Many organisations are embarking on their own Office 365 journey, a significant investment that can result in major business change and even digital transformation. Office 365 implementation is usually a multi-year programme of work with a number of different projects and milestones. Along the way new tools will be adopted, processes will be completely reimagined, and new opportunities will emerge.

A common milestone in an Office 365 roadmap is the introduction of new Office 365 intranet, based on SharePoint Online. If this isnt on your roadmap then youre likely missing a trick. An Office 365 intranet offers an excellent opportunity to drive value and can also complement the other milestones in your overall 365 roadmap in several ways.

In this article were going to explore the reasons why an Office 365 intranet really should be a key milestone in your Office 365 plans.

1Its a great opportunity to deliver an excellent intranet

Office 365 and more specifically SharePoint Online is an excellent base technology for an intranet for multiple reasons. We recently posted an article detailing ten reasons why SharePoint and SharePoint Online really is the best choice for an intranet. This includes elements such as its flexibility, scalability, variety of options, ability to support both publishing and collaboration, and the easy integration with the rest of the Office 365 suite, a theme we explore in more detail below. If your current intranet is less than great, youre missing out on an opportunity to deliver an excellent new intranet and fully leverage your investment in Office 365.

2An intranet is part of digital transformation

Office 365 programmes are often positioned as an enabler of digital transformation or as a strategic change programme. Although IT may be leading the roll-out, the wider change is likely to be endorsed by the CEO or other members of the C-suite. If this is the case it would be strange to leave the intranet, a major channel for internal communication and change management, out of scope of such a high-profile initiative. An intranet helps communicate change and should be part of the change itself.

3You may be aligning and simplifying your technology stack

With a move to Office 365 its very likely that you may be moving many of your applications to the cloud, and generally rationalising your technology stack. The introduction of Office 365 can effectively render some of your existing applications as legacy systems. In the world of intranets, you may indeed have an old CMS, as well as a myriad of local intranet solutions, perhaps some of them on-premises. There may also be a number of make-shift applications which act as a place to store content. A new Office 365 intranet may well be an opportunity to simplify your technology stack and rationalise a lot of old CMS and intranet solutions, ultimately cutting costs, making the environment more manageable and probably reducing risk too.

4It helps bring Office 365 into the daily flow of work

One of the key advantages of an Office 365 intranet is that you can easily integrate Office 365 tools like Yammer and MS Teams into it. This turns your Office 365 intranet into more of a digital workplace, bringing Office 365 tools into the daily flow of peoples work, for example by providing a feed of aggregated updates across different groups and workspaces into one place.

Its also possible to bring automation, workflow and reporting using the wider suite of Office 365 tools right into the intranet experience, again bringing the power of these tools to employees, while also making for a more essential and relevant intranet.

5It supports governance

Office 365 and its constituent tools provide a fantastic opportunity for organisations and teams to improve the way they work. However, in the rush to drive adoption you can run into governance issues that may can leave you with operational issues further down the line. For example, when first launched, Teams can go viral which is great, but can soon lead to a platform with duplicated, unused and hard to find spaces.

An Office 365 intranet can actually help support your governance in multiple ways, for example WIzdom comes with a collaboration hub that allows you to put approval workflow in place for the creation of new sites. Your intranet can also encourage the use of approved Office 365 tools rather than shadow IT.

6It supports adoption and change

Implementing Office 365 involves a large change management effort in order to help drive adoption. A SharePoint Online intranet can help with this effort not only in including communications, but also in helping to feature particular tools, removing barriers to their use and aggregating notifications. Here the tight potential integration between intranet and Office 365 can be useful.

When rolling out Office 365 It can also help to present the overall range of communication and collaboration options available in an intranet together with the other options across Office 365, so an employee has a complete picture of the tools available to them.

7It supports findability across Office 365

Achieving reasonable levels of findability across the digital workplace can be a challenge.  One of the key roles of an intranet is to help users find what they need – employees may now expect an intranet search to perform at  least some kind of enterprise search. Implementing an Office 365 intranet with SharePoint or Microsoft search is going to be more effective than a non-SharePoint intranet in displaying results from across SharePoint sites and other Office 365 tools like Teams.

8It supports future exploitation of Office 365

Microsoft continue to invest heavily in Office 365 and its suite of tools, including out-of-the-box intranet capabilities, new features and more. Having an Office 365 intranet helps you to more fully leverage the Office 365 future roadmap. For example, there are improvements coming to both Yammer and to the Power Platform providing an opportunity to improve collaboration and introduce more sophisticated automation right into the intranet experience.

9Seize the opportunity to fund your new intranet

A new intranet is not always the top priority for senior management and can be regarded as hygiene rather than a strategic investment. This means internal communications functions and intranet teams sometimes have to wait longer than they should do for investment to get a new or improved platform

In our experience, Office 365 programme are usually well-funded, so ensuring that an Office 365 intranet is in scope within the programme, is usually an excellent (bur rare) opportunity to properly fund a new intranet. If your company is going down the Office 365 route, then its time to make your business case!

Get in touch!

If youre launching Office 365 and want to know more about your intranet options, or are about to refresh your intranet on Office 365 and think you may need help then get in touch! Wed love to hear from you.

Despite the focus on outside threats, todays most damaging security threats arent limited to hackers or malware but from a companys trusted insiders with access to sensitive information in collaboration tools like SharePoint. A recent report from Cybersecurity Insiders and Nucleus Cyber looked at what companies believe are the drivers for insider attacks. The top answer – lack of user training. The solution to the problem most cited – more user training. While employees need access to sensitive information to do their job, organizations need a plan to make sure their own people are not the cause of a data breach – both malicious insiders and negligent insiders. However, more training alone isnt the answer training backed by automated enforcement in your Office 365 collaboration is.

