1. Microsoft Office 365 Security, Privacy, and Trust
9/11/2018 8:08 AM
OSP323
Microsoft Office 365 Security, Privacy, and Trust
Alistair Speirs, Sr. Program Manager
Bharath Rambadran, Sr. Product Marketing Manager
Microsoft Corporation
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Brings together cloud versions of our most trusted communications and collaboration products with the latest version of our desktop suite

3. Office 365 Delivers World Class Capabilities
9/11/2018
Office 365 Delivers World Class Capabilities
Pay-as-you-go, per-user licensing
Complete Office experience with services integration
Always the latest version of Office and Office Web Apps
Familiar Office user experience
IM & Presence across firewalls
GAL/Skill search in SharePoint
Online meeting with desktop sharing
Windows Live federation
My Sites to manage and share documents
Access documents offline
Document-level permissions
Share documents securely with Extranet Sites
25Gb mailbox with voic & unified messaging
Integrated personal archiving
Retention policies and legal hold
Free/busy coexistence

4. Trusting The Cloud It’s all over the news – “Can I trust the cloud?”
Key Concerns
Privacy
Loss of Control
Regulatory
Physical/Logical Security
CLOUDY WITH A CHANCE OF RAIN
“What is holding IT managers back (from going to the cloud) is fear about security.”
— The Economist, March 5, 2010

5. The Trust Questions… Privacy Transparency Compliance Security
What does privacy at Microsoft mean?
Are you using my data to build advertising products?
Where is my data?
Who has access to my data ?
Compliance
Security
What certifications and capabilities does Microsoft hold?
How does Microsoft support customer compliance needs?
Do I have the right to audit Microsoft?
Is cloud computing secure?
Are Microsoft Online Services secure?

6. Office 365 Trust Center Clear messaging with plain English
9/11/2018
Office 365 Trust Center
Clear messaging with plain English
Details for security experts
Links videos, whitepapers
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

7. The Trust Principles Privacy Verified Security
Cohesive Process Combining 4 Pillars
Your
Privacy
Matters
Leadership in Transparency
We Respect your
Privacy
You know ‘where’ data resides, ‘who’ can access it and ‘what’ we do with it
Compliance with World Class Industry standards verified by 3rd parties
Independently
Verified
Excellence in Cutting edge security practices
Relentless on
Security

8. Privacy
Your Privacy Matters

9. What Do We Mean by “Privacy”?
Repudiation
Elevation of Privilege
Information Disclosure
Tampering
Spoofing
Denial of Service
PII Controls
Notice and Consent
Breach Response
Data Minimization
Transnational Data Flows
PRIVACY
SECURITY

10. Privacy at Office 365 No Advertising Data Portability No Mingling
9/11/2018
Privacy at Office 365
At Microsoft, our strategy is to consistently set a “high bar” around privacy practices that support global standards for data handling and transfer
No Advertising
No advertising products out of Customer Data.
No scanning of or documents to build analytics or mine data.
Data Portability
Office 365 Customer Data belongs to the customer.
Customers can export their data at any time.
No Mingling
Choices to keep Office 365 Customer Data separate from consumer services.
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

11. How Privacy of Data is Protected?
We use customer data for just what they pay us for - to maintain and provide Office 365 Service
Microsoft Online Services Customer Data1
Usage Data
Account and Address Book Data
Customer Data (excluding Core Customer data)
Core Customer Data
Operating and Troubleshooting the Service
Yes
Security, Spam and Malware Prevention
Improving the Purchased Service, Analytics No
Personalization, User Profile, Promotions
Communications (Tips, Advice, Surveys, Promotions)
No/Yes
Voluntary Disclosure to Law Enforcement
Advertising5
Usage Data
Address Book Data
Customer Data (excluding Core Customer Data*)
Core Customer Data
Operations Response Team (limited to key personnel only)
Yes.
Yes, as needed.
Yes, by exception.
Support Organization
Yes, only as required in response to Support Inquiry.
No.
Engineering
No Direct Access. May Be Transferred During Trouble-shooting.
No Direct Access. May Be Transferred During Trouble- shooting.
Partners
With customer permission. See Partner for more information.
Others in Microsoft
No (Yes for Office 365 for small business Customers for marketing purposes).

12. Transparency
You know ‘where’ data resides, ‘who’ can access it and ‘what’ we do with it.

13. Who accesses and What is accessed?
9/11/2018
Transparency
At Microsoft, our strategy is to consistently set a “high bar” around privacy practices that support global standards for data handling and transfer
Where is Data Stored?
Clear Data Maps and Geographic boundary information provided
‘Ship To’ address determines Data Center Location
Who accesses and What is accessed?
Core Customer Data accessed only for troubleshooting and malware prevention purposes
Core Customer Data access limited to key personnel on an exception basis.
How to get notified?
Microsoft notifies you of changes in data center locations.
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

