Office 365 for the Information Governance and ediscovery Practitioner Part I: Office 365 Fundamentals

Transcription

1 Office 365 for the Information Governance and ediscovery Practitioner Part I: Office 365 Fundamentals John P. Collins, JD, Director-Information Governance Solutions

2 Three-Part Webinar Series: Office 365 for the Information Governance and ediscovery Practitioner Part I: The Fundamentals of Office 365 When: Tuesday, October 6 at 1:00 PM Eastern Time What is Office 365 (it s not just in the cloud!) but rather an entire ecosystem of applications, tools, and content. This webinar breaks it all down. The Office 365 plans available and why this is important The primary system components (Exchange, SharePoint, and Skype for Business) Types of data and ESI likely to reside in Office 365 Overview of the Information Governance and ediscovery features built into the platform Part II: ediscovery Deep Dive When: Tuesday, October 27 at 1:00 PM Eastern Time Can you address some, all, or none of your ediscovery requirements and needs using the built-in ediscovery features of Office 365? This webinar will help organizations answer this question. Review of type of ESI available for discovery from Office 365 ediscovery Center explained: where much of the ediscovery activity takes place Exchange ( ) only ediscovery Office 365 Compliance Center Pros and cons of built-in ediscovery features Guest Speaker: Craig Ball Part III: Information Governance and RIM When: Tuesday, November 17 at 1:00 PM Eastern Time Office 365 provides several different approaches to the retention and disposition of data including full records management capabilities via SharePoint. This webinar will provide an overview of the various options and approaches to managing data residing in Office 365. Options for records management in SharePoint and Exchange Security and compliance features Data loss prevention (DLP) Mobile device management (MDM) Information Rights Management (IRM) Encryption Auditing Guest Speaker: John Holliday

3 Housekeeping Today s webinar is being recorded and will be available for download within 1-2 days If you experience technical problems please call and press 2 To make comments or ask questions-enter using your keyboard via the Chat function

4 Agenda What is Office 365? Why should IG and ediscovery professionals pay particular attention to Office 365? Demystifying Office 365: who, what, and where Plans What services and capabilities are available? Where is data stored in Office 365? Types of data (ESI) in Office 365 Challenges presented by Office 365 ediscovery features in Office 365 IG features in Office 365 4

5 What is Office 365? Suite of Services/Products , Instant Messaging, Collaboration, File Storage Office (Word, Excel, PowerPoint, Access, etc.), Exchange, SharePoint, Skype for Business Software as a Service (SaaS) Individuals, companies, organizations subscribe to the service for a fixed monthly or annual fee Cloud Quintessential example of cloud computing Hardware, storage, backup and disaster recovery are handled by Microsoft Brand Microsoft is labeling products and services as Office 365 or part of Office 365 (Project for Office 365, Dynamics CRM, etc.) Juggernaut 5

6 Why IG and ediscovery professionals should pay detailed attention to Office % of Fortune Over 1 billion 18 quarters 3.5 million 1 in companies use at least one of Microsoft s cloud services people use Office 1 in 7 people on the planet of triple digit growth for Office 365 Home Premium subscribers in less than one year of Microsoft s enterprise customers now has Office 365 Office 365 is Microsoft s fastest growing commercial product ever Office 365 recently eclipsed Salesforce.com as the most widely used cloud-based business application Commercial cloud revenue grew 88% (up 96% in constant currency) driven by Office 365, Azure and Dynamics CRM Online and is now on an annualized revenue run rate of over $8 billion from Microsoft Press Release During discovery, what % of ESI preserved, collected, reviewed, and produced is and attachments? What % is Word, Excel, PowerPoint, and PDF files? What is the fastest growing type of data at your organization?

