More Related Content
What's hot
What's hot (14)
Similar to Getting answers to your top questions for your cloud
Similar to Getting answers to your top questions for your cloud (20)
Recently uploaded
Recently uploaded (20)
Getting answers to your top questions for your cloud
- 11. Datacenter maps
- 16. It is your data
- 19. How Microsoft responds to requests to access customer data Law Enforcement Requests Reports
- 22. • Security Incident Response based on NIST 800-61
- 24. Service Trust Platform https://aka.ms/servicetrust Audit reports for Azure, Office 365, Dynamics 365, Yammer and more... Compliance guides, penetration tests, and technical white papers
- 28. perform a risk assessment and assess the compliance of Microsoft cloud services
- 33. better protect your data by using Microsoft cloud services
- 38. review Microsoft cloud governance and privacy practices
- 40. supporting your journey to compliance with GDPR
- 42. © Copyright Microsoft Corporation. All rights reserved.
Editor's Notes
- So Caroline let’s see if we can answer top 5 questions from our customers and show how anyone can get in-depth answers for each of the questions We ask you as customers to make sure you are able to ask and get straight answers for these questions from any and all cloud service providers.
- As customers consider the transition to the cloud, we often hear that they want to ensure that their security, privacy and compliance requirements are met. At Microsoft, we believe that we need to make it super easy for customers to get answers to the following questions: How Microsoft safeguards confidentiality, privacy, integrity, availability, and reliability of my data? Who has accesses to my data and how I can control this access. How Microsoft complies with regulatory and industry standards within the service as well as help me comply with my regulatory, industry and even organizational compliance requirements?
- So today we will go over Microsoft cloud’s commitment to trust, how you can get answers to your top security, compliance, and privacy questions. When and why you need to do risk assessment of Microsoft cloud and finally how you can perform this risk assessment So, Om what are top 3 concerns?
- Thanks Caroline – We understand as customers when you are evaluating move to cloud you have 3 top concerns: How will Microsoft protect my data Who has access to my data What about complying with global regulations that matter to me?
- Microsoft is committed – starting at the top – to providing a cloud you can trust. We take very seriously our commitment to protect customers in a cloud-first world. We follow a set of standards and best practices to ensure that our cloud services are reliable and perform as you need them to. And we actively partner with a wide range of industry and government entities to establish confidence and trust in the wider cloud ecosystem.
- We start with ensuring that our Microsoft cloud services are reliable – we are consistently best in class about up and running cloud We build reliability, uptime, and security into DNA or our cloud service architecture and infrastructure. On top of this reliable infrastructure and secure architecture, we build automation to minimize access to customer data (No standing access), ensure privacy and give control to you as customer. Now to prove that we are doing what we are saying in all the things that I just talked about – we ask 3rd party independent auditors to come and audit us. Finally, what will be the use of all this investment, if we can not transparently share information around reliability, security, privacy and compliance to you – our customers and partners – so we focus on providing industry leading transparency
- We put money where our mouth is – we spend more than $1B on security R&D every year – this demonstrated our commitment to protect your data in our clouds. The Graph feeds the security capabilities we build into Windows, Office 365, Azure, and the Enterprise Mobility + Security offerings to deliver an empowering work environment (that end users love) that is also incredibly secure (which IT loves). As Satya noted last year, Microsoft is the biggest security company you’ve never heard of – and the breadth and strength of our security platform is proof. As a company, we spend over $1B each year on security R&D and integrating our breakthroughs into the products and services you rely on every single day. Today, I want to show you some of our newest innovations and the end-to-end scenarios you can use right now. http://www.gettyimages.com/license/519515855
- This commitment is further demonstrated by our deepest and most comprehensive compliance coverage in the industry We are compliant with global standards, US Government standard, Industry standards for financial services, and healthcare, and more. We also understand that you have unique regional requirements and we go above and beyond to ensure we support those.
- One of the strengths to our approach is consistency. We are guided by our Trusted Cloud pillars: Security, Privacy & Control, Compliance and Transparency. These pillars influence how we engineer our services, how we identify and implement security features and controls, how we write our contacts and how we share information with customers. We have also used our Trusted Cloud pillars to develop and evolve our unique offerings for cloud services customers. In this presentation, we will focus on these pillars, for which Microsoft has developed amazing new offerings.
- So Caroline let’s see if we can answer top 5 questions from our customers and show how anyone can get in-depth answers for each of the questions We ask you as customers to make sure you are able to ask and get straight answers for these questions from any and all cloud service providers.
