Cybersecurity insights

Five settings to check today

Most Microsoft 365 account compromises exploit basic settings that were left open. These five checks close the doors attackers use most.

1. Turn on MFA for every accountStart with administrators. It is the single most effective measure against stolen passwords.
2. Block legacy authenticationOlder protocols (POP, IMAP, SMTP with basic authentication) do not support MFA and are used as a way in.
3. Limit global administratorsFew accounts, reserved for administration and separate from day-to-day accounts.
4. Check audit loggingMake sure the audit log is enabled and kept long enough to investigate after an incident.
5. Protect your email domainSet up SPF, DKIM and DMARC to limit spoofing of your domain name.

Want an outside look? See our Microsoft 365 and Azure security service.

What to do in the first hour

The first decisions matter: they limit the damage and preserve the traces needed to understand what happened.

1. Isolate, but do not power offDisconnect affected devices from the network but leave them on: turning them off can erase traces that are useful to the investigation.
2. Cut off compromised accessReset passwords and revoke active sessions, from a clean device.
3. Preserve the evidenceDo not delete emails, files or logs. Write down the times and the actions taken.
4. Alert the right peopleManagement, your IT lead, your person in charge of the protection of personal information and, where applicable, your insurer.
5. Ask for helpA fast response reduces the extent of the damage. Contact us.

If personal information is affected, Law 25 sets out reporting obligations.

How to spot a phishing email

Phishing is still the starting point of many attacks. Five signals should make you slow down.

1. A sender that does not matchThe address does not belong to the organization the message claims to come from.
2. A pressing toneUrgency, a threat or a one-time opportunity: the message wants you to act before you think.
3. A misleading linkHover over the link before you click: the address shown does not lead where you expect.
4. An unexpected attachment or sign-in pageA document to open or a page asking for your password, for no clear reason.
5. A request for money or banking detailsAlways confirm through another channel, such as a call to a number you already know.

Five measures to reduce the risk

No single measure removes the risk. Together, these make an attack harder and recovery much faster.

1. Offline, tested backupsKeep at least one copy out of reach of the network, and regularly check that restoring actually works.
2. Patches applied quicklyStarting with internet-facing systems.
3. MFA on all remote accessVPN, remote desktop and email.
4. Least privilegeLimit administrator rights to the people who really need them.
5. A response planWho to call, what to isolate, how to restore: decide before you need it.

Where to start

Law 25 compliance starts with a few basic steps. Here is a logical order for a business that is just getting started.

1. Designate a person in chargeBy default, it is the person with the highest authority in the business. Their title and contact information must be published on your website.
2. Inventory your personal informationWhat do you hold, where is it stored and who has access to it?
3. Keep an incident registerEvery confidentiality incident must be recorded in it, even when it does not have to be reported.
4. Publish a confidentiality policyIn clear, simple language, if you collect information through technological means.
5. Secure in proportion to sensitivitySecurity measures must match the sensitivity, quantity and use of the information.

This summary is provided for information purposes and is not legal advice. See also our Law 25 summary.