[Dux Raymond Sy] So you’ve made the decision to move to Office 365 – now how do you ensure your critical business information is secure in the cloud? In this interactive session, you will learn how to reduce risk and ensure your users do the right thing by employing industry best practices for information governance, risk, and compliance. We’ll also explain how recent enhancements from Microsoft – including Office 365 Security & Compliance Center and Azure Information Protection – as well as other related technologies can help. This session will empower you to implement proven tactics to ensure your Microsoft Cloud investment meets business needs while protecting your most sensitive data.

3. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Session Objectives
Challenges today
1
What to Govern
2
Develop
your strategy
3

4. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

5. Unstructured content is all over

6. On-premises

7. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
We don’t know what we don’t know
What is this?
What you use…
What you need to keep…
Dark Data

8. We need to establish confidence

9. Cost of ignoring this problem

10. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Balancing Act

11. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

12. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Information is everywhere in Office 365
Planner “Outlook
“Team”
“Team”
“Team”
“Yammer
Connected”
Group”
X
X
X X=
=
=

13. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
What does Microsoft offer?
Protect The FileProtect The AccessProtect The System
RMSCASBDLP
• Enterprise-Wide Classification
• Data Governance Framework
• Risk Assessment
In-House Dev
Protection @
Office 365
Cloud App Security
Advanced Security
Management
Azure Information
Protection
CLP, Windows,
Office, Mobile
• Enterprise-Wide Classification
• Data Governance Framework
• Risk Assessment

14. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Benefits of Good Governance
Administrative efficiency
Accurate cataloging & monitoring of adoption, usage and governance attributes for collaboration workspaces
Provable compliance with internal and external policies and regulatory requirements
Repeatable and consistent service delivery

15. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
How containers are
requested, approved
and created
For collaborative workspaces, we want to govern:
Governance Focus
Provisioning
How are availability,
compliance and
changes over time are
managed
Management
How do I
retain/expire/dispose of
information as
appropriate
Lifecycle

16. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Provisioning
• Sprawl
• Duplication
• Appropriateness
• Convention
• Cataloging
How Containers
are Born

17. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Management
• Monitor usage and
adoption
• Ensure users aren’t doing
what they shouldn’t
• Quota enforcement
Ongoing
Operations

18. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Information Lifecycle
• How do I know when a
container should be expired
• How do I get rid of it “safely”
• How do I make sure
information management
policies are enforced? (ie
retention, backup)
2.
Retention,
Expiration and
Disposition

19. PCs, tablets, mobile
Office 365 DLPWindows Information Protection
Azure Information Protection
Exchange Online, SharePoint
Online & OneDrive for Business
Highly regulated
Microsoft Cloud App Security
Office 365 Advanced Data Governance
Datacenters, file
shares
Azure 3rd-Party SaaS
MICROSOFT’S INFORMATION PROTECTION – VISION
Common Classification and labeling policies across all Microsoft technologies
O F F I C E 3 6 5D E V I C E S C L O U D S E R V I C E S , S A A S
A P P S & O N - P R E M I S E S

20. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

21. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Why do you need brakes?

23. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
4 steps to develop your strategy

24. Discover and Classify
1

25. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

26. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Discover and map
Where is it?
File Share
SharePoint
Office 365
Databases
Who can access it?
Who owns it?
Who can read it?
Who can edit it?
What is it?
?
File Level Analysis
Content Level Analysis
• Redundant, outdated and
trivial (ROT) data
• File types (Music, log files, etc..)
• Sensitive data
• Date Created
• Owner

27. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Example: Duplicate file report

28. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
What do you need to secure?
Regulated Data
Data that requires retention / long-term archives
ITAR / export controlled data
Gold copies or replication
Sensitive Data
“Controlled Unclassified Information” (CUI)
PII / PHI / PCI data that about employees / citizens
Classified Data
Operational security (OpSec)
Intellectual Property
Classified documents

29. a
DETECT SENSITIVE
INFORMATION
CLOUD & SaaS APPS
MCAS
AIP scanner

30. Example: Heat map of sensitive data

31. Example: Single pane of glass for risk

32. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Tag and classify
Tags
Ownership Purpose
Audience Sensitivity level
Classify
Is it a record?
Is it high business
impact?
Who should have
access?Where should it live?

