Office 365 Message Encryption

A W A R D W I N N I N G E X C H A N G E & O F F I C E 3 6 5 M A N A G E M E N T

Managing Encryption in Exchange Online

@enowconsulting

Find us!

ENow Software

ENowSoftware

ENowSoftware.com

Some of ENow’s Loyal Customers

• Microsoft Silver ISV & Messaging Microsoft Partner

• Focused on building software solutions that simplify the life of IT administrators

• Software architected by MVPs with >15 years experience in high-end Microsoft

consulting and management

• Customers in over 60 countries ENow Software

About ENow

About the Speaker • Office 365 MVP• Microsoft Certified Solutions Master:

Messaging• Consultant @ SPS (spscom.com)

• @MCSMLab• Nathan@MCSMLab.com• Linkedin.com/in/nathanobryan• http://www.mcsmlab.com

Introduction• Why encrypt?

• Transport Layer Security

• Office 365 Message Encryption

• Information Rights Management

• Secure/Multipurpose Internet Mail Extensions

Why encrypt email?• The vast majority of email is sent over the Internet in plain text

• Reasons to encrypt:• Compliance• Protect organizational Intellectual Property• Security• Expand your job role

About compliance

• Four main areas to focus on when thinking about complianceo Retain and Removeo Discover and Searcho Protection against disclosureo Protection against misuse

• In this webcast, we’ll be focusing on protecting against disclosure and misuse

Transport Layer Security (TLS)

• TLS creates a point to point encrypted tunnel between two organizations

• Using specific connectors, TLS sends all traffic between two organizations over port 587

• Domain Secure is not available in Office 365

Domain Security in Exchange On-prem• TLS + end user notification that message delivery is secured

• Uses mutual TLS

• Requires edge servers

Configuring TLS• Office 365 Admin Portal >

Exchange > mail flow > connectors

• + to add a new connector

• From: Office 365

• To: Partner organization

• Next

Configuring TLS

• Give the new connector a name and description that will be meaningful to your organization’s IT staff

• Next

Configuring TLS• Specify the domain or domains that

you want to use this connector

• Next

• On the next page, specify if you want to route messages via MX record or to a specific smart host

Configuring TLS• Check the box to use TLS,

and specify the details for the expected certificate

• Confirm your settings on the final page of the wizard

• After the configuration runs, you’ll be asked to provide an email address to use in validating the connector

When is TLS the right choice?

• Many users in your organization send many sensitive messages to another organization

• Message traffic between two separate organizations are considered internal

• It can be set up between two separate Office 365 tenants

Office 365 Message Encryption (OME)• Simple way for users to send secure messages over the internet

• Using transport rules, OME will secure messages that meet specific conditions

• OME encrypted messages can be sent to users on any platform

Configuring OME

• North America: Set-IRMConfiguration -RMSOnlineKeySharingLocation https://sp-rms.na.aadrm.com/TenantManagement/ServicePartner.svc

•European Union: Set-IRMConfiguration -RMSOnlineKeySharingLocation https://sp-rms.eu.aadrm.com/TenantManagement/ServicePartner.svc

•Asia-Pacific: Set-IRMConfiguration -RMSOnlineKeySharingLocation https://sp-rms.ap.aadrm.com/TenantManagement/ServicePartner.svc

Configuring OME

• Import-RMSTrustedPublishingDomain -RMSOnline -name “RMS Online”

• Set-IRMConfiguration -InternalLicensingEnabled $True

Configuring OME

• Adding Disclaimer and branding

• Get-OMEConfiguration

• Set-OMEConfiguration

Configuring OMECustomize this feature Use commands

Default textSet-OMEConfiguration -Identity <OMEConfigurationIdParameter> -EmailText "up to 1024 characters"

Disclaimer statementSet-OMEConfiguration -Identity <OMEConfigurationIdParameter> DisclaimerText "1024 characters"

Text at the top of the encrypted mail portalSet-OMEConfiguration -Identity <OMEConfigurationIdParameter> -PortalText "128 characters"

