• Backup Office 365 Please

    What? You still aren’t backing up your Office 365 Tenant?

     

    Office 365 has become one of the most popular cloud-based productivity platforms. According to a recent study performed by Barracuda, “Market Analysis: Closing Backup Recovery Gaps”, more than 60% of IT professionals are using it to drive business success in some fashion. Email is the most popular (78%), followed by OneDrive (60%), SharePoint (50%), Teams (36%), and OneNote (35%).

     

    Office 365 Security

     

    Microsoft has done a good job in creating “Best Practices” for Office 365 Tenant Security. On January 6, 2020, they released the “Top 10 ways to secure Office 365 and Microsoft 365 Business Plans.” Its aim is to help secure organizations achieve the goals described in the Harvard Kennedy School Cybersecurity Campaign Handbook.

     

    Microsoft recommends the following be applied to your Office 365 environment:

     

    • Setup multi-factor authentication
      • This is the easiest and most effective way to increase the security of your organization. Add a 2-step verification to all accounts. In addition to the password, there is a second component. This is usually a mobile device, which provides a code received from Office 365.
    • Train your users
      • Establish a strong culture of security awareness within the organization. This includes training users to identify phishing attacks. For example,  don’t open the attachment just because someone you know sent it to you.
    • Use separate/dedicated admin accounts
      • Admin accounts are valuable targets for hackers. Admins should have a separate account for regular, non-administrative use.
    • Raise the level of protection against malware in email
      • Blocking of attachments with file types that are commonly used for malware.
    • Protect against ransomware
      • Warn users of messages originating external to the organization. Blocking of file extensions that are commonly used for ransomware.  Warn users who receive attachments that include macros.
    • Stop auto-forwarding for email
      • Hackers who gain access to a user’s mailbox can exfiltrate mail by configuring the mailbox to automatically forward email.
    • Use Office 365 Message Encryption
      • Organizations can send and receive encrypted email messages between people inside and outside the organization.
    • Protect your email from phishing attacks
      • Configure anti-phishing protection, ATP (Advanced Threat Protection). This can help protect from malicious impersonation-based phishing attacks.
    • Protect against malicious attachments and files with ATP (Advanced Threat Protection) Safe Attachments
      • Helps determine whether an attachment is safe or malicious.
    • Protect against phishing attacks with ATP (Advanced Threat Protection) Safe Links
      • Hackers sometimes hide malicious websites in links in email or other files. Safe Links can help protect by providing time-of-click verification of web addresses (URLs) in email messages and Office documents.

     

    Where’s Backup

     

    control_your_office365dataOne glaring omission, not purposely according to Microsoft, is backup and retention of Microsoft 365 data. Microsoft does not hide the fact that they do not backup or provide long-term retention of Microsoft 365 data.

     

    Wait……. What?

    That’s right, Microsoft does not provide backup or long-term retention of Microsoft 365 data.

    Let that sink in.

    Microsoft does not provide backup or long-term retention of Microsoft 365 data.

    An estimated 40%, that’s right 40%, of Microsoft 365 organizations aren’t using any third-party backup tools to protect their mission-critical data. Mostly due to a major misconception that Microsoft is backing up their data for them.

     

    40% of Microsoft 365 Organizations
    are not using third-party backup tools to protect
    their mission critical data

     

    Microsoft uses the term, shared responsibility model:

     

    • They have physical security in their data centers.
    • They offer data storage replication and redundancy.
    • Their SLAs include guarantees of uptime and privacy controls.
    • They will protect you from natural disasters that affect their data centers, hardware or software failures on their part, power outages, operating system errors, etc.
    • You are responsible to protect your data from human error (due to malicious activity or innocuous accidents), misconfigured workflows, hackers, and viruses. Backing up your users and data is truly your responsibility.  If you are not proactive about that, any help you get from Microsoft in times of crisis is minimal at best.

     

    In other words, while Microsoft provides a resilient SaaS infrastructure to ensure availability, it does not protect data for historical restoration for long. Its SLAs don’t protect against user error, malicious intent or other data-destroying activity. In fact, deleted emails are not backed up in the traditional sense. They are kept in the Recycle Bin for a maximum of 93 days before they’re deleted forever. If a user deletes an email, and the retention period is reached, that email is gone forever. If a user deletes their whole mailbox, the admin doesn’t realize, and the retention period is reached, the whole mailbox is gone.

    On SharePoint and OneDrive, deleted information is retained for a maximum of 14 days by Microsoft. Individuals must open a support ticket to retrieve it. SharePoint and OneDrive are unable to retrieve single items or files. They must restore an entire instance. It’s unlikely that such short retention policies will meet most compliance requirements.

     

    Don’t Make a Costly Mistake

     

    Many assume that Microsoft will support their backup requirements for Office 365 data. This could be a costly mistake. If they suffer a serious incident, they could find that crucial data has been deleted permanently. There are plenty of advanced, cost-effective third-party backup and recovery solutions for Office 365. IT Managers should revisit their backup strategies to ensure there are no gaps in coverage, especially in cloud-based applications, such as Office 365.

    Need assistance navigating Microsoft products and backup solutions, contact Zunesis.

     

     

     

     

    Categories

  • Archives

  • Social

    • GET IN TOUCH

    EMAIL: info@zunesis.com

         

        

    NAVIGATION

    CORPORATE OFFICE

    Zunesis, Inc.
    4B Inverness Ct E Suite 100,
    Englewood, CO 80112
    (720) 221-5200

    Las Vegas
    6671 Las Vegas Blvd S
    Building D Suite 210, Office 260
    Las Vegas, NV 89119
    (702) 837-5300

    Copyright © 2023 Zunesis. All Rights Reserved. | Website Developed & Managed by C. CREATIVE, LLC