Brad Smith, General Counsel & Executive Vice President, Legal and Corporate Affairs, Microsoft

Transcription

1 Brad Smith, General Counsel & Executive Vice President, Legal and Corporate Affairs, Microsoft 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

2

3 Public Data Internal Data Confidential Data

4 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

5 Protect Detect - Expand

6 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

7 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

8 Privacy by Design This means that Microsoft does not use YOUR information for anything other than providing you services

9 Legal Obligation to Store Data 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

10 Does Microsoft Comply with Regulations? Why should this be a concern for customers? Customers as Data Controllers are legally responsible for the processing of their data, even when a third party data processor is involved. What are Microsoft s commitments? Microsoft complies with the Safe Harbor principles & signs a Data Processing Agreement with EU Model Clauses, specifying how data is being processed. (Microsoft is the only cloud provider to meet strict EU standards for international data transfers -> Art. 29 Working Party endorsement letter blog) 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

11 Your Cloud Provider is Your Partner Responsibility On-Prem IaaS PaaS SaaS Risk customers must manage Data Classification End Point Devices Shared risks Identity & access management Data classification and accountability Client & end-point protection Identity & access management Application level controls Network controls Risks a provider can help reduce Physical Networking Host Security Physical Security Cloud Customer Cloud Provider 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

12 Microsoft s Commitment to Data Privacy & Security

13 Microsoft s Commitment to Data Privacy & Security

14 Clearing the Air We don t : provide any government with direct, unfettered access to your data; We don t: assist any government s efforts to break our encryption or provide any government with encryption keys; We don t: engineer back doors into our products & we take steps to ensure governments can independently verify this. here 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation.

15 Our Commitment If we receive a government demand for any enterprise customer s data: In short, when governments seek information from Microsoft relating to customers, we strive to be principled, limited in what we disclose, and committed to transparency.

16 Certifications Relevant Certification by Region Microsoft Certification Status CERT MARKET REGION Art. 29 Working Party Validation Letter

17 2-sided Compliance Commitment to industry standards and organizational compliance

18 Transparency in action Transparency

19 24-hour security monitoring of data centers Transparency Perimeter security Fire suppression Multi-factor authentication Premises monitoring

20 Transparency in action Transparency Security Process & Technology Government Data Requests Transparency Centers Secure Development (SDL) Secure Operations (OSA) Disclosing government data requests Opposing gag orders Challenging egregious demands for data Ability to review source code Assurance there are no back doors

21 Customer Risk Management Public Data Internal Data Confidential Data

22 Customer Risk Management Comparative Risk Assessment is key ustomer Risk Assessment It starts with Data Classification and business impact Start Early!

23 Customer Risk Management Jo Wouters

24 Summary Your Privacy Matters Leadership in Transparency Relentless on Security Independently Verified Service Continuity We respect your privacy You know where data resides, who can access it and what we do with it Excellence in cutting edge security practices Compliance with Industry Standards verified by 3rd parties We financially back our guarantee of 99.9% uptime.

25 Office 365 Trust Center

26 Cyber Trust Blog

27