Enhancing Data Protection in Office 365.Pages
Total Page:16
File Type:pdf, Size:1020Kb
Osterman Research WHITE PAPER White Paper by Osterman Research Published June 2019 Sponsored by Commvault Enhancing Data Protection in MicrosoftO Office 365 Enhancing Data Protection in Microsoft Office 365 Executive Summary When decision makers consider moving their users to Office 365, a critical issue that faces them is: • Will the platform be a complete replacement for all on-premises Microsoft servers and capabilities, or • Will it merely be an addition to current on-premises capabilities? Our research, as well as that of many others, indicates that most organizations are largely opting for the former: Office 365 is replacing on-premises deployments of Microsoft Exchange and other on-premises email platforms. While many other platforms will continue to be used, particularly in larger organizations, Office 365 is becoming the leading business email and collaboration tool in the workplace. While Microsoft offers a solid platform of useful features and functions with Office 365, no platform can be all things to all users, and so decision makers must perform due diligence and determine what Office 365 does well and in which areas supplementary or replacement solutions from third parties will be required. Moreover, there is also the issue of whether the native capabilities in Office 365 provide adequate support for non-Microsoft content sources. Osterman Research holds the Retention view that Office 365 is a solid and robust platform, but that in most cases organizations will want and need to deploy additional solutions to offer better Policies by performance or functionality, or to provide necessary functionality for solutions not offered by Microsoft. Plus, as discussed in this paper, the use of third-party solutions themselves do can be useful in helping to drive down the cost of an Office 365 deployment. not protect What follows is a discussion of the limitations within the Office 365 platform that against a rogue decision makers will want to consider as they decide how to deploy Office 365 in their administrator environment. unless ABOUT THIS WHITE PAPER Retention Lock This white paper was sponsored by Commvault. Information about the company is provided at the end of this paper. is added. However, this feature cannot Data Protection Within Office 365 be disabled Osterman Research has identified some limitations in Office 365’s data protection approach: once it is turned on. • Use of the Recycle Bin is essential for accidental deletion protection, but content from the Recycle Bin can be accidentally or maliciously cleared, and so it does not offer a true data protection option in and of itself. • The use of Retention Policies can result in an increase in storage use within OneDrive and SharePoint, potentially resulting in having to pay for extra storage beyond what is included in a given plan once the storage allocation has been reached. Extra storage is priced at $0.20 per gigabyte per month, meaning that an additional 50 gigabytes of storage per user in a 1,000-user company will cost $10,000 monthly. • Moreover, Retention Policies by themselves do not protect against a rogue administrator unless Retention Lock is added. However, this feature cannot be disabled once it is turned on, and so organizations that experience a major increase in storage will not be able to rectify that problem by disabling Retention Lock. This can also be an issue for organizations that are obligated to delete data, such as from a “right-to-be-forgotten” demand under GDPR. ©2019 Osterman Research, Inc. 1 Enhancing Data Protection in Microsoft Office 365 BACKING UP OFFICE 365 The best practice of having three copies of data – two on different platforms and one in a remote location – is a well-established practice for data protection. However, within Office 365 the native capabilities to protect data use the platform itself to provide data protection, a violation of this best practice. The use of an external service or platform to protect Office 365 data is more in line with sound data protection – even Microsoft itself recommends doing this in its service agreement. There are some capabilities within Office 365 for recovering corrupted data. For example, Files Restore will return OneDrive to a specific point in time from the past 30 days. It reverts all basic file and folder operations that transpired during the selected time period, but it does not support a selective restoration. For selective restoration – such as to recover a file or folder that was deleted accidentally rather than being subject to a ransomware attack – OneDrive offers access to the Recycle Bin and/or Version History for each file to roll back to a previous version. The ability to restore files, folders, and subfolders is a standard feature in third party backup tools. Similarly, SharePoint sites and subsites can be restored, but this can be accomplished by Microsoft support, and there are some limitations with this process, including the fact that there is no SLA for it. If a site collection must be restored, Microsoft can restore only the entire site in place, but any data created after the latest backup will be lost. The process of restoring subsites to alternate locations is possible, but Microsoft says this process is more complicated and error-prone than a full site collection restore. Customers are LONG-TERM ARCHIVAL OF DATA Data from Office 365 will be retained for three years and then deleted afterwards, responsible for and deleted emails will be moved into an archive folder and held there for three access and years, after which they will be deleted. It is important to note that the total retention period will be three years, not three years in mainline storage and an additional three control of their years in an archive folder. There are some other issues to consider: data that • The import process can corrupt a mailbox resides in the Importing data can accidentally corrupt a mailbox in some circumstances. For example, if a .PST file has been imported into a mailbox, it is not possible to Office 365 remove only the imported emails or to do a point-in-time restore to a point prior infrastructure. to the .PST import. A user in an online forum posted this exact scenario, including the difficulty in cleaning it up without the ability to do a point-in-time restore. • Users who are on legal hold When a user is on legal hold, their deleted email is not automatically migrated to an archive folder, but is instead put into the “dumpster”. If the dumpster exceeds 100 gigabytes, it must be manually moved to an archive folder or a separate retention policy must be established to manage it. Other Issues to Consider WHO PROTECTS WHAT? Office 365 is a robust offering and Microsoft has gone to significant lengths to ensure that the platform stays up and running. However, there are some important issues for any current or prospective Office 365 customer to consider: • Office 365 uses what it calls the “shared responsibility model”. This model dictates that Microsoft is responsible for its global infrastructure and ensuring that the Office 365 remains up and running; while customers are responsible for access and control of their data that resides in the Office 365 infrastructure. ©2019 Osterman Research, Inc. 2 Enhancing Data Protection in Microsoft Office 365 • While Office 365 is a fairly reliable system on a worldwide basis (it achieved 99.97 percent reliability during the first quarter of 2019i), it suffers from somewhat frequent outages on a more localized, regional basis. For example, it suffered from four such outages in April 2019 and five in May 2019ii. These outages can result in data loss. • Microsoft states that “point in time restoration of mailbox items is out of scope for the Exchange Online service.iii” That means that if an organization suffers an account takeover, ransomware attack, or data deletion from a malicious insider, among other potential problems, there is no guarantee of being able to restore lost data. In short, this means that Office 365 customers are responsible for their own data, just as if they were managing their own email and collaboration solution on-premises. Consequently, organizations that deploy Office 365 will still need to maintain robust data protection capabilities to protect against data loss. THE NEED FOR AN EMAIL JOURNAL Journaling is a useful tool in helping organizations to satisfy their regulatory, legal and best practice compliance requirements, since it records all inbound and outbound email communications that occur within an environment. Journaling is useful in the context of satisfying compliance requirements that exist in the financial services, healthcare and various other industries. Office 365 email (Exchange Online) does not have a conventional email journal, but Microsoft has changed its Office 365 model to achieve the same “compliance outcome” of a journal service. By putting all relevant mailboxes on In-Place Hold, all emails sent and received will be retained indefinitely and cannot be deleted by users. Inactive mailboxes within the environment (e.g., those belonging to ex-employees) may also be placed on Indefinite Hold. Office 365 For organizations that have an existing journal that must be migrated to Office 365, customers are one of the following will be necessary: responsible for • The existing journal must be moved to a third-party journal service and content their own data. will continue to be written to the journal from Office 365, or • All of the existing journal content must be migrated to Office 365. The first option will require that two locations be maintained and searched in order to satisfy an organization’s information governance and eDiscovery requirements, and it may result in a less expensive and more practical solution, particularly if an organization must retain large volumes of information.