WELCOME! Office 365 – What Security Threats Worry You? What do you hope to learn today? Please take a moment to fill out the yellow cards. Our presenters will review the cards to ensure that we cover the topics/areas of interest. We will collect them before we get started. Thanks! Collect ‘Learn Today’ Cards What do you hope to learn today? Please take a moment to fill out the yellow cards. Our presenters will review the cards to ensure that we cover the topics/areas of interest. We will collect them before we get started. Thanks! System Source & Microsoft: System Source & Microsoft: Microsoft Certified Partner…since 1980’s Silver – Learning Solutions Train 6,000 students/year Our Instructors rate 20% higher than Microsoft National Average Customer Satisfaction Scores. Silver – Infrastructure 1,000’s of Microsoft implementations Small Business to Enterprise Non-profit Education What Security Threats Worry You? Stephen Deming Microsoft Partner Technology Strategist Challenges 2 billion records compromised in the last year 140+ days between infiltration and detection 87% of senior managers admit using personal accounts for work 45% of organizations lack data governance which leaves them open to litigation and data security risks Ever-evolving industry standards across geographies Attack kill chain Attack kill chain Attack kill chain and ATA Our Commitment to Trust Privacy Customer is the owner of their data. We do not mine customer data for advertising purposes. Privacy controls enable you to configure your company privacy policies. Microsoft advocates for data privacy on behalf of customers. Microsoft safeguards customer data with strong contractual commitments. Transparency Know where your data is stored. Understand who has access your data and under what circumstances. Monitor the state of your service, get historic view of uptime. Integrate security events’ feeds into your company security dashboard. Gain insight with access to service dashboards & operational reporting. Operational security Safeguards to prevent unauthorized access and data loss Physical security with 24-hour monitoring and multi-factor authentication Admin background checks Zero-standing access to data Data encryption at-rest and in-transit Red team / Blue team penetration testing and incident response practice Product development using Security Development Lifecycle Bug bounty program to identify vulnerabilities Safeguarding your data Managed apps Identify, label, classify, set policies to help protect information. Encrypt your data and restrict access using Azure Information Protection. Safeguard information with Data Loss Prevention. Get visibility into and improve your security position with Secure Score Restrict unauthorized data sharing across apps with MAM. Prevent data leaks with support for Windows Information Protection. Manage data on devices through built-in MDM. Securely communicate with customers using Message Encryption. Personal apps Detect and protect against external threats Block 100% of known malware and 99% of spam with Exchange Online Protection. Provide zero-day protection against unknown malware in attachments and links with Advanced Threat Protection. Providing actionable insights to global attack trends with Threat Intelligence. Get alerts of suspicious behavior using Advanced Security Management. Secure user accounts with Conditional Access and multi-factor authentication. Compliance Meet compliance obligations for data access with Customer Lockbox. Monitor and investigate events related to your data with full audit tracking. Reduced cost and risk with in-place intelligent Advanced eDiscovery. Efficiently perform risk assessment with Service Assurance. Manage data retention with Advanced Data Governance. PROTECT DETECT across all endpoints, from using targeted signals, behavioral sensors to the datacenter monitoring, and machine learning MICROSOFT’S SECURITY APPROACH ! RESPOND closing the gap between discovery and action Security Tactics Security Tactics Identity Devices Apps & Data Cloud apps Shadow IT SaaS Azure Employees Partners Customers Device breach Data breach Identity breach On-premises apps Transition to New attack Current defenses cloud & mobility landscape not sufficient IDENTITY DRIVEN SECURITY Identity anchors our approach to security Simple connection Windows Server Active Directory Other directories Self-service Single sign-on SaaS Azure Public cloud On-premises Microsoft Azure Active Directory Cloud Multi-factor authentication Data encryption User accounts Device log-ins Malware Unauthorized data access Attacks User log-ins Phishing Denial of service System updates Enterprise security Our unique intelligence 450B 1B 200B Security Tactics Security Tactics Global, hyper-scale, enterprise-grade