Share via

Email Phishing Protection Guide - Part 8: Deploy ATP Safe Links Policies

  • Article

The Email Phishing Protection Guide is a multi-part blog series written to walk you through the setup of many security focused features you may already own in Microsoft Windows, Microsoft Office 365, and Microsoft Azure. By implementing some or all of these items, an organization will increase their security posture against phishing email attacks designed to steal user identities. This guide is written for system administrators with skills ranging from beginner to expert.

Email Phishing Protection Guide Index: Introduction: Email Phishing Protection Guide - Enhancing Your Organization's Security Posture Part 1: Customize the Office 365 Logon Portal Part 2: Training Users with the Office 365 Attack Simulator Part 3: Deploy Multi Factor Authentication (MFA) Part 4: Deploy Windows Hello Part 5: Define Country and Region Logon Restrictions for Office 365 and Azure Services Part 6: Deploy Outlook Plug-in to Report Suspicious Emails Part 7: Deploy ATP Anti-Phishing Policies Part 8: Deploy ATP Safe Link Policies Part 9: Deploy ATP Safe Attachment Policies Part 10: Deploy and Enforce Smart Screen for Microsoft Edge, Microsoft Internet Explorer and Google Chrome Part 11: Monitor Phishing and SPAM Attacks in Office 365 Part 12: Discover Who is Attacking Your Office 365 User Identities Part 13: Update Your User Identity Password Strategy Part 14: Prevent Brute Force and Spray Attacks in Office 365 Part 15: Implement the Microsoft Azure AD Password Protection Service (for On-Premises too!) Part 16: Disable Office 365 Legacy Email Authentication Protocols Part 17: Control Application Consent Registrations in Microsoft Office 365 and Microsoft Azure Part 18: Increase Security with Microsoft Secure Score Part 19: Email Phishing Protection Security Checklist Part 20: Recommended Security and Anti-Phishing Training from Microsoft Ignite 2018

 

Part 8: Deploy ATP Safe Link Policies

We are on a journey in this series of blogs to increase the security posture of your organization against phishing emails. We are setting up a variety of locks that an attacker will need to pick for a successful email phishing attack. Organizations need to make it as difficult as possible for an attacker to be successful. So let's consider that a well-crafted phishing email has managed to pick through a few locks and made it to a user's email Inbox. Given the potential that the user may now click on the phishing link (or an attachment), we want to setup another lock to help prevent any type of malicious activity as a result. ATP Anti-Phishing Policies, ATP Safe Links and ATP Safe Attachments (security features within Office 365 ATP) can help protect environments from when a user may unknowingly click on a malicious link.

Hyper-links included in any inbound message to Office 365 email users are rewritten when Safe Links is enabled and policies are defined. This feature also extends to email sent from one Office 365 user to another either within the same tenant or to another tenant. In early 2018, the URL protection was also extended to Office 365 documents that are stored in Word Online, Excel Online, PowerPoint Online, and OneNote Online (as well as Office 365 ProPlus on Mac) - providing a much greater layer of protection across an organization. As explained in this link, "ATP Safe Links can help protect your organization by providing time-of-click verification of web addresses (URLs) in email messages and Office documents." If a link is scanned and found to contain malicious content, instead of opening, the user will presented with a warning page instead (examples of warning page). Office 365 ATP Safe Links provides another layer of locks in the email and Office Online environment that every organization should consider implementing. See the section in this link called How do we get ATP Safe Links protection if not already included in your Office 365 subscription.

Office 365 ATP Safe Links Policies

Organizations that have ATP capabilities in their Office 365 subscriptions must define policies for ATP Safe Links. Also explained in the aforementioned link(see the table on example scenarios), this policy is not defined or active by default. It is up to the organization to define policies based on their internal design.

Instructions to Setup Office 365 ATP Safe Links Policies

Note: Only user accounts in your organization with the ATP license will be protected by this policy. Please see the section how to How to Get ATP Safe Links in this link for licensing information.

  1. Logon to https://protection.office.com as a global administrator in your Office 365 tenant. This opens the Security & Compliance area of the tenant.

  2. Within the Security & Compliance area, expand Threat Management and then click on Policy.

  3. Click on the ATP Safe Links tile.

  4. In the Safe Links area is a policy called Default. Let's edit it to include several monitoring features. With Default highlighted, click on the pencil icon to edit it.

  5. Within the Default policy, I recommend the following options be set to increase the security of these areas.

    Use Safe Links in:

    Office 365 ProPlus, Office for iOS and Android: Enabled

    Office Online of above applications: Enabled

    For the locations selected above:

    Do not track when users click on safe links: Disabled (Note: If it were my organization to administer, I would want to see if I have a problem with users clicking on links. This could indicate a need for additional training to recognize phishing emails.)

    Do not let users click through safe links to original URL: Enabled (Note: The goal is to prevent the unsuspecting user from clicking on a malicious link. This is where they should be blocked.)

  6. Click Save when done with the settings. With these settings in place, you now want to monitor the quarantine area of your environment.

  7. Back in the Security & Compliance area, expand Threat Management. Then, click Threat Tracker to view items in quarantine. In addition to this blog about configuring ATP Safe Links, be sure to review the other options to further secure your environment.

Conclusion: In this blog on ATP Safe Links we reviewed how this feature helps to further secure an organization and how to define a protection policy. We also reviewed how to monitor the quarantine area in Threat Tracker.