Office 365 Security And Compliance
•Download as PPTX, PDF•
0 likes•52 views
Office 365 Security And Compliance
Recommended
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Office 365 Security And Compliance
Similar to Office 365 Security And Compliance (20)
Recently uploaded
Recently uploaded (20)
Office 365 Security And Compliance
- 3. Our commitment to trust
- 4. Customer challenges 2 billion records compromised in the last year 140+ days between infiltration and detection 87% of senior managers admit using personal accounts for work 45% of organizations lack data governance which leaves them open to litigation and data security risks Ever-evolving industry standards across geographies
- 8. User log-ins Unauthorized data access Data encryption Malware System updates Enterprise security Attacks Phishing Denial of service User accounts Device log-ins Multi-factor authentication
- 12. Enterprise reliability via 100+ data centers and Microsoft’s global network edge Compliance leadership with standards including ISO 27001, FISMA, and EU Model Clauses No standing access to data, transparent operational model, and financial-backed 99.9% SLA Secure by design, operationalized at the physical, logical, and data layers Global, hyper-scale, enterprise-grade infrastructure
- 13. Over 1000 controls in the Office 365 compliance framework enable us to stay up to date with the ever-evolving industry standards across geographies. Trust Microsoft’s verified services. Microsoft is regularly audited, submits self-assessments to independent 3rd party auditors, and holds key certifications. Key certifications United States CJIS CSA CCM DISA FDA CFR Title 21 Part 11 FEDRAMP FERPA FIPS 140-2 FISMA HIPPA/HITECH HITRUST IRS 1075 ISO/IEC 27001, 27018 MARS-E NIST 800-171 Section 508 VPATs SOC 1, 2 Argentina Argentina PDPA CSA CCM IRAP (CCSL) ISO/IEC 27001, 27018 SOC 1, 2 Spain CSA CCM ENISA IAF EU Model Clauses EU-U.S. Privacy Shield ISO/IEC 27001, 27018 SOC 1, 2 Spain ENS LOPD United Kingdom CSA CCM ENISA IAF EU Model Clauses ISO/IEC 27001, 27018 NIST 800-171 SOC 1, 2, 3 UK G-Cloud Japan CSA CCM CS Mark (Gold) FISC ISO/IEC 27001, 27018 Japan My Number Act SOC 1, 2 Singapore CSA CCM ISO/IEC 27001, 27018 MTCS SOC 1, 2 New Zealand CSA CCM ISO/IEC 27001, 27018 NZCC Framework SOC 1, 2 Australia CSA CCM IRAP (CCSL) ISO/IEC 27001, 27018 SOC 1, 2 European Union CSA CCM ENISA IAF EU Model Clauses EU-U.S. Privacy Shield ISO/IEC 27001, 27018 SOC 1, 2, China China GB 18030 China MLPS China TRUCS
- 14. Privacy Customer is the owner of their data. We do not mine customer data for advertising purposes. Privacy controls enable you to configure your company privacy policies. Microsoft advocates for data privacy on behalf of customers. Microsoft safeguards customer data with strong contractual commitments.
- 15. Transparency Know where your data is stored. Understand who has access your data and under what circumstances. Monitor the state of your service, get historic view of uptime. Integrate security events’ feeds into your company security dashboard. Gain insight with access to service dashboards & operational reporting.
- 16. Security Built-in operational security Safeguards to prevent unauthorized access and data loss Detect and protect against external threats
- 17. Operational security Physical security with 24-hour monitoring and multi-factor authentication Admin background checks Zero-standing access to data Data encryption at-rest and in-transit Red team / Blue team penetration testing and incident response practice Product development using Security Development Lifecycle Bug bounty program to identify vulnerabilities
- 18. Safeguarding your data Identify, label, classify, set policies to help protect information. Encrypt your data and restrict access using Azure Information Protection. Safeguard information with Data Loss Prevention. Get visibility into and improve your security position with Secure Score Restrict unauthorized data sharing across apps with MAM. Prevent data leaks with support for Windows Information Protection. Manage data on devices through built-in MDM. Securely communicate with customers using Message Encryption. Personal apps Managed apps
- 19. Detect and protect against external threats Block 100% of known malware and 99% of spam with Exchange Online Protection. Provide zero-day protection against unknown malware in attachments and links with Advanced Threat Protection. Providing actionable insights to global attack trends with Threat Intelligence. Get alerts of suspicious behavior using Advanced Security Management. Secure user accounts with Conditional Access and multi-factor authentication.
- 20. Compliance Meet compliance obligations for data access with Customer Lockbox. Monitor and investigate events related to your data with full audit tracking. Reduced cost and risk with in-place intelligent Advanced eDiscovery. Efficiently perform risk assessment with Service Assurance. Manage data retention with Advanced Data Governance.
