Nathan Winters Exchange 2010 protection and compliance

Nathan Winters
MVP Exchange Server
MMMUG – www.mmmug.co.uk
Exchange 2010 Protection and Compliance

Exchange 2010 IPC
Introduction to Information Protection and Compliance (IPC)
The arsenal of Technical Tools!
Archiving
Multi-Mailbox Search
Legal Hold
IRM
Moderation
Enhanced Transport Rule Capabilities
MailTips
Demonstration Scenarios

Why is IPC important?
Large UK Retailer Leaks Payment Information via Email
The Information Commissioner’s Office will be able to issue fines of up to £500,000 for serious data security breaches.
Nearly 40% of workers have received confidential information that was not meant for them!
Appeal Win Lets FSA Grab Evidence for SEC

Some of the legal factors
Public Sector - Freedom of Information
All - Data protection act
Finance – Financial Services Authority, SEC, BASEL2
RIPA - Regulation of Investigatory Powers Act 2000
Human Rights - Lawful business protection
Electronic Communications Act – Adding Disclaimers
US – SOX, HIPAA etc

What does IPC mean to you?
It’s a policy build around the relevant laws for your industry.
Based on a bunch of technical tools which we try to automate
Monitor email – content, recipients where is it going
Know what is happening based on email attributes
Retain and Provide
Archiving, Retention and Discovery
Control and Protection – allow or prevent
Granular policies
Soft to Hard control

Retain and Provide mail where required with Archiving, Retention and Discovery
Protection & Control: Soft to Hard
Ensure that you target the correct data with the correct policy to maximise usability

Personal Archive
Retention Policy
Legal Hold
Archiving, Retention & Discovery

Exchange 2010 Archiving, Retention & DiscoveryBetter mailbox management

World Today: Email Repositories
Organization Archive
Keeps all E-mail
Allows Org Control
Optimized for Search
PSTs
Circumvents Quota
Highly Portable
Mailbox
Highly Available
Rich Client Access
Personal Archive
Circumvent Quota
Allows Org Control
End User Access
Personal Archive
(TBs)
Outlook PSTs
(GBs)
Exchange
(MBs)
Org Archive
(PBs)
Backup
Backup
Replicated Backups
Replicated Backups
Backups uncommon and difficult
Users do manual backups
IT does unsupported backups
Replication Only Choice
Datasets Require Replication
Replication Common
Backups Less Common
Tape/Disk Backups Common
Item Level BackupsCommon

PSTs present a problem
IT Pro
Storage of old email on expensive SAN inefficient
Hard to discover content for legal request
Hard to prevent changes to content for legal hold
Management for Backup and Recovery expensive
End User
Only Stored on one machine
Corruption increases when stored on network share
No access through browser
Requires management by end user
Stability/responsiveness is an issue with large PST files

Why Archive? A Vicious Cycle of Volume vs. Control
PSTs difficult to discovery centrally
Regulatory retention schedules contribute to further volume/ storage issues
Increasing storage and back-up costs
Users forcedto manage quota
Quota management often results in growing PSTs (Outlook auto-archive)

Breaking the CycleWith large mailbox architecture and archiving
Large Mailbox Architecture
maintains performance
provides option for DAS-SATA storage to reduce costs
Archiving
simplifies discovery, retention and legal hold
Archiving
enables simple migration of PSTS back to server

Large Mailbox Lower Costs, Better Performance

Personal Archive
Oveview – What is it and where does it live?
User goals and assumptions
Simple to use – OWA & Outlook
IT Pro goals and assumptions
Get rid of PSTs!
Easy to enable.

Message RetentionOverview
Move Policy: automatically moves messages to the archive
Options: 6 months, 1 year, 2 years (default),
5 years, Never
User Impact: Helps keep mailbox under quota
Works like Outlook Auto-Archive – without PSTs!
Delete Policy: automatically deletes messages
User Impact: removes unwanted items
Helps keep mailbox under quota
Delete policies are Global (they travel to the Archive)
Per-item policies take priority over per-item policies

Legal HoldOverview
Hold Policy captures all edits/deletes irrespective of user or admin access.
User workflow is unchanged, items captured in hidden folders in Dumpster 2.0.
Multi-mailbox search can retrieve items indexed in Dumpster 2.0.
ISSUE – Consider that the whole mailbox is put on hold, not just the granular info that you need on hold!

