WHITE PAPER SPON. The Need for Third-Party Security, Compliance and Other Capabilities in Microsoft Office 365. Published July 2013

Transcription

1 WHITE PAPER N Security, Cmpliance and Other Capabilities in Micrsft An Osterman Research White Paper Published July 2013 spnsred by spnsred by SPON spnsred by Osterman Research, Inc. P.O. Bx 1058 Black Diamnd, Washingtn USA Tel: Fax: inf@stermanresearch.cm twitter.cm/msterman

2 EXECUTIVE SUMMARY Micrsft Office 365 is a leading, clud-based slutin frm the wrld s largest sftware cmpany. It ffers , instant messaging, telephny, cntent management, desktp prductivity, security, archiving and ther capabilities delivered frm Micrsft s wrldwide netwrk f clud data centers. It is ffered in a large (sme wuld say cnfusing) number f versins at price pints ranging frm free t $20+ per user per mnth. While Office 365 is, t sme extent, marketed as smething f a ne-stp-shp fr cmmunicatin and cllabratin needs, it is a generalist prduct by its very nature, as are all clud-based cmmunicatin and cllabratin tls ffered t a mass audience. In shrt, Office 365 cannt satisfy every requirement fr every user at every rganizatin. Cnsequently, Osterman Research believes that mst mid-sized and large rganizatins (as well as many smaller nes) that are cnsidering Office 365 will need t use third party fferings that will supplement the capabilities in Micrsft s ffering r that will serve as replacements fr them. KEY TAKEAWAYS Office 365 is a gd platfrm fr cmmunicatins and cllabratin and ffers rbust functinality with reasnable reliability. There are limitatins in Office 365 particularly with regard t security and archiving that many rganizatins will want t layer r replace with third party slutins that will better satisfy their particular requirements. Althugh Office 365 is a clud-based slutin, sme f the mre advanced capabilities f Office 365 require a significant level f n-premises infrastructure r the use f third-party capabilities. The majrity f mid-sized and large rganizatins will deply Office 365 using a hybrid mdel f clud-based and n-premises infrastructure because f their inability r the cst effectiveness f migrating all capabilities t the clud. A CAVEAT The gal f this white paper is nt t denigrate Office 365, its capabilities r Micrsft. In fact, we believe Office 365 is quite rbust and useful fr a large number f rganizatins. Hwever, ur gal is t be as hnest and balanced as pssible in discussing bth the advantages and drawbacks f Office 365. As with any clud-based cmmunicatins and cllabratin tl, there are limitatins in Office 365 that can be satisfied thrugh the use f third party tls and services. Any limitatins discussed here are nt limited t Office 365, but can be part f any clud-based slutin. The majrity f mid-sized and large rganizatins will deply Office 365 using a hybrid mdel. ABOUT THIS WHITE PAPER Osterman Research cnducted a market research survey with rganizatins that had at least 50 users and that had nt definitely ruled ut the pssible use f Office 365. In fact, 5% f the users in the rganizatins surveyed are currently served by Office 365, a figure that is expected t increase t 22% by May The survey, cnducted in early May 2013 with the Osterman Research survey panel, fcused n capabilities, features and functins that these rganizatins wuld require frm their cmmunicatin and cllabratin systems, and hw well these might be satisfied by Office 365 and ther slutins. Sme f the results frm that survey are discussed in this white paper, but a separate dcument will be made available specifically fcused n all f the survey results. The spnsr f this white paper is McAfee. Infrmatin abut the cmpany and its relevant fferings are included at the end f this paper Osterman Research, Inc. 1

3 WHY ARE ORGANIZATIONS USING OFFICE 365? CORE FEATURES AND OVERVIEW OF THE PLATFORM Office 365 is a cllectin f clud-based fferings that includes Exchange Online (mst accunts ffer 25-gigabyte mailbxes), SharePint Online, Lync Online and Web-based versins f desktp prductivity applicatins, as shwn in the table n the next page. Organizatinal decisin makers are seriusly cnsidering the use f Office 365 and ther clud-based messaging and applicatin platfrms because they can ffer lwer and mre predictable csts f wnership, the ability t free IT staff fr ther tasks, and t add new capabilities that wuld either require the additin f new staff members r access t expertise that is nt readily available. Our survey fund that an imprtant r extremely imprtant reasn fr migrating t Office 365 is t reduce csts (cited by 66% f decisin makers and influencers), t reduce the wrklad fr IT staff (61%), and t free up IT staff fr ther prjects r initiatives (55%). INCREASING USE OF OFFICE 365 In April 2013, Micrsft claimed that 25% f enterprises (defined by Micrsft as rganizatins with at least 250 emplyees instead f the mre cmmnly accepted standard f 1,000+ emplyees i ) are nw using Office 365 and that the service is nw running at a rate f generating $1 billin in annual revenues ii. While the frmer claim means that 25% f enterprises have Office 365 running within them fr at least sme f their users, there is n dubt that the platfrm is becming mre ppular as decisin makers cnsider increased use f clud and related services. In fact, as shwn in the fllwing figure, ne in fur rganizatins surveyed by Osterman Research that have nt ruled ut the use f Office 365 anticipate that they will mve all f their users t the platfrm at sme pint. Hwever, an equal number believe they will use a hybrid mdel f Office 365 and n-premises infrastructure. Osterman Research believes that the hybrid mdel will ultimately be the mst cmmnly used mdel fr deplying Office 365 in mid-sized and large rganizatins. Plans fr Migrating t Office 365 Amng rganizatins that are still cnsidering a migratin t Office 365 Our survey fund that an imprtant r extremely imprtant reasn fr migrating t Office 365 is t reduce csts, t reduce the wrklad fr IT staff, and t free up IT staff fr ther prjects r initiatives. DIFFERENCES BETWEEN OFFICE 365 AND BPOS Micrsft BPOS, the predecessr t Office 365, was intrduced in late 2008 and was quite successful, selling several millin seats. At the same time, BPOS was cntrversial with Micrsft s significant ecsystem f hsted Exchange prviders 2013 Osterman Research, Inc. 2