Logo Set-OMEConfiguration -Identity <OMEConfigurationIdParameter> -Image <Byte[]>

Using OME

When is OME the right choice?• Users need to send secure email to recipients outside your

organization

• Recipients may be on any email platform

• Users and/or recipients may not have technical sophistication for S/MIME

Rights Management Services (RMS)• Uses encryption to enforce usage rights on messages and documents

• Using controls in Office applications (or OWA) users can apply templates to messages and documents

• Most functionality of RMS works best within the same organization

RMS options

FeatureRMS for Office 365

EMS or Azure RMS Standalone

Users can create and consume protected content by using Windows clients and Office applications yes yes

Users can create and consume protected content by using mobile devices yes yes

Integrates with Exchange Online, SharePoint Online, and OneDrive for Business yes yes

Integrates with Exchange Server 2013/Exchange Server 2010 and SharePoint Server 2013/SharePoint Server 2010 on-premises via the RMS connector yes yes

Administrators can create departmental templates yes yes

Organizations can create and manage their own RMS tenant key in a hardware security module (the Bring Your Own Key solution) yes yes

Supports non-Office file formats: Text and image files are natively protected; other files are generically protected yes yes

RMS SDK for all platforms: Windows, Windows Phone, iOS, Mac OSX, and Android yes yes

Integrates with Windows file servers for automatic protection with FCI via the RMS connector yes

Preview: Users can track usage of their documents During preview only yes

Preview: Users can revoke access to their documents During preview only yes

https://technet.microsoft.com/en-us/network/dn858608.aspx

Configuring RMS• See OME section• Three default templates

o Do Not Forwardo Company – Confidential - View,

Reply, Reply All, Save, Edit, and Forward.

o Company – Confidential View Only - View

• Use advanced features button to create new templates

• On-premises AD can be used for RMS in Exchange Online

Configuring RMSAdvanced features > Rights Management

RMS Sharing App• https://portal.azurerms.com

• Allows you to see who has opened your RMS protected documents

• Allows you to revoke access

Using RMS• Templates that start with Company are only useable within that

tenant• Do Not Forward template can be used with other Office 365 tenants,

but does not work well with non-Office 365 mail systems• BYOK is available in Azure AD, but currently does not work with RMS• RMS is not a foolproof protector against violations• Templates are usable in other Office applications

When is RMS the right choice?• Sensitive documents and messages need to be protected internally

• Recipients need time limited access to documents and messages

• Should be considered a tool to assist users in following policy

Secure/Multipurpose Internet Mail Extensions (S/MIME)

• Developed in 1995, V3 in 1999 and achieved wide acceptance

• Provides:oDigital signatureso End-to-end message encryption

Obstacles to using S/MIME• Not all email software supports S/MIME

• Because S/MIME encryption and decryption is done at client, message traffic is not inspected by transport stack

• Requires SSL certificate to be installed on client machine

S/MIME digital signaturesDigital signatures provide:

• Authentication• Nonrepudiation• Data integrity

Digital signatures DO NOT provide:• Confidentiality

S/MIME signing processWhen a message is signed:• The text of the message and the user’s private key are processed together• The output is a signature that is appended to the message

When recipient receives a message:• The digital signature process is repeated using public key• The output is compared to the original signature

S/MIME message encryptionMessage encryption provides:

• Confidentiality• Data integrity

Message encryption DOES NOT provide:• Authentication• Nonrepudiation

S/MIME message encryption

• S/MIME message encryption works backward

• You install an SSL certificate so others can send you encrypted messages

S/MIME digital signatures + message encryption• Both can be applied to the same message

• Provides all the benefits

• For added security, use one certificate for signing and one certificate for encryption

• By default OWA “triple wraps” messages that are signed and encrypted

• Outlook does not “triple wrap” messages, but can read triple-wrapped messages

Configuring S/MIME• Install your SSL certificate on

your PC - Free certificate from http://startssl.com/

• Certmgr.msc

• Export

• Select Microsoft Serialized Certificate Store (.SST)

