Navigating Strong Personalities: Effective Leadership in Cyber Crisis Management

By: Mark Sangster, Chief of Strategy

In a cyber crisis, who makes the decisions: The senior person? The technical expert? The self-appointed hero? When it comes to effective crisis leadership, removing emotion is critical. This guide identifies six personalities that emerge during a cyber crisis and how to harness challenging styles.

You’ll learn about the following personalities:

  • The Hero
  • The Martyr
  • The Hinderer
  • The Hoarder
  • The Captain

Harness Each Personality

Everyone metabolizes stress differently. To be the most effective leader during a cyber crisis, it is important to learn how to navigate the pitfalls of the human element. Quickly identifying learning types helps team leaders and executives assign specific members to the incident response team and assign responsibilities and tasks.

Download The Ultimate Guide to Managing Strong Personalities During a Cyber Crisis to learn how to manage these personalities properly.

Battling Business Email Compromise with Cybersecurity Automation

By: Brittany Demendi, Corporate Communications Manager

According to Security Magazine, there has been a 150% year-over-year increase in Business Email Compromise (BEC) attacks, making them the most financially damaging type of attack. When this threat is getting worse every year, it’s no surprise the FBI named BEC the “$26 billion scam.”

So, what exactly is a BEC scam, and how do we protect against them?

This blog will dive into the details of these attacks, covering how an attack works to your defense against them.

What is Business Email Compromise?

BEC is a cybercriminal phenomenon with a high risk of severe consequences. These attacks are more likely to rise, both in frequency and losses to organizations, big or small, that fall victim. BEC is a common scam where cybercriminals pose as vendors or company employees attempting to commit wire transfer fraud, among other tactics.

The FBI reported nearly $2.4 billion in adjusted losses due to BEC scams, which is reported as 49x as much as ransomware losses in 2021. These scams are simple yet effective and have become more sophisticated as prevention methods are implemented. For example, cybercriminals use a common form of phishing called domain spoofing, where they fake a website or email domain to fool the target into clicking or responding.

BEC has been known as a low-risk, high-reward way to siphon money from organizations. The FBI calls out five primary types of BEC attacks to be aware of:

  • Data Theft: Cybercriminals target human resource employees to obtain personal and confidential information about individuals within the organization, specifically executives. Cybercriminals use this information as leverage or to impersonate someone for future attacks.
  • Account Compromise: Cybercriminals gain access to an employee’s email account and use it to request money from vendors. Payments are sent to bank accounts controlled by cybercriminals.
  • Attorney Impersonation: Cybercriminals often impersonate legal representatives or lawyers over the phone. Lower-level or entry-level employees are targets for these attacks due to not knowing to question the authenticity of the request.
  • CEO Fraud: Cybercriminals position themselves as an executive or CEO of a company. Posing as a CEO, cybercriminals typically target an employee within the finance or accounting department, requesting funds to be transferred to an account controlled by the cybercriminal. Or they request sensitive information.
  • False Invoice Scheme: Cybercriminals target organizations that use foreign suppliers are the main target of this tactic. The cybercriminal impersonates the supplier requesting payments or fund transfers into an account controlled by the cybercriminals.

Techniques for Business Email Compromise: Phishing

As we have touched on in a previous blog post, phishing is an early-stage and reliable tactic used by cybercriminals to gain access to networks as a part of a more powerful attack. In other words, phishing can be used as a technique or vessel for BEC.

An example of phishing as a BEC technique is as simple as receiving an email from your IT department asking you to update your password or complete a security awareness training module. You then click the links provided in the email, not noticing the extra letter in the company email domain or the unusual URL provided.

Cybercriminals commonly use techniques like the above phishing email example to lure a potential victim into performing dangerous actions that put organizational data at risk, costing an organization a significant amount of money.

Illuminating Threats

BEC scams can be highly transactional; cybercriminals do their research targeting large corporations’ email accounts and employees who use email for daily financial transactions. From global corporations to medium and small businesses, everyone is vulnerable to BEC.

There is not one type of software or solution that can combat BEC. A suggested approach is multifaceted and multilayered, including a strategic combination of implementing cybersecurity awareness training, business email compromise simulators, behavior analytics, and multi-factor authentication.

