Supporting your GDPR compliance journey with Microsoft · Email address Social media posts ......
Transcript of Supporting your GDPR compliance journey with Microsoft · Email address Social media posts ......
Corporate
Public
Private cloud
Vendors SaaS
Remote teamPersonal
Data is shared more often
and more widely than ever.
How do I get started?
Identify what personal data you have and
where it residesDiscover1
Govern how personal data is used
and accessedManage2
Establish security controls to prevent, detect,
and respond to vulnerabilities & data breachesProtect3
Keep required documentation, manage data
requests and breach notificationsReport4
Discover In-scope
Any data that helps
you identify a person
Name
Email address
Social media posts
Physical, physiological,
or genetic information
Medical information
Location
Bank details
IP address
Cookies
Cultural identity
Inventory
Any container where
personal data is
collected and stored
Emails
Documents
Databases
Removable media
Metadata
Log files
Backups
Identify what personal data you have and where it resides
Gain deep visibility and granular controls into cloud app usage with Microsoft Cloud App Security
Cloud discoveryDiscover cloud apps used in your
organization, get a risk assessment
and alerts on risky usage.
Data visibilityGain deep visibility into where
data travels by investigating all
activities, files and accounts for
managed apps.
Data controlMonitor and protect personal and
sensitive data stored in cloud apps
using granular policies.
Get anomalous usage alerts, new app and trending apps alerts.
On-going analytics
Discover 13K+ cloud apps in use across your networks and sensitive data they store.
Discovery of cloud apps and data
Assess risk cloud apps based on ~60 security and compliance risk factors.
Cloud app risk assessment
Protect your employees’ privacy while discovering
cloud apps in your environment.
Log anonymization
Set granular policies to control data in the cloud—either automated or based on file label—using out-of-the-box policies or you can customize your own.
Granular Data loss prevention (DLP) policies
Detect and manage 3rd party app access.
Revoke access for 3rd party apps
Identify policy violations, enforce actions such as quarantine and permissions removal.
Policy enforcement
Cloud App Security reads labels
set by AIP to give admins visibility
into sharing of sensitive files.
Increased visibility
Admins can set policies for
controlling sharing of sensitive
files and also get alerted if the
policies are violated.
Improved control
Manage
Govern how personal data is used and accessed
Data
governance
Defining policies, roles
and responsibilities for
the management and
use of personal data
At rest
In process
In transit
Storing
Recovery
Archiving
Retaining
Disposal
Data
classification
Organizing and
labeling data to
ensure proper
handling
Types
Sensitivity
Context / use
Ownership
Custodians
Administrators
Users
Protect data on-premises and in the cloudwith Azure Information Protection
Classification
and labelingClassify data based on
sensitivity and add labels—
manually or automatically.
ProtectionEncrypt your sensitive
data and define usage
rights or add visual
markings when
needed.
MonitoringUse detailed tracking
and reporting to see
what’s happening with
your shared data and
maintain control over it.
PERSONAL
HIGHLY CONFIDENTIAL
CONFIDENTIAL
GENERAL
PUBLIC
You can override a classification and optionally
be required to provide a justification.
Manual reclassification
Policies can be set by IT Admins for automatically
applying classification and protection to data.
Automatic classification
Based on the content you’re working on, you
can be prompted with suggested classification.
Recommended classification
Users can choose to apply a sensitivity label to the
email or file they are working on with a single click.
User-specified classification
Discover personal data and apply persistent labels
Labels are persistent and
readable by other systems
e.g. DLP engine
Labels are metadata
written to data
Sensitive data is
automatically detected
Discover personal data with auto-classification
Data is
auto-classified
based on content
Sensitive data is
automatically detected
Safely share data with people inside and outside
of your organization.
Define explicit permissions for recipients, e.g.,
allow people to view and edit, but not print or
forward.
Secure sharing
Office 365 Advanced eDiscovery
Identify relevant documents
Predictive coding enables you to train the system
to automatically distinguish between likely relevant
and non-relevant documents.
Identify data relationships
Use clustering technology to look at documents in
context and identify relationships between them.
Organize and reduce the data prior to review
Use near duplicate detection to organize the data
and reconstruct email threads from unstructured
data to reduce what’s sent to review.
