Secure Collaboration within Organizations, B2B and B2C.

Transcription

1 Secure Collaboration within Organizations, B2B and B2C

2

3 Definition of the term Collaboration : Working with others to do a task and to achieve shared goals. Major Business Requirements Structured filing Simple and secure identity and access management processes within and across companies, user self-services Broad support of devices and applications Flexibility regarding business processes and team structures Data security and classification Traceability and auditability of any IAM and business activities Evidence records for contracts and approval processes

4 Requirement SharePoint Structured filing IAM, user self-services Broad support of devices and applications Flexibility w.r.t. processes and team structures Data security and classification Traceability and auditability Evidence records

5 Microsoft Azure, Office 365, SharePoint Online Global cloud solution managing tenants and trusts Single user identity for authentication and authorization to all resources Broad support of devices and applications Rights Management Services Leverage access control beyond applications (DLP) Data classification Document tracking Digital Signature Services Evidence records for contracts and approval processes

6 Requirement SharePoint Structured filing IAM, user self-services Broad support of devices and applications Flexibility w.r.t. processes and team structures Data security and classification Traceability and auditability Evidence records

7 Microsoft Azure, Office 365, SharePoint Online Rights Management Services Short introduction of Microsoft RMS and Secure Islands IQ Protector Digital Signature Services

8 About RMS Traditional security controls (e.g. ACLs, firewalls, etc.) have limited effectiveness to protect company data while still empowering users to work efficiently (i.e. usage of many platforms, applications, mobile workplaces, etc.) RMS protects the sensitive information independent of any other security measures. It uses encryption, identity, and authorization policies to help secure the data.

9 Available on-prem (AD RMS) and in the cloud (Azure RMS) Major features Security is intrinsically tied to data, no dependency to other security measures Dynamic management of users and roles (joiners / movers / leavers / deputies / auditors / legal investigators) RMS Protected Data Data Data Owner / Author RMS Template Ad-hoc User/Group RMS Metadata IQP Classification IQP Metadata

10 Major features Data protection and classification Rights enforcement (do not forward, read only, do not print, etc.) Document tracking and document revocation Application RMS Protected Data Data Data Acquire RMS License RMS Server Log / Report Owner / Author RMS Template Ad-hoc User/Group Use Auth RMS Metadata IQP Classification IQP Metadata

11 Broad support of applications and file-types Microsoft Office on Windows and Mac (Office 2016 and beyond for Mac ) RMS SDK available for Windows, Linux and ios and Android More and more RMS enlightened applications available Broad support of file-types (Office, PDF, CVS, TXT, JPG, etc., almost any file-types)

12 Typical Use-cases Leverage access control beyond applications (DLP) Separation of business data from IT administrators Separation of individual organizational units (e.g. human resources or finance department, research and development, etc.) Secure collaboration within an organization or across organizational boundaries Document tracking (and document revocation)

13 Additional use-cases with Secure Islands IQP Policy-based file- and folder encryption Automated and policy-based encryption / classification of data, e- mails, web up- and downloads User-awareness (pop-up windows) based on pattern matching (content scanning) Comprehensive Microsoft Exchange Journaling support for compliance and audit reasons

14 Use-case example B2B Sync Microsoft Azure Tenant (Org 1) Tenant (Org 2) User A Group G Azure Active Directory User X Group W Azure Active Directory Azure RMS Sharepoint Online (Office 365) Sharepoint Online (Office 365) Directory Synchronization (AADConnect) Federation Service (ADFS) on-prem Directory Synchronization (AADConnect) Federation Service (ADFS) on-prem Data Data User A Group G Active Directory User A User X Group W Active Directory User X Fileshare, Exchange, USB Stick, etc. Data User Y

15 Use-case example - description 1. User X from Org 2 downloads a document from the SharePoint Online Server of Org 1 2. User X is entitled to access the SharePoint Online Server and to open the document 3. User X sends the document to User Y (File-share, , etc.) 4. User Y is not entitled to access the SharePoint Online Server. Since the RMS rights on the document are based on the permissions of the SharePoint access rights the User Y cannot open the document. Note: It is possible to apply other protection rules, especially wit RMS on prem and Secure Islands IQP

16 RMS - Document tracking and reporting Keyon - true-xtended Reporting for RMS and IQP Collects log-files and events from many sources, especially from Secure Islands IQP and Microsoft RMS Servers Enriches log-files and events from further sources (e.g. AD, LDAP, DB s, DLP Systems, other Applications) Periodically copies enriched log-files and events into Splunk or Microsoft Reporting Services Data collection and reports can be customized

17 RMS - Document tracking and reporting.. and how it looks like Live Demo

18 Microsoft Azure, Office 365, SharePoint Online Rights Management Services Digital Signature Services Short introduction

19 Digital Signature Services Business Benefits Evidence records for approval processes Contracts and agreements Integrity and authenticity of internal and external documents Benefits for IT operations Signed Office Macros Signed code (.exe, Java)

20 Digital Signature Services Breakout-Session 14:15 Swiss Re - Moderne Signaturanwendungen für Business Workflows und IT-Sicherheit inkl. Live-Demo

21 Microsoft Azure, Office 365, SharePoint Online Short introduction Rights Management Services Digital Signature Services

22 Microsoft Office 2013 (new: Office 2016) Office Application Suite for PC and Mac Mobile Apps for ios, Windows & Android Microsoft Azure Active Directory (AAD) Sharepoint Online Azure RMS

23 Office 365 / Azure prerequisites Identity and access management Collaboration with Sharepoint Online RMS protection Demo B2C lookout, IDM challenges

24 Office 365 / Azure prerequisites Office 365 subscription Subscription that includes Sharepoint Online: Starting with Office 365 Business Essentials (CHF 4.70/user/month). Also available in Office 365 Business Premium Included in all enterprise plans Basic personal sharing and collaboration options are also available with subscriptions that include OneDrive for Business but not Sharepoint.