When security teams often lack the proper resources to test their security programs, they need a tool to understand their organization’s risk to the current and evolving threats. A BEC simulator tool tests prevalent attacks while identifying areas of risk. When paired with Proactive Security Awareness, employees gain awareness and are empowered with the knowledge and skills to identify suspicious activity. While BEC simulators are testing the strength of security tools, Proactive Security Awareness uses real-life de-weaponized attack campaigns holding every employee accountable for their actions without damage to the organization.

Your Defense: Automation

BEC scams require a people-centric and automated defense that can detect, prevent, and respond to a wide range of BEC scams and phishing techniques. Automation is about leveling the playing field between cybercriminals and cybersecurity experts with the goal in mind of reducing the number of threats by eliminating vulnerabilities and risk through the prevention of identification of zero-day attacks and known cyber threats.

An automated cybersecurity solution, combined with cybersecurity experts, eliminates human error, increases agility, and reduces response time and remediation costs. In addition, security and behavior analytics assist with tracking users to ensure that an employee signing into a network is legitimate.

Email is the largest infection vector for transmitting threats, requiring a reliable solution to remain resilient. Domain authentication, email security, user awareness, and content inspectors must work together to provide the utmost protection.

2022: In Case You Missed It

By: Brittany Demendi, Corporate Communications Manager

As we begin to wrap up 2022, we reflect and want to share with you some of the most prevalent cybersecurity topics covered this past year. From remote work to data breaches, one thing has been consistent: how hungry our readers are for cybersecurity information to improve their security posture. Cyberattacks will happen regardless of how big or small an organization is, and the better you become at educating yourself to strengthen your strategy, the better off you’ll be in the new year.

Here are five of our reader’s favorite blogs of 2022

    Remote Work Challenges

1. Remote Work and The Human Error: 3 Major Challenges

Working from home is a significant game-changer for organizations, and it doesn’t look like it is going away anytime soon. While working from home has benefits and advantages for both organizations and employees, it comes with an abundance of new cybersecurity risks that need to be accounted for. As the employees’ environment changes, so do the magnitude of threats.

In this blog, you’ll learn:

  • The number one reason for cybersecurity attacks
  •  How to help close skill gaps within the cybersecurity industry
  • What embracing the new era of digitalization looks like

Explore three of the most prominent rising challenges organizations need to look out for if they offer remote work; read more.

municipal cyber attack

2. The Rise of Municipal Cyberattacks: Becoming Proactive

Now, more than ever, municipalities are expected to meet the demanding needs of maintaining and sustaining vital sectors within our communities. Cities must do this with strict budgets and limited resources, making them vulnerable targets for cyberattacks. The best way for municipalities to protect themselves from attacks is to tighten up their cybersecurity offensive strategies.

In this blog, you’ll find:

  • Suggested solutions to mitigate cybersecurity risks
  • How Continuous Vulnerability Management can benefit municipalities
  • Why cybersecurity awareness training not only helps employees but helps organizations

We dive deep into four prevention methods municipalities should consider as they look to avoid cyberattacks and reduce the risk of financial loss; read more.

financial institution cybersecurity compliance

3. Mandatory or Not? Achieving Cybersecurity Compliance for Financial Institutions

Compliance is a challenging requirement for not only financial institutions but many organizations. So many new and evolving regulations are mandatory to safeguard data for financial institutions and customers. It is essential to follow them to ensure credibility and trustworthiness and to avoid fines and penalties for being non-compliant.

In this blog, you’ll discover:

  • Which cybersecurity regulations are mandatory vs. optional
  • A solution for taking the burden of staying compliant off your IT team plate
  • What cybersecurity regulations are out there, and what is required

Here is your cybersecurity compliance checklist for financial institutions breaking down what’s out there and what is required; read more.

most expensive data breaches in history

4. More Money, More Problems: The Most Expensive Data Breaches in History

Organizations are paying not just for the immediate repair of a data breach but the aftermath of it. Although cyberattacks are inevitable, the notion that cyberattacks are impossible to stop is one of the largest misconceptions harbored by businesses. As an organization, you have control over the steps you take to mitigate the risk of a breach.

In this blog, you’ll find out:

  • How an organization can fold after a cyberattack and prevention methods
  • The top three most expensive data breaches in history to date
  • What built-in components to look for within a managed security platform

Discover a list of the top three most expensive breaches in history, more notable breaches, and what solutions can mitigate the risk of becoming a national or global headline; read more.