4 because Micrsft s per-seat pricing fr BPOS was much lwer than many prviders pricing fr hsted Exchange. Mrever, BPOS was built n the 2007 versins f Exchange, SharePint and Office Cmmunicatins Server (nw Lync Server) instead f the mre clud-friendly 2013 versins n which Office 365 is based. Plus, while BPOS was designed fr smaller businesses, Office 365 was designed fr enterprises, as well, a market int which Micrsft has been making significant inrads. Selected Versins and Csts fr Office 365 Versin Exchange Online Plan 1 Exchange Online Plan 2 Office 365 Enterprise E1 iv Office 365 Enterprise E3 Office 365 Enterprise E4 SharePint Online Plan 1 SharePint Online Plan 2 Lync Online Plan 1 Lync Online Plan 2 Includes Hsted Exchange, spam and malware filtering, Active Integratin, In-Place Archive Same as abve plus In-Place Hld, unlimited strage, hsted vic and DLP iii capabilities Hsted with 25Gb f strage, plus Office Web apps, basic file sharing, Web cnferencing, public Web site, intranet capabilities, etc. Same as abve plus desktp versins f Micrsft Office, Office Mbile apps, archiving and legal hld capabilities, unlimited archival strage, ediscvery Center (supprts Exchange, SharePint and Lync), hsted vic , business intelligence Same as abve plus enterprise vice, business intelligence tls App catalg and marketplace, team sites, wrk management, scial capabilities, external sharing, basic search, standard search, cntent management, recrds management, access services, SharePint 2013 wrkflw Same as abve plus enterprise search, e-discvery, ACM, cmpliance with varius regulatry requirements, Excel services, Visi services, frmbased applicatins, business cnnectivity services Presence, instant messaging, IM federatin (w/windws Live), Skype cnnectivity, Lync-t-Lync calling, Lync mbile clients Same as abve plus desktp, applicatin and whitebard sharing; multiparty cntent sharing, interperability with third-party audi cnferencing services, multi-party vide, etc. $/User/ Mnth $4.00 $8.00 $8.00 $20.00 $22.00 $3.00 $7.00 $2.00 $5.50 In additin t the fferings nted abve, there are a number f ther Office 365 versins, including: Business Office 365 Small Business (up t 25 users): $5.00/user/mnth Office 365 Small Business Premium (up t 25 users): $12.50/user/mnth Office 365 PrPlus: $15.00/user/mnth Office 365 Midsize Business (up t 300 users): $15.00/user/mnth Educatin Office 365 Educatin A2: free t students and faculty/staff Office 365 Educatin A3: $ /user/mnth Office 365 Educatin A4: $ /user/mnth 2013 Osterman Research, Inc. 3

5 Gvernment Exchange Online Plan 1: $3.50/user/mnth Exchange Online Plan 2: $7.00/user/mnth Office 365 (Plan 1) fr Gvernment: $6.00/user/mnth Office 365 (Plan 3) fr Gvernment: $17.00/user/mnth Kisk Exchange Online Kisk: $2.00/user/mnth Office 365 K1: $4.00/user/mnth Office 365 K2: $8.00/user/mnth By just abut any measure, Office 365 is a very slid ffering frm a leading and well-respected vendr. While Micrsft has been ffering clud-based fr many years, the current versins f their clud fferings are rbust and ffer enterprisegrade features and functins. Mrever, Micrsft has made Office 365 cmpatible with a range f key standards and ther requirements as verified by varius third parties v, further enhancing its appeal fr enterprise custmers: Business Assciate Agreements under the Health Insurance Prtability and Accuntability Act (HIPAA) The Federal Infrmatin Security Management Act (FISMA) Internatinal Organizatin fr Standardizatin (ISO) Eurpean Unin (EU) Safe Harbr and Data Prtectin Directive Mdel Clauses The Gramm-Leach-Bliley Act (GLBA) The Family Educatinal Rights and Privacy Act (FERPA) Title 21 CFR Part 11 f the Cde f Federal Regulatins The Federal Infrmatin Prcessing Standard (FIPS) Trusted Internet Cnnectins (TIC) By just abut any measure, Office 365 is a very slid ffering frm a leading and wellrespected vendr. What this means is that Office 365 may be used in a variety f regulated envirnments, such as healthcare, gvernment and in the Eurpean Unin. Micrsft als benefits frm rbust supprt fr a hybrid mdel given its cmmanding market share fr desktp prductivity applicatins and its dminance in the business market thrugh Exchange. WHY ORGANIZATIONS MAY HESITATE TO USE OFFICE 365 In spite f Office 365 s several benefits, it has sme limitatins that are wrth nting: SECURITY ISSUES N versins f Office 365 ffer end user access t the spam quarantine fr selfmanagement capabilities vi. Exchange Online Plans 1 and 2 d nt prvide fr administratr management f the quarantine vii. Office 365 des nt supprt perating redundant spam filters in parallel with Office 365 s built-in spam prtectin. Office 365 des nt include advanced and targeted threat prtectin techniques, such as real-time link fllwing, t emulate the cntents fr malware, in additin t reputatin checks Osterman Research, Inc. 4

