www.cyren.com Open in urlscan Pro
84.39.152.48  Public Scan

Submitted URL: http://mkt.cyren.com/n/OTQ0LVBHTy0wNzYAAAF_PFnopgCilsBYS5uP4nSXiy7-hP1tQzWFhB3-MGMuprAVk8o_U0GvJ-vgg7WLp7YgRGkYcsA=
Effective URL: https://www.cyren.com/blog/articles/safe-links-in-office-365?utm_campaign=ongoing_blog&utm_medium=email&utm_source=202...
Submission: On September 01 via api from SG

Form analysis 2 forms found in the DOM

GET /search.html

<form action="/search.html" method="get" class="container">
  <input type="search" name="keywords" placeholder="Enter search" class="text search-input" value="">
  <button type="submit" class="search-submit">
    <img src="/tl_files/cyren_v3_preview/images/top-nav-search-icon-white.png" alt="Search Icon">
  </button>
</form>

POST https://feedburner.google.com/fb/a/mailverify

<form action="https://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow"
  onsubmit="window.open('https://feedburner.google.com/fb/a/mailverify?uri=CyrenSecurityBlog', 'popupwindow', 'scrollbars=yes,width=550,height=520');$('#subscribe-blog-modal').modal('toggle');return true">
  <div class="row">
    <div class="form-group col-md-12">
      <label class="control-label" for="LastName">Please enter your email address</label>
      <input class="form-control" type="text" name="email" required="">
      <input type="hidden" value="CyrenSecurityBlog" name="uri">
      <input type="hidden" name="loc" value="en_US">
    </div>
    <div class="col-md-12">
      <p class="submit-container" style="text-align: center;"><button class="btn btn-cyren-red submit" type="submit" tabindex="8">Subscribe</button></p>
    </div>
  </div>
</form>

Text Content

Safe Links in Office 365

Go back

 *  

Skip navigation
 * < Products and Solutions
   
   
   PRODUCTS
   
   For the Enterprise
   
    * Threat InDepth Threat Intelligence
    * Inbox Security for Office 365
    * F-Prot Anti-Virus
   
   --------------------------------------------------------------------------------
   
   For Service Providers and Tech Companies (OEM)
   
    * Threat InDepth Threat Intelligence
    * Cyren Email Security Engine
    * Cyren Web Security Engine
    * Cyren Malware Detection Engine
    * Cyren Threat Lookup
   
   
   SOLUTIONS
   
   Phishing and Spam Protection
   
    * Threat InDepth Threat Intelligence
    * Inbox Security for Office 365
    * Cyren Email Security Engine
   
   --------------------------------------------------------------------------------
   
   Advanced Malware Detection
   
    * Threat InDepth Threat Intelligence
    * Cyren Malware Detection Engine
    * Cyren Threat Lookup
   
   --------------------------------------------------------------------------------
   
   Web Traffic Protection
   
    * Cyren Web Security Engine
    * Threat InDepth Threat Intelligence

 * < Research
    * Cyren Security Center
    * Cyren Security Blog
   
   --------------------------------------------------------------------------------
   
   More on threats
   
    * Glossary of cyber threats
    * Phishing
    * Malware
    * Ransomware
    * Botnets

 * < Expert Content
    * Webinars & Events
      
      
      
    * On-Demand Webinars
    * Brochures and datasheets
    * Reports and white papers
    * Videos
    * Show all resources
   
   
 * < Company
   
   About Cyren
   
   More than 1.3 billion users around the world rely on Cyren's 100% cloud
   internet security solutions to protect them against cyber attacks and data
   loss every day. Learn more
   
    * Contact Us
    * Careers
   
   Press and Investors
   
    * In the News
    * Press Releases
    * Investor Relations
    * Security Alliance
   
   --------------------------------------------------------------------------------
   
   Leadership
   
    * Management
    * Board of Directors

 * 

 
 * Login
    * Cyren Inbox Security Login
    * Cyren Cloud Security Login
    * MyEleven Login

 * Partners
    * Partner Portal
    * Partner Lookup Tool

 * Support
 * Contact
 * Blog
   
   
   
 * EN
    * Select your language:
    * English
    * Deutsch

 * 


Get A Demo


CYREN SECURITY BLOG


SAFE LINKS IN OFFICE 365

by Mike Fleck August 19, 2021 Security Research & Analysis

Safe Links is a feature of Microsoft Defender for Office 365 (formerly known as
Advanced Threat Protection) that helps protect from users clicking on malicious
URLs. Proofpoint calls their version, URL Defense. Mimecast calls theirs, URL
Protect. All these feature names describe the same thing - URL rewriting.



It’s much easier to explain Safe Links and URL rewriting with examples and
diagrams. Let’s use three URLs from an imaginary email message:

1. A safe website – www.amazon.com

2. Let’s pretend this is a well-known phishing site –www.Phishing-R-Us.com

3. We’ll use this as a new, uncategorized website - www.o365-shop.com



Safe Links rewrites the above URLs a format similar to these:

1. na01.safelinks.protection.com/?url=www.amazon.com

2. na01.safelinks.protection.com/?url=www.phishing-r-us.com

3. na01.safelinks.protection.com/?url=www.o365-shop.com

 

Due to the magic of HTML, Microsoft ATP can rewrite URLs without changing how
they’re displayed to the users. For the most part, users only know if ATP has
written a URL if they click and watch the location bar in their browsers.

