IN THIS PART âŚ
Start with an overview of how the workplace has changed since the arrival of cloud computing.
Get an understanding of the current threat landscape with the proliferation of hacking as a cottage industry. Learn how bad actors use social engineering to trick you into giving away the keys to your kingdom.
Get your feet wet with a broad understanding of the Microsoft cloud and how Office 365 fits into the mix.
Look into Office 365 and all the products stuffed into the offering, including Exchange Online for email, SharePoint Online for your portal needs, Microsoft Teams for instant and ad-hoc meetings and communication, and Office ProPlus for your desktop productivity needs.
IN THIS CHAPTER
Understanding cloud computing and its value in the current threat landscape Getting to know the cloud deployment and service models Determining the right Office 365 plan for your organization The way we work today is vastly different from the way we worked in the past. Gone are the days when we worked from 9 a.m. to 5 p.m. in one location using one desktop computer and software that didnât connect to the Internet. Today we get our work done using a desktop, a laptop, a smartphone, or a tablet while on the bus, at the doctorâs office, during a run, at a coffee shop, and even when weâre on vacation.
Welcome to the new world of work. It is the way most organizations are working, and it is the way the modern and younger workers expect to work.
As more companies embrace the opportunities presented by cloud and mobile computing, they also take on new risks. One of the most significant challenges in todayâs computing environment is ensuring security, privacy, and compliance. In fact, there is a consensus in the business world that there are only two types of organizations: those that know theyâve been hacked, and those that donât know theyâve been hacked. By the end of 2017, more than 28,800 data breaches had occurred globally with over 19 billion â again, thatâs billion â records exposed stemming from over 20,000 types of vulnerabilities.
The security issues we know today are not isolated to Fortune 500 companies. The reality is that small and medium-sized businesses (SMBs) are just as vulnerable to attacks. In fact, SMBs face more serious risks for a variety of reasons, including the scarcity of security talent in the industry; their inability to identify, assess, and mitigate security risks; the lack of familiarity with security best practices and the overall threat landscape; and confusion from the multitude of security solutions from which to choose.
One might conclude that the best defense against cyberattacks is to have a computing environment thatâs not in the cloud (rather on-premises, as technologists call it), and is protected by firewalls using the best encryption technology and running the latest anti-virus software. The problem with this approach is that all it takes to start a breach is one simple human error, such as clicking on a link or opening an attachment in an email. The reality is that as software and platforms are getting better at combatting cyberthreats, attackers are shifting their focus to the human element to hack the users through social engineering.
But what is social engineering? Consider the following real-life example:
Cloud611, a Microsoft Cloud Solutions Provider, resells Office 365 licenses to SMBs. Recently, a customer forwarded an email to Cloud611 asking why the company was warning him that his account could be deleted or closed. The exact language of the email read:
- Your account will be disconnected from sending or receiving mails from other users because you failed to resolve errors on your mail.
- Confirm your activities here.
- Regards,
- The Mail Team
Under the guise of being a solutions provider, the attacker tried to use a scareware tactic to trick the customer into clicking on the word âhere,â which is hyperlinked to a site that then downloads and installs malware on his computer. Fortunately, the customer did not completely fall for it, and the attacker failed â this time.
Social engineering comes in many forms: phishing, spear phishing, scareware, and more. These tactics all attempt to psychologically manipulate a user into divulging information or influence an individual to perform a specific action. The end game is usually to gain access to the computing environment to do harm.
The good news in this story is that the customer did not have to invest thousands of dollars to implement an end-to-end security solution nor hire an expensive security expert to protect his small business. For a mere $2 per user per month, the customer added Advanced Threat Protection (ATP) to his Office 365 Business Premium license to secure his mailboxes, files, online storage, and even his Office applications against advanced threats.
This chapter is for those of you who have a keen interest in understanding the basic principles of cloud computing with the intent of utilizing the benefits of the cloud to run your business in a way that increases employee productivity while keeping your environment secure. It covers the various services offered within Office 365, including what they cost and the latest security and privacy features built into the services. With the knowledge you gain from this chapter, you will be better prepared run a more secure, productive organization.
Understanding Cloud Computing
The âcloudâ is a metaphor for the âInternet.â In simplistic terms, cloud computing means that your applications or software, data, and computing needs are accessed, stored, and occur over the Internet âin the cloud.â
If youâve had a Facebook account, played online games, shared files with Dropbox, or shared a photo of your new haircut on Instagram, youâve been computing in the cloud. Youâre using the services of an entity to store your data, which you can then access and transfer over the Internet. Imagine what life would be like if you wanted to share photos of your lunch with all of your 500 friends and cloud computing didnât exist.
For businesses and other organizations, cloud computing is about outsourcing typical information technology (IT) department tasks to a cloud service provider who has the experience, capability, and scalability to meet business demands at a cost that makes sense.
For example, letâs look at a small business such as a boutique accounting firm that services over 200 businesses locally. Email is a critical communication platform for the firm. To be productive, the firm decided to hire an independent IT consultant to install an email server in the office. The deal was that the IT consultant would train a couple of people from the firm to do basic server administration. Beyond the basics, the consultant would be available to remotely access the server to troubleshoot or show up in person if something breaks.
Like most horror stories weâve heard from people who try to manage their own servers without a highly trained IT staff, the situation turned out to be a nightmare for this firm. The email server went down during tax season when the IT consultant wasnât immediately available. In an industry where highly sensitive data is exchanged and customer trust is paramount, you can imagine the stress the company owner experienced dealing with email that contained sensitive attachments ending up in a black hole, irate customers who didnât get a response to their time-sensitive requests, and lost opportunities beyond quantifying.
Cloud computing for members of this firm meant migrating their email to Office 365. So instead of running their own email server, fixing it, patching it, hounding their IT consultant, and dreading another doomsday, they simply paid a monthly subscription to Microsoft, which is the entity responsible for ensuring the services are always up and running. They also know that email will not be lost, because they donât rely on one piece of equipment getting dusty in a corner of their office break room. Instead, theyâre taking advantage of Microsoftâs huge and sophisticated data centers to replicate and backup data on a regular basis.
The basic premise of cloud computing is that organizations of any size can take advantage of the reduced cost of using computing, networking, and storage resources delivered via the Internet while at the same time minimizing the burden of managing those complicated resources.
Breaking down the cloud deployment models
Not all organizations are created equal. For example, a financial organization has different requirements than a nonprofit organization or a government organization. To address these varied needs, cloud service providers offer different deployment options.
Public cloud
The type of deployment model the boutique accounting firm used in the previous section is referred to as the public cloud, where the cloud computing service is owned by a provider (Microsoft) and offers the highest level of efficiency in a shared but secure environment. The firm did not own or maintain any ...