6 There is n supprt fr blacklists in Office 365 P1. There is n supprt t take actin n an cntaining a link strictly based ff the URL reputatin alne. There is n supprt t help users n mbile devices determine whether a link in an is safe t click n. Instant messaging and file filtering are nt available with any Office 365 plans viii. ARCHIVING ISSUES Archiving in Office 365 has sme limitatins, including lack f supprt fr Exchange Online archiving with Outlk 2011 under Mac OS X, as well as lack f supprt fr accessing archived s via Andrid and iphne devices. Archiving fr Lync Online des nt include sme types f Lync cntent, such as peer-t-peer file transfers, cnferencing anntatins, applicatin-sharing fr peer-t-peer instant messages and cnferences, r audi/vide fr peer-t-peer instant messages and cnferences. Mrever, archiving settings cannt be directly cntrlled frm inside the Lync administratin center, but instead are cntrlled by the Exchange mailbx In-Place Hld attribute established fr each user s accunt ix. Archiving f Lync cntent requires a legal hld t be placed n the mailbx. Mrever, Lync archiving can be accmplished nly with the Lync desktp applicatin and nt at the server level, such as when users are lgged int Office 365 via Web services. SharePint Online, while ffering ediscvery, cmpliance with varius regulatry bligatins and ther capabilities, des nt archive cntent. Because f the grwing amunt f cntent that is stred in SharePint-enabled rganizatins, the ability t archive this cntent is critical. The In-Place Archive (frmerly knwn as the Persnal Archive) is a secndary mailbx that can be deplyed n the same r a different server frm a user s primary mailbx. The In-Place Archive r retentin plicies require either an Exchange Server accunt r an Exchange Online accunt tgether with an Exchange Server Enterprise Client Access License and nly certain Outlk licenses a variety f Outlk versins are nt supprted x. Office 365 requires an external mailbx r third party archive fr jurnaling capabilities (jurnaling is the prcess f capturing a cpy f s that can then be archived). Our research fund that 57% f the rganizatins we surveyed are interested r very interested in jurnaling fr cmpliance purpses, making this capability mre cumbersme t implement in many envirnments. Only Plans E3 and E4 ffer unlimited strage (thers must share the 25 Gb f space between the primary mailbx and the In-Place Archive). End user search capabilities in Office 365 are mre limited than they are with many cmpeting clud-based and n-premises archiving slutins. SharePint Online, while ffering ediscvery, cmpliance and ther capabilities, des nt archive cntent. Because f the grwing amunt f cntent that is stred in SharePintenabled rganizatins, the ability t archive this cntent is critical. There are n native surveillance features in Office 365 that allw mnitring r sampling f cmmunicatins this is an imprtant capability fr highly regulated firms, such as financial services firms that must sample cmmunicatins per FINRA Regulatry Ntice xi. Fr rganizatins that need t jurnal cntent int Office 365 such as Salesfrce Chatter cntent, instant media, scial psts, etc. they will require the use f a third party archiving slutin, since jurnaling within Office 365 des nt supprt imprt f external, nn-lync cntent Osterman Research, Inc. 5

7 PERFORMANCE ISSUES The maximum number f messages that can be delivered is 30 per minute xii. Fr messages sent t 5,000+ recipients, the maximum size f the message is tw megabytes xiii. The maximum number f POP r IMAP cnnectins is 20 and the maximum number f cncurrent Exchange ActiveSync cnnectins is fur xiv. RETENTION ISSUES Items in the Deleted Items and Junk flders can be retained fr a maximum f 30 days xv. The maximum size f the arbitratin mailbx is ten gigabytes xvi. Office 365 Plans E3 and E4 can have the Recverable Items Flder (frmerly knwn as the Dumpster) set t retain deleted s beynd the default 30 days t any ther value xvii (dependent n the strage quta limitatins fr the Recverable Items Flder). This capability is simply a hidden flder that allws users t recver that was intentinally r mistakenly deleted. Fr SharePint Online, data is backed up twice each day and retained fr 14 days. SHAREPOINT ISSUES SharePint Online fr Office 365 Enterprise, Educatin and Gvernment is limited t xviii : 500 megabytes per subscribed user (but additinal strage is available fr an additinal fee). The strage base per tenant is 10 gigabytes plus the limit nted abve. There can be n mre than 100 gigabytes per site cllectin. The file uplad limit is 250 megabytes per file. The maximum number f unique external users is 10,000 per mnth. The SharePint Online API requires custm cde t wrk with the Micrsft sandbx mdel. Office n Demand, a key feature f Office 365 that permits temprary Office client t be installed n any Windws 7/8 PC, is nt supprted n the ipad. SSL is nt available in SharePint Online fr sme Office 365 users. MOBILITY ISSUES Office 365 will wipe nly thse mbile devices that are managed using ActiveSync. BlackBerry Enterprise Server (BES) is nt supprted in Office 365. Despite declining supprt fr BES in sme rganizatins (a situatin that we believe will be reversed ver the next 24 mnths as BlackBerry regains lst market share), this is a serius prblem fr rganizatins that still have many BlackBerry users. Office n Demand, a key feature f Office 365 that permits temprary Office client t be installed n any Windws 7/8 PC, is nt supprted n the ipad, the mst cmmnly deplyed tablet cmputer in the wrkplace. MAILBOX ISSUES Shared mailbxes in Office 365 are prvided at n charge, but cannt be larger than five gigabytes and can be created nly with Remte PwerShell. Mrever, a shared mailbx cannt be accessed by users f an Exchange Online Kisk 2013 Osterman Research, Inc. 6

