Many organizations were forced to expedite their move to Office 365 to provide a better experience for their end users who are now working from home. Teams adoption has skyrocketed to 75 million daily users up from 44 million in March. In fact, on a recent Microsoft earnings call it was announced that they’ve seen two years of digital transformation take place in two months.
Transformations this fast don’t happen without mistakes. And it’s these mistakes that have the U.S. Department of Homeland Security CISA concerned enough to issue an alert with guidance on how to protect your organization. I’ve outlined below why mistakes happen in a rush and what protections need to be put in place now to help unravel the chaos when we all can stop and take a breath.
The Human Side of Digital Transformation
Digital transformation doesn’t happen without people. People in IT have been forced to make many changes much quicker than ever originally planned. Those who had already fully deployed Office 365 were at an advantage and many organizations who had not already fully adopted Office 365 have been forced to sprint to catch up to enhance productivity and remain competitive. Like a race, those who are trained runners will be able to keep up and run a marathon much better than someone who is out of shape and has never ran before.
That probability of a human making an error when making mass configuration changes is higher when they are stressed out. Many IT staff are feeling the pressure from the business to help enable them to continue operating all while working from home. Security is also on everyone’s mind as ransomware outbreaks are still occurring. With that said, many are now using Conditional Access Policies to prompt for MFA to verify the identity of the user authenticating. Instead of creating a strategy to create these authorizations using Office 365 groups, many will adopt the usage of a hybrid group originating from Active Directory.
Log management needs to start today to protect and unravel the chaos later
It is VITAL to capture the logs of all the changes being made to Office 365 during these rushed times. Microsoft default log retention time varies based on workload and license, but even with an E5 license and the compliance add-on log data may only be stored for one year. As we are now two months into COVID-19, it is URGENT to collect the data now somewhere to capture the history of all that has changed in the last 90 days.
As new processes and best practices are developed you will likely review existing data that do not meet that criteria. There are sometimes exceptions to a rule and having the audit data may provide the needed context to understand why that exception was made. Simply having the information of who made the change may help you understand WHY something was done a certain way and may even remove the fear of making a change to the existing state. As an example, Microsoft recommends disabling end-user consent to applications. Perhaps now that people have settled into working from home you run a report to review consent settings (Enterprise Reporter can do this) to ensure least privileges are defined. Having the data as to WHO consented to these applications can be extremely beneficial to understand if it was legit or not.
CISA provided guidance to send your audit data to a SIEM so you can identify anomalous data. Unfortunately, there is typically an ingestion cost for a SIEM and it is not intended to be a long term storage solution. Also, since there are so many changes happening at once, anomalous data will be harder to identify as most are working a new way that they previously did, so all activity may be anomalous activity.
Hopefully part of your digital transformation and usage of Office 365 involves Conditional Access Policies. As part of your organization’s Zero Trust strategy it makes perfect sense while working from home to have controls in place to verify the identity of your users. Documentation of how these policies were created may be unlikely and I’ve spoken to many customers who do not realize that a change to an on-premise group could affect the conditions of who has to adhere to these policies.
While many have rushed to make remote work, work, we can’t neglect the importance of maintaining security. The outcomes of doing so will only add to the issues companies are looking to solve right now. Organizations need to start down the path of unraveling and managing the rush to Office 365 during these unprecedented times.
