Download to read offline
EMS GDPR Generic_Overview Deck_June 2017.pptx
- 1. This presentation isintended to provide an overview of GDPR how EMS technologies can support you and is not a definitive statement of the law. Supporting your journey to EU GDPR compliance with Microsoft Enterprise Mobility + Security
- 2. The General DataProtection Regulation (GDPR) imposes new rules on organizations in the European Union (EU) and those that offer goods and services to people in the EU, or that collect and analyze data tied to EU residents, no matter where they are located. EU General Data Protection Regulation Enhanced personal privacy rights Increased duty to protect data Mandatory breach reporting Significant penalties for non-compliance
- 3. When must webe compliant? What if we are not compliant? Who needs to be compliant? Organizations inside or outside of the EU that process personal data of EU residents. Companies can be fined up to €20m or 4% of annual global turnover, whichever is greater, for failure to meet GDPR requirements. The European Parliament approved and adopted the GDPR in April 2016 and enforcement begins on May 25, 2018.
- 4. 2012 May 252018 Spring 2014 April 27 2016 2016/2017 2015 EU Council reaches agreement Separate negotiations within Council and European parliament European Commission publishes legislative proposal EP reaches agreement Negotiations and approval among the three institutions Regulation published in the Official Journal Two-year implementation phase EU general data protection regulation START European Commission European Parliament EC EP EU Regulation applies going forward
- 5. What are thekey changes to address the GDPR? Personal privacy Controls and notifications Transparent policies IT and training Organizations will need to: • Train privacy personnel & employees • Audit and update data policies • Employ a Data Protection Officer (if required) • Create & manage compliant vendor contracts Organizations will need to: • Protect personal data using appropriate security • Notify authorities of personal data breaches • Obtain appropriate consents for processing data • Keep records detailing data processing Individuals have the right to: • Access their personal data • Correct errors in their personal data • Erase their personal data • Object to processing of their personal data • Export personal data Organizations must: • Provide clear notice of data collection • Outline processing purposes and use cases • Define data retention and deletion policies
- 6. Improved data policiesand processes to support data subject rights and ensure lawful processing Stricter control on where personal data is stored and how it is used Better data governance tools for better transparency, recordkeeping and reporting What does this mean for data privacy?
- 7. of US organizationsconsider GDPR compliance their top data protection priority1 92% “By the end of 2018, more than 50 percent of companies affected by the GDPR will not be in full compliance with its requirements.” Organizations Are Unprepared for the 2018 European Data Protection Regulation, Gartner Newsroom; May 3, 2017 http://www.gartner.com/newsroom plan to spend $1M USD or more on GDPR compliance1 77% of EU organizations indicate they have documented the sensitive data they house2 50% 1. http://www.pwc.com/us/en/increasing-it-effectiveness/publications/gdpr-readiness.html 2. https://securityintelligence.com/prepared-for-the-general-data-protection-regulation-gdpr-top-10-findings-from-hurwitz-associates-survey/ Gartne r
- 8. Preparing for theGDPR Leverage guidance from experts Use our partner network to help you meet your privacy, security, and compliance goals Simplify your privacy journey Elevate your privacy practices with our cloud Uncover risk & take action Use our solutions to expose areas of risk and respond with agility and confidence
- 9. “Businesses and usersare going to embrace technology only if they can trust it.” Satya Nadella Chief Executive Officer Microsoft Corporation Microsoft is the industry leader in privacy and security with extensive expertise complying with complex regulations. We take a principled approach with strong commitments to privacy, security, compliance and transparency. Moving to the cloud makes it easier for you to become compliant with privacy regulations by managing and protecting personal data in a centralized location.
- 10. Microsoft is theindustry leader in privacy and security with extensive expertise complying with complex regulations. We take a principled approach with strong commitments to privacy, security, compliance and transparency. Moving to the cloud makes it easier for you to become compliant with privacy regulations by managing and protecting personal data in a centralized location. To simplify your path to compliance, Microsoft will be GDPR-compliant across our cloud services when enforcement begins on May 25, 2018. We will share our experience in complying with complex regulations such as the GDPR. Together with our partners, we are prepared to help you meet your policy, people, process, and technology goals on your journey to GDPR. Our commitment to you…
- 11. How do Iget started? Discover Identify what personal data you have and where it resides. Manage Govern how personal data is used and accessed. Protect Establish security controls to prevent, detect, and respond to vulnerabilities & data breaches. Report Keep required documentation, manage data requests and breach notifications.
