Listen to this Post
Introduction:
In an era where cyber threats evolve at breakneck speed, organisations must adopt a multilayered security posture that goes beyond basic antivirus software and firewalls. Indgro Multi Services Group™, a diversified outsourcing provider operating across temporary employment, cleaning, hygiene, and pest control, demonstrates that cybersecurity is not merely an IT concern but a foundational business imperative. Their approach—anchored in continuous internal cyber security awareness training, Multi-Factor Authentication (MFA), DMARC email authentication, and Microsoft Defender for Office 365—offers a replicable blueprint for any organisation seeking to fortify its defences while maintaining operational excellence.
Learning Objectives:
- Understand the core components of a modern cybersecurity compliance program, including MFA, DMARC, and email threat protection.
- Learn how to configure and implement DMARC, SPF, and DKIM to prevent email spoofing and domain impersonation.
- Master the setup of anti-phishing, anti-spam, and Safe Attachments/Links policies within Microsoft Defender for Office 365.
- Develop a continuous security awareness training framework that educates employees and measures organisational risk reduction.
- Explore how ISO 27001 and NIST frameworks can structure and validate a comprehensive information security management system.
You Should Know:
- Multi-Factor Authentication (MFA): The First Line of Defence
MFA is no longer optional—it is a critical control that significantly reduces the risk of account compromise. Indgro’s commitment to MFA reflects a broader industry consensus that passwords alone are insufficient. According to the UK’s National Cyber Security Centre (NCSC), organisations should implement the strongest MFA methods available, ideally allowing users to choose from options that meet the organisation’s security needs and risk appetite. However, not all MFA is created equal; SMS-based and email-based one-time passwords are increasingly vulnerable to phishing and SIM-swapping attacks.
Step‑by‑step guide: Implementing Phishing-Resistant MFA in Microsoft Entra ID (Azure AD)
- Assess your current authentication landscape: Identify all users, including administrators, and catalogue which applications support modern authentication protocols (OAuth 2.0, SAML). Legacy protocols that do not support MFA must be disabled or migrated.
-
Enable MFA for all users: In the Microsoft Entra admin center, navigate to Protection > Conditional Access > Policies. Create a new policy named “Require MFA for all users” and assign it to all cloud apps. Under Access controls, select Grant and check Require multi-factor authentication. Set the policy to Report-only initially to monitor impact before enabling enforcement.
-
Choose phishing-resistant methods: Prioritise FIDO2 security keys (physical hardware tokens) or the Microsoft Authenticator app with number matching, rather than SMS or voice calls. Under Authentication methods, ensure only phishing-resistant methods are enabled for privileged roles.
-
Monitor and iterate: Use the Sign-in logs and Audit logs in Entra ID to track MFA enrollment rates, failed authentication attempts, and risky sign-ins. Regularly review excluded accounts and exceptions, as these are common backdoors.
Windows (PowerShell) command to enforce MFA for a specific user:
Connect to Microsoft Graph Connect-MgGraph -Scopes "User.Read.All", "Policy.ReadWrite.AuthenticationMethod" Get the user's authentication methods Get-MgUserAuthenticationMethod -UserId "[email protected]" Enforce MFA registration by updating the user's authentication methods policy (This is typically done via Conditional Access; the following sets a registration campaign) Update-MgUserAuthenticationMethod -UserId "[email protected]" -BodyParameter @{ "isRegistrationCampaignEnabled" = $true }
- DMARC, SPF, and DKIM: Securing Your Email Domain
Email remains the primary vector for cyberattacks, with phishing and business email compromise (BEC) costing organisations billions annually. Indgro’s use of DMARC (Domain-based Message Authentication, Reporting & Conformance) is a proactive measure to prevent attackers from spoofing their domain. DMARC builds on SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail) to give domain owners control over what happens to unauthenticated emails.
Step‑by‑step guide: Configuring DMARC from Monitoring to Enforcement
- Publish an SPF record: Identify all authorised senders (your mail server, marketing platforms, CRM, etc.) and publish an SPF TXT record in your DNS. For example: `v=spf1 mx include:spf.protection.outlook.com ~all` (the `~all` indicates a soft fail).
