Cloud-based Office 365 has become one of the most common email platforms for small to mid-sized businesses — we see it every day.  However, while Office 365 is a great option for businesses that don't want the responsibility of managing in-house email servers, it can also create a significant security risk to the business if it is implemented without appropriate security measures.

​

Some of the attacks we have investigated during the last few months have involved external offenders accessing an employee's business email account using a web browser.  Once access is gained they implement a forwarding rule on the account which results in a copy of all email in and out of the account being sent to an external email account such as Gmail or Yahoo. 

​

The attackers then dig through emails that are already in the account as well as any new material being sent and received, all the time looking for an opportunity to gain a financial benefit.  This could include obtaining your valuable IP or other confidential data and selling it on the internet or manipulating invoicing and payments to redirect funds.

​

The cost to your business resulting from this type of compromise can include significant financial loss and the substantial wasted time and distraction from normal business while you identify the compromise and fulfil your reporting requirements under the Notifiable Data Breach Reporting legislation.  

​

All these consequences can be prevented if you take suitable security measures before implementing the Office 365 email tenancy. It is critical to have a professional review your email platform, risk profile and security requirements before your business becomes the next victim.

If you use Office 365 and haven't had someone undertake a fundamental security review, you are at risk.

​

BACK TO CASE STUDIES