Hello and welcome to Office Mechanics. Coming up on the show
if you want to look at how we're actually protecting information when it's
authored
stored and shared, we're going to have a look at all the latest technologies for data loss
prevention
We'll even give an early look at the new incident management reports and auditing
capabilities
within data loss prevention
Microsoft Office
Office Mechanics
I'm joined again by Asaf Kashi. Welcome Asaf!
Thank you Jeremy.
So how do we think about information protection data loss?
So as a rule everywhere your data exists, moves and is shared
we want to protect it. So we think about this in a couple different ways
let's take a look and get started. So here we have
your company the Microsoft Office 365 cloud
and a remote user. We split protecting your data into a couple different areas
one
we think about protection of data at rest this happens using BitLocker and other
technologies such as some of our file encryption
And were also encrypting all the different
transfers we're using TLS or SSL between data centers between
end-users and between
are customers and tenant sites so that we make sure that all traffic is also encrypted, right?
Right, we make sure that all the pipes are encrypted
so beyond that we think about DLP
and Data Loss Prevention and this is something that we've had
around for a while in messaging we've had it in Exchange 2013 and Outlook and in OWA
and more recently we've announced and have started previewing the
SharePoint Online and OneDrive functionality of DLP
But this is just service side. We're even going beyond that right? We're going into even more areas to make
make sure the protections
even more pervasive
That's right we've recently announced that we're
taking our policy tips our user education and empowerment down to
all the Office clients so we've had policy tips
in Outlook 2013 and in OWA, we've added it to Word, PowerPoint and Excel
so the user is natively receiving those cues, those policy tips their ability to
override and interact with a policy
in their productivity tool of choice
All of this information is also sent up in to our infrastructure as well right?
That's right. So for the IT Admin we think of it in a couple different ways
first there's the policy management so we have the compliance Center
which again it's a recent announcement earlier this year
where you can manage the policies for all the various workloads in one place
you can apply one policy across your SharePoint
across OneDrive across Exchange etcetera and in the future it will be more
workloads there
not only that we're also taking all those
actions all those hits, the rule hits,
the overrides are coming back and we're putting it in that one place
and providing a really rich audit story
that plays out for the IT Admin both in our reports and in our
a newly announced activity feeds
So you're doing a lot in terms making sure that the
transparency what's going on in your organization is also there
through new auditing capabilities that we're going to demonstrate in a minute why don't we
actually show a few of these demonstrations in terms of what we can do
So what I have here, we're going to start with an email that I actually wrote up in my draft
folder to you Jeremy
and I've attached a marketing survey data Excel file
and what you can see is, pretty quickly that policy tip came up here
and let's see if we can zoom in a little bit here
you can see a policy tip on the screen that says this message appears to
contain sensitive information the system has detected that it flagged it's the
attachment and it tells me that
it may or may not, it may or may not
comply with what my policy is for my business
that means I as an end user can understand that while I am authoring
I don't have to go
read at six hundred-page you know handbook for my business I don't have to
interpret things
we're teaching the user right then and there let's take a look at the
policy we want to show how it's set up and built-up
If I go here to our Compliance Center in this is again one of those new
areas on the left side you can see that the compliance center has
all the archiving device management data loss prevention
anything that you think that is compliancy so anything the CISO or their
IT department
might be interested in all in one place if I
take a look at data loss prevention there are two items here one
if I could create a new policy by default
all of the policies and regulations that you would need
anywhere in the world are already built in now is that gonna be everything
probably not you probably gonna need to tune some things but it's going to be
the majority so for most businesses
you don't have to start by being a
a super expert at all these regulations you can start using the stuff we have in the box
And you can start with a blank canvas there are all these templated
rules and actions you can do based on these rules we got
configured into the tool
you can start showing things like credit card information Social Security numbers
also international equivalent to those things alright already
to make it really easy to get set up that's right so let's take a look at
what are the ones I've already configured
this one is that payment card industry so PCI DSS
and you can see that this is built I the first page comes up you can see that
their locations here
and we have SharePoint and one drive selected an olive the site so it's gonna
apply to my entire tenant
all with one click I can always select the narrow down
whether I'm testing it are applying it to one department or one group cites
fine take a look at the rules that we've got configured I i've single by these