8 license and cannt archive s frm individual users xix. Inactive mailbxes (i.e., deleted mailbxes) can have their cntents held indefinitely if an In-Place Hld is exercised befre the mailbx is autmatically deleted. While the cntents f a deleted mailbx can be recvered fr 30 days after deletin, bth the mailbx and its cntents will nt be recverable after 30 days if the hld is nt activated xx. OS AND APPPLICATION VERSION ISSUES Windws XP/SP3 and Vista SP2 will nt be supprted after 2013 xxi. Outlk versins earlier than 2007 (Windws) r 2011 (Mac) with all patches and service pack upgrades are the minimum versins supprted with Office 365 xxii. DATA LOCATION ISSUES Micrsft stres Office 365 custmer data in varius cuntries based n the lcatin f the custmer xxiii, can mve custmer data withut ntice, and will nt guarantee exactly where a custmer s data will be stred. Fr example: Nrth American custmers: primary data centers are lcated in the United States. Gvernment custmers in the United States: primary data and backup centers are lcated in the United States. Mst EMEA custmers: primary data centers fr Office 365 are in Ireland and the Netherlands; Lync Online custmers prvisined befre Octber 2011 may be hsted frm a US data center. Asia Pacific custmers: the primary data centers fr Office 365 data are in Singapre and Hng Kng, but a data center in Ireland is used fr Active Directry and Glbal Address Bk data. Lync Online and Online Prtal data are served frm a US data center. Suth American custmers (except Brazil): primary data centers are lcated in the United States. Brazilian custmers: the primary data center fr SharePint Online is in Brazil; fr Exchange Online custmers after Octber 30, 2011, a Brazilian and US data are used interchangeably as the primary data centers; fr Exchange Online custmer prvisined befre Octber 30, 2011, the primary data center is in the United States. Micrsft states that it uses ne r mre f its data centers in the United States as the backup data center fr all services fr US and Suth American custmers. Backup data centers fr EMEA custmers are in Ireland and the Netherlands, except that Active Directry and Glbal Address Bk data are hsted in US data centers fr perfrmance reasns. Fr Asia Pacific custmers, backup data centers are used in Singapre and Hng Kng, but a data center in Ireland is used fr backup f Lync Online Active Directry, Glbal Address Bk data and Online Prtal. Users f Office 365 d nt necessarily cntrl when they will be upgraded, since Micrsft determines when upgrades ccur. OTHER ISSUES Users f Office 365 d nt necessarily cntrl when they will be upgraded, since Micrsft determines when upgrades ccur xxiv. Backup and recvery f custmer data are cntrlled nly by Micrsft. Althugh Office 365 prpses a utility-based mdel fr licensing, autmatic plan assignment r re-assignment as a user changes rles is nt available thrugh 2013 Osterman Research, Inc. 7

9 DirSync/ADFS, as is als the case fr true single sign-n capability. Clud-based, third party slutins can help t fill this gap. Single sign-n supprted in Office 365, but nly with Active Directry Federatin Services. With an Exchange Server n-premises, admins can access lg files using simple scripting, a feature nt pssible in Office 365. THE NEED FOR BETTER SECURITY IN OFFICE 365 Micrsft ffers a number f security capabilities in Office 365: anti-virus and antispam filtering; physical access cntrls that using multiple authenticatin schemes at its data centers that are managed by Micrsft Glbal Fundatin Services; and emplyee access that is restricted by jb functin; amng ther capabilities. Hwever, there are sme security issues that decisin makers shuld take int accunt as they cnsider a mve t Office 365, including: Office 365 uses a multi-tenant architecture The Office 365 architecture is multi-tenant, meaning that multiple custmers envirnments run n the same servers. While this can be a secure envirnment, many rganizatins particularly thse in highly regulated industries r thse with very sensitive infrmatin may nt be cmfrtable in such a shared data envirnment. Despite the fact that Micrsft islates custmer data int sils, the cmpany ffers the ability t stre Office 365 data n dedicated hardware fr an additinal cst xxv. Extra security layers may be needed Micrsft Exchange Online Prtectin (EOP) xxvi uses multiple scanning engines frm leading security vendrs and EOP s SLA claims t detect 100% f all knwn viruses with updates every 15 minutes. That said, sme custmers may want t add an additinal layer f inbund prtectin/detectin fr increased abilities fr phishing r spearphishing detectin capability, fr example. Or they may simply want t add anther layer f malware r spam filtering fr additinal prtectin. Fr example ur research fund that the ptential market fr Office 365 finds the fllwing prtectin capabilities t be imprtant r very imprtant, capabilities that may nt be fully satisfied by an Office 365-nly deplyment: The Office 365 architecture is multi-tenant, meaning that multiple custmers envirnments run n the same servers. Clud prviders ffering SLAs fr spam and malware filtering (65%) The availability f multiple malware scanners fr incming (62%) Multi-vendr threat prtectin (62%) Integrated, end-t-end encryptin (58%) Graymail filtering capabilities (42%) Integrated DLP fr scanning the channel (50%) Graymail capabilities have been added t EOP, but the system classifies graymail as spam, leaving it undifferentiated frm actual spam. DLP cmpliance template capabilities have als been added t EOP, but they will nt satisfy all custmers requirements. Plus, Lync Online des nt scan files r ther cntent fr malware, nr des it archive instant messaging cntent as nted abve. Mrever, it is essential t segment phishing cntent frm spam, allwing fr prper management f phishing messages (e.g., nt placing phishing messages in the same quarantine as spam s that end users are prevented frm pening phishing messages and having their PC and netwrk ptentially cmprmised). Filtering limitatins While mst versins f Office 365 prvide reprts f received r sent spam, and malware detectins in received r send , Office 365 Small Business and 2013 Osterman Research, Inc. 8

