Compliance in Office 365
Edge Pereira
Sandy Millar
From Avanade Australia
OSS304
Source: Gartner Report: IT Governance, Risk, and Compliance Management Solutions, http://www.gartner.com/resId=1884814
Example Avanade
Levels and activities are driven by many factors
For example
•
Public or private sector
•
Industry vertical
•
Business activities
•
Geography
•
Laws or regulation
Built-in Office 365 capabilities
(global compliance)
•
•
•
•
•
•
•
•
•
Access Control
Auditing and Logging
Continuity Planning
Incident Response
Risk Assessment
Communications Protection
Identification and Authorisation
Information Integrity
Awareness and Training
Customer controls for
compliance for internal policies
•
•
•
•
•
•
•
Data Loss Prevention
Archiving
eDiscovery
Encryption
S/MIME
Legal Hold
Rights Management
•
•
•
•
•
•
It is all about customer controls!
Remembering
“A control is a process, function, in fact anything
that supports maintaining compliance”
Identify
Monitor
Protect
Educate
“Data loss/leak prevention solution is a system that is designed
to detect potential data breach / data ex-filtration transmissions
and prevent them by monitoring, detecting and blocking
sensitive data while in-use (endpoint actions), in-motion
(network traffic), and at-rest (data storage).“[1]
“Quotation...”
Good definition
http://csrc.nist.gov/groups/SNS/rbac/documents/data-loss.pdf
[1]
http://en.wikipedia.org/wiki/Data_loss_prevention_software
•
•
•
•
•
•
•
•
credit cards, and SWIFT codes)
medical account number and TFN)
driver's license)
driver's license and passport number)
Country
PII
Financial
USA
US State Security Breach Laws,
US State Social Security Laws, COPPA
GLBA & PCI-DSS
(Credit, Debit Card, Checking and
Savings, ABA, Swift Code)
Germany
EU data protection,
Drivers License, Passport National Id
EU Credit, Debit Card,
IBAN, VAT, BIC, Swift Code
Data Protection Act,
UK National Insurance, Tax Id, UK Driver
License, Passport
EU Credit, Debit Card,
IBAN, BIC, VAT, Swift Code
PIPED Act,
Social Insurance, Drivers License
Credit Card,
Swift Code
EU data protection,
Data Protection Act,
National Id (INSEE),
Drivers License, Passport
EU Credit, Debit Card,
IBAN, BIC, VAT,
Swift Code
PIPA,
Resident Registration, Social Insurance,
Passport, Driving License
Credit Card,
Bank Account,
Swift Code
UK
Canada
France
Japan
Health
Limited Investment:
US HIPPA,
UK Health Service,
Canada Health
Insurance card
Rely on Partners
and ISVs
Australian sensitive
information types
provided by Microsoft
•
•
•
• Bank Account Number
• Driver's License Number
• Medicare Account
Number
• Passport Number
• Tax File Number
• Protect communications
• Basic level of built-in anti-malware and enhanced spam
filtering to help protect your email environment from
threats
Enforce policy
Data loss prevention (DLP) controls that can detect sensitive data in email
before it is sent and automatically block, hold or notify the sender
Simplify management
Unified administration of anti-spam, anti-malware and data loss prevention
within Exchange
[2]
Wikipedia (http://en.wikipedia.org/wiki/Electronic_discovery)
DISCOVERY
Find relevant content (documents, emails, Lync conversions)
PRESERVATION
Place content on legal hold to prevent content modification
and/or removal
COLLECTION
Collect and send relevant content for processing
PROCESSING
Prepare files for review
REVIEW
PRODUCTION
Lawyers determine which content will be
supplied to opposition
Provide relevant content to opposition
•
•
•
•
Provide a high level of immutability by:
•
•
•
Preserving data in source
Protecting from deletion
Protecting from tampering
Provides easy management via:
•
•
•
Rich query, location and time based content target
Across Exchange, Lync and SharePoint
Using Exchange Admin or eDiscovery Centres
•
•
•
•
•
•
•
•
•
•
Recoverable Items quotas separate from mailbox quotas and
need to be monitored
Hybrid data sources
Comprehensive view of DLP policy
performance
Downloadable Excel workbook
Drill into specific departures from
policy to gain business insights
Protect communications
Governance, risk management, and compliance
Office 365 Service Descriptions
Additional Slides
DLP extensibility points
Get
Content
Joseph F. Foster
Visa: 4485 3647 3952 7352
Expires: 2/2012
Content analysis process
RegEx
Analysis
4485 3647 3952 7352  a 16 digit number
is detected
Function
Analysis
1. 4485 3647 3952 7352  matches checksum
2. 1234 1234 1234 1234  does NOT match
Additional
Evidence
1. Keyword Visa is near the number
2. A regular expression for date (2/2012)
is near the number
Verdict
1. There is a regular expression that matches
a check sum
2. Additional evidence increases confidence
Office 365 Message Encryption – Encrypt messages to any SMTP
address
Information Rights Management – Encrypt content and restrict
usage; usually within own organization or trusted partners
S/MIME – Sign and encrypt messages to users using certificates