7 Why IG and ediscovery professionals should pay detailed attention to Office 365 Microsoft s perspective on software and services: it s a Mobile First, Cloud First World 7

8 Microsoft s cloud services date back to 2002

9 Office 365: a plan for all Office 365 is marketed and sold to two distinct market segments: 1. Home (households, individuals, students) 2. Business (corporations, government, education, nonprofit) 9

10 Office 365 for Home Households Individuals Students Each plan includes: OneDrive online storage (15 GB to 1 TB) Store Office files, pictures, video, etc. Word, Excel, PowerPoint Some plans also include Outlook, Access, and Publisher Office apps for smartphones Does NOT include Exchange, SharePoint, Skype for Business 10

11 Office Online Free Just requires a (free) Microsoft account Includes Outlook.com Word, Excel, PowerPoint, and OneNote Online Docs.com, Sway, Calendar OneDrive Where Office Online files are stored by default 15 gigabytes of storage at no charge can purchase additional 11

12 Office 365 for Business 18 different plans available across market segments Business Enterprise Education Government Nonprofit 12

13 Resource: Office 365 service comparison 13

14 Office 365 for Business Core Components Word Excel PowerPoint Outlook OneNote Access Publisher Instant Messaging Presence Voice and video calls Web meetings Archiving/Legal Hold Items archived or on Legal Hold are subject to ediscovery search in Exchange, SharePoint, and Compliance Center Collaboration (Team Sites) File storage (OneDrive, Team Sites, Libraries, Lists, etc.) Intranet Portals, web pages Extranet Business applications Information Governance, ediscovery, Legal Hold, Records Management Enterprise Content Management (ECM) , Contacts, Calendar, Tasks, Notes Site Mailboxes, Public Folder Mailboxes Records Management/ Management Legal Hold ediscovery Information Security/Data Loss Prevention 14

15 Other Office 365 Branded Add-Ons, Products, and Services Standalone versions of Exchange, SharePoint, and Skype for Business Yammer Enterprise social media platform Power BI for Office 365 Microsoft Dynamics CRM Project Exchange Online Archiving Exchange Online Protection (EOP) Visio Pro for Office

16 Where is your data? 16

17 Office 365 Challenges Features, Features, Features! A number of features have IG and ediscovery impact: need to assess suitability prior to roll-out IM conversation history (Skype for Business) Unified messaging; visual voice mail (Exchange) Some features require expertise in non-technical subjects: ediscovery; records management Can be difficult to leverage the wide range of features: how can the business leverage? Velocity of change New features and data types are in perpetual development and release 20 new recent updates 43 updates being rolled out 29 updates in development Automatically rolled out Unlike on-premise software, updates are constantly being implemented New content types! Sway (remember when Twitter did not exist?) 17

18 Types of Data (ESI) That May be Found in Office 365 Obvious? Contacts Calendar Word files Excel files PowerPoint files OneNote files Picture files Video files PDF files Visio files Less Obvious? Web pages Instant Messages (IM Chats) Skype call logs Meeting content generated during Skype meetings Newsfeeds Conversations Not Obvious? Surveys Wikis Blogs Announcements Links Issue tracking Custom Can buy or build custom apps Sway 18

19 ediscovery features in Office 365 Exchange In-Place ediscovery & Hold Search across one or more mailboxes Search using Boolean, wildcard, proximity operators, metadata fields Preserve Assess Collect and export SharePoint ediscovery Center Search across mailboxes and one or more SharePoint sites Search using Boolean, wildcard, proximity operators, metadata fields Preserve Assess Collect and export NOTE: Part 2 of this series will be a deep-dive into Office 365 s ediscovery capabilities and limitations 19

20 Information Governance features in Office 365 Archiving Auditing Data Loss Prevention Document deletion policies Encryption Information Management Policies Information Rights Management (IRM) Messaging Records Management (MRM) Mobile Device Management (MDM) Records Management (SharePoint Records Center) Site Closure Policies Transport Rules NOTE: terminology used by Microsoft for IG and ediscovery related features is Security and Compliance 20