10 Office 365 Small business Premium d nt. Advanced threat prtectin Office 365 may nt prvide the level f prtectin frm advanced threats that many rganizatins will require. Fr example, if an attacker creates a new URL specifically targeted against a cmpany and links it t malware, EOP may nt scan thse new links and the cntent behind thse links at the time f click t blck thse that are malicius. Because many larger rganizatins will need t wrap advanced security capabilities like these arund Office 365, the base security capabilities in Office 365 will need t be carefully evaluated in light f decisin makers attitudes tward risk. Mbility limitatins Office 365 wipes nly ActiveSync devices, which can be a majr limitatin in the large number f rganizatins that still supprt BlackBerry devices and d nt want t d via ActiveSync. Mrever, while all versins f Office 365 supprt BlackBerry Internet Service, nt all versins supprt BlackBerry Business Clud Services. Althugh BlackBerry supprts ActiveSync, sme have reprted prblems in ding s. An alternative fr many rganizatins will be t deply BlackBerry Enterprise Services, which will ffer supprt fr nt nly BlackBerry devices, but als ios and Andrid devices. Micrsft manages Office 365 backup and recvery Micrsft manages all f the backup and recvery f cntent fr Office 365 custmers unless custmers have implemented their wn capabilities at an additinal cst, nr are there native selective restre capabilities. While Micrsft managing backup and recvery is nt an inherent weakness per se, custmers must rely n Micrsft t manage these aspects f the Office 365 experience and t d s in a timely manner. Plus, as nted abve, Micrsft determines where it stres custmer data, which can be a prblem fr many custmers in jurisdictins with strict privacy requirements and restrictins n the gegraphic lcatin f data. Single sign-n capabilities can be very cmplex Single sign-n (SSO) capabilities are supprted in Office 365, but they can be cmplex. Fr example, the use f the Micrsft Online Services Sign-In Assistant that can streamline authenticatin fr client applicatins is nt an actual SSO capability because it actually cmbines tw passwrds xxvii. True SSO is achievable with Office 365, but nly when Active Directry Federatin Services (ADFS) are used in netwrks that are running Windws Server 2008 Active Directry n-premises. This means that in an enterprise envirnment, a fair amunt f n-premises infrastructure will still be required in rder t effectively manage Office 365 access. While Micrsft ffers an SLA fr Office 365, it is imprtant t nte that it may nt be as rbust as sme decisin makers might like. The Office 365 SLA may nt be adequate While Micrsft ffers an SLA fr Office 365 xxviii, it is imprtant t nte that it may nt be as rbust as sme decisin makers might like. Fr example: Service Credits are Custmer s sle and exclusive financial remedy fr any vilatin f [the Office 365] SLA. The Service Credits awarded in any calendar mnth shall nt, under any circumstance, exceed Custmer s mnthly service fees. The service credits equal 25% f the service fee nly if mnthly uptime drps belw 99.9% (43 minutes per mnth), 50% if mnthly uptime drps belw 99% (seven hurs 12 minutes per mnth), and 100% if mnthly uptime drps belw 95% (36 hurs per mnth). The SLA des nt apply t factrs utside Micrsft s reasnable cntrl, that resulted frm Custmer s r third-party hardware r sftware, during 2013 Osterman Research, Inc. 9

11 scheduled dwntime, r during beta and trial services (as determined by Micrsft). Micrsft calculates mnthly uptime in such a way that high levels f dwntime culd be experienced by sme Office 365 users withut triggering the payment f Service Credits. Fr example, cnsider the case f a 1,000-user rganizatin with 800 users in Nrth America and 200 users in Eurpe. If the Eurpean custmers experienced three hurs f unplanned dwntime in ne mnth and 30 minutes f dwntime as a result f scheduled maintenance, but the Nrth American users experienced n dwntime during that mnth, Micrsft wuld calculate ttal uptime fr that mnth acrss the entire rganizatin at 99.92%. This means that althugh the Eurpean users experienced uptime f nly 99.51% during that mnth, n Service Credits wuld be paid. The bttm line is that Office 365 s included security is a reasnably slid ffering, but it des nt ffer the advanced prtectin level f a pure play security prvider and, therefre, may nt be the mst suitable security slutin fr every rganizatin. THE NEED FOR BETTER COMPLIANCE IN OFFICE 365 Anther ne f the key issues that Osterman Research has discvered in its research ver the past several years is that many decisin makers d nt cnsider their specific archiving, security and cmpliance requirements in as much detail as they shuld. Mrever, many d nt cnsider all f their lng-term archiving and cmpliance requirements befre migrating t a clud-based messaging platfrm. Hwever, when migrating t the clud, a new set f cmpliance cnsideratins becmes imprtant t understand befre any decisins are made. BETTER ARCHIVING CAPABILITIES Many rganizatins have a regulatry bligatin t retain varius types f data and ensure its authenticity and integrity fr many years, in sme cases indefinitely. The In-Place Archives in Office 365 d nt address these types f requirements as well as sme third party archiving slutins, since users can delete cntent frm the frmer. Only Office 365 Plans Enterprise E3 and E4 ffer unlimited archive strage qutas and litigatin hld capabilities, meaning that users nt prvisined with these mre expensive Office 365 plans may require additinal archiving capabilities t ensure adequate retentin f their data. Mrever, the ther plans share strage between the primary mailbx and the archive, whereas the E3 and E4 plans d nt. Office 365 s included security is a reasnably slid ffering, but it des nt ffer the advanced prtectin level f a pure play security prvider. Our research fund that 50% f thse surveyed cnsider third party backup and archiving capabilities fr Office 365 t be imprtant r very imprtant 40% f respndents cnsider third party backup and archiving fr SharePint data t be this imprtant. This means that a sizeable prprtin f the Office 365 market will want t deply additinal backup and archiving capabilities, negating sme f the cst advantage f migrating t Office 365. While placing a mailbx n litigatin hld in Office 365 r jurnaling prevents users frm deleting messages, the Messaging Recrds Management (MRM) capability in Office 365 r Exchange Online des nt. Fr example, Micrsft states that MRM desn t guarantee retentin f every message. Fr example, a user can delete r remve a message frm their mailbx befre the message reaches its retentin age; MRM isn't designed t prevent users frm deleting their wn messages. xxix This means that sme rganizatins with strict requirements fr retaining all relevant messages, such as financial services cmpanies, may need t seek alternative archiving slutins that will ensure retentin f all messaging cntent Osterman Research, Inc. 10

