It is tough enough to manage a government agency, what with budget constraints, shifting political winds, and near constant attacks by sophisticated hackers.
Government organizations are cybercrime targets because the data they contain is so tantalizing – it is confidential, often classified, containing the kind of secrets hackers and state-sponsored groups lust after. Much of this data is personally identifiable information (PII), which is held in vast quantities.
Stealing this data is one aim, but manipulating it to cause harm, and sow chaos and confusion is another motive, often done in the name of hacktivism where the hacking is in support of social or political causes.
Ransomware is another concern, with research from Bitsighttech finding that government organizations are the second largest ransomware target, and that “Ransomware attacks in this sector have more than tripled over the last 12 months,” the group discovered.
Meanwhile, publicity about attacks on governmental systems threatens national and regional security, and shatters public confidence.
Common challenges and security exposures include:
- Not knowing when data, even in large amounts, is stolen
- Blocking unauthorized access by outside devices
- Stopping the use of obsolete systems for which patches are not even available
Meanwhile, a report by Security Scorecard analyzing 552 government organizations found an array of issues, including:
- Using outdated software
- Falling behind on patching
- Lack of endpoint protection
Besides these, there is a more general problem. “The report found that government agencies tend to struggle with basic security hygiene issues, like password reuse on administrative accounts, and management of devices exposed to the public internet, from laptops and smartphones to IoT units” a Wired article explained.
These days, government agencies, departments and organizations are completely dependent on IT systems, and increasingly SaaS applications such as Microsoft Office 365, to run their operations, and store, process, secure and report on critical and confidential data.
The Insider Threat
As much as cybercriminals around the world attack government systems, insiders can be a more insidious threat. Often this is through social engineering where the employees are unwitting participants. Other times, insiders are angry and want revenge, or are even paid to steal data or wreak havoc.
Office 365 Security Questions
Office 365 shops have specific security fish to fry. Here are more ten key questions government organization should ask:
- How do I secure external users?
- How do I minimize and analyze the threat of malware?
- How do I secure my O365 environment and automate security alerts for compliance issues?
- How do I segment my single O365 tenant to better manage my environment?
- How do I enable IT staff to track all end user actions to stop or investigate inappropriate use?
- How do I enable chargeback accounting against department or agency?
- How do I enable remote users on BYOD (Bring Your Own Device)?
- How do I make user adoption self-service?
- How do I automate the provisioning AND deprovisioning of the O365 features to ensure consistency?
- How do I tell which O365 security features are working – and more importantly, which ones are not?
Learn About 26 Office 365 Security Pain Points – and How to Cure Them
Get answers to all these questions with CoreView’s four white papers showing 26 common O365 security problems. Topics include:
Data Protection and Data Breaches
Improper Administration and Non-Compliance
Find Security Holes for FREE
Get your O365 security profile FREE with our new CoreDiscovery solution. You can get your free software now at the CoreDiscovery sign up page: https://www.coreview.com/core-discovery-sign-up/.
Doug Barney was the founding editor of Redmond Magazine, Redmond Channel Partner, Redmond Developer News and Virtualization Review. Doug also served as Executive Editor of Network World, Editor in Chief of AmigaWorld, and Editor in Chief of Network Computing.