Protect
Establish controls to prevent, detect, and respond to vulnerabilities and breaches
Preventing
data attacks
Protecting your data
Physical datacenter protection
Network security
Storage security
Compute security
Identity management
Access control
Encryption
Risk mitigation
Detecting &
responding
to breaches
Monitoring for and
detecting system
intrusions
System monitoring
Breach identification
Calculating impact
Planned response
Disaster recovery
Notifying DPA & customers
Bing
Xbox Live
OneDrive
Microsoft Digital
Crimes Unit
Microsoft Cyber Defense
Operations Center
Azure
Microsoft
Accounts
Skype Enterprise Mobility
+ Security
Azure Active Directory
IF
Privileged user?
Credentials found in public?
Accessing sensitive app?
Unmanaged device?
Malware detected?
IP detected in Botnet?
Impossible travel?
Anonymous client?
High
Medium
Low
User risk
10TBper day
THEN
Require MFA
Allow access
Deny access
Force password reset******
Limit access
High
Medium
Low
Session risk
Azure
BingOneDrive
Microsoft
Cyber Defense
Operations Center
Microsoft
Cybercrime Center
Xbox Live
Microsoft
Accounts
Skype
Enforce on-demand, just-in-time administrative access when needed
Use Alert, Audit Reports and Access Review
DomainUser
Global Administrator
Discover, restrict, and monitor privileged identities
DomainUser
Administrator privileges expire after
a specified interval
Managed apps
Personal apps
Advanced device managementEnforce device security policies such as
encryption, password/PIN requirements,
jailbreak/root detection and more.
Remote actions
Enforce device security policies such as
encryption, password/PIN requirements,
jailbreak/root detection and more.
Device security configuration
Restrict access to specific applications or
URL addresses on mobile devices and PCs.
Restrict apps and URLs
Managed apps
Personal appsPersonal apps
Managed apps
Corporate data
Personaldata
Multi-identity policy
Multi-identity allows you to separate company
data from personal data within an app.
Data separation
Control what happens to docs and data after
they’ve been accessed with app protection
policies.
• App encryption at rest
• App access control—PIN or credentials
• Save as/copy/paste restrictions
• App-level selective wipe
• Apply policies for Windows 10 InformationProtection for even greater control
Data control
On-premises abnormal behavior and advanced threat detection
Advanced
Threat Analytics
Identity-based attack and threat detection
AzureActive Directory
Anomaly detectionfor cloud apps
Cloud AppSecurity
!!
!
ATA builds the organizational security graph,
detects abnormal behavior, protocol attacks, and
weaknesses.
3. Detect
ATA observes and learns all entities’ behaviors
automatically.
2. Learn
ATA uses context to prevent false positives and
presents alerts as an attack timeline.
4. Alert
ATA analyzes all Active Directory-related traffic
and collects relevant events from SIEM.
1. Analyze
Gain useful insights from user, file, activity, and
location logs.
Advanced investigation
Assess risk in each transaction and identify anomalies in your cloud environment that may indicate a breach.
Behavioral analytics
Enhance behavioral analytics with insights from the Microsoft Intelligent Security Graph to identify anomalies and attacks.
Threat intelligence
Safe
Multiple filters + 3 antivirus engineswith Exchange Online protection
Links
RecipientUnsafe
Attachment• Supported file type• Clean by AV/AS filters• Not in Reputation list
Detonation chamber (sandbox)Executable?
Registry call?
Elevation?
……?
Sender
Report
Keep detailed records about how personal data is handled
Record-keeping
Enterprises will need
to record the:
Purposes of processing
Classifications of
personal data
Third-parties with
access to the data
Organizational and
technical security
measures
Data retention times
Reporting tools
Implement reporting
capabilities
Cloud services
(processor)
documentation
Audit logs
Breach notifications
Handling Data Subject
Requests
Governance reporting
Compliance reviews
Displays all sign-in events to applications that
contain personal and sensitive data.
Access and usage reporting
• Security reports. Displays risky users and sign-ins e.g., sign-ins from anonymous IPs, impossible travel, unfamiliar locations and infected devices.
• User-specific reports. Displays device/sign-in activity data for a specific user.
• Activity logs. Displays all audited events e.g., group activity changes, password resets and registration activity.
Azure Management Portal
• Rights management
• Access management
• User/device management
• Security policies
• Threat management
• Data search and discovery
• Compliance management
• Logs and reporting