12 GEOGRAPHIC AND JURISDICTIONAL REQUIREMENTS Sme rganizatins are under strict bligatins t cmply with varius jurisdictinal requirements, such as a requirement that data nt leave a particular gegraphic area r that it nt be mved t a natin that des nt ffer adequate prtectin f sensitive data. Hwever, Micrsft admitted in June 2011 that cntent in its data centers can be handed ver t US r ther authrities and that custmers might nt be ntified f this disclsure xxx. Mrever, as nted abve, custmer data can be mved t a variety f lcatins fr day-t-day management r backup purpses. On the ther hand, sme third-party archiving slutins ffer mre transparency abut where custmer data resides, which will alleviate sme decisin makers cncerns. This is particularly true fr nn-us custmers that may nt want their data subject t review under the PATRIOT Act, by the IRS xxxi r ther US gvernment agencies. Anther cnsideratin, nt nly fr Office 365 but fr all culd prviders in general, is the issue f blind subpenas subpenas issued by a gvernment authrity withut the knwledge f the custmer. Because a clud prvider can be cmpelled t grant the gvernment access t custmer recrds withut infrming their custmer f the activity, sme rganizatins may decide that n-premises archiving f clud-based cntent is preferable. CONTENT AVAILABILITY An imprtant limitatin f Office 365 is that if the service experiences a dwntime incident, the archived cntent is als unavailable. Use f a third party archiving slutin eliminates this limitatin by string data in tw different infrastructures, allwing users t access their archived cntent and, as part f a business cntinuity slutin, t send and receive s while Office 365 is unavailable. This is nt a trivial cnsideratin, since there have been sme serius utages in the Office 365 infrastructure. Fr example, in January 2013 alne, there were fur majr utages that affected Micrsft s nline services. DLP Micrsft has implemented DLP in Office 365, Exchange Online and Exchange 2013 based n Exchange Transprt Rules xxxii. Thrugh the use f Plicy Tip ntificatin messages, Outlk users can be alerted t ptential vilatins f crprate plicies when sending that might cntain sensitive r cnfidential infrmatin xxxiii. Micrsft has prvided a number f definitins xxxiv that can be used ut f the bx, but allws admins t create custm definitins, as well. As f this writing, DLP can be used nly with Outlk 2013 fr Plicy Tips, nt with Outlk Web Access when used with either Office 365 r n-premises Exchange. While DLP plicies wrk fr s sent frm ther clients, the Plicy Tips feature wrks nly with Outlk Advanced capabilities such as file fingerprinting are als nt available. Several thirdparty archiving slutins ffer mre granular capabilities than are available with Micrsft s slutins. ediscovery AND LITIGATION HOLD CAPABILITIES The Enterprise plans fr Office 365 prvide built-in ediscvery capabilities, but sme rganizatins will need mre sphisticated and granular functinality, such as highly cnfigurable legal hlds and rbust case management when perfrming nline reviews. Sme rganizatins that have sphisticated ediscvery requirements will find that althugh useful, Office 365 s built-in capabilities might nt meet their needs. Several third-party archiving slutins ffer mre granular capabilities than are available with Micrsft s slutins, such as tamper-prf strage acrss all Office 365 plans, the ability t perfrm very cmplex searches fr ediscvery r regulatry cmpliance purpses, utput t varius file frmats when exprting cntent t thirdparty review tls, and better supprt fr EDRM requirements. Imprtant limitatins in Office 365 in the cntext f ediscvery include: 2013 Osterman Research, Inc. 11

13 The In-Place Hld feature des nt capture distributin list membership r BCCs, and s des nt ffer a cmplete recrd f every message sender and recipient. If an emplyee leaves the rganizatin, his r her mailbx will be permanently deleted if nt placed n hld within 30 days f its deactivatin. Reviewing the data that results frm a search can be mre difficult in Office 365 than with sme ther tls. Because search results are cpied t a discvery mailbx and then accessed via Outlk r OWA, this can make the review f large search results r sharing the respnsibility f reviewing cntent acrss grups mre time cnsuming. The lack f sphisticated review tls is a key cnsideratin fr rganizatins that need t perfrm early case assessment r similar types f peratins acrss the entire rganizatin xxxv. The In-Place ediscvery and Hld interface in Exchange Online can be used t implement an In-Place Hld fr a maximum f nly 50 mailbxes in a single search. If cntent needs t be captured fr mre than 50 mailbxes, the prcess must be repeated and cntent held in batches f 50 mailbxes, r IT must use the Exchange Management Shell cmmand-line interface t manage discvery xxxvi. If the ediscvery Center in SharePint Online is used, a search query acrss a maximum f 1,500 mailbxes is pssible, but if mre mailbxes must be searched multiple search queries must be run r the Exchange Management Shell cmmand-line interface must be used xxxvii. Fr Office 365 dedicated plans, a maximum f 15% f the mailbxes in Office 365 can be placed n hld at any given time. Once the maximum is reached, new mailbxes cannt be placed n hld xxxviii. NOT ALL PLATFORMS AND CONTENT SOURCES ARE SUPPORTED Many rganizatins perate multiple n-premises and clud-based platfrms, and s will need an archiving and cmpliance slutin that can supprt all f these platfrms. Micrsft s archiving slutins d nt currently supprt all f the platfrms that an rganizatin might have in place, such as cmpeting mail systems like GrupWise, Ntes/Dmin r Ggle Apps; r varius dcument repsitries like Bx r Drpbx. Fr example, while Micrsft ffers nline archiving fr Exchange, it des nt d s fr SharePint, requiring the use f a third party slutin fr rganizatins that need t archive SharePint cntent. This is an imprtant cnsideratin, since an ediscvery effrt, fr example, can be made mre cmplicated if an rganizatin must extract cntent frm multiple archiving systems e.g., ne fr Office 365, ne fr SharePint cntent, ne fr files, etc. Having a single archiving slutin fr all cntent streamlines ediscvery, litigatin hlds and ther activities. Many rganizatins perate multiple n-premises and clud-based platfrms, and s will need an archiving and cmpliance slutin that can supprt all f these platfrms. STORAGE LIMITATIONS Many rganizatins stre very large amunts f infrmatin as a result f either lng retentin perids fr and ther cntent, r because they preserve dataintensive files like engineering, graphic r architectural drawings. As a result, fr sme custmers the limitatins in Office 365 s archiving fr the less expensive plans will nt be acceptable Osterman Research, Inc. 12

