Safeguard Your Critical Data
Financial services SMEs and large companies are under attack from increasingly sophisticated cybersecurity threats. Microsoft 365 (M365) offers advanced tools that can significantly enhance security – but they must be configured and used correctly.
Advanced Microsoft 365 Configuration: Unlock Enhanced Security and Business Performance
Comprehensive Security With Microsoft 365
Financial services companies are having to adopt ever more complex security and compliance solutions to enhance cyber resilience.
Microsoft 365 provides a robust suite of security tools that – when correctly configured – can substantially mitigate risks and strengthen organisational resilience.
Microsoft Purview and Defender provide robust capabilities that align with the stringent regulatory requirements and challenging threat landscapes faced by the financial services industry.
The integration of Purview and Defender into solutions specific to the financial services sector – and their deployment by institutions – indicate a substantial and growing adoption within the industry.
But correct configuration is crucial. Errors or omissions can lead to major security vulnerabilities and the reduced effectiveness of these powerful tools. The consequences of misconfiguration can include:
- increased risk of data breaches – malware uploads, and corruption and exfiltration of sensitive data
- reduced threat detection – leaving the organisation vulnerable to attacks
ineffective data protection – potentially exposing confidential data - impaired communication – devices may experience limited communication with security services, reducing their ability to report and respond to threats
- false positives or missed alerts – an abundance of false alarms, or failure to trigger alerts for genuine security incidents.
Microsoft Purview: A Powerful Tool for Data Governance And Protection
Sensitivity Labels
Purview allows automatic application of sensitivity labels to files – enabling greater visibility and control over sensitive data in the cloud. This automatic application process works in two main ways:
- Client-side labelling applies labels when users are editing documents or composing emails. It’s designed for individual items (files, emails, meetings), groups and sites (Teams, Microsoft 365 groups, SharePoint sites) and schematized data assets in Microsoft Purview Data.
- Service-side labelling uses auto-labelling policies to scan content and apply labels without user intervention. It’s particularly useful for bulk labelling of existing content – and ensuring consistent labelling across large volumes of data.
Data Loss Prevention
Purview helps to identify sensitive data and stop it from being compromised – crucial for financial institutions handling confidential client information.
This powerful software provides unified protection across multiple platforms including Microsoft 365 services (such as Teams, Exchange, SharePoint and OneDrive), endpoints (Windows 10, Windows 11, macOS), non-Microsoft cloud apps, on-premises data, and Power BI (interactive data visualisation).
This comprehensive coverage ensures that sensitive financial data is protected regardless of where it’s stored or how it’s accessed.
Insider Risk Management
Purview integrates with Microsoft Defender to provide insider risk alerts, helping organisations to distinguish internal incidents from external cyberattacks.
The integration leverages the vast breadth of service and third-party indicators to swiftly identify, triage and act on potential insider risks. It correlates various signals to detect both malicious and inadvertent insider risks, such as intellectual property theft, data leakage and security violations.
By combining the strengths of Purview Insider Risk Management and Microsoft Defender, financial institutions can create a more robust defence against insider threats while maintaining a balance between user privacy and organisational risk.
The system features privacy by design. Users are pseudonymised by default. Role-based access controls and audit logs protect user-level privacy.
Microsoft Defender: Comprehensive Protection Against Cyber Threats
Advanced Threat Protection (ATP)
Microsoft Defender for Endpoint – formerly known as Microsoft Defender Advanced Threat Protection (ATP) – is a comprehensive security solution that combines endpoint protection, network security and email security to detect and prevent sophisticated cyber threats.
At its core, Defender for Endpoint utilises a proactive and multi-layered approach to security.
It starts with threat and vulnerability management, which performs real-time software inventory on endpoints to detect and prioritise security loopholes related to installed applications and missing patches.
This proactive approach helps organisations to address potential weaknesses before they can be exploited.
The solution also uses hardware isolation and application control to minimise the overall attack surface of a system. This includes monitoring application audit data and implementing attack surface reduction rules, helping to prevent common threat vectors.
Real-time Threat Intelligence
Automated response capabilities help organisations to protect themselves against advanced threats.
Real-time threat intelligence is a crucial component of modern cybersecurity strategies, particularly in the context of automated response capabilities. Microsoft Defender Threat Intelligence (MDTI) exemplifies this approach by providing direct access to real-time data and signals for threat hunting across organisational environments.
