fy17 mtc e5 briefings security

Security Week 27 maart – 31 maart

Security Week 27 maart – 31 maart

Maandag - ‘Trusted cloud’: hoe kun je de cloud vertrouwen?

Dinsdag - Office 365; beveiliging van gegevens en informatie

Woensdag - Digitaliseer veilig je organisatie in de cloud

Woensdag - Wat moet je weten over de nieuwe GDPR regelgeving?

Donderdag - Digitale Transformatie & de security voordelen

Vrijdag - Veilig mobiel werken in de cloud

SecurityBuilt-in Enterprise ProtectionHans van der Meer

hansv@microsoft.com

Our commitment to trust

Customer challenges

160 million customer records compromised

229 days between infiltration and detection

87% of senior managers admit using personal accounts for work

50% year over year growth in electronic data

Ever-evolving industry standards across geographies

Our unique approach

Our unique approach

Our security platform

User log-ins

Unauthorized data access

Data encryption

Malware

System updates

Enterprise security

Attacks

Phishing Denial of service

User accounts

Device log-ins

Multi-factor authentication

300B

1B

200B

Our unique intelligence

Our unique approach

Our partnership approach

Reinventing productivity for the digital transformation

Enterprise reliability via 100+ data centers and Microsoft’s global network edge

Compliance leadership with standards including ISO 27001, FISMA, and EU Model Clauses

No standing access to data, transparent operational model, and financial-backed 99.9% SLA

Secure by design, operationalized at the physical, logical, and data layers

Global, hyper-scale, enterprise-grade infrastructure

Over 900 controls in the Office 365 compliance framework enable us to stay up to date with the ever-evolving industry standards across geographies.

Trust Microsoft’s verified services. Microsoft is regularly audited, submits self-assessments to independent 3rd party auditors, and holds key certifications.

Key certifications

United StatesCJIS

CSA CCM

DISA

FDA CFR Title 21 Part 11

FEDRAMP

FERPA

FIPS 140-2

FISMA

HIPPA/HITECH

HITRUST

IRS 1075

ISO/IEC 27001, 27018

MARS-E

NIST 800-171

Section 508 VPATs

SOC 1, 2

ArgentinaArgentina PDPA

CSA CCM

IRAP (CCSL)

ISO/IEC 27001, 27018

SOC 1, 2

SpainCSA CCM

ENISA IAF

EU Model Clauses

EU-U.S. Privacy Shield

ISO/IEC 27001, 27018

SOC 1, 2

Spain ENS

United KingdomCSA CCM

ENISA IAF

EU Model Clauses

ISO/IEC 27001, 27018

NIST 800-171

SOC 1, 2, 3

UK G-Cloud

JapanCSA CCM

CS Mark (Gold)

FISC

ISO/IEC 27001, 27018

Japan My Number Act

SOC 1, 2

SingaporeCSA CCM

ISO/IEC 27001, 27018

MTCS

SOC 1, 2

New ZealandCSA CCM

ISO/IEC 27001, 27018

NZCC Framework

SOC 1, 2

AustraliaCSA CCM

IRAP (CCSL)

ISO/IEC 27001, 27018

SOC 1, 2

European UnionCSA CCM

ENISA IAF

EU Model Clauses

EU-U.S. Privacy Shield

ISO/IEC 27001, 27018

SOC 1, 2,

ChinaChina GB 18030

China MLPS

China TRUCS

Privacy

Customer is the owner of their data.

We do not mine customer data for advertising purposes.

Privacy controls enable you to configure your company privacy policies.

Microsoft advocates for data privacy on behalf of customers.

Microsoft safeguards customer data with strong contractual commitments.

Transparency

Know where your data is stored.

Understand who has access your data and under what circumstances.

Monitor the state of your service, get historic view of uptime.

Integrate security events’ feeds into your company security dashboard.

Gain insight with access to service dashboards & operational reporting.