14 ADDITIONAL ISSUES THAT DECISION MAKERS SHOULD CONSIDER Decisin makers will als need t answer fur basic questins when decisin n whether r nt t migrate sme r all f their users t Office 365 (r any clud-based messaging and applicatin platfrm): 1. Shuld we migrate ur active mailbxes t Office 365? 2. Shuld we prt ur existing archive t Office 365? 3. If yes t either, shuld we use Micrsft r a third-party t prvide Office 365 services? 4. Shuld we use ne r mre ther third parties t strengthen r prvide ther capabilities? Here are sme f the mre imprtant questins that decisin makers shuld ask internally, f cnsultants and f vendrs as they cnsider a pssible migratin t Office 365: -GENERATING APPLICATIONS What legacy applicatins are currently emplyed that will need t be rewritten, applicatins that cannt be migrated t the clud because f regulatry r ther cnsideratins, r that will require n-premise infrastructure t supprt? Our research fund that 36% f the rganizatins surveyed have mre than 50 -generating applicatins in place. REGULATORY ISSUES T what extent d we r will we need t cmply with SEC/FINRA, HIPAA, FERPA, SOX, GLBA and ther regulatry requirements? Hw well will native Office 365 capabilities cmply with ur requirements and what are the hles we will need t fill with third party services? Will the native Office 365 DLP capabilities be sufficient t meet ur cmpliance bligatins and hw well will they integrate with ther DLP capabilities we might have tday r in the future? BUSINESS ISSUES Shuld third-party clud vendrs be used t enhance the security f Office 365, including vendrs f security, encryptin, business and cmpliance archiving r Web filtering? Fr example, the Micrsft encryptin slutin is passive and can create prblems frm a risk management perspective. Hw well will native Office 365 capabilities cmply with ur requirements and what are the hles we will need t fill with third party services? Migrating key services like and cllabratin t the clud carries with it sme level f risk, s shuld we emply multiple prviders in rder t distribute the risk? Fr example, if we are cncerned abut ging all-in with a clud strategy, will we be better ff using a third-party archiving slutin that will maintain cpies f data at the Office 365 prvider s and the archiving prvider s data centers? Shuld we deply Office 365 using nly basic services with supplemental capabilities ffered by third parties, r shuld we pt fr mre sphisticated (and mre expensive) services initially, keeping in mind the limitatins in migrating frm less capable t mre capable plans? Is the security prtectin ffered sufficient fr the needs f ur business, r shuld we be cncerned abut the risk f targeted attacks and layer an advanced clud security service arund Office 365? 2013 Osterman Research, Inc. 13

15 What are the ptins available fr clud service prtability? In ther wrds, hw easy r difficult will it be t migrate t Office 365, frm Office 365 t anther prvider, r back t an n-premise service mdel? What is the current level f internal IT supprt that we culd devte t managing the migratin t and supprt fr Office 365 and third-party fferings? What is the desired level f internal IT supprt fr managing the migratin t and supprt fr Office 365 and third-party fferings? Hw will ur rganizatin respnd and stay prductive in the event f an Office 365 service disruptin r utage? ARCHIVING AND CONTENT MANAGEMENT D we need redundant cpies f ur archived data in multiple lcatins? If yes, why? Fr data prtectin? Business cntinuity? Disaster recvery? What is the relative imprtance f each? D we need t specify in which cuntry(ies) ur cntent will be stred? What will be the impact f the US PATRIOT Act n ur ability t prtect infrmatin? D we need t add ur crprate dmain(s) and set up jurnal rules t capture all messages sent r received frm Exchange Online directly within the administratin cnsle? What ptins are available fr maintaining an n-premise archive f clud-based cntent? SERVICE LEVELS Is Office 365 able t meet ur requirements fr uptime/availability? Hw reliable are third-party slutins fcused n security, encryptin, archiving, cmpliance, etc.? What cmpensatin is ffered by prviders fllwing utages? What shuld ur backup strategy fr Office 365 data be? What services are ffered fr migrating existing, npremise Exchange mailbxes and security settings t Office 365? What metrics d we need t establish with regard t Recvery Time Objectives (RTO) and Recvery Pint Objectives (RPO)? MIGRATION SERVICES What services are ffered fr migrating existing, n-premise Exchange mailbxes and security settings t Office 365? What services are ffered fr migrating frm SharePint t Office 365? What services are ffered fr migrating archived data frm n-premise archiving slutins t either Exchange Online Archiving r a third party, clud-based archiving slutin? D these services include mail rute cntrl, split dmains r blended slutins that can streamline the migratin prcess? T what extent are custmizatin services required? 2013 Osterman Research, Inc. 14