- 22. Discover: In-scope: • • • • • • • • • • Inventory: • • • • • • • Microsoft Azure Microsoft Azure Data Catalog Enterprise Mobility + Security (EMS) Microsoft Cloud App Security Dynamics 365 Audit Data & User Activity Reporting & Analytics Office & Office 365 Data Loss Prevention Advanced Data Governance Office 365 eDiscovery SQL Server and Azure SQL Database SQL Query Language Windows & Windows Server Windows Search Example solutions 1
- 23. 2 Example solutions Manage: Data governance: • • • • • • • • Data classification: • • • • • • • Microsoft Azure Azure Active Directory Azure Role-Based Access Control (RBAC) Enterprise Mobility + Security (EMS) Azure Information Protection Dynamics 365 Security Concepts Office & Office 365 Advanced Data Governance Journaling (Exchange Online) Windows & Windows Server Microsoft Data Classification Toolkit
- 24. 3 Example solutions Protect: Preventing data attacks: • • • • • • • • Detecting & responding to breaches: • • • • • • Microsoft Azure Azure Key Vault Enterprise Mobility + Security (EMS) Azure Active Directory Premium Microsoft Intune Office & Office 365 Advanced Threat Protection Threat Intelligence SQL Server and Azure SQL Database Transparent data encryption Always Encrypted Windows & Windows Server Windows Defender Advanced Threat Protection Windows Hello Device Guard
- 25. 4 Example solutions Report: Record-keeping: • • • • • Reporting tools: • • • • • • Microsoft Trust Center Service Trust Portal Microsoft Azure Azure Auditing & Logging Microsoft Azure Monitor Enterprise Mobility + Security (EMS) Azure Information Protection Dynamics 365 Reporting & Analytics Office & Office 365 Service Assurance Office 365 Audit Logs Customer Lockbox Windows & Windows Server Windows Defender Advanced Threat Protection
- 27. © 2015 Microsoft Corporation. All rights reserved. 27
Editor's Notes
- For additional information on Microsoft’s security stance, please reference the below video featuring Satya Nadella. http://news.microsoft.com/security2015/ Updated August 2016
- Bamburgh Castle lidt syd for Edinburgh på grænsen mellem Skotland og England – defeted in 1464 as first British castle (artillery) af Richard Niville – Kongemageren Warwick
- MSFT Field - Please view associated material at: http://infopedia/SMSG/Pages/EnterpriseSecurity.aspx 2 billion records compromised in the last year: Risk Based Security 140+ days between infiltration and detection: Mandiant Consulting M-Trends 2016 87% of senior managers admit using personal accounts for work: Stroz Friedberg On the Pulse Information Security in American Business 50% year over year growth in electronic data: AIIM – Information Management in 2016 and Beyond, March
- MSFT Field - Please view associated material at: http://infopedia/SMSG/Pages/EnterpriseSecurity.aspx
- People – identity, device, apps, data MSFT Field - Please view associated material at: http://infopedia/SMSG/Pages/EnterpriseSecurity.aspx
- People – identity, device, apps, data MSFT Field - Please view associated material at: http://infopedia/SMSG/Pages/EnterpriseSecurity.aspx
- Office 365 is a global service with over 1000+ security and privacy controls that enable us to stay up to date with standards and regulations that apply to your industry and geography. We have built a specialist compliance team that is continuously tracking standards and regulations, and developing common control sets for our product team to build into the service. · EU Model Clauses: Ensures appropriate safeguards are in place to protect personal data that leaves the European Economic Area. · ISO 27018: Microsoft was the first cloud service provider to comply with this new standard which protects personally identifiable information and ensures your data will not be used for advertising purposes We also regularly audit our controls and submit self assessments to independent 3rd party auditors. We are actively working with countries and regions to stay up to date or meet relevant compliance regulations. For example Microsoft is committing to be GDPR compliant across our cloud services when enforcement begins on May 25, 2018. Read more at https://blogs.microsoft.com/on-the-issues/2017/02/15/get-gdpr-compliant-with-the-microsoft-cloud/#exsm1d4kB8pquRAh.99
- Add talk track around GDPR
- MSFT Field - Please view presenter notes/talk track at: aka.ms/gdprnotes View the Microsoft external site for more information: www.Microsoft.com/GDPR Microsoft Azure: Microsoft Azure Data Catalog Enterprise Mobility + Security (EMS): Microsoft Cloud App Security Dynamics 365: Audit Data and User Activity Report & Analytics with Dynamics 365 Dynamics 365 metadata & data models Office & Office 365: Data Loss Prevention Advanced Data Governance Office 365 eDiscovery SQL Server and Azure SQL Database: SQL Query Language
- MSFT Field - Please view presenter notes/talk track at: aka.ms/gdprnotes View the Microsoft external site for more information: www.Microsoft.com/GDPR
- MSFT Field - Please view presenter notes/talk track at: aka.ms/gdprnotes View the Microsoft external site for more information: www.Microsoft.com/GDPR Microsoft Azure: Azure Security Center Data Encryption in Azure Storage Azure Key Vault Log Analytics Enterprise Mobility + Security (EMS): Azure Active Directory (Azure AD) Azure Active Directory Premium Cloud App Security Microsoft Cloud App Security Microsoft Intune Microsoft Azure Information Protection Office & Office 365: Advanced Threat Protection Threat Intelligence Advanced Security Management Office 365 Audit Logs SQL Server and Azure SQL Database: Azure SQL Database firewall SQL Server authentication Dynamic Data Masking (DDM) Row-Level Security (RLS) Transparent Data Encryption Always Encrypted Auditing for SQL Database and SQL Server audit SQL Database Threat Detection Windows 10 & Windows Server 2016: Windows Hello Windows Defender Antivirus Windows Defender Advanced Threat Protection Device Guard Credential Guard BitLocker Drive Encryption Windows Information Protection Shielded Virtual Machines Just Enough Administration and Just in Time Administration
