Office 365 Spam Filter

[jamoritch]

Hi all,

 

One of the schools that I support are being bombarded by phishing scams and they have been caught out twice now.

 

Does anybody use an Office365 filtering system at all? A quick google search brought up Barracuda but I’m wondering if anyone could recommend a filtering system to block all of these phishing scams.

 

Cheers

[ordeology]

We use O365 Advanced Threat Protection and it seems to be doing a pretty good job so far, it is catching a lot of stuff.

[network41]

Is ATP worth the money in your opinion , I keep banging on about it and get the usual respose of "it's a bit pricey" FFS

[jamoritch]

What plan do you use? I had a look and the lower bracket is probably the only one the head would possibly go for.

[network41]

Think its called A1

[rlculver]

I am looking at O365 Advanced Threat Protection Plan 2.

 

Was thinking of enabling for key staff as well. I take it you can assign to specific users ?

[CCCSecMan]

I wouldn't waste your money on it - better to look at a 3rd party product.

 

Is there a particular trend of the phishing scams that the existing product is letting in? Are you sure that you have got the spam filter configured correctly in exchange online protection? You haven't got a bunch of email addresses in the allow list have you? This bypasses all filtering for any email addresses you add in.

[dmj]

We are currently looking at Mimecast but it is quite expensive.

A cheaper option might be to route email through Google suite as they have some quite good spam filtering (I think it is called postini) and they don't charge for it.

[Oaktech]

Our standard spam filter cranked all the way up is pretty good at catching most phishing attempts, the only ones that have come through are ones from genuine accounts that we've previously had contact with that have been compromised - 2 from local schools and an adoption agency that asked us for a reference etc. Our staff are pretty good at spotting a scam now though. They've flagged the 3 that did make it through.

 

Also, 2FA for important accounts.

[Slum90]

I adjusted Office 365 settings so anything that is deemed malicious is held in the portal until I can check it over an release it.

Also 2FA is highly recommended