- Caroline: Do you know where your data located Om: We certainly understand our customers need to understand location of their data. We have created dedicated page (Where your data is located) to be transparent about where there data resides. Lets walk through Azure, Office 365, and Intune data locations for example. (Clicks on the link and Goes to Demo) We wanted you to be crystal clear about where your data is located. Clicks on Azure Data maps Clicks on O365 Data maps (Comes back to slides no 11) Also when customer creates Microsoft cloud tenant or a cloud subscription we provide choice to customers on where they choose to store their own data within Microsoft cloud.
- Caroline: Do you know where your data located Om: We certainly understand their need to understand location of their data. We have created dedicated page (Where your data is located) to be transparent about where there data resides. Lets walk through Azure, Office 365, and Intune data locations for example. (Clicks on the link and Goes to Demo) We wanted you to be crystal clear about where your data is located. Clicks on Azure Data maps Clicks on O365 Data maps (Comes back to slides no 11) Also when customer creates Microsoft cloud tenant or a cloud subscription we provide choice to customers on where they choose to store their own data within Microsoft cloud.
- Caroline: Do you know where your data located Om: We certainly understand their need to understand location of their data. We have created dedicated page (Where your data is located) to be transparent about where there data resides. Lets walk through Azure, Office 365, and Intune data locations for example. (Clicks on the link and Goes to Demo) We wanted you to be crystal clear about where your data is located. Clicks on Azure Data maps Clicks on O365 Data maps (Comes back to slides no 11) Also when customer creates Microsoft cloud tenant or a cloud subscription we provide choice to customers on where they choose to store their own data within Microsoft cloud.
- Caroline: Do you know where your data located Om: We certainly understand their need to understand location of their data. We have created dedicated page (Where your data is located) to be transparent about where there data resides. Lets walk through Azure, Office 365, and Intune data locations for example. (Clicks on the link and Goes to Demo) We wanted you to be crystal clear about where your data is located. Clicks on Azure Data maps Clicks on O365 Data maps (Comes back to slides no 11) Also when customer creates Microsoft cloud tenant or a cloud subscription we provide choice to customers on where they choose to store their own data within Microsoft cloud.
- Caroline: Do you know where your data located Om: We certainly understand their need to understand location of their data. We have created dedicated page (Where your data is located) to be transparent about where there data resides. Lets walk through Azure, Office 365, and Intune data locations for example. (Clicks on the link and Goes to Demo) We wanted you to be crystal clear about where your data is located. Clicks on Azure Data maps Clicks on O365 Data maps (Comes back to slides no 11) Also when customer creates Microsoft cloud tenant or a cloud subscription we provide choice to customers on where they choose to store their own data within Microsoft cloud.
- Caroline: Do you know who is accessing your data and how you can control access? Om: Again we start with the premise as customers you bring in this data- you are the owner of this data so that it is your data (Demo - Clicks on It is your data links) We ensure that you can bring in and take action on your data whenever you want We have processes to ensure that through engineering investments and automations – there is no standing access to customer data. We provide on request – approved by manager – time bound limited access on case by case basis in circumstances that require access to customer data – for example troubleshooting your mailbox. We are very transparent and require Microsoft full time employees to be transparent in terms of the subcontractors that have access to this data. (Comes back to slide 12)
- Caroline: Do you know who is accessing your data and how you can control access? Om: Again we start with the premise as customers you bring in this data- you are the owner of this data so that it is your data (Demo - Clicks on It is your data links) We ensure that you can bring in and take action on your data whenever you want We have processes to ensure that through engineering investments and automations – there is no standing access to customer data. We provide on request – approved by manager – time bound limited access on case by case basis in circumstances that require access to customer data – for example troubleshooting your mailbox. We are very transparent and require Microsoft full time employees to be transparent in terms of the subcontractors that have access to this data. (Comes back to slide 12)
- Caroline: Do you know who is accessing your data and how you can control access? Om: Again we start with the premise as customers you bring in this data- you are the owner of this data so that it is your data (Demo - Clicks on It is your data links) We ensure that you can bring in and take action on your data whenever you want We have processes to ensure that through engineering investments and automations – there is no standing access to customer data. We provide on request – approved by manager – time bound limited access on case by case basis in circumstances that require access to customer data – for example troubleshooting your mailbox. We are very transparent and require Microsoft full time employees to be transparent in terms of the subcontractors that have access to this data. (Comes back to slide 12)
- Caroline: It is crucial for you to know how government or law enforcement data requests are handled? Om: Certainly, very natural question – Lets walk through dedicated page that explains this scenario - How Microsoft responds to Government and law enforcement requests First of all, we do not offer direct access to customer data – period. We always attempt to redirect the third party to obtain the requested data from our customer. We will promptly notify you of any third-party request, and give you a copy unless we are legally prohibited from doing so. We are fully committed to protect customer data from inappropriate government access, and where necessary, we have advanced this position through the courts. Demo - Clicks on page explaining the process and takes them to portal where they can see stats about Law Enforcement requests.