Security

Built-in operational security

Safeguards to prevent unauthorized access and data loss

Detect and protect against external threats

Operational security

Physical security with 24-hour monitoring and multi-factor authentication

Admin background checks

Zero-standing access to data

Data encryption at-rest and in-transit

Red team / Blue team penetration testing and incident response practice

Product development using Security Development Lifecycle

Bug bounty program to identify vulnerabilities

Safeguarding your data

Identify, label, classify, set policies to help protect information.

Encrypt your data and restrict access using Azure Information Protection.

Safeguard information with Data Loss Prevention.

Restrict unauthorized data sharing across apps with Mobile Application Management.

Prevent data leaks with support for Windows Information Protection.

Manage data on devices through built-in MDM.

Securely communicate with customers using Message Encryption.

Personal apps

Managed apps

Detect and protect against external threats

Block 100% of known malware and 99% of spam with Exchange Online Protection.

Provide zero-day protection against unknown malware in attachments and links with Advanced Threat Protection.

Share & integrate data across security services with Threat Intelligence.

Get alerts of suspicious behavior using Advanced Security Management.

Secure user accounts with Conditional Access and multi-factor authentication.

Compliance

Meet compliance obligations for data access with Customer Lockbox.

Monitor and investigate events related to your data with full audit tracking.

Reduced cost and risk with in-place intelligent Advanced eDiscovery.

Efficiently perform risk assessment with Service Assurance.

Manage data retention with Advanced Data Governance.

Next steps and resources

Security Blogs on Office Blogs

Compliance Blogs on Office Blogs

Take a guided tour of Office 365

FastTrack for Office 365

Office 365 E5 Trial

Office 365 Trust Center

Microsoft Trust Center

Microsoft Secure

Office 365 Roadmap

© 2015 Microsoft Corporation. All rights reserved.

24

Time-of-click protection against malicious URLs

URL reputation checks along with detonation of

attachments at destination URLs.

Zero-day protection against malicious attachments

Attachments with unknown virus signatures are

assessed using behavioral analysis.

Critical insights into external threats

Rich reporting and tracking features provide critical

insights into the targets and categories of attacks.

Integrated across apps & services

Protection across Exchange Online, SharePoint

Online, OneDrive for Business, and Office apps.

Intelligence sharing with devices

Integration with Windows Advanced Threat

Protection to correlate data across users and devices.

Advanced Threat Protection

Advanced Security Management

Threat detection

Identify high-risk and abnormal usage, security

incidents, and threats.

Enhanced control

Shape your Office 365 environment with granular

security controls and policies.

Discovery and insights

Gain enhanced visibility and context into your

Office 365 usage and shadow IT.

Customer Lockbox

Meet Compliance Needs

Customer Lockbox can help customers meet

compliance obligations by demonstrating that they

have procedures in place for explicit data access

authorization.

Extended access Control

Use Customer Lockbox to control access to

customer content for service operations.

Visibility into actions Actions taken by Microsoft engineers in response to Customer Lockbox requests are logged and accessible via the Management Activity API and the Security and Compliance Center.

Advanced eDiscovery

Identify relevant documents

Predictive coding enables you to train the system

to automatically distinguish between likely relevant

and non-relevant documents.

Identify data relationships

Use clustering technology to look at documents in

context and identify relationships between them.

Organize and reduce the data prior to review

Use near duplicate detection to organize the data

and reconstruct email threads from unstructured

data to reduce what’s sent to review.

Threat Intelligence

Broad visibility into attack trends

Billions of data points from Office, Windows, and

Azure

Integrated data from external cyber threat hunters

Proactive security policy management

Intuitive dashboards with drill-down capabilities

Advanced Data Governance

Leverage intelligence to automate data retention

Classify data based on age, type, user, or sensitivity

Policy recommendations based on machine

learning

Apply actions to preserve high value data

Purge redundant, obsolete, and trivial data