The National Cyber Security Centre Finland (NCSC-FI) which acts as Finland's National Communications Security Authority published today a detailed guide on how to secure Microsoft Office 365 against data breaches and credential phishing. NCSC-FI's guide is focused on mitigating Microsoft Office 365 phishing which can lead to stolen credentials and to financial losses in the event of a successful Business Email Compromise (BEC) scam fraud that would use the stolen information. To put the seriousness of BEC attacks into perspective, FBI's Internet Crime Complaint Center (IC3) received victim complaints regarding 166,349 domestic and international incidents between June 2016 and July 2019, with a total exposed dollar loss of more than $26 billion according to a PSA issued on September 10. The same day, the U.S. Department of Justice (DoJ) said in a press release that 281 individuals were arrested over a four-month period in the U.S. and around the world as part of Operation reWired, a worldwide coordinated effort to disrupt BEC schemes. The first step to secure Office 365 against phishing and security breaches is to secure identities by customizing login pages to match the organization’s look, using hard to crack passwords, securing the local Active Directory, enabling modern authentication, blocking legacy email protocols without two-factor authentication (2FA) support, enabling 2FA, using conditional access, and carefully manage administrator roles. Next in line is securing Office 365 email accounts by securing email routing by rejecting emails that aren't sent over TLS and aren't sent by parties authenticated using certificates. Also, users should be secured against junk, malware, phishing emails, and zero-day attacks with the help of Office 365 Advanced Threat Protection (Office 365 ATP) via the ATP Safe Attachments, ATP Safe Links, and ATP Antiphishing features. To learn more and get the full guide to navigate to OUR FORUM.