- 12. Discover In-scope Any datathat helps you identify a person Name Email address Social media posts Physical, physiological, or genetic information Medical information Location Bank details IP address Cookies Cultural identity Inventory Any container where personal data is collected and stored Emails Documents Databases Removable media Metadata Log files Backups Identify what personal data you have and where it resides
- 13. Manage Govern how personaldata is used and accessed Data governance Defining policies, roles and responsibilities for the management and use of personal data At rest In process In transit Storing Recovery Archiving Retaining Disposal Data classification Organizing and labeling data to ensure proper handling Types Sensitivity Context / use Ownership Custodians Administrators Users
- 14. Protect Establish controls to prevent,detect, and respond to vulnerabilities and breaches Preventing data attacks Protecting your data Physical datacenter protection Network security Storage security Compute security Identity management Access control Encryption Risk mitigation Detecting & responding to breaches Monitoring for and detecting system intrusions System monitoring Breach identification Calculating impact Planned response Disaster recovery Notifying DPA & customers
- 15. Report Keep detailed records abouthow personal data is handled Record-keeping Enterprises will need to record the: Purposes of processing Classifications of personal data Third-parties with access to the data Organizational and technical security measures Data retention times Reporting tools Implement reporting capabilities Cloud services (processor) documentation Audit logs Breach notifications Handling Data Subject Requests Governance reporting Compliance reviews
- 16. Supporting your GDPR compliance journeywith Microsoft Enterprise Mobility + Security
- 17. Microsoft Enterprise Mobility+ Security can help you on your GDPR journey Holistic Helps you address security challenges across users (identities), devices, data, apps, and platforms―on- premises and in the cloud. Identity-driven Offers one protected common identity for secure access to all corporate resources, on-premises and in the cloud, with risk-based conditional access Persistent Provides persistent data protection on-premises and in the cloud with innovative and sophisticated technologies Intelligent Enhances threat and anomaly detection with the Microsoft Intelligent Security Graph driven by a vast amount of datasets and machine learning in the cloud
- 18. Access granted to data Supporting yourGDPR compliance journey with Microsoft Enterprise Mobility + Security Apps Risk MICROSOFT INTUNE AZURE ACTIVE DIRECTORY MICROSOFT CLOUD APP SECURITY AZURE INFORMATION PROTECTION MICROSOFT ADVANCED THREAT ANALYTICS ! Device ! CONDITIONAL ACCESS Location Classify Audit Protect Label ! !
- 19. Corporate Public Private cloud Vendors SaaS Ex-employees Online backup Graphic designer Offshore teams Legal review Agency teams Project Lead Salesteams Project Manager Project Lead Remote team Personal Data is shared more often and more widely than ever.
- 20. Key scenarios EMShelps you address How to provide persistent data protection on-premises and in the cloud How to grant and restrict access to data How to protect data in mobile devices and applications How to gain visibility and control of data in cloud apps How to detect data breaches before they cause damage
- 21. How to provide persistentdata protection on- premises and in the cloud Online backup Email Out of your control Mobile devices, SaaS apps SaaS apps Cloud storage Mobile devices On-premises
- 22. Personal data Any informationrelated to an identified or identifiable natural person including direct and indirect identification. Examples include: • Name • Identification number (e.g., SSN) • Location data (e.g., home address) • Online identifier (e.g., e-mail address, screen names, IP addresses, device IDs) Sensitive personal data Personal data afforded enhanced protections: • Genetic data (e.g., an individual’s gene sequence) • Biometric Data (e.g., fingerprints, facial recognition, retinal scans) • Sub categories of personal data including: • Racial or ethnic origin • Political opinions, religious or philosophical beliefs • Trade union membership • Data concerning health • Data concerning a person’s sex life or sexual orientation How the EU GDPR defines personal data
- 23. Protect data on-premisesand in the cloud with Azure Information Protection Classification and labeling Classify data based on sensitivity and add labels— manually or automatically. Protection Encrypt your sensitive data and define usage rights or add visual markings when needed. Monitoring Use detailed tracking and reporting to see what’s happening with your shared data and maintain control over it.