Law firm vulnerabilities

5. Law Firm Vulnerabilities: Why Data Breaches and Bad Actors Strike

Law firms manage unparalleled access to valuable and confidential information, making them a one-stop shop for attracting cybercriminals. It is their responsibility to equip employees with the proper knowledge not to jeopardize clients’ reputations or information. The risk can be mitigated by consistently evaluating security posture to determine where gaps lie and if there are holes within an IT network.

In this blog, you’ll read about:

  • Cyber-threats law firms need to know about
  • What kinds of cybersecurity the American Bar Association requires from attorneys
  • How to properly equip employees and law firms to have the best cybersecurity defense and offense

This blog outlines why cybercriminals target law firms, what types of insider threats to lookout for, and how to properly equip employees for safeguarding data; read more.

Looking Forward to More Cybersecurity Discussions in 2023

As we have seen this past year, security and risk management is no longer considered ‘nice to have’ features of your cybersecurity strategy. Instead, cyber risk management has evolved into a board-level issue for organizations. With cyberattacks becoming more sophisticated and common, new laws and regulations are being passed to protect customer data, and organizations are putting cybersecurity at the core of their decisions. In the following year and beyond, we anticipate more organizations decentralizing, which changes the threat landscape and protection.

Adlumin is here to work as an extension of your IT team or be its core. We understand IT and security teams stretch thin and are here to be your command center for security operations. If you are ready to proactively protect your IT environment, set up a demo or a free trial with one of our cybersecurity experts. Or visit www.adlumin.com for more information.

Best Security Information and Event Management (SIEM) Software

Adlumin is featured as one of the top ten Best Security Information and Event Management (SIEM) Software Companies by Gmpis, a software, mobile apps and online services review publication.

Adlumin’s Security Operations Platform plus extended risk management and security services operates as more than a SIEM and is proud to be continuously recognized as being a leader in security analytics and MDR.

“SIEM solutions provide a consolidated view of security events, making them an essential component of Cybersecurity. However, not all SIEM solutions are created equal. When deciding on which SIEM to adopt, it is important to keep in mind that SIEM is not an isolated solution but should be part of a larger security strategy,” Gmpis states.

Adlumin’s Security Operations Platform and MDR services is your command center for security operations. Adlumin illuminates the threats that would have otherwise gone unseen in the lead-up to a massive attack. Our cloud-native platform leverages powerful machine learning to identify critical threats, automates remediation rules and systems updates, and provides live continuous compliance reporting. Our platform is backed by an expert team delivering 24×7 human insights, threat hunting, and the trusted support that larger companies can no longer offer,” Gmpis continues.

Read the full announcement here.

Penetration Testing for Enterprises FAQ

By: Brittany Demendi, Corporate Communications Manager

How and when did penetration testing begin?

The concept of penetration testing, commonly known as ‘pentesting’ or ‘ethical hacking,’ first started around the 1960s, when cybersecurity experts informed the government that its computer communications lines were not as secure as they thought. To further investigate, the government brought in what they called “Tiger Teams,” named after special military teams, according to Infosec Institute, to hack their own network. Most government systems failed fast, however, they learned two things: first, that they could be accessed, and second, penetration testing was a valuable technique to identify any weak points in networks, systems, hardware, and software that needed to be further developed, thought out, and studied.

Is penetration testing considered a “luxury” tactic?

If penetration testing has been around since the 1960s, why is it a relatively new practice organizations implement into their security plan? It is estimated, by Infosec Institute, that $6.4 billion is spent on security checks and tools each year, with penetration tools not even skimming that surface. It is also considered to be only about a decade old, formally established in 2009. In addition, it mainly comes down to the lack of proper resources.

Penetration can be expensive trying to source in-house. Yes, there are penetration testers out there, but when our country is hitting an all-time high of open cybersecurity jobs, it can be tough to find the right experts to facilitate a penetration test properly, effectively, and consistently.

What is the difference between pentesting and scanning for vulnerabilities?

Vulnerability scanning, and penetration testing are sometimes mistaken as the same type of service. One of the main issues many organizations have is whether they will utilize or purchase one when they really need both to have the best proactive protection. A vulnerability scan is a high-level automated test that looks for vulnerabilities. It is a more passive approach to vulnerability management.

As it is possible to take vulnerability scanning to the next level with Continuous Vulnerability Management, it is still essential to add penetration testing in the mix because they work hand-in-hand. Continuous Vulnerability Management is continuous, while penetration testing is customized with various deployment options. Both programs play a critical role in building a healthy cybersecurity plan.