25 Identity and Access Management Office 365 uses Azure Active Directory Users of Office 365 must exist in Azure AD Several options: Cloud identity: Create users online (small companies without Active Directory) Synchronized identity: Synchronize users from AD to Azure AD + password sync (Identity Lifecycle) Federated identity: Synchronize users from AD to AAD and federate with Azure AD (Identity Lifecycle + SSO)

26 User synchronization and federation: Microsoft Azure Tenant (Org 1) Re-use identities from the organization s Active Directory Synchronize AD users and groups to Azure AD (AADConnect) User A Group G Azure Active Directory Sharepoint Online (Office 365) Enable SSO through Federation (ADFS) Directory Synchronization (AADConnect) Federation Service (ADFS) on-prem User A Group G Active Directory User A

27 Result of user synchronization: The synchronized users appear in the Azure AD and are ready for use

28 Single Sign On with Federation:

29 External users: Collaboration partners reuse their own Azure identities to access shared team sites in Sharepoint Online. Users that are not yet in Azure can create a Microsoft account to access shared team sites User A Group G Azure Active Directory Directory Synchronization (AADConnect) Federation Service (ADFS) B2B Sync Tenant (Org 1) Sharepoint Online (Office 365) on-prem User X Group W Azure Active Directory Directory Synchronization (AADConnect) Federation Service (ADFS) Microsoft Azure Tenant (Org 2) Sharepoint Online (Office 365) on-prem User A Group G User X Group W Active Directory User A Active Directory User X

30 Identity and Access Management Identity management, provisioning and decommissioning Azure Active Directory B2B collaboration lets you enable access to your corporate applications from partner managed identities. You can create cross-company relationships by inviting and authorizing users from partner companies to access your resources B2B Sync Tenant (Org 1) Microsoft Azure Tenant (Org 2) User A Group G Azure Active Directory Sharepoint Online (Office 365) User X Group W Azure Active Directory Sharepoint Online (Office 365)

31 Create team and project based SharePoint sites Edit documents together at the same time Access files across devices Share internally and externally Versioning, archiving IRM protection External users do not require an Office 365 license to access files shared with them

32 Other collaboration tools offered by Microsoft 365: Lync instant messaging Supports federation with Lync in other organizations Shared team/project mailboxes Share your calendar with people outside of the organization OneDrive for Business

33 RMS protection Sharepoint Online supports RMS protection RMS Protection is applied when the document is downloaded from Sharepoint Online or when it is opened for editing in Microsoft Office. The applied RMS protection is determined based on the permissions of the user on the site that contains the file: Permission Manage Sharepoint site Edit items, manage lists View items IRM Permission Full Control: Generally allows a user to read, edit, copy, save and to modify permissions Edit, copy and save (Print only, if allowed in the library settings) Read (Print only, if allowed in the library settings)

34 Extended RMS features Extended SharePoint RMS features with Secure Islands IQP Storage of encrypted and classified data in SharePoint Optional indexing of encrypted data for keeping the search capabilities

35 Live Demo SharePoint Online and Azure RMS

36 B2B Sync Microsoft Azure Tenant (Org 1) Tenant (Org 2) User A Group G Azure Active Directory User X Group W Azure Active Directory Azure RMS Sharepoint Online (Office 365) Sharepoint Online (Office 365) Directory Synchronization (AADConnect) Federation Service (ADFS) on-prem Directory Synchronization (AADConnect) Federation Service (ADFS) on-prem Data Data User A Group G Active Directory User A User X Group W Active Directory User X Fileshare, Exchange, USB Stick, etc. Data User Y

37 challenges regarding credentials and device policies Maintaining control of users application access across on-prem and cloud platforms is challenging

38 Federation introduces single (or hybrid) identities Such identities span on-premises and cloud-based capabilities, creating a single user identity for authentication and authorization to all resources, from any devices, regardless of location Questions How to assess the assurance level of credentials? Are smartcards, virtual smartcards, HW based OTPs, SW based OTPs, SMS tokens, biometrics, etc. equivalent to each other? How to determine the assurance level of credentials based on federated tokens (ABAC, policies, agreements)? How to determine the security capabilities and security policies of devices (corporate managed devices, BYOD, MDM, etc.)

39 Cloud based solutions enable new business processes Secure collaboration B2B and B2C Fast evolving Frequent features releases of cloud based components (RMS, SP Online, Intune, etc.) Increased interoperability of cloud based components

40 Q&A Thank you for your attention