Personal Archive
Retention Policy
Legal Hold
Demo

Archive Management Add-Remove-View Archive
Adding the archive requires a simple checkbox in the new-mailbox wizard
Archive can be disabled together or separate from the mailbox
Archive auto-discover requires no Outlook restart to activate archive
19

Archive Management Set Quota
Select archive quota to change default settings
The default quota warning for the Archive is 10 GB

Personal ArchiveUser experience
User can view, read, navigate, flag and reply to archived mail same as live mail
Folder hierarchy from primary mailbox maintained
Reply to message in archive puts message in live mail sent items (same as PSTs)
User gets conversation view scoped to Archive (same as PSTs)

Personal Archive Search
Option to search archive only or both live and archived mail
Advanced search options work across live and archived mail
22

Retention PolicesAt the folder or item level
Policies can be applied directly within an email
Policies can be applied to all email within a folder
Delete
policies
Archive policies
Expiration date stamped directly
on e-mail

Preserve: Message RetentionArchive and Delete policies
Policies can be applied directly within an email
Policies can be applied to an entire folder
Delete policies
Archive policies
Expiration date stamped directly
on e-mail

Set Explicit Move Policy on a Folder
Outlook OWA
User selects 5 Years from set of Policies

Set Move Policy on an ItemNo delete policy
Outlook OWA

Set Move Policy on a FolderWith delete policy
User selects 10 Years from set of Delete Policies
Outlook OWA
User selects 5 Years from set of Move Policies

Set Move Policy on an ItemWith delete policy
Outlook OWA

Multi-Mailbox Search Simple, role based GUI
Delegate access to search to HR, compliance, legal manager
Search all mail items (email, IM, contacts, calendar) across primary mailbox, archives
Filtering includes: sender, receiver, expiry policy, message size, sent/receive date, cc/bcc, regular expressions, IRM protected items

Multi-MailboxSearch
Additional e-discovery features
Search specific mailboxes or DLS
Export search results to a mailbox or SMTP address
Search results organized per original hierarchy
Request email alert when search is complete
API enables 3rd tool integration with query results for processing

Legal Hold
Show the user
Issue that the hold mailbox is placed on hold not just the relevant info

Preserve: Hold PolicyIW Experience
IW is told how to comply (no action needed for e-mail)
URL links to additional info

Preserve: Hold PolicyIT Pro Experience
Comment and URL tell the IW how to comply
Comment and URL tell the IW how to comply
Specify how long items are kept

Information Rights Management
MailTips
Moderation
Enhanced Transport Rules
Protection and Control

Exchange 2010 Protection and Control

Information LeakageCan be costly on multiple fronts
Legal, Regulatory and Financial impacts
Non-compliance with regulations or loss of data can lead to significant legal fees, fines, and more
Damage to public image and credibility with customers
Financial impact on company
Loss of Competitive Advantage
Disclosure of strategic plans
Loss of research, analytical data, and other intellectual capital

Message Confidentiality?
Enforcement tools are required—content protection should be automated.

Automatic Content-Based Privacy
Exchange Server 2010 provides a single point in the organization to control the protection of e-mail messages.
Automatic Content-based Privacy:
Transport Rule action to apply RMS template to e-mail message
Transport Rules support Regex scanning of attachments in Exchange 2010 (including content)
Internet Confidential and Do Not Forward Policies available out of box
38

What is Rights Management Services?
Windows Platform Information Protection Technology
Better safeguard sensitive information
Protect against unauthorized viewing, editing, copying, printing, or forwarding of information
Limit file access to only authorized users
Audit trail tracks usage of protected files
Persistent protection
Protects your sensitive information no matter where it goes
Uses technology to enforce organizational policies
Authors define how recipients can use their information

Protection via Transport Rules
New Transport rule action to “RMS protect”
Transport Rules support regular expression scanning of attachments in Exchange Server 2010
“Do Not Forward” policy available out of the box
Office 2003, Office 2007, Office 2010, and XPS documents are supported for attachment protection

Outlook Protection Rules
Allows an Exchange administrator to define client-side rules that will protect sensitive content in Outlook automatically
Rules can be mandatory or optional depending on requirements
Rules look at the following predicates:
Sender’s department (HR, R&D, etc.)
Recipient’s identity (specific user or distribution list)
Recipient’s scope (all within the organization, outside, etc.)
Rules are automatically retrieved from Exchange using Autodiscover and Exchange Web Services

Transport Pipeline Decryption
Enables Hub Transport agents to scan/modify RMS protected messages
Required for Antivirus scanning, Transport Rules or 3rd party agents
Decryption Agent
Decrypts message and attachments, using RMS super-user privileges
Only decrypts once per forest, on the first Hub, to improve performance
Option to non-deliver (NDR) messages that can’t be decrypted
Encryption Agent
Re-encrypts messages, message forks and NDRs with original Publishing License

