The weakest link of Office 365 security

Abstract

Office 365 service is widely adopted in Higher Education field all around the world. It is a cloud service provided by Microsoft, including Office applications and services like Exchange Online and SharePoint Online. Although the Office 365 is audited by many external bodies, there have been continuous discussions about the information security of the service. One of the top current security risks of web applications is Security Misconfiguration. This paper introduces some techniques a rogue administrator may use in order to exploit users’ confidential information. Symptoms, detection techniques, forensics, and mitigation techniques of these are also introduced. As a conclusion, it can be argued that the weakest point of Office 365 security is organisation’s on-premise misconfiguration. This paper helps organisation’s security officers and IT administrators auditing their on-premise environment security.