Analyzing Compromised Cloud Productivity Suites

The reality is that most cloud-based security incidents within an organization will occur at the productivity suite level. As we discussed in Chapter 7, Microsoft 365 and Google Workspace are the most popular SaaS-based platforms in the industry. Organizations rely on Microsoft 365 and Google Workspace for business applications and services such as email, storage, office applications, and much more. Through the rise in the adoption of SaaS-based email solutions through Microsoft 365 and Google Workspace by corporations, these platforms have become a prime target for business email compromise attacks. Since these email accounts are integrally linked to other services within 365 and Workspace, such compromises also pose a risk to any additional service connected to the user’s account, amplifying the potential for broader security breaches and a larger impact.

This chapter will dive into the details of compromised productivity...