Thousands of organisations in Ghana run their email, files and meetings on Microsoft 365. That also makes it a favourite target. One compromised mailbox is enough to send convincing fake invoices to your customers or quietly copy your data.
The good news is that Microsoft 365 already includes most of the tools you need. They just have to be switched on and set up properly. These are the seven we check first for almost every client.
1. Turn on multi factor authentication for everyone
MFA asks for a second check, usually a tap on a phone app, as well as the password. It blocks the large majority of password attacks, and if you only do one thing on this list, make it this one.
2. Block legacy authentication
Older email protocols cannot do MFA, so attackers use them to get around it. Unless you have a specific reason to keep them, turn them off for the whole organisation.
3. Lock down your admin accounts
Keep the number of global admins small. Give admins a separate account that they do not use for everyday email, and make those accounts use the strongest sign in methods you have.
4. Switch on anti phishing and Safe Links
Microsoft Defender for Office 365 checks links and attachments, spots people pretending to be your CEO and warns users before they click. Phishing is still the most common way attackers get in, so this one matters.
5. Stop automatic forwarding to outside addresses
When attackers get into a mailbox, one of the first things they do is set up a hidden rule that forwards every email somewhere else. Blocking automatic forwarding to external addresses shuts that down.
6. Manage the devices people use
Microsoft Intune lets you insist that laptops and phones are encrypted and up to date before they can open company data. If a device is lost or stolen, you can wipe the company information from it remotely.
7. Turn on audit logs and alerts
Make sure audit logging is on, and set up alerts for things like strange sign ins or someone downloading a huge number of files. If something does go wrong, those logs are how you find out what happened.
Your staff matter just as much
Settings only go so far. Short, regular security training helps people recognise phishing emails and fake payment requests, and fake payment requests in particular are catching out more and more businesses.
A word on compliance
If you handle personal information, Ghana’s Data Protection Act, 2012 (Act 843) expects you to keep it secure. Getting your Microsoft 365 security right goes a long way towards meeting that.
If you would like a second pair of eyes on your setup, our engineers are happy to take a look. Get in touch or call us on +233 24 419 7610.