Configuring S/MIME• $sst = Get-Content <sst

filename>.sst -Encoding Byte

• Set-SmimeConfig -SMIMECertificateIssuingCA $sst

• Outlook > File > Options > Trust Center > Trust Center Settings… > Email Security > Settings…

S/MIME with on-premises PKI

• You can use an on-premises PKI to set up S/MIME in Office 365

• Once on-premises CA is in place, enabling S/MIME for users is much the same process

Using S/MIME in Outlook

• Options > More Options

• Security settings

Using S/MIME in OWA

• From new message select …• Show message options

• Under options > S/MIME you can set default to encrypt and/or sign all messages

• Must install S/MIME control on each PC in addition to certificate

S/MIME messages

When is S/MIME the right choice?

• Small number of sophisticated users send and receive many highly sensitive messages

• IT staff has the technical knowledge to manage complex encryption

• Sensitive messages need to be secured from end to end

What doesn’t work in Exchange Online

• Journal report decryption

• Outlook Protection Rules

• Domain Security

Summary

• Why encrypt?

• Transport Layer Security

• Office 365 Message Encryption

• Information Rights Management

• Secure/Multipurpose Internet Mail Extensions

• Questions?

Thank Youwww.enowsoftware.com

Office 365 Message Encryption

Internet

Understanding Encryption Services Using Wireshark · Understanding Encryption Services Using Wireshark ... Slide 12 Part 1 ... Message Digests b)

Office 365 E5 and Skype for Business Disclosure FAQ · ... Office 365 E5 and Skype for Business Disclosure Office 365 ... Power BI Pro ... Availability dates for DLP and Encryption

Symmetric encryption and message confidentiality

Message Encryption in Office 365

Breaking Message Integrity of an End-to-End Encryption ... · encryption break. Key words: E2EE, LINE, key exchange, group message, authenticated encryption 1 Introduction 1.1 Background

Multi-Input Functional Encryption with Unbounded-Message ...Multi-Input Functional Encryption with Unbounded-Message Security Vipul Goyal Aayush Jain † Adam O’ Neill ‡ Abstract

1 Chapter 2-1 Conventional Encryption Message Confidentiality

Quran Encryption - heliwave.com Encryption Ali Adams – 2014 - heliwave@yahoo.com Encryption transforms a readable message M into a non-readable message C to be decrypted

02_Chapter 2_Conventional Encryption and Message Confidentiality

Message-Locked Encryption and Secure … preliminary version of this paper appears in the proceedings of Eurocrypt 2013. This is the full version. Message-Locked Encryption and Secure

CONVENTIONAL ENCRYPTION PRINCIPLES, CONVENTIONAL ... · Conventional Encryption principles A Symmetric encryption scheme has five ingredients 1. Plain Text: This is the original message

Public Key Encryption Techniques Provide Extreme … Key Encryption Techniques Provide ... when a user clicks their name any message sent ... Public Key Encryption Techniques Provide

Chapter 2. Symmetric Encryption and Message … SYMMETRIC BLOCK ENCRYPTION ALGORITHMS This section focuses on the three most important symmetric block ciphers: the Data Encryption

Fmdszqujpo! Encryption!. Encryption Group Activity 1: Take the message you were given, and create your own encryption. You can encrypt it anyway

An Identity-Based Key-Insulated Encryption with Message

Cisco Email Encryption · Enabling Message Encryption ontheEmail Security Appliance Step1 ClickSecurity Services > Cisco IronPort Email Encryption. Step2 ClickEnable. Step3 (Optional)ClickEdit

Chapter 20 Symmetric Encryption and Message Confidentiality

Chosen-Ciphertext Secure Fully Homomorphic Encryptiona chosen-ciphertext-secure encryption scheme. An encryption of a message m in their (CCA1) construction is simply an ID-based encryption

Conventional Encryption Message Confidentiality

Data Encryption Technologies in Microsoft Office 365