21 IG features in Office 365: Archiving Exchange based archiving is called In-Place Archive It s NOT the type of archiving associated with dedicated archiving tools such as Enterprise Vault, SourceOne, Legato, etc. Provides additional storage capacity for s can be moved into the archive via several methods: Move or copy by user Inbox rules Retention policy Key benefit is elimination of need for offserver storage (such as PST files) 21

22 IG features in Office 365: Auditing Tracks changes made by BOTH Microsoft and subscriber Audit reports can be viewed and downloaded Audit data available for 90 days (longer in some instances this is a moving target) Reports include: Litigation holds & ediscovery searches Mailbox access by non-owners (delegates) Admin activity (admin audit logging) in Exchange Online Access to mailboxes (mailbox audit logging) in Exchange Online User activity in SharePoint Online and OneDrive for Business Admin activity in SharePoint Online and OneDrive for Business Admin activity in Azure Active Directory (the directory service for Office 365) User sign-in activity in Azure Active Directory 3 rd party audit tools more robust (API available) Compliance Center reporting in deployment (provides additional reports) 22

23 IG features in Office 365: Data Loss Prevention (DLP) DLP policies contain sets of conditions which filter messages and attachments DLP policies employ: Rules: for example, if a sequence of numbers such as appear Actions: if appears, do not send the message Exceptions: its ok to send the message if the sender is John Doe Target PII, PHI, credit card numbers, social security numbers, drivers license numbers, etc. Use out of the box templates, create custom rules, or import rules created by 3 rd parties 23

24 IG features in Office 365: Encryption Multiple options available to implement a program to encrypt sensitive information in Office Message Encryption (OME) Works with internal and external recipients No special software required by recipients (don t have to be on Office 365) Secure/Multipurpose Internet Mail Extensions (S/MIME) Uses certificates in a private-public key framework Includes digital signature 24

25 IG features in Office 365: Information Rights Management (IRM) Encrypts files and limits programs and users who are allowed to decrypt Limits what users can do: who can access, forward, print, or copy sensitive data SharePoint: limit actions users can take on files such as readonly (can t edit), copying and printing Can be configured to be in effect for set period of time (expiration) rules: Can configure rules to apply IRM to certain messages (for example, messages containing word confidential ) 25

26 IG features in Office 365: Messaging Records Management (MRM) management framework Employs a tagging paradigm Tags get applied to: Entire mailbox OR a folder OR an individual message/item Multiple tags can be created, for example: 1 year (delete all items after one year) 5 year (retain item or items in folder for 5 years) Archive (move Inbox items to archive mailbox after 6 months) Policies: Can aggregate tags into distinct policies (Executive Policy, VP Policy, Legal Dept. Policy, etc.) Legal hold suspends deletion 26

27 IG features in Office 365: Site Closure Policies Close and/or delete SharePoint sites automatically Trigger can be site creation or close date Make closed sites read-only Can create a workflow (such as an approval process) if desired Options available to extend period prior to deletion 27

28 IG features in Office 365: Information Management Policies SharePoint oriented Framework for How long to retain files and content Audit actions taken on files and content Provides various options for what happens to files and content Delete Start a workflow Etc. Implementation requires planning, training, careful thought Can apply policies at the site collection, site, or library level 28

29 IG features in Office 365: Document Deletion Policies A policy framework for SharePoint Applies to site collections, sites, OneDrive for Business Not a records management oriented approach Keep for X number of years then delete Multiple policies depending on need: Policy for OneDrive for Business Policy for internal team sites Policy for extranets Legal hold suspends deletion 29

30 IG features in Office 365: SharePoint Records Management Out of the box, SharePoint provides a framework to implement records management Three possible approaches: In-Place: leave document in current location but declare it as a record Records Center: documents are moved into a centralized repository within SharePoint and managed as records there Hybrid Collaborate Externally upload, view, manage documents and data Outside Counsel Vendor Outsourcing NOTE: Part 3 of this series will be a deep-dive into Office 365 s records management capabilities and limitations 30