two just two rules
there's a Los a very nice very we're gonna open up the high severity and take
a look at what it's looking for
so on my screen you can see that I'm looking for
any piece of content that has 10 or more credit cards is the high severity
will take one action for if catching 10 or more and more different action if
we're
we've got less than 10 also the other piece that's interesting in this is a
very common action or very common condition
for our customers is when content is shared external to my organization
generally data loss prevention or data leakage we don't wanna
send this information outside organization without thinking twice or
sometimes three times
about that so let's see it what actions we've got configured here
this is a new action this first when he up top it says block
access the content so we did not want to be destructive about the content
it's something is violating that the policy again we want to make sure that
the user can go to remedy it
I'm of course that's assuming the IT organization wants to configure it that
way
in this case will restrict sharing to just the site owner
the author %uh the document in the last modifier
and again you can select which one of them but this allows you to have the
right person
remediate that as soon as they get notice on it you don't have to say great
let the lead the filer let's shut down the site
or anything super destructive over time we will add more and more action
encrypt is a very common one right as well as quarantine
delete it said or so we will at all the actions that we have an exchange today
over to the SharePoint site I'm so it makes sense in that particular workload
additionally we have a notification here and this was going to be something we're
going to look at
are more closely in a second the notification configuration allows me to
configure
who gets notice love this violation both on the back in
meaning IT compliance etcetera as well as the end-user this is where you would
configure their policy tip
the override ability whether the user gets to participate or just be notified
and you can customize the messages that they see as well if you want your own
corporate customized verbiage in there you can customize that up that's right
it turns out that not only is that language sensitive
the tone of the message between different companies in different
industries when you're trying to tell the user that they violated a policy
needs to be customized the against against the different regions in the
world and they are
businesses that we are supporting up finally the the last thing we're going
to highlight here in the configuration site is the incident reports
every rule hit not can generate
a Gier generate incident report this means that it is a real-time
notification sent in this case via email
to any male boxer group that you would like any contains any meta data about
this rule head
that you think I would be relevant so this is the way you would attach it to
your ticketing system
this would be the way that you log into again in real time obviously everything
is also audited in a log
that collects all I an aggregate of all our rule
its all this idea i really wanna go back to some I W so let's kick that often
take a look at how
the I W experiences all this we're gonna start with my mailbox
again and I'm going to show a different message in this one is
that the same a the same attachment that I crafted before
okay this time I actually share this earlier with you Jeremy
using my one drive so this attachment is my one drive I right clicked I did share
a message got sent out what that means that yeah SharePoint are not really
seems to me that actually show that
and we can true /param I'm sure yet what it was like let's take a look at your
issue
all rights on my computer I have the
I have a ignite Boulder for me I've also got the message here
be my partner David I tax loss acts that's the pilots of the we actually
reply protection against I know that because then SharePoint actually fired
off another
message saying that this item is Ben has been protected
I can open a blog company I item and fix the issues not gonna link here to do
that
couple things at all see once I hit that site like to
first before the site coming I'll see in the pop-up is that the items
sure people outside my organization so I can see exactly what's going on
it right this is that policy depicts perience same thing we saw in
our we're seeing it over in in SharePoint it's very consistent
to write in your your your productivity service writes on my case has been
shared with people outside my organization as you had me rolling
earlier
it also contains credit card information something that I don't have enough I'll
like neither is all that up if I got the ability to resolve that there might be a
a false positive going on there this case in a close down all see that
also have access to the file on I want to look and see that policy that began
ever as I'm heading the the ellipses here on the right at the file name
I can see that there as well I can see the positive again if I'd like to
in my case women is shut that down actually show the experience I love
exile
because this is really powerful now I can actually use excel in this case to
view that the OP policy to have now
I'm gonna say that I got a couple different masses I gots offer a bit
surreal
looks like on a hand during the day love and I've got my policy to hear this is
the new one
all the way out who lives in on that one is the show this content may contain
sensitive information this is something brand new again
we had the mail clients before but this is an Excel here
