Skyhigh for Office 365

Transcription

1 Skyhigh for Office Skyhigh for Office is a comprehensive cloud security solution, providing visibility into user activity, compliance and governance policy enforcement, and threat protection. Microsoft is committed to protecting your company s data in its cloud-based services. However, many enterprises require greater visibility and control over usage and an additional layer of protection for data in SharePoint Online, OneDrive, Exchange Online, and Yammer. Using Skyhigh along with Microsoft Graph, companies can leverage the massive productivity gains enabled by Office while meeting their various compliance, threat protection and data security requirements. Rob Lefferts, General Manager, Extensibility With Skyhigh for Office you can: Enforce data loss prevention policies for data at rest and in motion Detect activity indicative of insider threat and compromised accounts Audit collaboration activity and enforce data sharing policies Identify shadow IT cloud services in use and coach users onto Office Capture and complete audit trail of all user and admin activity for investigations Control access to data based on user role, device, and location

2 Visibility: Shadow IT Discovery Identify any shadow IT cloud services employees are using in place of the corporate stand, OneDrive, Yammer and SharePoint. Coaching and Enforcement Displays just-in-time coaching messages guiding users from unapproved services to Office and enforces granular policies such as read-only access. On-Demand Data Scan Examines existing content to identify sensitive data, subject to compliance requirements or security policies. Usage Analytics Identifies all users and groups accessing Office and reveals which users are accessing sensitive data. Compliance: Sensitive Data Analytics Provides a detailed and continuous view of sensitive data stored or uploaded to cloud to cloud services including the data location and users who have accessed it. Secure Collaboration Enforces external sharing policies based on domain whitelist/blacklist and content and educates users on acceptable collaboration policies. Cloud Data Loss Prevention Enforces DLP policies based on data identifiers, keywords, and regular expressions and supports alerting, blocking, tombstoning and quarantining actions. Pre-Built DLP Templates Provides out-of-the-box Office DLP templates for all major verticals and regulations to help identify sensitive content such as PII, PHI, or IP. Policy Violation Management Offers a unified interface to both review and remediate all DLP, access control, or collaboration policy violations. Usage Analytics: Identify all users and groups accessing sensitive data in Office. Collaboration Analytics Visually summarises sharing with third-party business partners, personal s and internal users and reports on policy exceptions. Policy Violation Management: View all violations via a unified interface.

3 On-Premises DLP Integration Provides integration and closed-loop remediation with existing on premise DLP solutions such as Symantec, EMC RSA, Intel McAfee, and Websense. Closed-Loop Policy Enforcement Leverages policies in existing DLP systems, enforces policies and registers enforcement actions in the DLP system where the policy is managed. Contextual Access Control Enables on premise and mobile access control policies based on user, device and geography with coarse blocking and granular view, edit, and download permissions. Contextual Access Control: Control access by user, device, and location. Collaboration Analytics: Visualises sharing between departments and with external organisations. Data Security: Searchable Symmetric Encryption Encrypts unstructured data and leverages advancements in encrypted search indexes to enable end-user search without compromising security. Key Management Support Provides flexible cloud or on premise deployment options and integrates with leading key management servers supporting the KMIP protocol. Preservation of Application Functionality Preserves end-user functions such as search, sort and format using academia and peer-reviewed encryption schemes. Rights Management Defines a circle of trust for any document and enforces rights management policies for intellectual property though integration with DRM solutions. Device Fingerprinting Identifies individual devices as managed or unmanaged based on a unique device fingerprint to enable distinct access policies for unmanaged devices. Threat Protection: Office SOC Delivers a security intelligence dashboard and incidentresponse workflow for potential insider/privileged user threats, compromised accounts, and flight risks.

4 Cloud Activity Monitoring Provides a comprehensive audit trail of all user and admin activities to support post-incident investigations and forensics. User Behaviour Analytics Automatically builds a self-learning model based on multiple heuristics and identifies anomalies indicative of insider threat data exfiltration. Geo-Location Analytics Visualises global access patterns and analyses activity to identify impossible cross-region access attempts indicative of compromised accounts. Geo-Location Analytics: Detects and remediates compromised account activity. Privileged User Analytics Identifies excessive user permissions, zombie administrator accounts, inappropriate access to data and unwarranted escalation of privileges and user provisioning. Adaptive Authentication Forces additional authentication steps in real-time in response to high-risk behaviours by integrating with single sign-on solutions. Platform: Enterprise Connector Collects logs from firewalls, proxies, SIEMs, and log aggregation products, integrates with LDAP solutions and tokenises sensitive data before uploading to the cloud. Integration with SIEMs Combine Skyhigh anomaly and event data with events from other systems and leverage your existing incident remediation process. Integration with Key Management Systems Seamlessly integrates with your existing key management systems using KMIP to encrypt data with enterprisecontrolled keys. Seamless SSO Integration Integrates with single sign-on (SSO) solutions, enabling pervasive and seamless policy enforcement including access control and encryption. On-Network and Off-Network Support Supports on-network access without requiring additional agents. Flexible Deployment Options Offers the ability to deploy Skyhigh in the cloud, on premise as a virtual appliance or in a hybrid model. Comprehensive Deployment Architecture Leverages a complete coverage model including log analysis, API integration and inline forward and reverse proxy deployment to support all cloud access scenarios.

5 Only Skyhigh Our approach eliminates the need for new device agents, ripping and replacing existing infrastructure and on premise appliances a win for both users and IT. Proven in production with the largest global enterprises analysing over 2 billion events daily per customer, revealing data trends across 12+ months. Leverages machine learning to tune a model of user behaviour based on network affects across 23+ million users and signatures for 16,000+ cloud services. Tokenises data on premises and obfuscates enterprise identity with an approach approved by financial, healthcare and European organisations. Delivers function-preserving encryption, searchable symmetric encryption with enterprise-controlled keys, rights management and best-in-class DLP. Patented approach to ensure a seamless and persistent layer of data protection for on-network and off-network access without device agents.