Global Security and Compliance Conference - Cologne
•Download as PPTX, PDF•
0 likes•21 views
During this session, I went into the options for eDiscovery and Microsoft Teams. Included is an insight into the Teams architecture.
Recommended
Recommended
More Related Content
Similar to Global Security and Compliance Conference - Cologne
Similar to Global Security and Compliance Conference - Cologne (20)
More from Albert Hoitingh
More from Albert Hoitingh (20)
Recently uploaded
Recently uploaded (20)
Global Security and Compliance Conference - Cologne
- 1. Global Security and Compliance Conference 13 – 14. Juni 2023 ⎜Köln ⎜#GSCC
- 2. eDiscovery and Microsoft Teams Global Security and Compliance Conference 2022 2 #GSCC Microsoft Purview
- 3. Sponsor Global Security and Compliance Conference 2022 3 Wir bedanken uns bei unseren Sponsoren ohne diese die Konferenz nicht möglich gewesen ist. KöllnService GmbH Noovic GmbH
- 4. Albert Hoitingh Sr. Consultant Compliance & Risk Lead Compliance Expert Team @InSpark The Hague – The Netherlands Microsoft Security MVP CISSP Global Security and Compliance Conference 2022 4 @Alberthoitingh https://linkedin.com/in/appieh https://alberthoitingh.com
- 5. Agenda • Look at Microsoft 365 eDiscovery options • How to use eDiscovery with Microsoft Teams • See what does and doesn’t work • Demonstrate both eDiscovery (Standard) and (Premium) Global Security and Compliance Conference 2022 5
- 6. Things we won‘t talk about… • Compliance boundaries • Predictive coding • Encrypted documents (or somewhat) • Attorney-client privilege • Targetted collections Global Security and Compliance Conference 2022 6
- 7. Electronic Discovery Or eDiscovery for short Global Security and Compliance Conference 2022 7
- 8. According to Wikipedia.. “Electronic discovery (also e-discovery or eDiscovery) refers to discovery in legal proceedings such as litigation, government investigations, or Freedom of Information Act requests, where the information sought is in electronic format (often referred to as electronically stored information or ESI” Global Security and Compliance Conference 2022 8
- 9. EDRM Model Electronic Discovery Reference Model Processing Preservation Identification Review Production and Presentation Analysis Collection
- 10. Microsoft Purview • Content Search • eDiscovery (Standard or “Core”) • eDiscovery (Premium or “Advanced”)
- 11. Licensing eDiscovery (Standard) • Office 365/Microsoft 365 E3 • Microsoft 365 F5 • Separate licenses for mailbox holds (if not part of E3/E5) https://bit.ly/3LLGoMw
- 12. Licensing eDiscovery (Premium) • Office 365 E5 | Microsoft 365 E5 • Microsoft 365 E3 and • E5 Compliance • E5 eDiscovery & Audit • Office/Microsoft 365 Education A5 https://bit.ly/3LLGoMw
- 13. Microsoft Teams architecture Global Security and Compliance Conference 2022 13
- 14. Teams is simple, right? • Channels • Conversations • Cards • Meetings Global Security and Compliance Conference 2022 14
- 15. More complex Teams architecture Global Security and Compliance Conference 2022 15
- 16. More complex Teams architecture Global Security and Compliance Conference 2022 17
- 17. More complex Teams architecture Global Security and Compliance Conference 2022 18
- 18. What is (not) discoverable? • Card content • Chat links | messages | edited messages | quotes • Emojis, GIF’s, stickers, inline images • Meeting conversations | metadata • Code snippets • Subjects, Tables • Linked documents (advanced) • Shared document • Audio recordings | Meeting transcripts • Channel names • Reactions • Feed notifications Global Security and Compliance Conference 2022 19 Some in preview/release
- 19. Global Security and Compliance Conference 2022 20 Coming soon/in preview
- 20. Meeting summary Kind:Meetings (can take 8 hours) Call summary Kind:Call (can take 8 hours) Search for Teams information All Microsoft Teams Kind:Microsoftteams Card Kind:Microsoftteams (look for “appname”) Conversation or chat Kind:IM (beware Skype for Business) Global Security and Compliance Conference 2022 21
- 21. Short demonstration Content Search eDiscovery (Standard) Global Security and Compliance Conference 2022 22
- 22. eDiscovery (Premium) Global Security and Compliance Conference 2022 23
- 23. eDiscovery (Premium) workflow Global Security and Compliance Conference 2022 24
- 24. Global Security and Compliance Conference 2022 25
- 25. Global Security and Compliance Conference 2022 26 Custodians & other data sources
- 26. Global Security and Compliance Conference 2022 27 Subsets of information based on queries Either is draft or final mode (committed – cannot be altered).