This system uses AI and machine learning capabilities to collect and analyse threat intelligence from various sources, including RiskIQ, Microsoft Threat Intelligence and Microsoft 365 Defender Security Research.
The real-time nature of this threat intelligence allows for immediate detection and analysis of potential threats. By continuously monitoring and analysing vast amounts of data, automated systems can identify patterns and anomalies that might indicate a cyber threat.
This rapid identification is vital because attackers are constantly evolving and refining their techniques.
Cloud App Security
Microsoft Defender for Cloud Apps uses a multi-faceted approach to help protect against data loss from cloud applications – vital in today’s cloud-centric environment. It begins by providing full visibility into an organisation’s cloud app landscape, enabling the discovery and risk assessment of more than 31,000 cloud apps.
This capability is crucial for identifying and managing shadow IT, which can lead to data leakage if left unchecked. Once cloud apps are identified, Defender for Cloud Apps employs advanced data protection mechanisms. It enables organisations to understand, classify and protect sensitive information at rest or in transit.
The solution uses out-of-the-box policies and automated processes to apply real-time controls to data accessed by cloud apps – ensuring that sensitive information remains secure even as it moves between different cloud services.
A key feature of Defender for Cloud Apps is its ability to monitor and control how apps interact with each other. This is particularly important in today’s interconnected cloud environments, where data often flows between multiple applications.
By controlling these interactions, the solution can prevent unauthorised data transfers and reduce the risk of data loss.
Correct Configuration for Risk Mitigation
Proper configuration of Microsoft 365 is essential for maximising security benefits. This includes:
Email Authentication – configuring DomainKeys Identified Mail (DKIM), Sender Policy Framework (SPF) and Domain-based Message Authentication, Reporting and Conformance (DMARC) for all custom email domains. This prevents email spoofing, the creation of email messages with a forged sender address.
Protection Policies – tuning Exchange Online Protection (EOP) and Defender for Office 365 protection policies in the Microsoft Defender portal. This is an essential step in enhancing an organisation’s email security posture. The process involves configuring preset security policies and customising various protection features to suit the specific needs of the organisation.
Conditional Access – implementing conditional access policies to control access to resources based on specific conditions. Access controls define the requirements that must be met for access to be granted. Common controls include requiring:
- multi-factor authentication (MFA)
- ensuring device compliance
- restricting access to specific locations or device platforms.
Conditional Access policies can be fine-tuned to address various scenarios. For example, organisations can create policies that require password changes for high-risk users, restrict access from non-compliant devices, or enforce specific security measures for privileged accounts.
It’s important to approach Conditional Access policy implementation strategically. Best practices include testing policies in report-only mode before full deployment, using a phased rollout approach, and regularly reviewing and updating policies to align with evolving security needs.
Additionally, organisations should consider creating a break-glass account that bypasses these policies for emergency access situations.
Device Management – for ‘bring your own device’ (BYOD) scenarios, configuring device enrolment restrictions, app protection policies and compliance policies.
Multi-factor Authentication (MFA) – enabling MFA as part of a robust Identity and Access Management (IAM) framework.
Encryption – using encryption capabilities to protect sensitive financial data.
Strengthening Organisational Resilience
By employing these advanced M365 tools and configurations, financial services organisations can significantly enhance their cybersecurity posture:
Threat detection and response – the integration of Purview and Defender provides a comprehensive view of the threat landscape, allowing for faster incident detection and response.
Compliance management – M365 tools help financial institutions to remain compliant with industry regulations, reducing the risk of penalties and legal issues.
Data governance – Purview’s data governance capabilities ensure that sensitive financial data is properly classified, protected and managed throughout its lifecycle.
Insider risk mitigation – the combination of Purview and Defender helps to identify and mitigate insider risks, a critical concern for financial institutions.
Secure collaboration – M365 enables secure and flexible collaboration across the enterprise while maintaining strict regulatory compliance.
Get Expert Advice on M365 Configuration and Cybersecurity
How well is your business using Microsoft? How secure is your IT system?
Find out by contacting PSTG – a highly experienced IT partner that offers financial services organisations enterprise-level expertise at an SME price point.
We are an accredited supplier to the Crown Commercial Service, an executive agency sponsored by the Cabinet Office.
PSTG is also ISO 9001, ISO 27001 and Cyber Essentials Plus certified.