CISA has shared guidance for government agencies and enterprises on the use of extended cloud in Microsoft 365 tenants as part of forensic and compliance investigations.
See also: CISA adds Oracle and Mitel vulnerabilities to KEV List
As the cybersecurity service explained, these new Microsoft Purview Audit (Standard) logging capabilities support cybersecurity operations by providing access to information about critical events, such as mail sent, mail accessed, and user searches in Exchange Online and SharePoint Online .
" These capabilities also allow organizations to monitor and analyze thousands of user and administrator operations performed across dozens of Microsoft services and solutions ," CISA said Wednesday
The 60-page guidance published by CISA also includes instructions for navigating expanded logs in Microsoft 365 and ingesting them into Microsoft Sentinel and Splunk SIEM (Security Information and Event Management) systems.
Microsoft expanded free logging capabilities for all standard Purview Audit customers (with E3/G3 licenses and above) under pressure from CISA after revealing in July 2023 that a Chinese hack identified as Storm-0558 stole emails belonging to senior government officials from the State and Commerce departments in an Exchange Online breach between May and June 2023.
See also: CISA: Treasury Department breach did not affect other federal agencies
Threat actors used a Microsoft account (MSA) key stolen from a Windows crash in April 2021 to create authentication tokens, which gave them access to targeted email accounts via Outlook.com and Outlook Web Access in Exchange Online (OWA).
While the attackers mostly evaded detection, the State Department's Security Operations Center (SOC) detected the malicious activity using an "internal detection tool" with access to enhanced cloud logging.
However, these logging capabilities (specifically MailItemsAccessed events with unexpected ClientAppID and AppID) were only available to customers with Microsoft's Purview Audit (Premium) logging licenses. This led to widespread industry criticism of the company for preventing organizations from detecting Storm-0558 attacks in a timely manner
Months after the breach, State Department officials revealed that Chinese hackers stole over 60,000 emails from the department's employees' Outlook accounts after breaching Microsoft's cloud-based Exchange Online email platform.
See also: CISA: Switch to encrypted messaging apps
Cybersecurity guidelines, such as those released by CISA, are essential for protecting an organization’s digital assets and maintaining trust with stakeholders. These functions include implementing strategies to prevent, detect, and respond to threats , including malware, phishing attacks, and data breaches. Key elements include deploying firewalls, intrusion detection systems, and endpoint protection, as well as creating strong security protocols and policies. A proactive approach, regular system monitoring, and employee training are crucial to reducing vulnerabilities and ensuring a comprehensive defense against evolving cyber risks.
Source: bleepingcomputer
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
