www.cyren.com
Open in
urlscan Pro
84.39.152.48
Public Scan
Submitted URL: http://mkt.cyren.com/n/OTQ0LVBHTy0wNzYAAAF_PFnopgCilsBYS5uP4nSXiy7-hP1tQzWFhB3-MGMuprAVk8o_U0GvJ-vgg7WLp7YgRGkYcsA=
Effective URL: https://www.cyren.com/blog/articles/safe-links-in-office-365?utm_campaign=ongoing_blog&utm_medium=email&utm_source=202...
Submission: On September 01 via api from SG
Effective URL: https://www.cyren.com/blog/articles/safe-links-in-office-365?utm_campaign=ongoing_blog&utm_medium=email&utm_source=202...
Submission: On September 01 via api from SG
Form analysis
2 forms found in the DOMGET /search.html
<form action="/search.html" method="get" class="container">
<input type="search" name="keywords" placeholder="Enter search" class="text search-input" value="">
<button type="submit" class="search-submit">
<img src="/tl_files/cyren_v3_preview/images/top-nav-search-icon-white.png" alt="Search Icon">
</button>
</form>
POST https://feedburner.google.com/fb/a/mailverify
<form action="https://feedburner.google.com/fb/a/mailverify" method="post" target="popupwindow"
onsubmit="window.open('https://feedburner.google.com/fb/a/mailverify?uri=CyrenSecurityBlog', 'popupwindow', 'scrollbars=yes,width=550,height=520');$('#subscribe-blog-modal').modal('toggle');return true">
<div class="row">
<div class="form-group col-md-12">
<label class="control-label" for="LastName">Please enter your email address</label>
<input class="form-control" type="text" name="email" required="">
<input type="hidden" value="CyrenSecurityBlog" name="uri">
<input type="hidden" name="loc" value="en_US">
</div>
<div class="col-md-12">
<p class="submit-container" style="text-align: center;"><button class="btn btn-cyren-red submit" type="submit" tabindex="8">Subscribe</button></p>
</div>
</div>
</form>
Text Content
Safe Links in Office 365 Go back * Skip navigation * < Products and Solutions PRODUCTS For the Enterprise * Threat InDepth Threat Intelligence * Inbox Security for Office 365 * F-Prot Anti-Virus -------------------------------------------------------------------------------- For Service Providers and Tech Companies (OEM) * Threat InDepth Threat Intelligence * Cyren Email Security Engine * Cyren Web Security Engine * Cyren Malware Detection Engine * Cyren Threat Lookup SOLUTIONS Phishing and Spam Protection * Threat InDepth Threat Intelligence * Inbox Security for Office 365 * Cyren Email Security Engine -------------------------------------------------------------------------------- Advanced Malware Detection * Threat InDepth Threat Intelligence * Cyren Malware Detection Engine * Cyren Threat Lookup -------------------------------------------------------------------------------- Web Traffic Protection * Cyren Web Security Engine * Threat InDepth Threat Intelligence * < Research * Cyren Security Center * Cyren Security Blog -------------------------------------------------------------------------------- More on threats * Glossary of cyber threats * Phishing * Malware * Ransomware * Botnets * < Expert Content * Webinars & Events * On-Demand Webinars * Brochures and datasheets * Reports and white papers * Videos * Show all resources * < Company About Cyren More than 1.3 billion users around the world rely on Cyren's 100% cloud internet security solutions to protect them against cyber attacks and data loss every day. Learn more * Contact Us * Careers Press and Investors * In the News * Press Releases * Investor Relations * Security Alliance -------------------------------------------------------------------------------- Leadership * Management * Board of Directors * * Login * Cyren Inbox Security Login * Cyren Cloud Security Login * MyEleven Login * Partners * Partner Portal * Partner Lookup Tool * Support * Contact * Blog * EN * Select your language: * English * Deutsch * Get A Demo CYREN SECURITY BLOG SAFE LINKS IN OFFICE 365 by Mike Fleck August 19, 2021 Security Research & Analysis Safe Links is a feature of Microsoft Defender for Office 365 (formerly known as Advanced Threat Protection) that helps protect from users clicking on malicious URLs. Proofpoint calls their version, URL Defense. Mimecast calls theirs, URL Protect. All these feature names describe the same thing - URL rewriting. It’s much easier to explain Safe Links and URL rewriting with examples and diagrams. Let’s use three URLs from an imaginary email message: 1. A safe website – www.amazon.com 2. Let’s pretend this is a well-known phishing site –www.Phishing-R-Us.com 3. We’ll use this as a new, uncategorized website - www.o365-shop.com Safe Links rewrites the above URLs a format similar to these: 1. na01.safelinks.protection.com/?url=www.amazon.com 2. na01.safelinks.protection.com/?url=www.phishing-r-us.com 3. na01.safelinks.protection.com/?url=www.o365-shop.com Due to the magic of HTML, Microsoft