 email a security risk?

When it comes to digital transformation, moving to the cloud is key. According to Forbes, 83% of enterprise workloads will be in the cloud by 2020 and two thirds of IT professionals responsible for managing the change say that security is their greatest concern.

Office 365 is integral to a seemingly ever-increasing number of enterprises. Microsoft's Office 365 commercial monthly active users reached 120 million in October 2017 (ZDNet). According to Microsoft itself, it expects 70% of customers to be using Exchange Online in Office 365 instead of Microsoft Exchange on premises within the next year (Osterman, 2018).

Microsoft offers two levels of email security to O365 customers - Exchange Online Protection (EOP) and Advanced Threat Protection (ATP). Neither offers true enterprise class - or best-of-breed security - and many organisations choose third party security solutions that are complementary and can enhance the security of the Microsoft platform - an approach advocated by analyst firm Gartner.

Top Office 365 email security concerns to be addressed:

Keeping the lights on: email continuity

A major concern for organisations adopting Exchange Online is service uptime and availability: keeping email up for your employees even when Microsoft goes down. In the event of an email outage, you need to maintain operations and user productivity. Email is, after all, a critical business application and most companies can’t afford to be without it for even short periods of time.

Email continuity provides users with an ‘Emergency Inbox’ usually via a web portal that contains access to Inbox and Sent items from the last 7-30 days. This means that if the primary email provider (or server) fails, users can still read and respond to email until service is restored. This provides a level of reassurance for companies, particularly when moving email off premises.

Keeping your archive compliant

When it comes to archiving, organisations – especially those working in regulated industries – need to ensure that they comply with legislative and regulatory requirements.

Office 365 does have email archiving, but it is not a best-in-breed product or fully compliant, and many organisations will require or desire additional features such as tamper-proof storage and functionality to quickly respond to ediscovery requests or warrants. A third-party archiving solution can provide assurance that you are supplementing Office 365 and not compromising compliance.

Stopping advanced threats

While Office 365’s email security tools provide a level of security from email-based attacks, even Advanced Threat Protection (ATP) does not include ultra-modern, multi-layered security that is common in third party email security solutions. Microsoft’s email security capabilities are powerful against traditional spam but less effective against the modern, highly-targeted email threats.

Today, more sophisticated threats need far more sophisticated tools. A common example is CEO impersonation attacks (also known as CEO Fraud or business email compromise), where an attacker uses a domain similar to the legitimate domain and sends a simple plain text email message asking an employee to settle an overdue invoice immediately or to urgently purchase a large amount of iTunes gift cards and email him/her the codes.

Multi-layered email security solutions use a combination of technologies and techniques to protect against a wide range of threats. Technologies will include more traditional pattern or recurrent pattern matching alongside algorithmic analysis. These core capabilities will be layered on top of connection level analysis and sender/server validation. Threat intelligence is used to determine if a domain is owned or registered to an individual that has a history of using domains for attacks or malware distribution.

To find out more about targeted email threats and advanced threat protection see our blog on How To Catch Phish.


The solution: Layering Office 365 with best-of-breed security

Organisations using, or who are considering Office 365, need to be aware of its limitations when it comes to security. If best-of-breed security solutions are deployed alongside it, the cloud-based software can be used productively and safely for business. However, companies should not settle for the standard tools, but instead seek out advanced solutions to ensure the safety of their data and integrity of their compliance programs.

Click here to find out more about how CensorNet can help you to ensure security protection for your business by working seamlessly with Office 365 or alongside Exchange as a hybrid deployment, or book a demo.