- 27. Global Security and Compliance Conference 2022 28 Used to review found information Allows you select information, annotate information and export results
- 28. Global Security and Compliance Conference 2022 29 Stored export jobs
- 29. Global Security and Compliance Conference 2022 30 Information on job status. Crucial to get an insight.
- 30. Exporting information Global Security and Compliance Conference 2022 31 • Difference in Standard and Premium • Either file or Azure Storage • If configured, redacted PDFs are included • When possible, information is also converted to text • Conversations are stored as HTML
- 31. Exporting information Global Security and Compliance Conference 2022 32 • Difference in Standard and Premium • Either file or Azure Storage • If configured, redacted PDFs are included • When possible, information is also converted to text • Conversations are stored as HTML
- 32. Short demonstration eDiscovery (Premium) Global Security and Compliance Conference 2022 33
- 33. More advanced subjects Global Security and Compliance Conference 2022 34
- 34. Break-out rooms Global Security and Compliance Conference 2022 35 • Documents stored in the initiator’s OneDrive • Chats (substrates) stored in the initiator’s mailbox • Recordings are stored in the initiator’s OneDrive
- 35. Private/shared channels documents Global Security and Compliance Conference 2022 36 • Stored in a separate SharePoint Online site-collection • Use PowerShell to find all site- collections • Include in eDiscovery query
- 36. Private channel conversations Global Security and Compliance Conference 2022 37 • Conversations in a private channel are stored in the mailbox of the private channel members, not the group mailbox! • Conversations are formatted, so they are visible using filters
- 37. Shared channel conversations Global Security and Compliance Conference 2022 38 • Conversations in a shared channel are stored in a separate system mailbox – this cannot be selected! • Instead – select the mailbox for the Teams itself (as the shared channel is associated with this one)
- 38. Microsoft Loop Global Security and Compliance Conference 2022 39 • OneDrive for Business | Chat Files • .fluid files are discoverable • No preview • Export is tricky – but on the roadmap!
- 39. Wrapping up Global Security and Compliance Conference 2022 40
- 40. Complex! Global Security and Compliance Conference 2022 41 • Beware of the many different locations when creating an eDiscovery case • Beware of breakout rooms, private & shared channels • You will need find and include all site-collections and users' mailboxes for the shared channel….. • Loop is still somewhat difficult but can be done! • Committed collections cannot be rerun or edited
- 41. Beware the roadmap! Global Security and Compliance Conference 2022 42 https://bit.ly/43BxdWK
- 42. Thank you! Feedback? Global Security and Compliance Conference 2022 43 https://forms.office.com/e/J5TB8AN3Ve
- 43. Albert Hoitingh Global Security and Compliance Conference 2022 44 @Alberthoitingh https://linkedin.com/in/appieh https://alberthoitingh.com
Editor's Notes
- Processing. After you've collected all data relevant to the case, the next step is process it for further review and analysis. In eDiscovery (Premium), the in-place data that you identified in the collection phase is copied to an Azure Storage location (called a review set), which provides you with a static view of the case data.