we've also got a coming to PowerPoint and Word as well in a look at the pole
sitter
now that will take me to the backstage in Excel and give me more information
about the policy to
again I've got a credit card number tells me that right from its old
backstage exactly
what's going on about file so really powerful in terms of not only when I'm
receiving the file but also the author in the file be able to see that right
there
within the app that I'm using my my favorite spreadsheet up
excel in this case everybody's favorite okay
so go back to your machine and show eva
more let's take a look so one thing that we are we've
but you gonna said it before incident management
this is something completely brand new so we created
the GIA ours we've had them in emails we've talked to partners son partners
have connected the dots
we've also went ahead recently and build a solution pack
that connects those yards connect those incidents over to dynamic CRM
so what we're I'm gonna show you something we we having really announce
until this week
where you what you can see is I'm in Dynamics CRM
I have an active dashboard in this is very similar to whatever ticketing
system you're using if you happen to use Dynamics CRM
we have the solution pack for if you're using another ticketing system
we're working with our various partners to connect our deal be solution to that
in this case I might be a front line support
engineer working on compliance cases and you can see that there are a number
a graph showing country as cases there's a queue of all the cases here
I can actually click on one and let's take this one it'll open this particular
incident
and this incident is telling me I can do some research here and show me there
were 52 credit cards
in this particular incident there are one recipient so it seems to be
a lot of data but only 21 recipient maybe it's the wrong recipient let's
we think we can keep taking a look through this we can see you sent this to
the
Eric gerber's the sender so again I can do the triage I can assess
I how I want to react to this what's the severity if I scroll down
I can see what rules fired here in the middle of the screen I can see
some data so I can see a snippet on the actual day to get all this is
configure role because sometimes you might want the tree as the case without
giving away the sins that information all over again
so you don't wanna propagate that and then another really powerful thing that
we've actually
added using dynamic CRM here is that the at the bottom I can actually see in this
view
all the incidents that relate to this particular user so maybe these are a
number of low-grade
incidents but I can see a trail that over time
the same person is doing the same thing so I'm sure if I pulled your record here
we would see a lot are you up
low grade 1 yeah up with so I'm again I could take an action I can change the
severity I can now
say that I need to send a notification to the user their manager
and do and and construct the work flow around this and this is particular to
every customer every customer has a ticketing system every customer is it
slightly differently
we're looking to integrate with all them here's one way and again we're actively
working with partners for
approved for this year to to really connected with other solutions so these
are the RNAP eyes that were opening up for customization be on all this though
we have the ability to see some other that they were inside a
the our office 365 had directly that's right so if I were to click on
in their complaints and on reports which I just did on my screen the first link
is up
this new auditing report that we've added around the view office 365
activity report
a very open the screen here and that you can see it's a very plain you ideas most
customers
will actually export this data or use PowerShell or other APIs to
to suck that out but you can do a quick quick search online
what I'm going to do here's actually browse for you Jeremy we're going to see
what you've been up to lately
and what you guys are senior real your real time is the fact that
I've just narrowed it down to only jeremy's action but I think in all
actions and all files again I can scope it further or not
in this case you can see that there's some password logon event so
security-based events you can see that there's file
fetched filed viewed so all the interaction you have with the system
and when the details come up for each one of these you can actually dive down
into what client was he using
what IP address where you coming from so again you can do full fledged security
auditing
full-fledged compliance auditing right from here or export this into your room
basically
way to collate all this and do some additional else's
there's a lot of things that we're trying here where is all this going to
stop
yes so as far as the OP for for Microsoft were actually kinda expanding
into areas one is Brett
so we definitely want to bring the OP into more and more on both Microsoft
office 365 Microsoft and partner solutions and we're expanding across do
you see this over the last year year and a half or so
now and we also look at depth so adding more content as we get feedback from our
customers
what regulations are important what technologies as the market evolves
reading more death and do how we
do deal P a lot of great advancements in terms of data loss prevention turned the
information protection
all these things you can even follow those I'd news items and more on the
office blog were also on the Trust Center
trust office 365 not comment about all the time we have for Today Show
thank you for watching him goodbye for now I think