Did you know that default Microsoft 365 configurations are inherently insecure?

Because Microsoft 365 often hosts critical and sensitive organization and patient data, it is often exploited by malicious attackers. Relying on default security configurations creates a large, unmitigated attack surface for healthcare companies and their patients.

Healthcare organizations must address cybersecurity beyond compliance. Echelon can help improve your security posture by securing systems and technologies that protect patient data, while complying with all mandates and regulations in a practical manner.

We secure overlooked Microsoft 365 security risks to reduce your attack surface

Healthcare records and databases are among the most coveted of targets because they contain all the details needed to steal an identity. As our healthcare systems become increasingly interconnected, our detailed personal data has moved far beyond paper files.

When healthcare systems are compromised, some of our most private and sensitive information can be exposed. With the increased connectivity of medical devices, it can also leave patients exposed to direct life-threatening attacks.

Even in mature organizations, we commonly find critical issues that open the potential for data disclosure, policy violations, and potential compromise. In many cases, these attack vectors are well-known and easy to exploit.

Security risks we commonly uncover include:

• Over-exposed or publicly available content
• Over-delegated permissions, including users having unnecessary admin rights and privileges to access data and change configuration
• Insecure default configurations​, which can allow for data exfiltration via power shell by a standard, non-administrative user
• Legacy protocol access​ that can bypass multifactor authentication, enabled by default
• Lack of inspection and visibility into risky logon events and application usage

What’s included in our MS 365 security assessment

We inspect hundreds of controls, including (but not limited to):

• Authentication mechanisms, password policies, and protocols
• Azure Active Directory security controls
• Application permissions within your MS 365 tenant
• Data management features, including Data Loss Prevention (DLP) policies
• MS Exchange (email) security controls and features
• Auditing controls and policies
• Data storage policies, such as sharing policies and permissions
• Mobile device management capabilities