Why Auditing Office 365 Natively Isn’t Enough

More than three quarters of enterprises have at least one application (or a portion of their enterprise computing infrastructure) in the cloud. In fact, enterprises predict that their cloud spending will exceed $3.5 million in 2018.

These statistics, taken from the 2018 Cloud Computing Study, would certainly suggest that the previous concerns surrounding cloud cybersecurity are becoming less prevalent. However, this does not mean that organizations are adequately securing their cloud platforms. Consistently we see that data breaches are a top concern for organizations looking to deploy cloud platforms, such as Office 365.

According to Microsoft, Office 365 had over 120 million active business users as of 2017. This is because Office 365 does enable organizations to share content more easily, along with many other benefits. But these benefits are useless if Office 365 security concerns aren’t addressed.

Microsoft launched the Office 365 Security and Compliance Center specifically to help users improve their data security when using the cloud platform. The security feature offers valuable reports that can shed light on Risky Sign-ins, Risk Events and Users at Risk. It also comes bundles with a crude risk assessment tool that scores our environment’s security stance and offers helpful tips to improve.

Microsoft are continuing to improve and build on their current Office 365 security offering, but as it stands, the Security and Compliance Center is not enough to ensure data security. There are three main reasons why native O365 auditing falls short of the mark.

Inadequate Log Retention

If your organization is beholden to a compliance standard, such as HIPAA, PCI or GDPR, it’s likely that you are required to store logs for a lot longer than native auditing allows. Depending on the compliance mandate itself, you may be required to store logs for up to six years (as is the case with HIPAA compliance for healthcare organizations in the USA).

For those organizations in the EU, the GDPR doesn’t exactly specify how long you should store logs for, but it does make clear that organizations should have the ability to investigate past breaches.

So, this means that the maximum retention period fir Office 365 logs of 90 days is completely inadequate for most modern businesses. The way you can get around this is to systematically save log data at 90-day intervals, which isn’t something that IT teams particularly are interested in doing.

Not Very User Friendly

Microsoft are making leaps and strides to provide a more usable interface, it still falls short of many sophisticated Office 365 change auditing solutions. This is particularly noticeable when you come to filter and sort reports to search specific information. There is also a distinct lack of any pre-defined security and compliance reports, which can make proving compliance and maintaining data security a challenge.

Lack of Support for On-Premise Platforms

Whilst a significant number of organizations are aiming for 100% cloud-deployment over the coming years, most are still operating on a mix of cloud and on-premise based platforms.

This presents a challenge when it comes to ensuring data security across your entire IT infrastructure, as the native O365 auditing capabilities can be a nightmare to integrate with data from your on-premise platforms.

What this means is that if you want to ensure complete data access governance and user behavior analytics across your whole IT infrastructure, you’ll likely need a third-party data security solution to do this.

Overcoming These Limitations

Lepide Office 365 Auditor enables organizations to overcome many of the limitations they may find with Office 365 Security and Compliance Center. The Office 365 auditing solution enables users to automatically collect log information and retain it on a long-term basis. It also provides auditing not just for Office 365, but also for a host of other on-premise and cloud-based platforms all from a single console.

To address the usability issues of native Office 365 auditing, Lepide Data Security Platform comes packaged with hundreds of pre-defined security and compliance reports that can give you instant insight into user behavior surrounding your sensitive data, wherever it is stored.

For a demonstration of how Lepide DSP can help you improve Office 365 security, come and talk to Lepide.