-
Enable DKIM: In Microsoft 365 Defender, navigate to Email & Collaboration > Policies & Rules > Threat policies > DKIM. Select your domain and enable DKIM signing. This generates a public key that you must publish as a TXT record in your DNS.
-
Create a DMARC record: Start with a monitoring policy (
p=none) to collect reports without affecting email delivery. The record should look like:v=DMARC1; p=none; rua=mailto:[email protected]; ruf=mailto:[email protected]. Publish this as a TXT record at_dmarc.yourdomain.com. -
Analyse reports and refine: Use the aggregate reports (RUA) to identify legitimate senders that are failing authentication. Update your SPF and DKIM configurations accordingly. Gradually move to a quarantine policy (
p=quarantine) and finally to a reject policy (p=reject), ensuring all legitimate traffic is authenticated. -
Verify your configuration: Use online tools like MXToolbox or the DMARC Report analyser to confirm your records are correctly published and that emails are being authenticated.
Linux (bind/named) command to add a DMARC TXT record:
Edit your zone file (e.g., /var/named/yourdomain.com.zone) Add the following line: _dmarc IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; pct=100" Reload the zone rndc reload yourdomain.com
Windows (DNS Manager) steps:
- Open DNS Manager.
- Right-click your forward lookup zone and select Other New Records.
- Choose Text (TXT) and enter `_dmarc` as the name.
- In the text box, paste your DMARC policy string.
- Microsoft Defender for Office 365: Anti-Phishing, Anti-Spam, and Safe Attachments
Indgro’s deployment of Microsoft Defender for Office 365 provides a comprehensive shield against email-borne threats. The platform’s anti-phishing policies, Safe Attachments, and Safe Links offer layered protection that extends beyond traditional spam filters. Anti-phishing policies in Defender can be configured to detect impersonation of users and domains, while Safe Attachments uses a virtual environment to “detonate” and analyse attachments for malware before delivery.
Step‑by‑step guide: Configuring Anti-Phishing and Safe Attachments Policies
- Access the Microsoft Defender portal: Navigate to `https://security.microsoft.com`. Go to Email & Collaboration > Policies & Rules > Threat policies.
-
Create an anti-phishing policy: Under Anti-phishing, click + Create. Provide a name and description. Under Impersonation, add the users and domains you want to protect (e.g., your CEO, CFO, and primary domain). Enable Enable impersonation protection and set actions for impersonated senders (e.g., quarantine the message).
-
Configure spoof intelligence: Ensure that spoof intelligence is enabled to detect and block spoofed senders automatically. You can review and allow/block specific spoofed senders in the Spoof intelligence tab.
-
Set up Safe Attachments: Navigate to Safe Attachments and click + Create. Name your policy and apply it to all recipients. Under Safe Attachments unknown malware response, select Dynamic Delivery—this delivers the email body immediately while the attachment is scanned in a sandbox environment, preventing user delays. Enable Turn on Safe Attachments for SharePoint, OneDrive, and Microsoft Teams to extend protection to collaboration platforms.
-
Configure Safe Links: Under Safe Links, create a policy that rewrites and scans URLs in emails. Select Apply Safe Links to email messages sent within the organisation and Apply Safe Links to Office 365 apps. Choose the action for malicious links (e.g., Block the URL and Replace the URL with a warning).
PowerShell command to enable Safe Links for all users:
Connect to Exchange Online PowerShell Connect-ExchangeOnline Get the default Safe Links policy Get-SafeLinksPolicy Create a new Safe Links policy with aggressive protection New-SafeLinksPolicy -1ame "Strict Safe Links" -EnableSafeLinksForEmail $true -EnableSafeLinksForOffice $true -EnableSafeLinksForTeams $true -TrackClicks $true -AllowClickThrough $false Apply the policy to all recipients New-SafeLinksRule -1ame "Strict Safe Links Rule" -Policy "Strict Safe Links" -RecipientDomainIs "yourdomain.com"
- Continuous Cyber Security Awareness Training: The Human Firewall
Technology alone cannot prevent all breaches; employees remain the first and last line of defence. Indgro’s emphasis on continuous internal cyber security awareness training and scoring acknowledges that security is a journey, not a destination. Effective programs are role-based, engaging, and continuously measured. They should include simulated phishing campaigns, interactive modules, and clear reporting mechanisms.