14. Excellence in cutting edge security practices

15. Ongoing Process Improvements
Microsoft Security Development Lifecycle Reduce vulnerabilities, limit exploit severity
Education
Process
Accountability
Administer and track security training
Guide product teams to meet SDL requirements
Establish release criteria and sign-off as part of FSR
Incident
Response (MSRC)
Training
Requirements
Design
Implementation
Verification
Release
Response
Core Security Training
Establish Security Requirements
Create Quality Gates / Bug Bars
Security & Privacy Risk Assessment
Establish Design Requirements
Analyze Attack Surface
Threat Modeling
Use Approved Tools
Deprecate Unsafe Functions
Static Analysis
Dynamic Analysis
Fuzz Testing
Attack Surface Review
Incident Response Plan
Final Security Review
Release Archive
Execute Incident Response Plan
Ongoing Process Improvements

16. Office Security Progress
Unique Security Issues Reported
Office XP
Macro security levels
Office 2007
Default setting changes
Reduced security prompts
XML file format support
Trust Center & Message Bar
Trusted locations
Active content security
Block file format settings
Document Inspector 9%
Office 2003
CryptoAPI support
Trusted publishers
ActiveX control security
Office 2010
Protected View
Office File Validation
Trusted Documents
Crypto Improvements

17. Core security improvements: file fuzzing
A method to identify previously unknown vulnerabilities in file formats
Office teams fuzzed millions of files 10’s of millions of times
Led to hundreds of new bugs being fixed
Used to create XML Schema Definitions (XSD) for binary Office files
XSDs allow binary files to be quickly scanned for potential problems

18. Industry-recognized security improvements

19. User protection starts with authentication
Active Directory at the core
Control user password policies across devices and services
Use Group Policies to configure operating environment
Extensible management with FIM, ADFS
Cloud integration options
Cloud managed user accounts managed via web portal
On premises directory synchronized to web portal
Single sign on capability using AD federation services
Active Directory
Cloud ID
Directory Sync
1-way trust

20. Securing users with Group Policy
Administrators can use Group Policy to mandate user settings for Office
Administrators can use settings to create highly restricted or lightly managed desktop configurations
Group Policy settings have precedence over OCT settings
Administrators can use settings to disable file formats that are not secure across the network
Over 4000 group policy control objects

21. 9/11/2018
Service Security – Defense in Depth a risk-based, multi-dimensional approach to safeguarding services and data
SECURITY MANAGEMENT
Threat and vulnerability management, monitoring, and response
Access control and monitoring, file/data integrity
DATA
Account management, training and awareness, screening
USER
Secure engineering (SDL), access control and monitoring, anti-malware
APPLICATION
Access control and monitoring, anti-malware, patch and configuration management
HOST
INTERNAL NETWORK
Dual-factor authentication, intrusion detection, vulnerability scanning
NETWORK PERIMETER
Edge routers, intrusion detection, vulnerability scanning
FACILITY
Physical controls, video surveillance, access control
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

22. Physical Security – Sample facility
24x7 guarded facility
700,000 square feet
10s of 1000s of servers
Days of backup power

23. Business Productivity
Microsoft Security Strategy Briefing
NDA - Microsoft Confidential
Business Productivity
Communicate and collaborate more securely using Exchange, SharePoint, Lync, and Office
Comprehensive Protection
Information Security
Visibility and Control
Multi-layered protection against spam and malware
Effectiveness guaranteed by 5 financially-backed SLAs
In-product controls that help protect users from threats
Policy rules that inspect s in transit
Integration with AD RMS to safeguard sensitive data
End-to-end encryption of communications
Integrated administration, reporting, and auditing
Granular control over user access and permissions
Mobile security policies and remote device wipe

24. Common Security Concern Customer data at rest is not encrypted
For “sensitive” data, implementation of Active Directory Rights Management Services (RMS)
Encryption impacts service functionality (e.g. search and indexing)
For “sensitive” externally sent/received , customers employ S/MIME
Identity/key management issues
The customer makes the decision

25. Compliance with World Class Industry standards verified by 3rd parties
Independently Verified
Compliance with World Class Industry standards verified by 3rd parties

26. Why Get Independently Verified
Why Get Independently Verified? “I need to know Microsoft is doing the right things”
Alignment and adoption of industry standards ensure a comprehensive set of practices and controls in place to protect sensitive data
While not permitting audits, we provide independent third-party verifications of Microsoft security, privacy, and continuity controls
Microsoft provides transparency
This saves customers time and money, and allows Office 365 to provide assurances to customers at scale

27. Compliance Management Framework
Policy
Business rules for protecting information and systems which store and process information
Control Framework
A process or system to assure the implementation of policy
Standards
System or procedural specific requirements that must be met
Operating Procedures
Step-by-step procedures

28. Data Processing Agreement
9/11/2018
Office 365 Compliance
We are the first and only major cloud based productivity to offer the following:
ISO27001
ISO27001 is one of the best security benchmarks available across the world.
Office 365 first major business productivity public cloud service to implement rigorous ISO security controls on physical, logical, process and management
EU Model Clauses
Office 365 is the first major business productivity public cloud service provider willing to sign EU Model Clauses with all customers.
EU Model Clauses a set of stringent European Union wide data protection requirements
Data Processing Agreement
Address privacy, security and handling of Customer Data.
Going above and beyond the EU Model Clauses to address additional requirements from individual EU member states
Enables customers to comply with their local regulations.
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

