How to Protect Identity, Devices and Content in the Cloud

How to Protect Identity, Devices and Content in the Cloud with Microsoft Enterprise Mobility + Security (EM+S) Introduction The proliferation of mobile devices in the workplace has meant employees are able to boost productivity by working on the go, anywhere, any time, and workers often want to use their own laptops, tablets and smartphones to do it. But what are the pitfalls for organisations, and how can they be overcome? With data often referred to as “the new oil”, protecting company and consumer data is of the highest importance. Data can enable a company to thrive. Put it at risk, and business could suffer untold damage to both finances and reputation. It’s also crucial that companies execute a sound app strategy, as well as find a way to keep communications compliant and consistent across any channel. This eBook explains how organisations can fully manage their expanding number of mobile devices in a secure fashion, using the new Microsoft Enterprise Mobility + Security (EM+S). The three key pillars of EM+S are: Identity protection Device protection Content protection Traditionally, identity, device and content protection was provisioned via software that ran inside an organisation. This was a satisfactory solution when identities, devices and information were also largely held inside the organisation. But, today employees take their mobile devices everywhere, and those devices are used to access both on-premise and software-as-a-service (SaaS) applications. These employees also want access to custom applications running on cloud platforms, such as Microsoft Azure and Amazon Web Services (AWS). And they want to do all this from their Windows 10, iOS and Android devices. This is a cloud-centric, device-centric world, and the modern workforce expects this easy, convenient access – and on-premise solutions for identity, device and information management cannot effectively address the new way of working. Microsoft says the control plane for all these services needs to move from an organisation’s own data centre to the cloud. Doing this with Microsoft EM+S enables provision of everything users expect, while organisations retain the protection and control they need. EM+S includes Azure Active Directory, Azure Rights Management, Microsoft Intune, and Advanced Threat Analytics to provide organizations with cost-effective, comprehensive security for users, devices, applications, and data. 2 Enterprise Mobility + Security Identity and access Managed mobile Information Identity-driven management productivity protection security Azure Active Directory Azure Information Microsoft Cloud App Premium P2 Protection Premium P2 Security Identity and access Intelligent classification and Enterprise-grade visibilty, EMS management with advanced encryption for files shared control, and protection for E5 protection for users and inside and outside your your cloud applications privileged identities organization (includes all capabilities in P1) (includes all capabilities in P1) Azure Active Directory Microsoft Intune Azure Information Microsoft Advanced Premium P1 Mobile device and app Protection Premium P1 Threat Analytics EMS Secure single sign-on to management to protect Encryption for all files and Protection from advanced E3 cloud and on-premises apps corporate apps and data on emails across cloud and on targeted attacks leveraging any device premises storage locations user and entity behavioural MFA, conditional access, and analytics advanced security reporting Cloud-based file tracking Identity Management As part of an efficient identity access SaaS application connects directly to every management (IAM) platform, organisations enterprise’s on-premise identity management should be able to choose and deploy single technology, it becomes difficult to manage. sign-on systems, to allow staff to use a single set of security steps for multiple gadgets, and A more effective approach is to use a cloud to make secure mobile working an solution for identity management. Azure Active easier experience. Directory (AD) Premium is part of Microsoft EM+S. With this solution, an on-premise Most users want single sign-on (SSO) for directory service is still essential, but now multiple applications – few like having to connects only to Azure AD. Azure AD then remember a number of sign-on names and connects directly to each SaaS application, passwords – and so organisations have long reducing the chaos. been using on-premise identity management technologies such as Microsoft Active Directory. Users’ identities can still come from the owned directory service – the business is still in However, with the increasing popularity control – but, by exploiting the power of the of SaaS applications, relying on identity cloud, users have easy access to both local and management on-premise is no longer enough. SaaS applications with a single sign-on. Life is To provide SSO, an on-premise technology, better for users and simpler for such as Active Directory, has to connect to each IT administrators. of the applications users wish to access. If all these applications are in an organisation’s Azure AD currently provides SSO to more own data centre, that’s easy, as each than 2,000 cloud applications, including application connects to its local instance of Office 365, Salesforce.com, Dropbox, Active Directory. But, as more applications Workday and ServiceNow. move to the cloud, problems arise. If every 3 Device Protection Compromised Devices The number of enterprises with compromised mobile devices grew by 42 percent in the “ A single compromised device fourth quarter of 2015, according to mobile can introduce malware into management firm MobileIron. the corporate network or The company reports in Q4 2015 Mobile enable the theft of sensitive Security and Risk Review that one in ten corporate data that resides enterprises have at least one compromised behind the firewall. mobile device on their network. “ Whether a company loses MobileIron uncovered numerous variants of millions of records or just anti-detection tools that hide that a device one record it’s still a breach. is compromised, creating a “false sense of For all companies, but security” at companies. The study also found particularly ones in highly that more than half of enterprises have at least regulated industries, this is one non-compliant device, including devices a huge problem.” with PIN protection, disabled or devices that lack up-to-date security policies. Michael Raggo Director MobileIron says that less than 10 percent of MobileIron Security Labs companies enforce device patching, while more than 95 percent of companies have no protection against mobile malware. Key to an efficient and secure mobile strategy is a comprehensive mobile device management (MDM) and mobile app management solution (MAM). Essential features in any system include provision to allow corporate administrators to be able to remotely configure, manage and secure devices. With remote configuration administrators can set up email accounts on multiple devices without individual users having to come into the office for it to be done. The team responsible for IT should be able to do it all with a few clicks of a mouse, without bothering staff in the field, or affecting productivity. 4 Device Protection Administrators should also have full control over corporate email, without affecting the What Chief Information Security Officers user’s personal emails. The system should allow care about companies to remotely delete all corporate Top questions for a CISO: Will cloud emails and other business data when an computing meet my specific needs? employee leaves the company – again, without Where is my data, who has access, and them having to come into the office with the what level of control will I have over relevant device/s. Companies should have the the data? ability to do the same when that device is lost or stolen. Securing productivity: CISOs have And companies must have the power to ensure responsibility for personnel, physical all devices adhere to company security policies. assets, and information in both physical Enforcing corporate password policies and and digital form. CISOs are often pushing out policies across all devices on the responsible for all the layers of an network should be simple. For example, admin organisation’s technology stack (network, managers should be able to set the minimum application, mobile, and data security). password length, the time lapse before the Agile management: the changing landscape device auto-locks, and a maximum number of of today’s enterprise means that potential failed password attempts. exposure points are growing exponentially, thereby posing new and more complex security challenges. Gaining control and focusing on cybersecurity is an imperative. CISOs: • Need greater insight into cybersecurity threats. • Need to demonstrate to the larger C-suite how vital it is to properly secure the network and illustrate the importance of effective cybersecurity investments. • Seek to understand the complexities that influence the true cost of security risks to business and how to determine the best security investments to protect the company’s assets. Transparency: moving to the cloud requires trust. CISOs want to understand how Microsoft operates in the cloud, handles data, and responds to law enforcement demands. Being transparent builds trust. 5 Device Protection Microsoft Intune Mobile devices became popular well before the rise of cloud computing, and so traditional MDM and MAM solutions were

Load more