Page 102 - Cyber Defense eMagazine Annual RSA Edition for 2024

Moving Beyond MFA: A Layered Security Approach

Although MFA is one of the best security measures for O365 applications, it is vulnerable to certain types
of cyberattacks. Defending your data with more advanced threat protection measures is imperative.

For an effective cybersecurity defence, you need a layered security approach, also known as defense in
depth. This approach simply means applying multiple countermeasures alongside MFA to substantially
bolster your cyber defenses. It helps prevent single points of failure and provides multiple opportunities
to deactivate a threat more efficiently.

A layered approach enables your business to prevent, detect, and respond to risks through organised
threat intelligence, risk mitigation strategies, and continuous improvement based on attack history.

Leaving your O365 data vulnerable is not a wise step. Go beyond MFA and maximise your data protection
with these additional security protocols:

Data Loss Prevention (DLP)

The DLP layer comprises people, tools, and processes that help prevent data loss, unauthorised access,
and intentional or accidental data leakage by limiting access to sensitive data. The O365 platforms
provide DLP tools that you can access to set rules for detecting, tracking, and automatically securing
sensitive data.

Consider this: In July 2023, a Chinese threat actor group exploited a validation flaw in Azure AD of the
M365 cloud to access unclassified emails in several US government agencies. Had they implemented
DLP processes, they could have restricted access to sensitive data and monitored outgoing emails for
suspicious activity.

User Behavior Analytics (UBA)

With UBA, you can gather and analyse user activities to establish benchmarks for their behaviour. For
example, you can track logins, data transfers, document accesses, and system usage. It helps you detect
suspicious behaviour such as:

• Logins at unusual times or locations
• Multiple failed login attempts
• Suspicious data access/transfers by unauthorised employees
• Unauthorised cloud storage or traffic spikes

Further, you can assess these activities against the benchmarks to detect compromised accounts, insider
threats, or other malicious activities and stop them from escalating into a full-blown attack.

102