Persistent phishing was getting through. I hardened the email stack and identity controls to cut the attack surface.
Context
The institution was a frequent phishing target, with email-based attacks regularly reaching inboxes.
Challenge
Email defenses were under-configured and identity controls were weak, leaving a wide attack surface for social engineering.
Scope
- Assess email and identity posture
- Harden Defender for Office 365
- Strengthen authentication
- Improve user-facing protections
Constraints
- A large, varied user base including students
- Limited central control over user behavior
- A need to avoid blocking legitimate mail
Approach
- 01Tuned anti-phishing, anti-spoofing, safe links and attachments
- 02Strengthened authentication and Conditional Access
- 03Closed spoofing gaps with proper mail authentication
- 04Balanced protection against false positives
Technologies
Defender for Office 365Exchange OnlineEntra ID
Defender for Office 365
Entra IDOutcome
- Less successful phishing reaching users
- Identity and email hardened against common attack paths
- Improved resilience without disrupting legitimate communication
Lessons
Email hardening is high leverage. A well-tuned stack removes a large share of opportunistic attacks for modest effort.
What made it complex
Hardening hard against phishing without blocking the legitimate mail a busy institution depends on.
Azure Landing Zones
Azure Policy
Microsoft Sentinel
KQL
Conditional Access