Contributing Factors to Insider Threats and Prevention Methods

Heres a quick look at the facts around insider attacks according to the 2019 Insider Threat Report:

• 56% of organizations surveyed believe the most critical factor enabling insider attacks is the lack of employee awareness and training.
• On the flip side, the most utilized tactic in combating insider threats, 51%, is user training to address both inadvertent insider threats due to human error as well as recognizing unusual and suspicious behavior often exhibited by malicious insiders.
• Those survey also cited a lack of training and expertise (58%) as the key barrier to better insider threat management, in addition to the lack of collaboration among departments (57%) and lack of budget (52%).

Theres one common thread here: a lack of or need for more user training.

Why More User Training Simply Isnt Enough

Collaboration tools, like SharePoint, are one of the best and worst things to happen to business productivity. Ironically, the ease of which users can share and collaborate on files is both its appeal and security downfall. With intranet tools like SharePoint, it has never been easier to share files with a colleague or even a third party. Plus, you can access files from any device with mobile apps designed to access your Office 365 documents at any time, from anyplace.

However, the facts clearly illustrate that simply relying on data governance and security policies to safeguard SharePoint data from insider attacks puts organizations in precarious security position. No one can guarantee that every person in an organization who has access to sensitive information in SharePoint and other collaboration tools will follow the rules – no matter how much training they receive.

There is concrete evidence that a large percentage of breaches are caused by employees accidentally or maliciously mishandling sensitive customer, patient or corporate information against policy.  The Insider Threat Report also revealed that 70% of organizations observed that insider attacks have become more frequent over the last 12 months. And 60% have experienced one or more insider attacks within the last 12 months. The results closely mirror McKinseys findings that insider threats are present in 50% of breaches reported in a recent study.

Adding to the complexity is the sheer number of communication channels that exist in Office 365 (i.e. SharePoint, OneDrive, Teams, Yammer) making it difficult for users to remember the rules for every situation and communication medium.

It can happen in any setting, and it can happen to you. So, what steps can you take to protect the business?

Protect Your Content and Your People

For starters, why are organizations only relying on user training when technology exists to protect data in any circumstance? Education has its place especially when it comes to protecting against outside threats from hackers like phishing attacks. And educating users on data sharing polices is important for them to understand the rules around collaboration, but its just one step you should be taking to protect your data.

Just as organizations depend on security technology to protect them from a myriad of outside threats, the right technology is also invaluable to protect data from within; from malicious insiders look to profit from data theft to innocent slips of the mouse that result in a headline making data breach.

You should look to protect your data and users (arguably your next most valuable asset) by:

1. Auditing Data and Access: To start, identify where all your data currently exists in both SharePoint, SharePoint online, OneDrive and any other data repositories and tools used to store it like legacy Windows file shares. You also need to ensure only authorized personnel have access to sensitive information – that includes your SharePoint admins. Sure, they need to know the files exist to manage them, but they dont need to be able to look at the file contents unless the information is applicable to them just like any other user.
2. Classifying and Securing Data: Once youve reviewed who should have access to sensitive information, you should look to automate the process of classifying documents according to their sensitivity level. Dont just rely on folder permissions or database security methods. The best course of action is to use data-centric security that both applies both classification and security to the individual document to restrict access and apply restrictions on what actions can be performed (print, save, email, etc.) based on its classification level. Extremely sensitive content should also be encrypted to ensure it remains protected if it makes its way out of the organization intentionally or not.
3. Addressing Changing Risk Profiles: Todays data isnt static – its constantly being collaborated on and changing. Look at data on a continuous basis to account for how information and its associated access attributes and user context change over time, then adjust its security accordingly. Assess the risk profile associated with the data and its use cases, then consider the security that should be applied in each scenario.
4. Balancing Security with Collaboration: Keep the right balance between what users want from a collaboration perspective and what the organization demands from a security perspective. Go too far in either direction and you can make your situation worse. Too lax and your data can be shared far too freely. Too stringent and your users find an alternative way to share and collaborate using shadow IT. In either situation you lose visibility and control of your sensitive data.

Training Backed by Automated Enforcement is Essential to Data Protection

Data-centric technologies that adapt security controls to match data sharing scenarios, without placing a burden on users that will cause them to circumvent or reduce their productivity, is the key to securing collaboration inside and outside of SharePoint.

Directly integrated into Microsofts content and collaboration platforms including Office 365, Teams, SharePoint, and Yammer NC Protect provides effective, dynamic data-centric security that minimizes data loss and misuse across entire organizations. NC Protect enables Microsoft customers to better secure collaboration and protect against inside threats.

NC Protect works natively with Azure Information Protection (AIP) and other Microsoft products to provide granular information protection to data within Microsoft collaboration tools by controlling file access and use combined with restricting certain collaboration functionality as needed, including elements of the SharePoint user interface, an applications method for viewing files, and encryption or restriction of attachments sent through Exchange Email. NC Protect can also apply dynamic, custom watermarks to editable and read-only Microsoft Office files for auditing and security purposes. It requires no additional client-side application, reducing IT overhead and the risks involved in implementing new cloud services or BYOD policies.

Secure Your SharePoint Collaboration

These measures coupled with a data-centric solution to automate these steps will help prevent insider attacks while ensuring the authorized users can access information in SharePoint to get their jobs done without bypassing security protocols to do so. In todays modern workplace solely relying on people to follow data security and sharing protocols is not only outdated, it can seriously impact the safety of your sensitive data.

Learn more about how to secure SharePoint and Office 365 content with NC Protect:

Watch the 2-minute video overview

See how a large utility company is dynamically securing access to sensitive information in SharePoint with NC Protect

If youd like to discuss any aspect of your SharePoint intranet security, then get in touch.