33. HIGHLY CONFIDENTIAL
CONFIDENTIAL
GENERAL
PUBLIC
PERSONAL
Business-lead policies & rules;
configured by ITAutomatic classification
Policies can be set by IT Admins for automatically applying
classification and protection to data
Recommended classification
Based on the content you’re working on, you can be
prompted with suggested classification
Manual reclassification
You can override a classification and optionally be required
to provide a justification
User-specified classification
Users can choose to apply a sensitivity label to the email or
file they are working on with a single click
CLASSIFY INFORMATION
BASED ON SENSITIVITY

34. FINANCE
CONFIDENTIAL
SENSITIVITY LABELS
PERSIST WITH THE
DOCUMENT
Document labeling – what is it?
Metadata written into document files
Travels with the document as it moves
In clear text so that other systems such as a DLP engine can
read it
Used for the purpose of apply a protection action or data
governance action – determined by policy
Can be customized per the organization’s needs

36. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Labels are persistent and readable by other systems e.g. DLP engine
Label is metadata written to data
Sensitive data is automatically detected
CLASSIFICATION & LABELING EXAMPLE – SENSITIVE DATA
Discover personal data and apply persistent labels

37. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Labeling can be end-user driven
or automatically applied
CLASSIFICATION & LABELING EXAMPLE – DATA GOVERNANCE

38. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

39. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

40. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

41. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

42. Define Data
Governance Policies
2

43. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
How do you know where to park?

44. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Approach to defining your policy
Build “controls”
into containers
Make sure no
one messes with
your controls
Ensure the system
is used as intended

45. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Example: Policy for SharePoint sites
New Project Site
Site Configuration
External
Sharing
Enabled?
Classification
of Content?
Data
Sovereignty?
Security
Permission
groups?
Outside
Vendors?
Ownership
Contacts /
Stewards?

46. Proactively Enforce
Policies
3

47. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.

48. Regional Farm
Regional Farm
Regional Farm
Regional Farm
Admins, Compliance and
Governance stakeholders

49. Admins, Compliance and
Governance stakeholders

50. Admins, Compliance and
Governance stakeholders

51. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
PROTECT SENSITIVE INFORMATION ACROSS
CLOUD SERVICES & ON PREMISES
Data encryption built into
Azure & Office 365
Revoke app access
File-level encryption and
permissions
Policy tips to notify and
educate end users
DLP actions to block
sharing
Visual markings to indicate
sensitive documents
Control cloud app access &
usage
Retain, expire or delete
documents

52. Make it Easy
to Do the
Right Thing

53. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
PROTECTION EXAMPLE:
DLP POLICY TO LIMIT DOCUMENT SHARING
Policy tips to warn
end users
Restrict or block sharing –
internally or externally
Across Office client applications –
mobile, desktop & tablets

54. Inside your
organization
Between your
business partners
With any of your
customers

63. Alex@Myorg.ms
Sends from
Outlook Desktop,
Windows

78. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Proactive enforcement with automation

79. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Example: Automated Classification + Quarantine
• It’s Friday 5pm and Joe needs to upload his daily documents
into SharePoint
• He doesn’t have time to classify documents and wants to go
home on time
• Company policy is that everything that goes into SharePoint
MUST be classified and Restricted information must not be
shared with Everyone

80. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Defining policy

81. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Uploading files

82. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Violation identified

83. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Classification & Compliance Enforced

84. Admins, Compliance and
Governance stakeholders

85. Report and Audit
4

86. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Many names, same idea
“RECERTIFICATION”
“ATTESTATION”
“ANNUAL REVIEW”
Hey! take a look…
are the current
settings still
appropriate?
If no– make the
changes.
If yes– sign off on it.
Recertification drivers may be internal (company controls),
external (regulatory requirement) or both

87. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
Regular Recertification
Data Ownership
Who is responsible for
the stuff in here?
Are they still here and
willing to own it?
Access Permissions
Who can do what to
the stuff in here?
Does Bob still need his
access?
Classification
Tell me about the stuff
that lives in here…
Is it sensitive?
Is it important?

88. MONITOR INFORMATION
PROTECTION EVENTS FOR
GREATER CONTROL
Policy violations
Document access &
sharing
App usage
Anomalous activity
End-user overrides
False positives
Visibility
Tune & revise
policies
Revoke access
Quarantine file
Quarantine user
Integrate into
workflows & SIEM
Take Action

89. Incident management is necessary

90. ©AvePoint, Inc. All rights reserved. Confidential and proprietary information of AvePoint, Inc.
4 Steps to develop your strategy

91. Azure Information Protection
Learn more about Azure Information Protection
Blog – Announcing Azure Information Protection
Intro to Microsoft Cloud App Security (video)
Office 365 Information Protection
Overview of Office 365 Data Loss Prevention (DLP)
Blog – Announcing the release of Office 365 Advanced
Data Governance
File Protection Solutions in Office 365
Windows Information Protection
Blog – Introducing Windows Information Protection
Protect your enterprise data using Windows
Information Protection
RESOURCES

92. Dux Raymond Sy
@meetdux
Linkedin.com/in/meetdux
Dux.sy@avepoint.com