How does it work?Transport Decryption
AD RMS
Active Directory
2. On first use, Exchange does an SCP lookup for the RMS server.
3. Exchange requests a RAC and CLC for the “shared identity” account. These are saved and re-used. The RAC is a super-user RAC.
1. Mail marked for protection or an already protected mail item.
Hub Transport
6. Process message is sent to next hop or delivered to the recipient.
4. Incoming IRM mail is decrypted so all agents have access to the decrypted content.
5. At the end of the agent pipeline the message is re-encrypted, including any changes made by agents.
Decryption
Encryption
Transport Rules
Journaling
Forefront Security for Exchange
3rd Party Agents

How does it work?
AD RMS
1. Administrator defines a set of Outlook Protection Rules. These are exposed via a web service to clients.
3. The first time a rule triggers the user is asked to get a RAC and CLC from RMS.
Client Access (OWA)
2. When the user connects to Exchange via CAS, the rules are automatically downloaded. They are then frequently updated on the client based on administrator changes.
4. The message is protected before the user sends.
User can override (if rule allows).

Streamlined End-User ExperiencePrevent RMS Protection from getting in user’s way
Pre-licensing enables offline and mobile access to RMS protected messages
IRM Feature Parity between Outlook and Outlook Web App
Conduct full-text search on RMS protected messages in Outlook Web Access
Built-in ability to create/consume RMS protected messages with Windows Mobile 6.x

Information Rights Management
MailTips
Moderation
Demo

Protected Content in Outlook
RMS Protection is applied both to the message itself and to the attachments.
Saved attachments retain the relevant protection (e.g. rights to view, print or copy content).

Protection via Transport Rules

Allows an Exchange administrator to define client-side rules that will protect sensitive content in Outlook automatically
Rules can be mandatory or optional depending on requirements
Rules look at the following predicates:
Sender’s department (HR, R&D, etc.)
Recipient’s identity (specific user or distribution list)
Recipient’s scope (all within the organization, outside, etc.)
Rules are automatically retrieved from Exchange using Autodiscover and Exchange Web Services

Step 1: User creates a new message in Outlook 2010.
Step 2: User adds a distribution list to the To line.
Step 3: Outlook detects a sensitive distribution list (DL) and automatically protects as MS Confidential.
Company Confidential - This content is confidential and proprietary information intended for company employees only and provides the following user rights: View, Reply, Reply All, Save, Edit, Print and Forward. Permission granted by: nwinters@gaots.co.uk

Rights Management Services Integration in Outlook Web Access

Manage Inbox Overload
Help Reduce Unnecessary and Undeliverable E-Mail Through New Sender MailTips
Remove Extra Steps and E-Mail
Limit Accidental E-Mail
Reduce Non-Delivery Reports
52

Journal

Journal Report Decryption

Rights Management Services Integration in Unified Messaging
Unified Messaging administrators can allow incoming voice mail messages to be marked as “private”
Private voice mail can be protected using “Do Not Forward”, preventing forwarding or copying content
Private voice mail is supported in Outlook 2010 and Outlook Web Application (OWA)

Rights Management Services Integration in Unified Messaging

Business to Business RMSSecurely Communicate with Partners
Today customers can communicate using RMS between organizations by deploying ADFS and setting up trusts
ADFS requires a separate trust between each partner
ADFS isn’t supported by Exchange
In Exchange Server 2010, customers can federate with the Microsoft Federation Gateway instead of each partner
A single federation point replaces individual trusts
Allows Exchange to act on-behalf-of users for decryption
Senders can control how their data is accessed by 3rd parties
By using federation, RMS can allow organizations and applications to access data on-behalf-of individuals
Specifically they can specify whether recipient organizations can archive e-mails in the clear
RMS administrator can control which 3rd parties can access data using federated authentication (allow/block list)

AD RMS Setup
MailTips
Demo

Features SummaryExchange 2010 Protection and Compliance

Key takeaways
Personal Archive gives seamless user experience and removes need for PSTs
Deep support for IRM
Automation enables ease of use and administration
Wide range of granular controls from Soft to Hard

Text Microsoftto 60300
Or
Tweet #uktechdays
Questions?

For resources, decks and video:
www.microsoft.com/uk/techdays
or my blog http://nathanwinters.co.uk

Related Content
Web link - http://www.microsoft.com/exchange/2010/en/us/information-protection-and-control.aspx
Web link - http://www.microsoft.com/exchange/2010/en/us/Archiving-and-retention.aspx
Breakout sessions

© 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Nathan Winters Exchange 2010 protection and compliance

by Nathan Winters

Accessibility

Upload Details

Usage Rights

1 Embed 18

Statistics