Data security and compliancy in Office 365

Uploaded on

Presented by Jethro Seghers.

Presented by Jethro Seghers.

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads


Total Views
On Slideshare
From Embeds
Number of Embeds



Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

    No notes for slide


  • 1. Jethro Seghers@jseghers –
  • 2. Located in Belgium Provides IT Business Consultancy - Evangelism  SharePoint 2010/2013 and Online  Cloud Services – Office 365, Windows Intune & Azure  IT as a service – MOF and ITIL v3@jseghers –
  • 3. Agenda Terminology Infrastructure settings Exchange Online Lync Online SharePoint Online Sources of Information@jseghers –
  • 4. Data Security
  • 5. The protection of data fromunauthorized (accidental or intentional)modification, destruction, or disclosure
  • 6. Data Compliance
  • 7. Compliance is either a state of being inaccordance with establishedguidelines, specifications, or legislationor the process of becoming so
  • 9. Infrastructure
  • 10. Overview Microsoft Datacenters & their locations DataFlow Privacy Encryption Identity Protection Password Policies@jseghers –
  • 11. Microsoft Datacenters . Physical Security  Secure physical access for authorized personnel only  State of the Art datacenters Hosted Applications Security  Anti SPAM  Encryption Mail Security Development Lifecycle  Potential threats while running a service  Exposed aspects of the service that are open to attack@jseghers –
  • 12. Microsoft Datacenters .. Secured Office 365 Services Infrastructure  Server Monitoring via System Center  Secure Remote Access via RDS  Intrusion Detection Network-level Security Measures  Customer Access via SSL  Uptime 99,9 % Identity & Access Management  Access control follows the separation of duties principle and granting least privilege.@jseghers –
  • 13. Where is our data stored: Example: EMEA A primary data center is where the application software and the customer data running on the application software are hosted. A backup data center is used for failover purposes Data center Dublin: Primary for F.O.P.E. Data center The Netherlands: SharePoint Online Dublin + The Netherlands: interchangeably Exchange Online + Lync Online@jseghers –
  • 14. What is stored in the US: EMEA Customer Information Microsoft Online Portal Routing Lync Online Communications Office 365 Authentication Additionally, Microsoft abides by the Safe Harbor Framework for transfer of data between the European Union and the United States.@jseghers –
  • 15. Privacy .Microsoft Online Usage Data Account and Customer Data CoreServices Customer Address Book (excluding Core Customer DataData Data Customer Data)Operating and Yes Yes Yes YesTroubleshooting theServiceSecurity, Spam and Yes Yes Yes YesMalware PreventionImproving the Yes Yes Yes NoPurchased Service,AnalyticsPersonalization, No Yes No NoUser ProfilePromotionsCommunications No Yes No No(Tips, Advice,Surveys,Promotions) – @jseghers
  • 16. Privacy ..Microsoft Online Usage Data Account and Customer Data CoreServices Customer Address Book (excluding Core Customer DataData Data Customer Data)Voluntary No No No NoDisclosure to LawEnforcementAdvertising No No No No @jseghers –
  • 17. Encryption HTTPS Communication with HTTPS Communication between clients and Exchange Online for all protocols PGP: Transportation and storage of Exchange Online Messages Lync Online: Instant Messaging, IM Federation SharePoint Online: HTTPS Connection (only for Enterprise & Academic)@jseghers –
  • 18. Identity Protection Identity stored in Microsoft Online Identity federation via SSO Granular Licenses Different Administrator Roles@jseghers –
  • 19. Identity options comparison 1. MS Online IDs 2. Federated IDs + Dir Sync• Authentication is done by Microsoft • Authentication is done by Corporate Infrastructure • Larger enterprise organizations with AD on-premisePros • Bound to the SLA of 99,9% of MSFT. Pros • Users and groups mastered on-premise • SSO with corporate cred • Users and groups mastered on-premiseCons • Password policy controlled on-premise • 2 sets of credentials that need to be • Enables co-existence scenarios maintained • Different Password policies Cons • High availability server deployments required
  • 20. Password Policy Password Restriction: 8 characters minimum and 16 characters maximum  Values allowed:  A-Z  a-z  0-9  !@#$%^&*-_+=[]{}|:‘,.?/`~“<>();  No UNICODE  Cannot contain the username alias (part before @ symbol) Password expiry duration:  This is set to 90 days and is not configurable@jseghers –
  • 21. Password Policy Password expiry:  Can be enabled/disable via powershell at user level Password strength  Strong passwords require 3 out of 4 of the following:  Lowercase characters  Uppercase characters  Numbers (0-9)  Symbols (see password restrictions above) Password history  Last password cannot be used again@jseghers –
  • 22. Password Policy Account Lockout  After 10 unsuccessful logon attempts (wrong password), the user will need to solve a CAPTCHA dialog as part of logon.@jseghers –
  • 23. Is thisIndependentlyVerified?
  • 24. MS Online Certification and Compliance Finder Certified for ISO 27001 EU Safe Harbor HIPAA-Business Associate Agreement Data Processing Agreement FISMA@jseghers –
  • 25. Exchange Online
  • 26. Exchange Online . Archiving Moderation Security/Distribution Groups Item Level Recovery Transport Rules Retention Policies – Managed Folder Assistent Deleted Mailbox Recovery@jseghers –
  • 27. Exchange Online .. Journaling F.O.P.E in Current Version, Built-In in EXO Wave 15 Auditing Retention Hold Litigation Hold Mobile Device@jseghers –
  • 28. DEMO
  • 29. Lync Online
  • 30. Lync Online Privacy Settings External Communications User Defined Settings  Sending files via IM  Make audio and video calls  Record Call and conferences  Federation with Lync users in other organizations  Federation with Users of public IM service providers  Dial-in Conferencing@jseghers –
  • 31. DEMO
  • 32. SharePoint Online
  • 33. SharePoint Online . Information Management Policy – Records Use Of Term Store & Required Fields – Content Types Drop Off Library Audit Blocked File Types Security Versioning Recycle Bin Backup: 14 days@jseghers –
  • 34. DEMO
  • 35. Sources Of Information Office 365 Trust Center : us/office365/trust-center.aspx Service Description Office 365 Password Policy Security White Paper Data Boundaries@jseghers –
  • 36. Questions