Do I need pentesting in my cybersecurity strategy?

Penetration testing allows organizations to evaluate the overall security posture of their IT infrastructure. An organization may have a robust security plan and strategy in place in one area but could be lacking in another. A successful cyberattack can be detrimental to most organizations, which means, no organization should wait for a real-world attack before utilizing its offense. Penetration testing exposes holes within every security layer, allowing cybersecurity experts to proactively act on shortcomings before they become a liability. Testing is focused on finding out how cybercriminals can get in.

This technique should not be a one-and-done type of effort. It is most efficient if it is a part of an ongoing vigilance. It is best to look for every possible open door into a network rather than finding one way in and calling it a day. Whenever there are security patch updates, which is a part of vulnerability scanning and patching as a service, or new applications used by employees, unknown risks open the door for cybercriminals. The most proactive way to slam those doors shut is to uncover any new security weaknesses by working on the offensive side of the game.

In addition to proactive cybersecurity protection, here are a few more reasons penetration testing is becoming a non-negotiable aspect of security plans:

  • Checking the box of compliance standards: penetration testing allows organizations to maintain industry standards and compliance regulations.
  • Improve security posture: penetration testing helps prioritize and address vulnerabilities with actionable results.
  • Hunting real-world vulnerabilities: weak endpoints are exposed in an organization’s computer system.

How do I perform a penetration test?

Penetration testing involves identifying an exploit, designing an attack, and performing a simulation of that attack to determine the best strategies to overcome a digital adversary. The nature of the exploit will often determine the resources that will be required to mitigate the risk. It combines manual and active attempts by pen testers to hack networks alongside automated tools that scan 24×7 for vulnerabilities.

Together, this is thought to offer a broader security review and has since evolved into cybersecurity services. This approach allows organizations of all sizes that may not be able to expand their IT team internally to a wide array of penetration tools and services like a Progressive Penetration Testing Program with experts to manage them.

In general though, penetration testing can be offered affordably, all while providing the utmost security protection. Specifically, Progressive Penetration Testing simulates different vantage points to see if any critical data can be accessed. In addition, documentation is provided and explained for each vulnerability, evidence, impact, recommendation, and observed instance.

Sometimes your IT teams are too close to the network to carry out effective tests, so turning to external cybersecurity experts to carry out a progressive penetration program can be the best way to monitor from different angles. Penetration tests transform into results with actionable insights for the stakeholder and decision-makers. There becomes more of an emphasis on the weak points exposed, better preparing a defense, and strengthening the offense.

For more information on progressive penetration programs, visit Adlumin.com. Or, if you are ready to get started with a demo or free trial, contact a cybersecurity expert today.

Importance of Penetration Testing in Cybersecurity

By: Brittany Demendi, Corporate Communications Manager

What is Penetration Testing?

Penetration testing, also known as “pentesting” and commonly known as “ethical hacking,” is a technique used by professionals like Adlumin’s Managed Detection and Response (MDR) Team to shine a light on potential vulnerabilities. Pen testing involves identifying and testing these vulnerabilities within an organization’s network in a controlled environment. In our case, the MDR Team takes on the mindset of a cybercriminal and mimics the actions or strategies of an attack to evaluate where the weak points are. Penetration testing can also test compliance regulations to resolve any risks.

In a previous blog post, we covered the Four Critical Areas for Planning a Penetration Test. This blog will dive into the benefits of implementing a Progressive Penetration Testing Program and how it can improve overall security posture.

#1: Meet Industry Data Compliance Regulations

Every industry now requires some type of data compliance regulations and/or guidelines to ensure customer trustworthiness, protection of data, and to achieve proper security posture. Penetration binds organizations to the reality of their network health. When it comes time for compliance reporting and monitoring, penetration testing takes it to the next level by suggesting actions for remediation.

Regardless of the ever-changing industry landscape (threats and regulations), the goal is to ensure compliance. Standards like PCI DSS, NIST, HIPPA, NCUA ACET, FFIEC CAT, and others have become more than just a paperwork exercise or checkbox. Most auditors ask teams to use data-driven processes to show regulatory compliance and improve cyber-risk maturity.