16 Are there exit strategies available n a number f levels: a) mving back frm Office 365 t sme srt f an n-premise capability, r b) mving frm clud-based archiving t n-premise archiving while leaving in the clud. SHOULD MICROSOFT MANAGE YOUR ? Anther imprtant cnsideratin is whether r nt Micrsft (r any single clud vendr) shuld manage all f an rganizatin s . When we asked this questin specifically abut Micrsft, we fund that many decisin makers and influencers were nt supprtive f having Micrsft manage their crprate , as shwn in the fllwing figure. Views n Having Micrsft Manage an Organizatin s Infrastructure SINGLE SIGN-ON ISSUES Is single sign-n required? Hw well can a third party vendr integrate with Office 365 frm a user management and Active Directry sync perspective? If s, will the investment in n-premise Micrsft slutins be wrth the expense, r will anther single sign-n ffering be a better fit? If a third party is used, will that party leverage Micrsft s ADFS fr identity management and single sign-n as ppsed t ther, nn-micrsftsanctined/apprved methds? MOBILITY ISSUES Which mbile platfrms are used tday and which nes will be used in the future? Hw well will ur mbile users be supprted in Office 365 and by third party prviders? INTEGRATION AND SUPPORT ISSUES What types f supprt services are available with the prviders we are cnsidering? Online supprt nly, telephne supprt, chat supprt, cncierge nbarding, US-based supprt? 2013 Osterman Research, Inc. 15

17 Hw much supprt will be required initially and lng term? Hw well can a third party vendr integrate with Office 365 frm a user management and Active Directry sync perspective? PROFESSIONAL SERVICES ISSUES T what extent will Micrsft-fcused prfessinal services be required t assist in the migratin and/r integratin prcess? T what extent will deep prduct integratin with Micrsft services and sftware be required? Hw much will prviders be required t knw abut Micrsft s underlying technlgy, including key Micrsft-fcused cmpetencies and certificatins? Hw much d they knw? Hw much experience shuld the prvider have with multiple Micrsft platfrms like Office 365, BPOS, n-premise Exchange, Exchange Online, SharePint, Lync, etc.? Des the prvider have direct access t internal Micrsft prduct team internal resurces, training materials and technical cntent? OTHER ISSUES Hw well can a hybrid deplyment f Office 365 and n-premise systems be managed? SUMMARY Office 365 is a slid ffering frm the wrld s leading sftware cmpany. It prvides a number f useful features acrss a wide range f price pints and is designed t satisfy many f the messaging, applicatin and cntent management needs f individual users thrugh very large enterprises. Despite its many capabilities, as a generalist prduct ffered t a mass market it is nt capable f satisfying every requirement frm every rganizatin. Cnsequently, many rganizatins will need t emply supplementary security, archiving, encryptin and ther capabilities t fill in the feature, functin and reliability gaps they will experience when using an Office 365-nly deplyment. SPONSOR OF THIS WHITE PAPER McAfee, a whlly wned subsidiary f Intel Crpratin (NASDAQ: INTC), empwers businesses, the public sectr, and hme users t safely experience the benefits f the Internet. The cmpany delivers practive and prven security slutins and services fr systems, netwrks, and mbile devices arund the wrld. With its visinary Security Cnnected strategy, innvative apprach t hardware-enhanced security, and unique glbal threat intelligence netwrk, McAfee is relentlessly fcused n keeping its custmers safe. Fr mre infrmatin abut McAfee Prtectin, McAfee SaaS Archiving, McAfee Web Prtectin, and McAfee Clud Single Sign On, please visit: Osterman Research, Inc. 16

18 2013 Osterman Research, Inc. All rights reserved. N part f this dcument may be reprduced in any frm by any means, nr may it be distributed withut the permissin f Osterman Research, Inc., nr may it be resld r distributed by any entity ther than Osterman Research, Inc., withut prir written authrizatin f Osterman Research, Inc. Osterman Research, Inc. des nt prvide legal advice. Nthing in this dcument cnstitutes legal advice, nr shall this dcument r any sftware prduct r ther ffering referenced herein serve as a substitute fr the reader s cmpliance with any laws (including but nt limited t any act, statue, regulatin, rule, directive, administrative rder, executive rder, etc. (cllectively, Laws )) referenced in this dcument. If necessary, the reader shuld cnsult with cmpetent legal cunsel regarding any Laws referenced herein. Osterman Research, Inc. makes n representatin r warranty regarding the cmpleteness r accuracy f the infrmatin cntained in this dcument. THIS DOCUMENT IS PROVIDED AS IS WITHOUT WARRANTY OF ANY KIND. ALL EXPRESS OR IMPLIED REPRESENTATIONS, CONDITIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE DETERMINED TO BE ILLEGAL Osterman Research, Inc. 17

19 CITATIONS i ii iii iv v vi vii viii ix x xi xii xiii xiv xv xvi xvii xviii xix xx xxi xxii xxiii xxiv xxv xxvi xxvii xxviii xxix xxx xxxi xxxii xxxiii xxxiv xxxv xxxvi xxxvii xxxviii Accrding t Micrsft, the new Exchange DLP features identify, mnitr, and prtect sensitive data thrugh deep cntent analysis. Exchange ffers built-in DLP plicies based n regulatry standards such as PII, HIPAA, and PCI, and is extensible t supprt ther plicies... Office 365 Enterprise Plans supprt external jurnaling t a third party archive, but nn- Enterprise plans d nt supprt jurnaling p pdf sharepint-nline-sftware-bundaries-and-limits-ha aspx# _SharePint_Online_fr_ Surce: Office 365 TM Security white paper Micrsft Exchange Online Dedicated Plans Versins Service Level Agreement (SLA), Octber Osterman Research, Inc. 18