Step‑by‑step guide: Building a Continuous Security Awareness Program
- Conduct a risk assessment: Identify which departments and roles are most at risk (e.g., finance, HR, executives). Tailor training content to address the specific threats they face.
-
Secure leadership buy-in: Present a business case that links training to reduced incident response costs and regulatory compliance. Leadership must champion the program to drive cultural change.
-
Deploy a training platform: Use a dedicated SAT platform (e.g., KnowBe4, Cybrary, MetaCompliance) that automates module delivery, tracks progress, and runs phishing simulations. Schedule monthly micro-learning sessions rather than annual hour-long videos to improve retention.
-
Run simulated phishing campaigns: Launch quarterly phishing simulations targeting all employees. Provide immediate feedback when an employee clicks a malicious link, directing them to a brief remedial module. Track the “click rate” over time as a key performance indicator.
-
Measure and refine: Generate reports on training completion, phishing susceptibility, and reported incidents. Use this data to adjust content and identify repeat offenders who may need additional coaching. Share anonymised metrics with leadership to demonstrate ROI.
Linux command to generate a phishing simulation report (example using a SAT API):
Example: Fetch training completion data from a SAT platform's API
curl -X GET "https://api.satplatform.com/v1/reports/completion?date_from=2026-01-01&date_to=2026-07-30" \
-H "Authorization: Bearer YOUR_API_KEY" \
-o training_report.json
Parse the report to identify users with low scores
jq '.users[] | select(.completion_rate < 80) | {email: .email, rate: .completion_rate}' training_report.json
Windows PowerShell script to send a reminder to non-compliant users (using Microsoft Graph):
Send a reminder email to users who haven't completed training
$nonCompliantUsers = Get-Content -Path "noncompliant_users.txt"
foreach ($user in $nonCompliantUsers) {
Send-MgUserMail -UserId $user -Message @{
Subject = "Action Required: Complete Your Cybersecurity Training"
Body = @{ ContentType = "Text"; Content = "Please complete your mandatory security awareness training by end of week." }
ToRecipients = @(@{ EmailAddress = @{ Address = $user } })
}
}
- Aligning with Compliance Frameworks: ISO 27001 and NIST CSF
Indgro’s ISO 9001:2015 certification and commitment to cyber security compliance point towards a broader governance framework. While ISO 27001 provides a prescriptive, certifiable Information Security Management System (ISMS), the NIST Cybersecurity Framework (CSF) offers a flexible, risk-based approach. Both can be used in tandem: NIST CSF for identifying, protecting, detecting, responding to, and recovering from threats, and ISO 27001 for formal certification and continuous improvement.
Step‑by‑step guide: Implementing an ISO 27001-aligned ISMS with NIST CSF controls
- Define the scope and context: Determine which business units, systems, and data assets fall within the ISMS. Conduct a high-level risk assessment to identify critical assets and potential threats.
-
Perform a gap analysis: Map your current security controls against ISO 27001 Annex A and the NIST CSF Core Functions (Identify, Protect, Detect, Respond, Recover). Document gaps and prioritise remediation based on risk.
-
Develop and implement policies: Create or update information security policies covering access control, incident response, business continuity, and supplier relationships. Ensure these policies are communicated to all employees and third-party partners.
-
Conduct internal audits and management reviews: Schedule regular internal audits to verify compliance with the ISMS. Hold management review meetings to assess performance, review non-conformities, and drive continuous improvement.
-
Pursue certification (optional): Engage an accredited certification body to conduct a Stage 1 (documentation review) and Stage 2 (implementation audit) assessment. Maintain the certification through annual surveillance audits.