# 2: Minimize Risks to Improve Cybersecurity Postures

A penetration test is one of the best ways to expose vulnerabilities and risks to a network. This ensures all systems are as secure as they can be. Adlumin’s MDR Team simulates different vantage points to see if any critical data can be accessed. Then, they can disrupt the kill chain by understanding the attack vectors leading to essential impacts.

All steps are meticulously documented so weaknesses can be exploited. A penetration test gives a baseline to work off to remediate the risk optimally and structurally. A sequence of the risks is provided, as well, to help tackle the highest risks first, then the others.

# 3: Stay Ahead of Cyber Threats and Hackers by Being Up-to-Date

Thinking ahead with the mindset of a cybercriminal sets proactive organizations apart from the ones that are only reacting to attacks. It is one thing to have an incident response plan for when an attack occurs, as this is vital for every organization regardless of industry. It is another thing to get ahead by penetrating a network as a cybercriminal would. Take advantage of programs that exist, like Progressive Penetration Testing, to see where the weak points are.

IBM states that in 2022, the average cost of a data breach will be $9.44M in the United States. Many organizations would fold if they were put in a situation like this. Thinking ahead can be the difference between an organization going under and thriving because data breaches are inevitable.

How are Penetration Testing Results Documented?

Complete results the most critical component of a test and should always be the result of a properly implemented penetration test. For example:

  1. Executive Summary report for high-level topics
  2. Pentest technical report for specific vulnerabilities and tasks
  3. Segmentation Report for understanding the types of attacks used
  4. Fix Actions report for resolving any issues uncovered

It’s essential to have comprehensive results that explain and document each vulnerability, evidence, impact, recommendation, and observed instance. Managed Detection and Response platforms plus services take the burden off already bogged-down IT teams, by implementing these tests and delivering actionable results.

The Proactive Cybersecurity Approach

With limited resources, most organizations struggle to prioritize vulnerabilities, identify exposures and weak points, and align to the larger business objectives to meet regulations of protected assets. Traditional penetration tests use limited formulaic methods and have not evolved to the constantly changing threat landscape organizations face.

Adlumin’s Progressive Penetration Testing provides real-world scenarios that are industry-specific threat assessments offering actionable recommendations. Every step is documented, providing a reverse-engineered blueprint to demonstrate how a cybercriminal can access the environment and gain access to critical systems laterally. Penetration tests ‘kill two birds with one stone’ by hitting multiple benefits that are required anyways. It just takes it a step further.

Protecting Microsoft Office 365 from Cyberattacks

By: Mark Sangster, VP, Chief of Strategy, and Will Ledesma, Director of Managed Detection and Response

Cloud adoption is universal, as is the move to SaaS applications like Microsoft Office 365 (O365). Cloud architecture simplifies management while increasing business access and collaboration. Yet, the open and available nature of tools like O365 expands your threat profile. Cybercriminals are adept at exploiting these systems, often called Living Off The Land (LOTL). Adopting services like O365 only reinforces the notion that the threat landscape is an ever-moving sea of dunes that provide cover for criminals to move undetected and easily infiltrate your business.

As you migrate to Office 365 (amongst other SaaS applications) and increase user access, does it come at a cost? Are you losing security protection? This post discusses the move to Office 365, the risks, and ways to secure your SaaS applications from cyber threats.

Office 365 Overview

In the following blog, when Office 365 is mentioned, we are referring to the collection of Microsoft web applications and cloud-based services¹. It includes Outlook, OneDrive, Microsoft Teams, and Microsoft Office (Excel, Word, and PowerPoint). These services further integrate with Microsoft Exchange Server, SharePoint, and others. Authentication is driven via Hybrid Azure configurations or full Azure Active Directory Server integration. Adlumin’s platform ingests the various logs produced by these applications, servers, and authentication services.

Real Threats in the O365 Trenches

Today’s IT (Information Technology) open and accessible infrastructure means companies cannot turn a blind eye to threats lurking in plain sight. Cybercriminal groups such as Gootloader actively seek and exploit Office 365 vulnerabilities.

Like other SaaS applications, Office 365 contains mission-critical, often confidential, and damaging information if exposed through unauthorized channels. Proprietary intellectual property, business plans, customer contracts, and financial data are stored and shared through Office 365. Cybercriminals are attracted to any source of critical assets, and the open nature of Office 365 creates double jeopardy in terms of cyber threats.

Add to that the complexity of any expansive ecosystem of services and applications, and it is no wonder the Office 365 family has a plethora of known vulnerabilities² that exploit services, including remote code execution, spoofing, bypassing controls, and information exposure.

