perm_phone_msgUNDER ATTACK? S.O.S. LINE 0114 354 0054

Top Categories



Cyber security The Register

Ukraine blames Belarus for PC-wiping ‘ransomware’ that has no recovery method and nukes target boxen

After last week’s website defacements, Ukraine is now being targeted by boot record-wiping malware that looks like ransomware but with one crucial difference: there’s no recovery method. Officials have pointed the finger at Belarus. Fountain at Independence Square in Minsk, Belarus Targets of this new malware wave “span multiple government, [...]

Top Voted
Sorry, there is nothing for the moment.

None shall pass: Yet another layer to protect hapless users, employers from dodgy docs added to Microsoft 365

Cyber security The Register today23/06/2020 126

share close

Feeling a bit uncertain about things? Never fear, kind old Microsoft has made Safe Documents generally available (assuming you’re a Microsoft 365 E5 subscriber).

Aimed at enterprise users, the feature improves on the Protected View with which users of Office apps are all too familiar. Protected View is supposed to keep users safe by opening documents in read-only mode, thereby ensuring that any nasties lurking within cannot wreak havoc by leaping out of the sandbox and into a user’s setup.

Protected View tends to be triggered when a document comes from somewhere unsafe, such as the internet or from an untrustworthy email sender. It is, in theory, a good thing. However, it can also be a bit of a pain, and all too many users eagerly take the option to edit and print regardless, thus potentially exposing an organisation to harm and undoing all the IT team’s hard work securing things.

Enter Safe Documents. Once enabled, an extra layer of security is added which sends the document through Microsoft Defender ATP for scanning before allowing it to be edited.

The scanner allows for a maximum upload size of 60MB, and things can be derailed if timeouts of network connectivity occur (potentially allowing the user to hit the edit button, although the Protected View does urge caution).

If all goes well, then the user may edit the document as normal. However, if the scan detects that something is amiss, then the Protected View bar turns an angry red and the user informed that what they thought was a letter from a wealthy prince was actually something a little more malicious.

It is up to administrators to decide if users should be able to skip through the alerts and jump straight to editing. Admins can also use the Kusto-based Advanced Hunting tools to retrieve additional information.

It’s off by default, and enabling it (and doubtless triggering a wave of calls to the helpdesk) is a simple matter of checking a box in the Security & Compliance Center.

Sadly, it is currently only possible to protect those with Microsoft 365 E5 or a Microsoft 365 E5 Security licence from themselves at present, and only those running in Window clients. ®

Sponsored: Google Security Whitepaper

See the original article here: The Register

Written by: The Register

Rate it
Previous post

Designed by Cloud Boffins