ATP can rewrite URLs without changing how they’re displayed to the users. For the most part, users only know if ATP has written a URL if they click and watch the location bar in their browsers. Figure 1 A Safe Links URL in the browser location bar When a user clicks one of these rewritten URLs, they are first directed to the na01.safelinks.protection.com server which checks if the destination URL, defined in the portion of the URL after the equal sign, is safe or a threat. If the URL is safe, the user is redirected to the destination as though nothing ever happened – although there is often a noticeable delay. If the URL is a threat, the user is redirected to a warning page instead of the intended destination. Figure 2 Safe Links blocking access to a phishing page The intent of URL rewriting is to provide something called time of click protection. It’s a belt and suspenders approach to applying static threat databases to defend against phishing. If the URL isn’t known to be a threat at the time it’s scanned (prior to delivery) then URL rewriting allows the email security server to check again when a user clicks the URL. However, there are a few problems with this approach: * URL rewriting cannot be applied to URLs in files attached to a message or files shared from, for example, Google Drive. Attackers know this and Cyren has observed a big increase in the number of phishing URLs contained in files. * Since the display name of the URL isn’t rewritten, users can simply copy that text and paste it into a browser. I do this all the time to skip the delay associated with the email security server. * The security is only as effective as your threat intelligence. We’ve found the best way to identify zero-day and targeted phishing URLs is to analyze them in real-time. * URL rewriting can break the association of URLs and app on your phone. I just ran into this when trying to reset the password for a mobile app using a reset link delivered to my inbox. * URL rewriting is reactive, so administrators still need to respond to threats. Really what you need is a system that not only continuously detects phishing threats as they evolve but can also automatically remediate all the affected messages. Safe Links is a handy feature of Microsoft Defender for Office. Just don’t let it give you a false sense of security. No single feature or solution can address all email security threats. We’ve found the best approach is to leverage everything Microsoft Defender for Office 365 (read: ATP) provides and complement it with a specialized anti-phishing and automated incident response solution. This combination allows you to filter out the known threats and then continuously scan and remove targeted and zero-day phishing. Go back Share: Subscribe to this Blog Read Another Article THANK YOU! Thank you for your request – a Cyren representative will be contacting you to discuss how Cyren can benefit your business. Subscribe to Cyren Security Blog Please enter your email address Subscribe Your privacy is important to us. We will never share your information. * Cyren Inbox Security * Expert Content * Company * Get a Demo Terms of Use // Privacy Policy // Cookie Policy © Cyren 2021. All trade/service marks or names referenced on this site belong to their respective owners. The information contained herein is subject to change without notice. * * * PRIVACY PREFERENCE CENTER YOUR PRIVACY YOUR PRIVACY When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information about our cookies * STRICTLY NECESSARY COOKIES STRICTLY NECESSARY COOKIES Always Active Strictly Necessary Cookies These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information. Cookies Details * PERFORMANCE COOKIES PERFORMANCE COOKIES Performance Cookies These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance. Cookies Details * TARGETING COOKIES TARGETING COOKIES Targeting Cookies These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising. Cookies Details Back Button ADVERTISING COOKIES Filter Button Consent Leg.Interest Select All Vendors Select All Vendors Select All Hosts Select All * REPLACE-WITH-DYANMIC-HOST-ID 33ACROSS 33ACROSS View Third Party Cookies * Name cookie name * REPLACE-WITH-DYANMIC-VENDOR-ID 33ACROSS 3 Purposes View Privacy Notice 33ACROSS 3 Purposes View Privacy Notice REPLACE-WITH-DYANMIC-VENDOR-ID Consent Purposes Location Based Ads Consent Allowed Legitimate Interest Purposes Personalize Require Opt-Out Special Purposes Location Based Ads Features Location Based Ads Special Features Location Based Ads Clear Filters Information storage and access Apply Confirm My Choices Allow All ON CYREN.COM WE USE COOKIES TO IMPROVE YOUR USER EXPERIENCE. By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. Cookie Policy Accept All Cookies Cookies Settings