Threat actors will look to identify any way into a system. Many use password spray techniques, while others attempt phishing tactics. Regardless of the vector, every attack angle must be observed.

Many of these exploits are easy for criminals to deploy. For example, Microsoft modified Azure authentication protocols to prevent unauthorized parties from intercepting or spoofing authentication requests, harvesting credentials and then passing these credentials to the Azure servers to complete the user’s login request³.

Office 365 Login

Convincing phishing emails that launched customer-branded log-in portals left the user unaware of the fraudulent nature of the act. And the successful sign-on offers no signs of suspicious or at least unexpected behavior.

Most organizations rely on Single Sign-On (SSO) servers to authenticate users. At the same time, they have been deployed for their simplicity and ease of use, and adversaries tailgate on these advantages to gain initial access to organizations.

Let’s dive into a real-world example that Adlumin’s Managed Detection and Response (MDR) team discovered. The Adlumin platform alerted on suspicious activity in the form of impossible travel, which is the notion that a user cannot log in from two geographical locations in a period in which they could not physically traverse. The adversary leveraged an older vulnerability against Oauth 2.0 that exploits cloud Azure authentication server misconfiguration. The threat actor was able to take ownership of the targeted account but was rapidly stopped by Adlumin.

Adlumin’s investment in machine learning algorithms solves the conundrum of analyzing the enormous volume of logs generated by O365 services and serves in this class of exploit. False positives are eliminated, and vetted alerts and events are presented to MDR analysts for complete analysis and containment.

Take the previous example of impossible travel authentication. A user cannot log in from New York and London at the same hour, but Microsoft load balancing might send an authentication request from a New York user to a server in London, given current Internet traffic. On the surface, the concurrent login looks suspicious, but it is not. Additional contextual information allows one to confirm the event and determine if it is malicious.

In this case, User and Entity Behavior Analytics (UEBA) solve this dilemma. UEBA baselines normal user and device activity and flags anomalies. Where does the user normally log in from? What are the normal behaviors of the user? What machine do they typically use? Adlumin UEBA paired with our MDR analysis provides a Zero Trust approach to identify the outliers, investigate, and contain them. It is about identifying threats before they turn into business-disruptive incidents.

With Microsoft SSO, attackers have a single portal to a world of applications: OneDrive, SharePoint, emails, confidential information, etc. Access to these systems additionally provides a vector for distributing malicious binaries like ransomware to other users and systems.

Alert and Response Example:

Adlumin’s MDR team has several containment actions. In this case, the analyst disabled the user account and implemented a firewall IP block via Adlumin’s SOAR (Security Orchestration, Automation, and Response) to provide machine-to-machine invoked protection actions.

The Alert

Alert in details showcasing the impossible actions:

A machine learning algorithm detected Office 365 activity originating from an anomalous

The Adversary’s Actions

The first move:

Once the adversary gains access, they set up a forwarding rule against an admin account.

Suspicious inbox forwarding rule\

The second move:

The adversary then looks for and collects an expense report.

collects an expense report

The third move:

In this case, the client had disabled automatic blocks against suspicious activity, including the compromised account, remote access, and source IP blocking. In response, Adlumin’s MDR team takes containment actions:

Security Orchestration Automation and Response (SOAR)

IP blocks were also implemented via SOAR:

IP blocks were also implemented via SOAR

At this point, the initial attack is contained. Adlumin’s MDR team continued to monitor for further intrusions against the customer.

Take Aways

Today’s risk equation includes sophisticated threat actors, growing accountability and compliance requirements, and the protection of emerging technology. Office 365 is not new, but attacks against SaaS applications will continue to grow. The pandemic shifted much of the global workforce to a remote model.

Distributed (cloud) storage, remote access, and expanding user privileges have created new challenges for system administrators. They can no longer control access through on-premises services and restricted devices. In the battle to protect your business from cyberattacks while moving with technology trends, Adlumin provides the confidence you need to adopt and protect emerging technologies and services like Office 365.

  1. https://en.wikipedia.org/wiki/Microsoft_365
  2. https://www.cvedetails.com/vulnerability-list/vendor_id-26/product_id-80308/Microsoft-365-Apps.html
  3. https://docs.microsoft.com/en-gb/microsoft-365/admin/setup/customize-sign-in-page?view=o365-worldwide