infrastructure Enterprise reliability via 100+ data centers and Microsoft’s global network edge Compliance leadership with standards including ISO 27001, FISMA, and EU Model Clauses No standing access to data, transparent operational model, and financial-backed 99.9% SLA Secure by design, operationalized at the physical, logical, and data layers United Kingdom Japan Key certifications CSA CCM CSA CCM ENISA IAF CS Mark (Gold) EU Model Clauses FISC Spain ISO/IEC 27001, 27018 ISO/IEC 27001, 27018 CSA CCM NIST 800-171 Japan My Number Act ENISA IAF SOC 1, 2, 3 SOC 1, 2 EU Model Clauses UK G-Cloud EU-U.S. Privacy Shield ISO/IEC 27001, 27018 SOC 1, 2 Over 1000 controls in the Office 365 compliance Spain ENS Singapore framework enable us to stay up to date with the LOPD CSA CCM ISO/IEC 27001, 27018 ever-evolving industry standards across MTCS geographies. SOC 1, 2 Trust Microsoft’s verified services. Microsoft is China China GB 18030 regularly audited, submits self-assessments to China MLPS independent 3rd party auditors, and holds key China TRUCS certifications. United States CJIS CSA CCM DISA FDA CFR Title 21 Part 11 FEDRAMP FERPA FIPS 140-2 FISMA HIPPA/HITECH HITRUST IRS 1075 European Union ISO/IEC 27001, 27018 Argentina CSA CCM MARS-E Argentina PDPA ENISA IAF Australia New Zealand NIST 800-171 CSA CCM EU Model Clauses CSA CCM CSA CCM Section 508 VPATs IRAP (CCSL) EU-U.S. Privacy Shield IRAP (CCSL) ISO/IEC 27001, 27018 SOC 1, 2 ISO/IEC 27001, 27018 ISO/IEC 27001, 27018 ISO/IEC 27001, 27018 NZCC Framework SOC 1, 2 SOC 1, 2, SOC 1, 2 SOC 1, 2 Providing clarity and consistency for the protection of personal data The General Data Protection Enhanced personal privacy rights Regulation (GDPR) imposes new rules on organizations in the European Increased duty for protecting data Union (EU) and those that offer goods and services to people in the EU, or that Mandatory breach reporting collect and analyze data tied to EU residents, no matter where they are located. Significant penalties for non-compliance Microsoft believes the GDPR is an important step forward for clarifying and enabling individual privacy rights Global Data Protection Regulation (GDPR) What it is and how Microsoft is preparing for GDPR GDPR is a global regulation that you will have to abide by starting May 2018 Microsoft is doing 3 different things to prepare for GDPR Customer outreach Engineering Government affairs We have many customer controls already available within Office that will help you stay GDPR compliant including controlling access and protecting personal data features. The most secure Windows ever XP Vista 7 8 8.1 10 2001 2007 2009 2012 2013 2015 Breach detection Device Threat Identity Information protection resistance protection protection investigation & response PRE-BREACH POST-BREACH Breach detection Device Threat Identity Information protection resistance protection protection investigation & response PRE-BREACH POST-BREACH When is more needed? Executive, management, or financial roles Access, process or store highly- sensitive customer data Regulated industries including publicly listed companies In-house software or IP development Breach detection Device Threat Identity Information protection resistance protection protection investigation & response PRE-BREACH POST-BREACH Microsoft Security: Defense in Depth • Trusted Boot Windows 10 • Windows Hello • Information Protection • Credential Guard • Device Guard • Advanced Threat Protection Microsoft Security: Defense in Depth Windows 10 • Multifactor Authentication • Anti-Spam / Anti-Malware Office 365 • Data Loss Prevention • Advanced Threat Protection Microsoft Security: Defense in Depth Windows 10 • Azure Active Directory Premium • Azure Information Office 365 Protection • Microsoft Intune Enterprise Mobility + • Advanced Threat Analytics Security • Cloud App Security Breach detection Device Threat Identity Information protection resistance protection protection investigation & response PRE-BREACH POST-BREACH Breach detection Device Threat Identity Information protection resistance protection protection investigation & response PRE-BREACH POST-BREACH 46 Windows 10 Windows Hello (Screens simulated, subject to change) 1. Fast and password-free. With Windows Hello,* you can sign into your Windows devices, compatible apps and sites 3 times faster1 than a password that you have to remember and type in and worry about keeping secure. Windows Hello uses your face, fingerprint, or a Windows Hello companion device† to recognize you instantly. You can always keep your PIN as a backup if you choose. 2. More secure than a password. Get better protection when you unlock your device with a look or a touch. Windows Hello uses biometric sensors to recognize you apart from all others. Windows Hello*