31 IG features in Office 365: Mobile Device Management Different than Exchange Active Sync (EAS) and if EAS is enabled it is overridden by MDM Manage iphones, ipads, Androids, and Windows Phones (NOTE: Blackberry has a specific service offering through Microsoft) Requires Office 365 license Users can still access SharePoint and Outlook Web App via browser (MDM does not control) Selective wipe! 31 Confidential Not For Distribution

32 Compliance Center: One-Stop Shopping? Introduced January 2015 Objective is to bring together compliance related features under single control console Currently it has a mix of unique and duplicate features Unique: Can search across ALL mailboxes and SharePoint sites in a single search Duplicate ediscovery link redirects to the SharePoint ediscovery Center Limitations: some features are not fully baked Example: search does not have an export or legal hold function (executing these functions requires use of PowerShell) 32

33 DTI Information Governance Services Office 365 Consulting, Training, and Implementation Office 365 Readiness and Strategy ediscovery best practices and workflows Office 365 ediscovery Outsourcing DTI operates ediscovery features and functions Office 365 Management and OneDrive for Business Planning Legal Hold Process and Planning Training ½ Day and Full Day Workshops for law firms and corporations Consulting Records and Information Management (RIM) Assessments Policies and schedules Program implementation ediscovery and Litigation Readiness Assessments ESI data mapping Process design and implementation Technology Services Defensible disposition and deletion Categorization Repository/application retirement Content audit File share and SharePoint cleanup and archive migration Archive retirement Migrate to cloud PST consolidation Legal hold repository Sensitive Data Retrieval/Remediation Targeted identification of PHI, HIPAA, PCI, IP, and other sensitive and critical data types Delete Copy/Move Audit 33

34 Three-Part Webinar Series: Office 365 for the Information Governance and ediscovery Practitioner Part I: The Fundamentals of Office 365 When: Tuesday, October 6 at 1:00 PM Eastern Time What is Office 365 (it s not just in the cloud!) but rather an entire ecosystem of applications, tools, and content. This webinar breaks it all down. The Office 365 plans available and why this is important The primary system components (Exchange, SharePoint, and Skype for Business) Types of data and ESI likely to reside in Office 365 Overview of the Information Governance and ediscovery features built into the platform Part II: ediscovery Deep Dive When: Tuesday, October 27 at 1:00 PM Eastern Time Can you address some, all, or none of your ediscovery requirements and needs using the built-in ediscovery features of Office 365? This webinar will help organizations answer this question. Review of type of ESI available for discovery from Office 365 ediscovery Center explained: where much of the ediscovery activity takes place Exchange ( ) only ediscovery Office 365 Compliance Center Pros and cons of built-in ediscovery features Guest Speaker: Craig Ball Part III: Information Governance and RIM When: Tuesday, November 17 at 1:00 PM Eastern Time Office 365 provides several different approaches to the retention and disposition of data including full records management capabilities via SharePoint. This webinar will provide an overview of the various options and approaches to managing data residing in Office 365. Options for records management in SharePoint and Exchange Security and compliance features Data loss prevention (DLP) Mobile device management (MDM) Information Rights Management (IRM) Encryption Auditing Guest Speaker: John Holliday

35 Contact Information John P. Collins, JD Director, Information Governance Solutions Phone: John Collins, J.D., DTI s Director of Information Governance Solutions, has extensive experience in assisting clients with a full range of information governance services, including data mapping, litigation and electronic discovery readiness, and the development of records and management and retention policies. As a technology manager for Thomson West (now Thomson Reuters), John managed a team of technology consultants providing technology solutions and installation and integration services to law firm and corporate legal departments throughout the Midwest. As Vice President for Consulting at The Ingersoll Firm, John worked with IT staff at a number of Fortune 1000 companies on data mapping and ediscovery readiness engagements. He has also published a number of articles and conducted numerous seminars, webinars and CLE programs on information governance and litigation readiness topics. John is a graduate of Nazareth College and the Concord Law School. 35