Example of a NIST CSF self-assessment command (using a JSON-based tool):
Use the NIST CSF Core to generate a self-assessment report (Assuming a custom script that reads controls from a CSV file) python nist_csf_self_assess.py --framework nist-csf-v2.0 --output report.html View the report firefox report.html
- Cloud Hardening and API Security: Beyond Email Protection
While Indgro’s publicly disclosed measures focus on email and identity, a robust cybersecurity posture must also address cloud infrastructure and APIs. With the increasing adoption of cloud services (e.g., Microsoft 365, Azure), organisations must harden their cloud environments against misconfigurations, excessive permissions, and insecure APIs. This includes enabling Azure Security Center, implementing Just-In-Time (JIT) access, and using API gateways with rate limiting and authentication.
Step‑by‑step guide: Hardening Microsoft 365 and Azure Environments
- Enable Azure Security Center: Navigate to the Azure portal, search for Security Center, and enable Microsoft Defender for Cloud. This provides continuous assessment, security recommendations, and threat detection across your cloud resources.
-
Implement Just-In-Time (JIT) access: Under Security Center > Just-in-time VM access, configure JIT to restrict management ports (e.g., RDP, SSH) to specific IP addresses and time windows. This reduces the attack surface for virtual machines.
-
Configure Conditional Access policies: In Microsoft Entra ID, create Conditional Access policies that block sign-ins from high-risk locations, require compliant devices, and enforce session controls (e.g., sign-in frequency).
-
Secure your APIs: If you expose APIs to partners or customers, use Azure API Management to enforce authentication (OAuth 2.0), rate limiting, and IP whitelisting. Regularly review API logs for anomalous traffic patterns.
Azure CLI command to enable JIT on a VM:
Enable JIT on a specific VM az vm jit-policy create --resource-group MyResourceGroup --vm-1ame MyVM --ports 22=10m 3389=10m
PowerShell command to review Azure Security Center recommendations:
Get security recommendations for your subscription
Get-AzSecurityTask | Where-Object { $_.State -eq "Active" } | Format-Table Name, Severity, ResourceId
What Undercode Say:
- Cybersecurity is a Business Enabler, Not a Cost Centre: Indgro’s 98% Client Satisfaction Index and 99% payroll accuracy are not accidental—they are underpinned by a secure and reliable operational environment. Cyber resilience directly translates to client trust and competitive advantage.
- Layered Defence is Non-1egotiable: No single control is foolproof. Indgro’s combination of MFA, DMARC, Defender for Office 365, and continuous training creates a defence-in-depth posture that mitigates the most common attack vectors—phishing, credential theft, and business email compromise. Organisations that adopt a piecemeal approach will inevitably face breaches.
The integration of these controls into a cohesive framework, validated by ISO 9001 certification, demonstrates that security maturity is achievable even for organisations outside the traditional technology sector. The key takeaway is that cybersecurity must be woven into the fabric of daily operations, with clear ownership, measurable KPIs, and a culture of continuous improvement. As threat actors become more sophisticated, so too must our defences—and that begins with awareness, authentication, and a relentless commitment to compliance.
Prediction:
- -1 The commoditisation of phishing-as-a-service and AI-generated social engineering will render traditional email filters less effective, forcing organisations to rely more heavily on user training and behavioural analytics.
- +1 Regulatory bodies worldwide will increasingly mandate DMARC enforcement and MFA for sectors handling personal data, creating a compliance-driven market for these technologies and benefiting early adopters like Indgro.
- -1 The shortage of skilled cybersecurity professionals will persist, making automated, managed security services—like those offered by Microsoft Defender—more attractive to mid-sized enterprises.
- +1 Continuous security awareness training will evolve from annual compliance checkbox exercises to real-time, AI-adaptive micro-learning platforms that personalise content based on individual risk profiles and recent threat intelligence.
- +1 Organisations that successfully integrate cybersecurity into their brand promise—as Indgro has done with “Cyber Security Compliant”—will differentiate themselves in competitive markets, particularly in sectors like outsourcing where client data is a critical asset.
▶️ Related Video (76% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: Lwellyn Ross – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
