What security and compliance challenges exist with the move to Microsoft Office 365?

Transcription

1 PROOFPOINT FOR OFFICE 365: ENABLES ADVANCED SECURITY AND COMPLIANCE FOR YOUR ENTERPRISE UNDERSTAND THE SOLUTION BY ROLE: IT & SECURITY What security and compliance challenges exist with the move to Microsoft Office 365? Defending against Targeted Threats With only Microsoft Exchange Online Protection (EOP), a legacy anti-spam engine, Office 365 is at greater risk of exposure to threats. More than 30% of today s spam conceals malware and there s also a growing number of threats that have become increasingly intelligent and targeted to specific users and roles within an organization. Targeted attacks containing malicious links and/or malicious attachments have quickly become the #1 threat vector in modern attacks. Some of the most common are: Phishing Longlining Watering Hole Spear-phishing Advanced Persistent Threats Spam Information Seeking Scams Hostile Attachments Securing Communications Policy decisions are left in users hands as Office 365 ships only with user-driven Data Loss Prevention (DLP) (e.g. users have to tag content for the DLP filter to find it) and a manually triggered encryption engine representing a significant risk of exposure. Studies have shown similar legacy user-driven schemes are often easily circumvented. Corporate typically contains up to 70% of an enterprise s sensitive data, making one of the key exposure points for inadvertent data loss. Proper filtering of outbound for sensitive content, and appropriate rejection or encryption of such messages is crucial, especially in light of increasingly stringent industry and government regulations with associated penalties. Proofpoint, Inc

2 What challenges arise with Office 365? Security Exchange Online Protection (EOP) provides basic hygiene services, but has some security shortcomings around end-user control and the ability to address advanced attacks. EOP does provide the ability to identify and filter spam, along with filtering capabilities around malicious phishing messages. However, the phishing messages are still accessible through the end-user s quarantine. Given this access, security teams are at the mercy of end-users decisions to release malicious phishing messages that had initially been blocked and quarantined. Though EOP provides end-user access and controls for their personal quarantine, the same cannot be said for control of their encrypted messages. Encrypted message control (e.g., message revocation) requires intervention by the administrators, lengthening the time needed before these critical actions are taken. EOP also lacks the ability to effectively address advanced threats that require dynamic malware analysis, in order to detect modern polymorphic malware. While no system can be 100% effective, EOP suffers from a lack of visibility, preventing security teams from responding efficiently after an attack has been identified. Compliance Exchange Online Archiving (EOA) provides basic archiving capabilities that some organizations may find sufficient. However, organizations that have strict retention and disposition requirements may find the policies difficult to enforce within EOA. This quickly gets even more complicated if the organization has multiple retention requirements across different geographies or business units. Specific regulations bring additional requirements that the basic archiving capabilities provided by EOA do not satisfy. For example, in the financial sector SEC 17a3-4 requires immutable storage and FINRA regulated organizations have supervisory review requirements, including review workflow, third party download capabilities and reporting that are not met by Microsoft Office 365. Legal Discovery ediscovery functionality within Microsoft Office 365 can be confusing to many users. While the basic discovery functionality exists, Office 365 relies on a batch-based search process that struggles with largescale searches. This prevents IT from being able to perform unlimited searches against concurrent matters. Keyword searches against the entire enterprise are also limited, preventing IT from effectively performing investigative searches. Organizations that have strict requirements for retention will find Office 365 is inadequate. Enforcement of retention is limited and messages are only archived after a specific period of time by default, this is 2 years. Users can delete messages at their discretion until that time. Proofpoint, Inc

