These days, all types of business communications are done via email — so employees cannot sacrifice the mobility, reliability and economy of their inboxes. From contract information to the latest sales reports, it is imperative that email data remain confidential. A single wrong click can give away top-secret company information, broadcast private financial statements or expose sensitive negotiations.

CAS Data Loss Prevention (DLP) policies for Office 365 Email now include an automated workflow that allows emails violating an enabled CAS DLP policy to be encrypted before being sent, using the existing Microsoft Office 365 Encryption service included in several of the Microsoft 365 and Office 365 Enterprise bundles.

What is email encryption, and how does Microsoft 365 use it?

Encryption is the process by which information is encoded so that only an authorized recipient can decode and consume the information. Microsoft/Office 365 uses encryption in two ways: in the service, and as a customer control. Encryption is used in the Microsoft 365 service by default; you don’t have to configure anything. For example, Microsoft 365 uses Transport Layer Security (TLS) to encrypt the connection, or session, between two servers.

There are different ways to embed customer control in a workflow; below is one example.

Here’s how email encryption typically works:

• If the encryption process is not automatic, the user selects the “Encrypt” option in Outlook.
• The message is encrypted, or transformed from plain text into unreadable ciphertext, either on the sender’s machine or by a central server while the message is in transit.
• The message remains in ciphertext while it’s in transit in order to protect it from being read if it is intercepted.
• Once the message reaches its destination, the message is transformed back into readable plain text in one of two ways:
  • The recipient’s machine uses a key to decrypt the message, or
  • A central server decrypts the message on behalf of the recipient, after validating the recipient’s identity.

How does SonicWall Cloud App Security help?

When you have a Microsoft 365/Office 365 bundle that includes Office 365 Message Encryption (OME) and CAS Advanced package, CAS can automatically encrypt emails that violate configured DLP policies.  When you configure your CAS Office 365 Email DLP policy workflow to use the “Encrypted by Microsoft” action, an appropriate Exchange Online mail flow rule is created automatically. Using CAS’s “Protect (inline) mode, emails are intercepted and evaluated against the selected DLP policy rules. When an outgoing email matches a DLP rule, SonicWall Cloud App Security automatically encrypts the email before it is allowed to be sent externally. With the embedded workflow, the admin can manage the DLP content in a much more efficient manner without any extra overhead — once the CAS policy is triggered, the mail is encrypted and delivered to recipient.

End-user email if a DLP workflow is invoked (Below)

Always stay updated

Once you’ve enabled the DLP workflow, outgoing emails that have been encrypted by the policy can be easily located under the Events pane. Selecting the event itself allows you to drill down into the Security Event details with the History visibly stating, “Encrypted by Microsoft.” There are various filters available to examine the available events more closely in case suspicious activity needs to be investigated.

Many cloud providers encrypt their servers to defend against outside threats, but don’t follow the information once it’s been shared or sent externally. That information can be copied, emailed and opened by anyone once it leaves your environment. With the introduction of this new workflow in SonicWall Cloud App Security, sensitive emails and file attachments can be automatically encrypted, preventing unauthorized access to your sensitive information outside of your environment.

Cloud App Security’s DLP workflow leverages your existing Office 365 Message Encryption (OME) services. This protects your sensitive emails, reducing the need for multiple encryption services and providers, and helps you manage costs by using services you’ve already paid for. Protecting sensitive information and saving money? Sounds like a total win to me!

Have you ever found yourself wondering whether you should click a URL you received in an email? Thinking, “Where does the URL really go? Is it safe for me to access, or is there malware or a fake login page on the other end?”

You don’t have to wonder anymore — SonicWall is excited to announce that Cloud App Security now provides even more URL protection straight out of the box. In addition to pre-delivery email URL analysis, Cloud App Security now includes Click-Time Protection to block URL access to sites that were initially benign but are now malicious.

Attacks evolve with each passing day, and differentiating a legitimate link from a malicious link is a constant challenge. Attackers attempt to evade detection by using compromised servers that appear benign until after the message has been delivered. But with Click-Time Protection, you get an additional layer of safety. Each and every time a user clicks on a URL received in email, it is analyzed, and access is blocked if that website is found to be malicious.

Secure Mail in Transit

“You can’t be what you can’t see” is a simple way to explain how SonicWall Cloud App Security helps you secure your inbox. Virtual inline protection analyzes URLs contained in emails before they’re delivered to the user’s mailbox. URLs found to be malicious are blocked, never getting to the user. URLs that are benign at delivery will now be replaced with a SonicWall URL. When anyone clicks that link, SonicWall will test the site before redirecting it to the user.

SonicWall Cloud App Security provides Pre-Inbox and Post-Delivery solutions and protects against ever-increasing zero-day malware and malicious sites. Then it goes one step further, scanning emails across the company and retracting any other email that might be affected by the same threat.

Behind the Scenes: How We Protect Users

Regardless of whether you’re securing a few users or a few thousand users, the configuration options are simple and easy to manage. SonicWall Cloud App Security’s Click-Time Protection offers the flexibility to configure policy for all users, specific users, or a group, and provides three actions to choose from:

1. Do nothing: Trust the user’s judgment and allow access to the site.
2. Block: Prevent the user from visiting the site when the URL is found to be malicious.
3. Warn: Notify if malicious, but allow the user to choose to proceed to the site.

Once Click-Time Protection has been enabled and policies are set, all links contained in incoming emails are replaced with SonicWall links. When the user clicks on a link, it triggers an immediate scan of the target site. If it is determined to be benign, the user continues without interruption. If it is determined to be malicious, the user is sent to a warning page. The user may be provided a link to the malicious page based on the policy and group he has been assigned to by the admin.

Enhanced Visibility — Analysis and investigation

Encountering a threat and obtaining forensic details of that threat are two separate actions that SonicWall’s Cloud App Security seamlessly stitches together without losing the essence or any details in translation. Each stage of the Click-Time Protection process is recorded for investigation and auditing purposes, from the original URL substitution event to the result of the time-of-click scan. Each step is logged and can be readily accessed based on the threat type. The events are grouped together so the activity can be easily understood.

Completing the Security Loop

The addition of Click-Time Protection to SonicWall Cloud App Security bolsters post-delivery protection, making our advanced anti-phishing technology even more robust. SonicWall Cloud App Security delivers next-gen security for SaaS applications, protecting email, data and user credentials from advanced threats while ensuring compliance in the cloud. SonicWall Cloud App Security also provides API-based security for software as a service (SaaS), delivering visibility, data security, advanced threat protection and compliance — all with low TCO, minimal deployment overhead and a seamless user experience.

To learn more about SonicWall Cloud App Security, click here.