- Caroline: It is crucial for you to know how government or law enforcement data requests are handled? Om: Certainly, very natural question – Lets walk through dedicated page that explains this scenario - How Microsoft responds to Government and law enforcement requests First of all, we do not offer direct access to customer data – period. We always attempt to redirect the third party to obtain the requested data from our customer. We will promptly notify you of any third-party request, and give you a copy unless we are legally prohibited from doing so. We are fully committed to protect customer data from inappropriate government access, and where necessary, we have advanced this position through the courts. Demo - Clicks on page explaining the process and takes them to portal where they can see stats about Law Enforcement requests.
- Caroline: It is crucial for you to know how government or law enforcement data requests are handled? Om: Certainly, very natural question – Lets walk through dedicated page that explains this scenario - How Microsoft responds to Government and law enforcement requests First of all, we do not offer direct access to customer data – period. We always attempt to redirect the third party to obtain the requested data from our customer. We will promptly notify you of any third-party request, and give you a copy unless we are legally prohibited from doing so. We are fully committed to protect customer data from inappropriate government access, and where necessary, we have advanced this position through the courts. Demo - Clicks on page explaining the process and takes them to portal where they can see stats about Law Enforcement requests.
- Caroline: Can you quickly find and react to breach? Om: We have aligned our security incident response process based on NIST 800-61 guidance. We have detailed our incident response plan for our customers to review and to get answers for this exact set of questions. https://aka.ms/Office365SIM provides information on: Microsoft’s approach to security incident management Our Response Management Process Our Federated Security Response Model (Demo – clicks on link – open documents and talks about incident response process) Comes back to slide 14
- Lets take example of our content encryption whitepaper for O365 – it provides following information: Encryption of customer content at rest Volume and File-level encryption Mailbox level encryption Encryption of customer content in-transit Various risks and protection provided by encryption against those risks
- Caroline: That brings us to final top question about have you performed in-depth risk assessment on your cloud Microsoft? Om: At Microsoft we believe in complete transparency – that is why created Service Trust Platform, where anyone can get access to our 3rd party audit reports, compliance guide, penetration testing and security assessment, and technical white papers.
- This is very key question and let me talk about when customers should perform risk assessments While evaluation us and performing due diligence – you should ask can we support your security and compliance requirements? If you have signed agreement with our cloud and are about to move your mission critical data – you should ask how can you protect that mission critical data? If you are in regulated industry or following information security best practice then you should at least perform an annual risk assessment on your cloud – is your cloud service provider in this case us Microsoft are still ensuring that effectiveness of security privacy and compliance controls? Also when you are renewing your agreement with us or after every few years – you should ask Microsoft about how not only we are meeting your current requirements but can we meet your needs in future?
- Caroline: So Om can you explain how does the shared responsibility model works between customer and cloud service provider? Om: Sure – So, when customers have their data on-Prem they are responsible for 100% of controls to secure that data and be compliant. When they move to Microsoft cloud – we are a partnership and operated under a shared responsibility model. We at Microsoft do major lifting and implement 80% of these controls. Furthermore, with Service Trust platform features like Control Companions – we let customers understand – how can they configure remaining 20% controls. So indeed, we are in a partnership here with customers to help them to protect their data and stay compliant with Microsoft cloud.
- Caroline: Let’s say I am Alex who is responsible for compliance at a bank. How I go about the risk assessment to evaluate Microsoft cloud?
- Om: First anyone with Azure Active Directory account (with either paid or free trial service) can access any and all of the information that I am going to talk about. So if you are a Risk and Compliance Officer – We have created a specific package for you – by reviewing this package, you get to know: How Microsoft cloud services comply with global standards and requirements How you can manage data security and compliance while using Microsoft cloud services How Microsoft helps protect your data If you need access to all of the compliance reports they are available for you at https://aka.ms/auditreports Furthermore, we have made “Audited controls” feature that not only provides “what” in terms of controls implemented and tested but also provides details on “How” we have implemented the controls and “How” 3rd party independent auditors have tested these controls. Audited controls are available for ISO 27001, ISO 27018 and for NIST 800-53 frameworks. Across these audited control documents - customers can get unparalleled “Under the hood” insights into not only what we are compliant with but how we went about it! As of today, no other cloud service provider provides this information to customers / partners.