- MSFT Field - Please view presenter notes/talk track at: aka.ms/gdprnotes View the Microsoft external site for more information: www.Microsoft.com/GDPR
- MSFT Field - Please view presenter notes/talk track at: aka.ms/gdprnotes View the Microsoft external site for more information: www.Microsoft.com/GDPR
- One of the biggest challenges in security is protecting users against not only known attack vectors, but unknown ones. With Office 365 Advanced Threat Protection – or ATP – you can do both – and you can also keep track of the targets and types of threats that you face. ATP provides robust defenses against spam, phishing, and other advanced threats within Office 365. But what’s really exciting about this feature is that it can protect even against entirely new, unknown, “zero day” attacks. When a user receives an attachment with an unknown virus signature, the attachment gets held back in a sandbox environment, where behavioral analysis techniques are used to assess it for malicious intent. To avoid delays while that assessment happens, the rest of the email is delivered with a placeholder for the attachment, to be replaced by the attachment itself if it is determined to be safe. Beyond its active protection capabilities, ATP also provides rich reporting and tracking features to help you discover who or what within your organization is being targeted for attack, and what kinds of attacks are being used against you. These critical insights show you where you need to focus additional security resources, and help to suggest what types of protections would be most useful to deploy.
- To help organizations with this problem, we built Office 365 Advanced Security Management which provides you with enhanced visibility and control into your Office 365 environment. At a high level, it does this in three ways. You get the ability to detect threats by helping you identify high-risk and abnormal usage, security incidents, and threats. Advanced Security Management also provides you with enhanced control by leveraging granular controls and security policies that can help you shape your Office 365 environment. You also get enhanced visibility and context into your Office 365 usage and shadow IT though the discovery and insights that the solution provides, all without installing an end-point agent. Let’s go a bit deeper into each one of these areas, starting with how we give you the ability to detect threats.
- Marissa to get screenshot Meet Compliance Needs Customer Lockbox can enable customers to meet compliance needs by demonstrating that they have procedures in place for explicit data access authorization. Customer Lockbox can help customers meet controls in regulations such as in HIPAA and FEDRAMP. Extended Access Control Use Customer Lockbox to control access to customer content for service operations. Customers who initiate the original request will grant final approval access to the Microsoft engineer. Customers have visibility into the purpose and length of access. Access to customer content will be revoked when service operation is completed. Visibility into Actions Actions taken by Microsoft engineers in response to Customer Lockbox requests are logged and accessible via the Management Activity API or the Security and Compliance Center.
- In-place, intelligent eDiscovery Office 365 offers a rich set of eDiscovery in-place capabilities including preservation, search, analysis, and export to help our customers simplify the eDiscovery process to quickly identify relevant data while decreasing cost and risk. Streamline with advanced data analysis The eDiscovery process for a single case often involves sorting through hundreds of thousands of email messages, documents, and other data to find the small number of files that may be relevant. Office 365 Advanced eDiscovery integrates Equivio machine learning, predictive coding, and text analytics to reduce the costs and challenges of sorting through large quantities of data. Enhanced focus on what’s relevant Office 365 Advanced eDiscovery helps to efficiently organize your eDiscovery process and reduce the volume of data by finding near-duplicate files, reconstructing email threads, and identifying key themes and data relationships. You can also use predictive coding to further reduce the volume of data by training the system to intelligently explore and analyze large, unstructured datasets and quickly zero in on what’s relevant. Throughout the process, your data stays in place, indexed in real time with no need to ship massive volumes of data to an outsourced process. This streamlines eDiscovery, saving you time and money while reducing risk because your data remains protected by stringent Microsoft security. Finally, once you are ready for review, you can export the data to integrated third-party review applications hosted in Azure.
- Check with AJ if positioning changed
- To address these concerns, Microsoft has released Service Assurance as part of the Office 365 Security and Compliance Center. Service Assurance provides information about how Microsoft’s cloud services maintain security, privacy and compliance with global industry standards. Service Assurance also includes independent third-party audit reports for Office 365, Yammer, Azure, CRM Online, and Intune, as well as implementation and testing details for the security, privacy, and compliance controls used by Office 365 to protect customer data. Providing you immediate access to: Details on how Office 365 implements security, privacy and compliance controls including details of how third-party independent auditors perform audits to test these controls. Third-party independent audit reports including: SSAE 16 / SOC 1, SOC 2 / AT 101, ISO 27001 and ISO 27018. Deep insights into how we implement encryption, incident management, tenant isolation and data resiliency. Information on how you can leverage Office 365 security controls and configurations to protect your data.
- Remove barriers to adoption for Office 365 Drive premium value and ARPU Accelerate E5 growth Establish Microsoft as a leader in security & compliance