Making it harder for the bad guys
For many years, client apps have used Basic Authentication to connect to servers, services and endpoints. It is enabled by default on most servers and services and it’s super simple to set up. Basic Authentication simply means the application sends a username and password with every request (often stored or saved on the device).
Basic Authentication makes it easier for attackers—armed with today’s tools and methods—to capture users’ credentials, which in turn increases the risk of criminal breach. Multi-factor authentication (MFA) offers another roadblock to stop bad actors.
Simply put, there are better and more effective alternatives to authenticate users available today. We are actively recommending to customers to adopt security strategies that apply real–time policies when users and devices are accessing corporate information. This allows for intelligent decisions to be made regarding who is trying to access what from where on which device rather than simply trusting a simple username and password (which could be a Bad Actor impersonating a user).
With these threats and risks in mind, we’re taking steps to improve data security in Exchange Online.
What Is Changing
Last year Microsoft announced they are turning off Basic Authentication for Exchange Web Services and Exchange Online products in October 2020. COVID-19 has pushed back the date, but the need for advanced security remains—in fact, it’s needed more than ever due to online threat activity levels.
We are asking for your help to move away from apps that use Basic Authentication to those that use Modern Authentication. Modern Authentication has many benefits and improvements that help mitigate the issues present in Basic Authentication. Enabling and enforcing multi-factor authentication is also very simple with this updated method.
How This Impacts You
This change might affect some of your users or apps, so we wanted to provide additional information to help you in identifying and deciding upon an action plan.
Finding impacted users
The next action you really need to be thinking about is assessing impact to your business. The first question you probably have is – so how do I know who at my business is using Basic Authentication? Great question, and we are here to help you determine that.
Once we understand what your users use, and know if they are using Basic or Modern Authentication, what can you do about it? Each of the impacted protocols have an easy solution that many customers already have access to.
Latest Microsoft 365 (formerly known as Office 365)
The current version of Microsoft 365 (including Outlook, Word, and Excel) includes Modern Authentication. By porting over current apps to this standard, we can eliminate the security issues that are presented (as well as the basic authentication standards that are being phased out).
We believe the best mobile device client to use when connecting to Exchange Online is Outlook mobile. Trusted by over 100M users across the world, Outlook mobile fully integrates modern Microsoft mobility and security capabilities. Outlook mobile helps you secure your users and your corporate data, and it natively supports Modern Authentication.
Summary
We know the change from Basic Auth to Modern Auth will potentially cause some disruption. For some users, change can bring challenge, but we want to do this together to improve security, protecting your and your users’ data. Disabling Basic Authentication and requiring Modern Authentication with MFA is one of the best things you can do to improve the security of your data and is a key component to a cyber security plan.
To learn more about MFA, check out this link from Microsoft: https://docs.microsoft.com/en-us/azure/active-directory/user-help/multi-factor-authentication-end-user-first-time .
We know this is big news for some and we’re here to help! Contact us for more information!
The Certified CIO Team