- 24. Classification and labeling PERSONAL HIGHLY CONFIDENTIAL CONFIDENTIAL GENERAL PUBLIC Youcan override a classification and optionally be required to provide a justification. Manual reclassification Policies can be set by IT Admins for automatically applying classification and protection to data. Automatic classification Based on the content you’re working on, you can be prompted with suggested classification. Recommended classification Users can choose to apply a sensitivity label to the email or file they are working on with a single click. User-specified classification
- 25. Classification and labeling Discoverpersonal data and apply persistent labels Labels are persistent and readable by other systems e.g. DLP engine Labels are metadata written to data Sensitive data is automatically detected
- 26. Protection Discover personal datawith auto-classification Data is auto-classified based on content Sensitive data is automatically detected
- 27. Protection IT Admins canset policies to automatically control, protect, and watermark data. Protection policies Azure Information Protection encrypts files containing personal data according to policies. File encryption
- 28. Protection Safely share datawith people inside and outside of your organization. Define explicit permissions for recipients, e.g., allow people to view and edit, but not print or forward. Secure sharing
- 29. Monitor distribution Elevate yourprivacy practices with our cloud Track and control data anywhere Log access Bob accessed from S. America Jane accessed from India Joe blocked in N. America Jane blocked in Africa 11 2 8 8 8 8 2 1 1 Jane Competitors Revoke access Jane’s access is revoked Bob Jane Sue
- 30. Monitoring Analyze the flowof personal and sensitive data and detect risky behaviors. Distribution visibility Track who is accessing documents and from where. Access logging Prevent data leakage or misuse by changing or revoking document access remotely. Access revocation
- 31. How to grantand restrict access to data
- 32. Bing Xbox Live OneDrive Microsoft Digital CrimesUnit Microsoft Cyber Defense Operations Center Azure Microsoft Accounts Skype Enterprise Mobility + Security Azure Active Directory Microsoft’s collective intelligence
- 33. IF Privileged user? Credentials foundin public? Accessing sensitive app? Unmanaged device? Malware detected? IP detected in Botnet? Impossible travel? Anonymous client? High Medium Low User risk 10 TB per day THEN Require MFA Allow access Deny access Force password reset ****** Limit access High Medium Low Session risk Azure Bing OneDrive Microsoft Cyber Defense Operations Center Microsoft Cybercrime Center Xbox Live Microsoft Accounts Skype Risk-based conditional access
- 34. Privileged identity management Enforceon-demand, just-in-time administrative access when needed Use Alert, Audit Reports and Access Review Domain User Global Administrator Discover, restrict, and monitor privileged identities Domain User Administrator privileges expire after a specified interval
- 35. How to protectdata in mobile devices and mobile apps
- 36. Secure devices withMicrosoft Intune mobile device management capabilities Managed apps Personal apps Advanced device management Enforce device security policies such as encryption, password/PIN requirements, jailbreak/root detection and more. Remote actions Enforce device security policies such as encryption, password/PIN requirements, jailbreak/root detection and more. Device security configuration Restrict access to specific applications or URL addresses on mobile devices and PCs. Restrict apps and URLs
- 37. Protect data atthe app level with Microsoft Intune mobile app protection policies Managed apps Personal apps Personal apps MDM (3rd party or Intune) optional App-level protection available with or without enrollment. Managed apps Restrict features, sharing and downloads Corporate data Personal data Multi-identity policy Multi-identity allows you to separate company data from personal data within an app. Data separation Control what happens to docs and data after they’ve been accessed with app protection policies. • App encryption at rest • App access control—PIN or credentials • Save as/copy/paste restrictions • App-level selective wipe • Apply policies for Windows 10 Information Protection for even greater control Data control
- 38. How to gainvisibility and control of data in cloud apps
- 39. Gain deep visibilityand granular controls into cloud app usage with Microsoft Cloud App Security Cloud discovery Discover cloud apps used in your organization, get a risk assessment and alerts on risky usage. Data visibility Gain deep visibility into where data travels by investigating all activities, files and accounts for managed apps. Data control Monitor and protect personal and sensitive data stored in cloud apps using granular policies.