3 When is third-party security necessary with Microsoft Office 365? Protection from Advanced Targeted Attacks Targeted attacks containing malicious links and/or malicious attachments are considered the #1 threat vector in modern attacks. The majority of recent breaches in the headlines all started with phishing s, masking a sophisticated URL-driven attack architecture that utilized obfuscated redirects, hosted TDS systems, and polymorphic malware delivered via zero-day exploits. However, Microsoft Exchange Online Protection (EOP) struggles with basic hygiene, and has repeatedly proven inadequate for handling targeted attacks, lacking dynamic malware analysis, per-user real-time insight and tracking. Deeper Data Loss Prevention Policy (DLP) Office 365 provides basic DLP policies via Exchange Transport Rules. Organizations that have very basic needs to identify simple instances of sensitive data may find Office 365 to be sufficient. For example, Office 365 can identify a social security number that is labeled SSN: 951-XX However, variations of this (e.g., 951-XX-4020) would not be flagged. Organizations with regulatory requirements to protect specific types of information or have the need to address more granular policies will need a third-party solution to more accurately implement DLP policies, as well as identify and classify violations. How easy is it to add advanced security, compliance and ediscovery? Microsoft Office 365 & Data Safeguarding Adding third-party advanced security, compliance and ediscovery capabilities to Office 365 is simple. As a SaaS-provider, Proofpoint s suite of solutions can be added quickly, without any premisebased hardware, allowing for continued adoption of cloud-based services. Cloud-Based Inbound and Outbound Channel Protection To start using Proofpoint Enterprise Protection, which provides protection against basic known and emerging malware, phish, -borne viruses and more, a simple redirect of the organization s MX record is required a straightforward online change that can be made in minutes. It s entirely usertransparent, too. Users can easily add Targeted Attack Protection, Data-Loss Prevention, and Encryption from the Proofpoint Protection dashboard. Subsequent customization is also available at the user s leisure. Cloud-based , Social Media, Content-in-place Discovery and Control To start using Proofpoint Enterprise Archiving, which provides ediscovery, legal hold, and 20-second search time from endpoints (including mobile devices),users simply need to configure their Office 365 instance to copy to Proofpoint s Enterprise Archive, and to add social network archiving (Social Platform for Archiving), simply add the appropriate plugin. For Content Control, download an agent to Proofpoint, Inc

4 each endpoint that needs to be monitored there s no limit to how many an organization can control. As is the case with Proofpoint Protection, it s entirely user-transparent, and subsequent customization is available at the user s leisure. When is third-party ediscovery required with Microsoft Office 365? Found in 20 Seconds: Rapid Response for Regulatory & Legal Queries For organizations that operate in a litigious or heavily regulated industry, the importance of rapid and complete response to data requests from counsel or compliance offices is critical. Both aspects of the response, speed and completeness are important. Speed can influence a regulator or litigator s impression of corporate readiness, and when counsel is able to perform their own self-service queries from their personal computers or mobile devices, it significantly reduces the turnaround time and load on IT. Similarly, completeness is crucial; a response to litigation that is missing a smoking gun can lead to billions of dollars in losses. Office 365 only does batch searches, lacks a mobile interface, and only indexes Microsoft Office content (not social, or other content forms), making it incomplete. When Hold Everything Increases Legal Risk & Exposure Counsel knows the information an organization chooses to not to retain is as important as the information they choose to retain. From a security and risk mitigation standpoint, granular retention that can vary by content curator, geographic region, function, etc. is crucial in any litigious or regulated industry. By default, Office 365 doesn t have such capabilities; legal hold is an everyone 100% or user-deletable proposition. When is third-party compliance necessary with Microsoft Office 365? When the Organization is Subject to Compliance by SEC, FINRA or Other Regulatory Bodies With Exchange Online Archiving (EOA), messages are archived after a specified period of time (by default, two years). Until that time, end-users have the capability to delete messages at their discretion. For financial services organizations, the answer is quite simple Microsoft Office 365 does not provide the functionality as outlined by SEC 17a3-4, which outlines how data must be stored immutably, or supervisory review requirements under FINRA. A third-party is necessary to address these requirements. When the Organization is Subject to Complex Retention Requirements For organizations that have complex retention requirements based on geographic or business unit needs, Microsoft Office 365 cannot be easily configured to address these needs. Organizations may end up in a situation in which they are storing much more than is necessary, which drastically increases legal risk and exposure, and could result in the failure to retain necessary information. In these situations, Proofpoint, Inc

5 organizations will need to engage with a third-party to address these requirements. Proofpoint, Inc