Other countermeasures
In addition to the resources listed earlier, there are some other additional tips when it comes to minimizing the risks from phishing attacks or users accessing malicious content:
- By default, Microsoft Teams allows for an open federation, which allows any organization to send direct instant messages to another user in another organization. Recently, I encountered a case where numerous users got messages from someone else in another organization mimicking users from the IT-department.
You can read more about the attack and its countermeasures at https://msandbu.org/phishing-attacks-in-microsoft-teams-and-external-federation/.
- As SharePoint admin, you can also define synchronization policies to define what kind of file attachments users are allowed (or not allowed) to synchronize up. Blocking files with a file extension such as
.exe,.hta,.js, or.isois a good start. You can read more about how to set up this feature at https://docs.microsoft...