- 40. Cloud discovery Get anomaloususage alerts, new app and trending apps alerts. On-going analytics Discover 13K+ cloud apps in use across your networks and sensitive data they store. Discovery of cloud apps and data Assess risk cloud apps based on ~60 security and compliance risk factors. Cloud app risk assessment Protect your employees’ privacy while discovering cloud apps in your environment. Log anonymization
- 41. Data visibility Compare classificationlabels against how that data is being shared to identify risk. Cloud data visibility Investigate on users, file, activities, locations and managed apps, quantify exposure and risk. Advanced incident investigation tools
- 42. Data control Set granularpolicies to control data in the cloud—either automated or based on file label —using out-of-the-box policies or you can customize your own. Granular Data loss prevention (DLP) policies Detect and manage 3rd party app access. Revoke access for 3rd party apps Identify policy violations, enforce actions such as quarantine and permissions removal. Policy enforcement
- 43. Cloud App Securityreads labels set by AIP to give admins visibility into sharing of sensitive files. Increased visibility Admins can set policies for controlling sharing of sensitive files and also get alerted if the policies are violated. Improved control Cloud App Security and Azure Information Protection integration
- 44. How to detectdata breaches before they cause damage
- 45. On-premises abnormal behavior andadvanced threat detection Advanced Threat Analytics Identity-based attack and threat detection Azure Active Directory Behavioral analytics helps detect & prevent data breaches Anomaly detection for cloud apps Cloud App Security ! ! !
- 46. Behavioral analytics forthreat protection Analyze Learn Detect Analyze the traffic and identity traffic and data related activities across the network including relevant events from SIEM and in real-time. Uses the organizational security graph to detect abnormal behavior, file activity, protocol attacks, and weak security configurations. Automatically learn the common behaviors for users and entities on the network to build an organizational security graph. Alert Intelligently use the learned context to prevent false positives and prioritize alerts, remediate problems automatically, and present attack timelines.
- 47. Monitors behaviors ofusers and other entities by using multiple data-sources Profiles behavior and detects anomalies by using machine learning algorithms Evaluates the activity of users and other entities to detect advanced attacks Credit card companies monitor cardholders’ behavior. By observing purchases, behavioral analytics learn what behavior is typical for each buyer. If there is any abnormal activity, they will notify the cardholder to verify charge. User and entity behavioral analytics $ $ $ $ 3 hours
- 48. Microsoft Advanced ThreatAnalytics Microsoft Advanced Threat Analytics brings the behavioral analytics concept to IT and the organization’s users. Behavior al Analytics Detection of advanced attacks and security risks Advanced Threat Detection An on-premises platform to identify advanced security attacks and insider threats before they cause damage
- 49. Advanced Threat Analytics ATA buildsthe organizational security graph, detects abnormal behavior, protocol attacks, and weaknesses. 3. Detect ATA observes and learns all entities’ behaviors automatically. 2. Learn ATA uses context to prevent false positives and presents alerts as an attack timeline. 4. Alert ATA analyzes all Active Directory-related traffic and collects relevant events from SIEM. 1. Analyze
- 50. Advanced Threat Analytics Deep packetinspection and threat intelligence helps identify advanced attacks such as Pass-the- Hash, Skeleton Key Malware, and Honey token. Advanced attacks in near real-time ATA uses machine learning algorithms to detect anomalous logins, abnormal behavior and resource access, and unusual working hours. Abnormal behavior ATA identifies known security issues and risks such as expose passwords in cleartext over the network, broken trust, weak protocols and protocol vulnerabilities. Known security issues and risks
- 51. Cloud App Security threatdetection Gain useful insights from user, file, activity, and location logs. Advanced investigation Assess risk in each transaction and identify anomalies in your cloud environment that may indicate a breach. Behavioral analytics Enhance behavioral analytics with insights from the Microsoft Intelligent Security Graph to identify anomalies and attacks. Threat intelligence
- 52. Azure Active Directory monitoringand reporting Displays all sign-in events to applications that contain personal and sensitive data. Access and usage reporting • Security reports. Displays risky users and sign-ins e.g., sign-ins from anonymous IPs, impossible travel, unfamiliar locations and infected devices. • User-specific reports. Displays device/sign-in activity data for a specific user. • Activity logs. Displays all audited events e.g., group activity changes, password resets and registration activity. Azure Management Portal