- Om: First anyone with Azure Active Directory account (with either paid or free trial service) can access any and all of the information that I am going to talk about. So if you are a Risk and Compliance Officer – We have created a specific package for you – by reviewing this package, you get to know: How Microsoft cloud services comply with global standards and requirements How you can manage data security and compliance while using Microsoft cloud services How Microsoft helps protect your data If you need access to all of the compliance reports they are available for you at https://aka.ms/auditreports Furthermore, we have made “Audited controls” feature that not only provides “what” in terms of controls implemented and tested but also provides details on “How” we have implemented the controls and “How” 3rd party independent auditors have tested these controls. Audited controls are available for ISO 27001, ISO 27018 and for NIST 800-53 frameworks. Across these audited control documents - customers can get unparalleled “Under the hood” insights into not only what we are compliant with but how we went about it! As of today, no other cloud service provider provides this information to customers / partners.
- Om: First anyone with Azure Active Directory account (with either paid or free trial service) can access any and all of the information that I am going to talk about. So if you are a Risk and Compliance Officer – We have created a specific package for you – by reviewing this package, you get to know: How Microsoft cloud services comply with global standards and requirements How you can manage data security and compliance while using Microsoft cloud services How Microsoft helps protect your data If you need access to all of the compliance reports they are available for you at https://aka.ms/auditreports Furthermore, we have made “Audited controls” feature that not only provides “what” in terms of controls implemented and tested but also provides details on “How” we have implemented the controls and “How” 3rd party independent auditors have tested these controls. Audited controls are available for ISO 27001, ISO 27018 and for NIST 800-53 frameworks. Across these audited control documents - customers can get unparalleled “Under the hood” insights into not only what we are compliant with but how we went about it! As of today, no other cloud service provider provides this information to customers / partners.
- Let take example of SOC reports reviewed by compliance officer – what you should look for: Our assertion of what controls areas we have implemented around security, availability, and confidentiality and processing integrity of your data. Overview of operation – this is in-depth discussion around our cloud service architecture and how all components of service come together You should looks into detail information provided by 3rd party independent auditor Lastly you will find supplemental information as per demands particular audit that will provide you details around management response around audit findings etc.
- Caroline: Let’s say I am a Security Officers or Architects at healthcare company who want to understand technical implementation of various security controls within Microsoft cloud?
- Om: For Security Officers and Architects, we have created similar package on Microsoft Trust Center. So they can start with “Protect your data by using Microsoft cloud services” page. On this page: They will get access to information on how we build security into our cloud services They will understand various features like Office 365 secure score that they can use to secure their cloud services and data. Further on Service Trust Platform they can get Trust Documents at https://aka.ms/trustdocs - where we provide “Control Companions” . The Office 365 Control Companions are Microsoft Excel workbooks designed to help security and compliance officers (and other professionals like Tenant Admins) to locate the Office 365 features that map to specific security and compliance controls. By leveraging these in-built Office 365 features, customers can secure their data and get help in becoming compliant with standards like ISO and FedRAMP. With control companion’s customers can understand: · Controls that are customer’s responsibilities · Description of what exactly these customer’s responsibilities are · Office 365 features that customer's can leverage to fulfill these responsibilities · Links to Office 365 portal to configure these controls · PowerShell Configure / PowerShell Get commands to configure these controls
- Om: For Security Officers and Architects, we have created similar package on Microsoft Trust Center. So they can start with “Protect your data by using Microsoft cloud services” page. On this page: They will get access to information on how we build security into our cloud services They will understand various features like Office 365 secure score that they can use to secure their cloud services and data. Further on Service Trust Platform they can get Trust Documents at https://aka.ms/trustdocs - where we provide “Control Companions” . The Office 365 Control Companions are Microsoft Excel workbooks designed to help security and compliance officers (and other professionals like Tenant Admins) to locate the Office 365 features that map to specific security and compliance controls. By leveraging these in-built Office 365 features, customers can secure their data and get help in becoming compliant with standards like ISO and FedRAMP. With control companion’s customers can understand: · Controls that are customer’s responsibilities · Description of what exactly these customer’s responsibilities are · Office 365 features that customer's can leverage to fulfill these responsibilities · Links to Office 365 portal to configure these controls · PowerShell Configure / PowerShell Get commands to configure these controls
- Om: For Security Officers and Architects, we have created similar package on Microsoft Trust Center. So they can start with “Protect your data by using Microsoft cloud services” page. On this page: They will get access to information on how we build security into our cloud services They will understand various features like Office 365 secure score that they can use to secure their cloud services and data. Further on Service Trust Platform they can get Trust Documents at https://aka.ms/trustdocs - where we provide “Control Companions” . The Office 365 Control Companions are Microsoft Excel workbooks designed to help security and compliance officers (and other professionals like Tenant Admins) to locate the Office 365 features that map to specific security and compliance controls. By leveraging these in-built Office 365 features, customers can secure their data and get help in becoming compliant with standards like ISO and FedRAMP. With control companion’s customers can understand: · Controls that are customer’s responsibilities · Description of what exactly these customer’s responsibilities are · Office 365 features that customer's can leverage to fulfill these responsibilities · Links to Office 365 portal to configure these controls · PowerShell Configure / PowerShell Get commands to configure these controls
- Lets take example of our content encryption whitepaper for O365 – it provides following information: Encryption of customer content at rest Volume and File-level encryption Mailbox level encryption Encryption of customer content in-transit Various risks and protection provided by encryption against those risks
- Caroline: What about I am Ellie the privacy officer European organization?