 



Figure 1 A Safe Links URL in the browser location bar

 

When a user clicks one of these rewritten URLs, they are first directed to the
na01.safelinks.protection.com server which checks if the destination URL,
defined in the portion of the URL after the equal sign, is safe or a threat. If
the URL is safe, the user is redirected to the destination as though nothing
ever happened – although there is often a noticeable delay. If the URL is a
threat, the user is redirected to a warning page instead of the intended
destination.

 



Figure 2 Safe Links blocking access to a phishing page

 

The intent of URL rewriting is to provide something called time of click
protection. It’s a belt and suspenders approach to applying static threat
databases to defend against phishing. If the URL isn’t known to be a threat at
the time it’s scanned (prior to delivery) then URL rewriting allows the email
security server to check again when a user clicks the URL. However, there are a
few problems with this approach:

 * URL rewriting cannot be applied to URLs in files attached to a message or
   files shared from, for example, Google Drive. Attackers know this and Cyren
   has observed a big increase in the number of phishing URLs contained in
   files.
 * Since the display name of the URL isn’t rewritten, users can simply copy that
   text and paste it into a browser. I do this all the time to skip the delay
   associated with the email security server.
 * The security is only as effective as your threat intelligence. We’ve found
   the best way to identify zero-day and targeted phishing URLs is to analyze
   them in real-time.
 * URL rewriting can break the association of URLs and app on your phone. I just
   ran into this when trying to reset the password for a mobile app using a
   reset link delivered to my inbox.
 * URL rewriting is reactive, so administrators still need to respond to
   threats. Really what you need is a system that not only continuously detects
   phishing threats as they evolve but can also automatically remediate all the
   affected messages.
   
   

Safe Links is a handy feature of Microsoft Defender for Office. Just don’t let
it give you a false sense of security. No single feature or solution can address
all email security threats. We’ve found the best approach is to leverage
everything Microsoft Defender for Office 365 (read: ATP) provides and complement
it with a specialized anti-phishing and automated incident response solution.
This combination allows you to filter out the known threats and then
continuously scan and remove targeted and zero-day phishing.

Go back

Share:
Subscribe to this Blog
Read Another Article


THANK YOU!

Thank you for your request – a Cyren representative will be contacting you to
discuss how Cyren can benefit your business.

Subscribe to Cyren Security Blog

Please enter your email address

Subscribe

Your privacy is important to us. We will never share your information.

 * Cyren Inbox Security
 * Expert Content
 * Company
 * Get a Demo

Terms of Use // Privacy Policy // Cookie Policy © Cyren 2021. All trade/service
marks or names referenced on this site belong to their respective owners. The
information contained herein is subject to change without notice.
   
 * 
 * 
   
 * 
   





PRIVACY PREFERENCE CENTER




YOUR PRIVACY


YOUR PRIVACY

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.

More information about our cookies


 * STRICTLY NECESSARY COOKIES
   
   
   STRICTLY NECESSARY COOKIES
   
   Always Active
   Strictly Necessary Cookies
   
   These cookies are necessary for the website to function and cannot be
   switched off in our systems. They are usually only set in response to actions
   made by you which amount to a request for services, such as setting your
   privacy preferences, logging in or filling in forms.    You can set your
   browser to block or alert you about these cookies, but some parts of the site
   will not then work. These cookies do not store any personally identifiable
   information.
   
   Cookies Details‎


 * PERFORMANCE COOKIES
   
   
   PERFORMANCE COOKIES
   
   Performance Cookies
   
   These cookies allow us to count visits and traffic sources so we can measure
   and improve the performance of our site. They help us to know which pages are
   the most and least popular and see how visitors move around the site.    All
   information these cookies collect is aggregated and therefore anonymous. If
   you do not allow these cookies we will not know when you have visited our
   site, and will not be able to monitor its performance.
   
   Cookies Details‎


 * TARGETING COOKIES
   
   
   TARGETING COOKIES
   
   Targeting Cookies
   
   These cookies may be set through our site by our advertising partners. They
   may be used by those companies to build a profile of your interests and show
   you relevant adverts on other sites.    They do not store directly personal
   information, but are based on uniquely identifying your browser and internet
   device. If you do not allow these cookies, you will experience less targeted
   advertising.
   
   Cookies Details‎

Back Button


ADVERTISING COOKIES

Filter Button
Consent Leg.Interest
Select All Vendors
Select All Vendors
Select All Hosts

Select All

 * REPLACE-WITH-DYANMIC-HOST-ID
   
   
   33ACROSS
   
   33ACROSS
   
   View Third Party Cookies
   
    * Name
      cookie name

 * REPLACE-WITH-DYANMIC-VENDOR-ID
   
   
   33ACROSS
   
   3 Purposes
   
   View Privacy Notice
   
   
   
   33ACROSS
   
   3 Purposes
   
   View Privacy Notice
   
   REPLACE-WITH-DYANMIC-VENDOR-ID
   
   Consent Purposes
   
   Location Based Ads
   
   Consent Allowed
   
   Legitimate Interest Purposes
   
   Personalize
   
   Require Opt-Out
   
   Special Purposes
   
   Location Based Ads
   
   Features
   
   Location Based Ads
   
   Special Features
   
   Location Based Ads



Clear Filters

Information storage and access
Apply
Confirm My Choices Allow All



ON CYREN.COM WE USE COOKIES TO IMPROVE YOUR USER EXPERIENCE.

By clicking “Accept All Cookies”, you agree to the storing of cookies on your
device to enhance site navigation, analyze site usage, and assist in our
marketing efforts. Cookie Policy

Accept All Cookies
Cookies Settings