29. US Health Insurance Portability and Accountability Act
9/11/2018
Office 365 Compliance
Comply with additional industry leading standards
US Health Insurance Portability and Accountability Act
HIPAA is a U.S. law that requires HIPAA covered entities to meet certain privacy and security standards with respect to individually identifiable health information
Microsoft is offering to sign the Business Associate Agreement (BAA) for any Microsoft Enterprise Agreement customer. The BAA helps enables our customers to comply with HIPAA concerning protected health information.
EU Safe Harbor
EU generally prohibits personal data from crossing borders into other countries except under circumstances in which the transfer has been legitimated by a recognized mechanism, such as the "Safe Harbor" certification
Microsoft was first certified under the Safe Harbor program in 2001, and we recertify compliance with the Safe Harbor Principles every twelve months
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

30. Compliance Update Compliance with Key Standards
Certification
Audience
BPOS Standard
Office 365
ISO 27001
All customers
Yes
Available Now
EU Safe Harbor
EU customers
SSAE 16 (Statement on standards for Attestation Engagement) Type I compliance
Primarily US customers
FISMA
US Government No
HIPAA/BAA
EA Customers
EU Model Clauses
EU Customers
Data Processing Agreement

31. Compliance Update HIPAA Business Associate Agreement (BAA)
What is it?
What does it cover?
Who and how to get it?
HIPAA is a U.S. law that requires HIPAA covered entities to meet certain privacy and security standards with respect to individually identifiable health information
To comply with HIPAA, in certain cases Microsoft is required to sign BAA with HIPAA covered entities which assures adherence to certain privacy and security requirements
Protects Protected Health Information (PHI) covering patient only information not end users
Security incident notification within 30 days of unauthorized access
Office 365 is not intended to be used as a PHI repository, customer should make their decision on how to best comply with HIPAA. More information can be found in the regulatory compliance section of the Trust Center.
Available today for all customers.

32. demo The Office 365 Trust Center Bharath Rambadran Sr. Product Manager
TechReady 14
9/11/2018 8:08 AM
The Office 365 Trust Center
Bharath Rambadran Sr. Product Manager
demo
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

33. How To Sign Up For EU Model Clauses
Office 365 Trust Center Compliance Section
Link to EU Model Clause sign-up Page
EU Model Clause Sign up Page
Located in MOSP Portal
Requires Admin Access
Customer enters Admin details and
Agreement I.D

34. Step 2: Sign in to Online Services Portal

35. Step 3: Select Contract and Accept

36. Step 4: Confirmation Page

37. Related Content Code Title Schedule OSP221
Microsoft Office 365 for Enterprises
6/11/ :00 PM
OSP305
The Modern Compatibility Process to Accelerate Microsoft Office Deployment
6/11/2012 4:45 PM
OSP321
Active Directory Integration with Microsoft Office 365
6/12/ :15 AM
OSP224
Microsoft Office 365 Management and Deployment
6/12/ :30 PM
OSP223
Microsoft Office 365 for Education
6/12/ :15 PM
OSP303
Supporting Microsoft Office in an Enterprise Environment
6/12/2012 3:15 PM
OSP202
Microsoft Excel: A Web Development Tool?
6/12/2012 5:00 PM
OSP306
Microsoft Office Deployment for the Elite
6/13/ :15 AM
OSP325
To the Cloud, from the Trenches: Best Practices for Migrating to Microsoft Office 365
6/13/ :30 PM
OSP302
Building Integrated Microsoft Office 365, SharePoint Online, and Office Solutions Using BCS and LOB Data
6/13/ :15 PM
OSP323
Microsoft Office 365 Security, Privacy, and Trust
6/13/ :00 PM
OSP324
Microsoft Office 365 Service Reliability and Disaster Recovery
6/14/ :30 AM
OSP304
Optimized Desktop Deployment Jeopardy Live Game Show
6/14/2012 1:00 PM
OSP222
Empowering Small Businesses: Microsoft Office 365 P-Suite
6/14/ :30 PM

38. Resources Office 365 Trust Center (http://trust.office365.com)
Office 365 Privacy Whitepaper (New!)
Office 365 Security Whitepaper and Service Description
Office 365 Standard Responses to Request for Information
Office 365 Information Security Management Framework

39. Related Resources
Office 365 TechCenter: technet.microsoft.com/Office365
Office Client TechCenter: technet.microsoft.com/office
Office, Office 365 and SharePoint Demo Area Includes:
Office 365 IT Pro Command Center
Office 365 Data Center Exhibit

40. Resources Learning TechNet http://europe.msteched.com
Connect. Share. Discuss.
Microsoft Certification & Training Resources
TechNet
Resources for IT Professionals
Resources for Developers

41. Submit your evals online
9/11/2018 8:08 AM
Evaluations
Submit your evals online
© 2007 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

42. Questions?

43. TechReady 14
9/11/2018 8:08 AM
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

44. 9/11/2018 8:08 AM
© 2009 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.