- Om: Yes, we understand that Governance and Privacy officers have a need to review specific set of focused information when they perform their risk assessment. So we created specific package for them on Microsoft trust center – they can start with understanding Microsoft cloud governance and privacy practices. They can access ISO 27001, and 27018 audit reports – that demonstrate Microsoft’s adherence to best practices around information security and privacy policy and procedures. Since lot of our customers are focused on upcoming GDPR regulation. We have created special information package around GDPR. On this GDPR page we provide customers information on how Microsoft is committed to support customers’ ability to comply with GDPR. Also, we have started providing in-depth information around Microsoft cloud features that customers can use to be compliant with GDPR requirements.
- Om: Yes, we understand that Governance and Privacy officers have a need to review specific set of focused information when they perform their risk assessment. So we created specific package for them on Microsoft trust center – they can start with understanding Microsoft cloud governance and privacy practices. They can access to ISO 27001, and 27018 audit reports – that demonstrate Microsoft’s adherence to best practices around information security and privacy policy and procedures. Since lot of our customers are focused on upcoming GDPR regulation. We have created special information package around GDPR. On this GDPR page we provide customers information on how Microsoft is committed to support customers’ ability to comply with GDPR. Also, we have started provided in-depth information around Microsoft cloud features that customers can use to be compliant with GDPR requirements.
- Om: Yes, we understand that Governance and Privacy officers have a need to review specific set of focused information when they perform their risk assessment. So we created specific package for them on Microsoft trust center – they can start with understanding Microsoft cloud governance and privacy practices. They can access to ISO 27001, and 27018 audit reports – that demonstrate Microsoft’s adherence to best practices around information security and privacy policy and procedures. Since lot of our customers are focused on upcoming GDPR regulation. We have created special information package around GDPR. On this GDPR page we provide customers information on how Microsoft is committed to support customers’ ability to comply with GDPR. Also, we have started provided in-depth information around Microsoft cloud features that customers can use to be compliant with GDPR requirements.
- Om: First we are committed to be most transparent cloud and customers should continue to expect industry leading deep insights from us. Second if you are trying to navigate security, compliance and privacy requirements and our responses then we would recommend you starting from Microsoft Trust Center at https://microsoft.com/trustcenter - choose either your role based package or browse wide range of topics that interests you on the trust center. Lastly if you are seasoned veteran trying to get access to all audit reports and trust documents that we have to help you understand how we comply with various global regulations, how you can protect your data and be compliant with using Microsoft cloud – visit Service Trust platform at https://aka.ms/servicetrust Thank you and we look forward to earning your trust!
- Om: First we are committed to be most transparent cloud and customers should continue to expect industry leading deep insights from us. Second if you are trying to navigate security, compliance and privacy requirements and our responses then we would recommend you starting from Microsoft Trust Center at https://microsoft.com/trustcenter - choose either your role based package or browse wide range of topics that interests you on the trust center. Lastly if you are seasoned veteran trying to get access to all audit reports and trust documents that we have to help you understand how we comply with various global regulations, how you can protect your data and be compliant with using Microsoft cloud – visit Service Trust platform at https://aka.ms/servicetrust Thank you and we look forward to earning your trust!