Upload
vaultive
View
277
Download
3
Embed Size (px)
Citation preview
The State of Office 365 Security
A Quick Intro
Tel AvivWorld-Class R&D
BostonCorporate HQ
Doug LaneVP of Product
Marketing
Today’s Topics• Office 365 market trajectory• Microsoft’s big cloud security moves• The current native Office 365 security toolbox• Vertical-specific considerations• Real-world tests of Office 365 security• When to consider third party cloud security solutions• Q&A
Office 365 is Taking Off
It’s Going Enterprise
Is Office 365 ready for the enterprise?
Operationally, yes.…but security is a big concern for many organizations
Microsoft’s Response
Key Native Security Features
Identity and Access Management
Data Loss Prevention
EOP & ATP for Exchange Online• Exchange Online Protection
(EOP)• Included with Business / Enterprise
subscriptions• Anti-Malware/Anti-Spam
• Advanced Threat Protection (ATP)• Optional add-on• Message sandboxing, link
reputation checking, and URL reporting/tracing
Activity Reporting and Visibility
Customer Lockbox
Native Encryption Capabilities
• Encryption in transit (TLS)• Encryption at rest (BitLocker)• S/MIME• Office 365 Message
Encryption
Data ResidencyData Security
Unauthorized Disclosure
Compliance
The Big Question: Is it Good Enough?
“By 2018, 40% of Office 365 deployments will rely on third-party tools to fill gaps in security and compliance, which is a major increase from less than 10% in 2015” (Gartner)
Example: Healthcare• Mature framework for sharing
compliance responsibility with third parties
• Microsoft provides blanket BAA contractual language
• More is always better, but Microsoft provides a good foundation
Other Verticals are….Messier
• Financial Services: FDIC and other industry audits
• Multi-National Enterprise: International data residency laws
• Law Firms and Mission-Based Orgs: Control over subpoena process
• Government Sector: ITAR compliance risk
Is the Risk Real or Imagined?
Data Disclosure Uncertainty
International Data Residency Uncertainty
And Finally…Desperate Measures
Third Party Cloud Security Landscape
Key Benefits:• Unified approach• Separation of control
Cloud Data Protection
“The Treatment”Cloud
Discovery“The
Diagnosis”
Key Cloud Data Protection Ingredients• Zero visibility encryption is the centerpiece• Additional non-encryption controls focused on protecting
data• Data redaction• Policy definition and enforcement (via inline proxy AND out-of-band
SaaS provider APIs)• Alerting: built-in and/or feeds to SIEM tools for more advance usage.• Auditing / Analytics: built-in/or and feeds to analytics tools (e.g.,
Splunk)
(SSL)
(SSL)
From: Mia To:VincentVincent, attached is thecustomer’s SSN and Credit-Card information.
(Vaultive & SSL)
From: Mia To:Vincent躎疓拺鴵鍔漼軴唺傖듌鐴給섐럑蜖虝私乴諡䂸䄙舅矇潹솴湶썙鑡㨜争껎㾔뻚
From: Mia To:Vincent躎疓拺鴵鍔漼軴唺傖듌鐴給섐럑蜖虝私乴諡䂸䄙舅矇潹솴湶썙鑡㨜争껎㾔뻚
From: Mia To:Vincent躎疓拺鴵鍔漼軴唺傖듌鐴給섐럑蜖虝私乴諡䂸䄙舅矇潹솴湶썙鑡㨜争껎㾔뻚
From: Mia To:VincentVincent, attached is thecustomer’s SSN and Credit-Card information.
Intended Recipient
CDPGateway
Example: Zero Visibility Encryption
Final Thoughts• Microsoft is highly committed to Office 365 security• It offers extensive native capabilities across the board• Best of breed third party products will continue to fill
critical gaps• A key question: can your business/industry support
Microsoft having access to your unencrypted data?
Want to learn more about Office 365 Security?
Visit: http://vaultive.com/for-your-technology/office-365-security/