- 53. Mobile device & appmanagement Information protection Microsoft Enterprise Mobility + Security Holistic and innovative solutions for protection across users, devices, apps and data Protect at the front door Detect & remediate attacks Protect your data anywhere Azure Active Directory Premium Microsoft Intune Azure Information Protection Microsoft Cloud App Security Microsoft Advanced Threat Analytics Identity and access management Threat detection
- 54. Next steps Read ourEMS for GDPR whitepaper to learn more Get a free 90-day trial, evaluate Enterprise Mobility + Security Deploy with FastTrack for Enterprise Mobility + Security
- 55. FastTrack experts workremotely with you and your partner Microsoft Virtual Academy and Immersion Demos, videos and labs Self-service resources Success Plans to speed-up deployment EMS Success Workshop Quick Start guides How To’s and personalized videos Trial: Experience EMS before you subscribe Proof of Concept (POC): Model your deployment by combining a trial and a Success Plan Assess: Determine the setup of your existing environment and identify any issues Remediate: Clean up any issues that might prevent your preferred deployment approach Enable: Set up EMS services, users, and integration with your environment Use: Help your users get their work done better with EMS Enhancements: Integrate your environment with custom apps and new capabilities FastTrack for Enterprise Mobility + Security is all of your deployment help
- 56. FastTrack is includedwith your EMS purchase to accelerate your deployments Azure Information Protection Cloud App Security Advanced Threat Analytics Azure Active Directory Microsoft Intune ENVISION Self-service help Scenarios Success Plan Trial ONBOARD Getting Started MVA Immersion MS Mechanics ONBOARD Remote guidance for your Success Plan and deployment help DRIVE VALUE Success Workshop Quick Start guides How To docs Demos and videos Yes Yes FastTrack Center Yes Yes Yes FastTrack Center Yes Yes Yes Request Help Yes Microsoft FastTrack for Enterprise Mobility + Security
- 57. What languages does MicrosoftFastTrack speak? Chinese Simplified Chinese Traditional English French German Italian Japanese Korean Brazilian Portuguese Spanish Thai Vietnamese Remote guidance is available in:
- 58. Microsoft Enterprise Mobility+ Security Technology Benefit E3 E5 Azure Active Directory Premium P1 Secure single sign-on to cloud and on-premises app MFA, conditional access, and advanced security reporting ● ● Azure Active Directory Premium P2 Identity and access management with advanced protection for users and privileged identities ● Microsoft Intune Mobile device and app management to protect corporate apps and data on any device ● ● Azure Information Protection P1 Encryption for all files and storage locations Cloud-based file tracking ● ● Azure Information Protection P2 Intelligent classification and encryption for files shared inside and outside your organization ● Microsoft Cloud App Security Enterprise-grade visibility, control, and protection for your cloud applications ● Microsoft Advanced Threat Analytics Protection from advanced targeted attacks leveraging user and entity behavioral analytics ● ● Identity and access management Managed mobile productivity Information protection Threat Detection
- 59. Resources Microsoft.com/GDPR Microsoft Online Services andGDPR • Microsoft Azure • Office and Office 365 • Microsoft Dynamics 365 • Enterprise Mobility Suite • Windows and Windows Server • SQL Server
- 60. © 2017 MicrosoftCorporation. All rights reserved.
- 61.
- 62. Supporting your GDPRcompliance journey with Microsoft Enterprise Mobility + Security Grant and restrict access to data Protect data on premises and in the cloud Detect data breaches before they cause damage ! Apps Risk MICROSOFT INTUNE Make sure your devices are compliant and secure, while protecting data at the application level AZURE ACTIVE DIRECTORY Ensure only authorized users are granted access to personal data using risk-based conditional access MICROSOFT CLOUD APP SECURITY Gain deep visibility, strong controls and enhanced threat protection for data stored in cloud apps AZURE INFORMATION PROTECTION Classify, label, protect and audit data for persistent security throughout the complete data lifecycle MICROSOFT ADVANCED THREAT ANALYTICS Detect breaches before they cause damage by identifying abnormal behavior, known malicious attacks and security issues ! Device ! Access granted to data CONDITIONAL ACCESS Location Classify Label Audit Protect ! !
- 63. Corporate Public Private cloud Vendors SaaS Ex-employees Online backup Graphic designer Offshore teams Legal review Agency teams Project Lead Salesteams Project Manager Project Lead Remote team Personal Data is shared more often and more widely than ever.