Consolidated Hygiene and Encryption Service E-Hub. Slide 1

Transcription

1 Consolidated Hygiene and Encryption Service E-Hub Slide 1

2 Agenda E-Hub Service Overview E-Hub Benefits & Features E-Hub Rates and Implementation Microsoft FOPE Hygiene Overview Demo Microsoft FOPE Encryption Overview Demo Questions Slide 2 2

3 OTECH E-HUB SERVICE OVERVIEW Slide 3

4 Current Environment hygiene a variety of solutions are in production throughout the state Inter-departmental is exposed to the public Internet (sent clear text) is scanned as potential spam at each department No consistent audit capabilities exist to monitor confidential and inappropriate transmissions by state employees (i.e. SSN, HIPAA & credit card data) No consistent encryption solution in the state for sending confidential information to citizens, businesses and partners Slide 4

5 E-Hub Purpose Secure and protect the State s inbound, outbound, and inter-departmental by implementing a highly available hygiene solution with a rich tool set and additional capabilities including encryption and content filtering while preserving departmental autonomy to create and manage security and compliance policies. Slide 5

6 E-Hub Workshop Participants Slide 6 6

7 E-HUB BENEFITS AND FEATURES Slide 7

8 E-Hub Benefits Establish base level security settings to protect all state systems Consistent security practices that will improve incident response Compliance with regulations such as HIPAA, FTI, and PCI-DSS Statewide reporting capabilities on volume as well as agency level reporting Slide 8

9 E-Hub Functions Hygiene (anti-spam & anti-virus) Inter-departmental no longer traverses the public Internet in clear text content filtering capability Outbound encryption service as an option Slide 9

10 E-HUB RATES AND IMPLEMENTATION Slide 10

11 E-Hub Rates Hygiene $0.56 Hygiene with ECAL * $0.13 Encryption (optional) $1.08 Rates are per mailbox per month Encryption is an add on to Hygiene * Rate if agency holds a Microsoft Enterprise Client Access License (ECAL) Slide 11 11

12 OTech Internal Process for Customer Migration to E-Hub Slide 12

13 MICROSOFT FOPE OVERVIEW Slide 13

14 Online Services Help Meet Challenges it is time for organizations to explore how a software-plus-services strategy can help them be better at and smarter about running their businesses. IDC, Microsoft Online Services: Giving Businesses a New Choice for Productivity Tools, July

15 Microsoft Online Services Real-time threat prevention Layered anti-spam and antivirus Customized policy enforcement Gateway, policy-based encryption No public and private key management Full encryption

16 Forefront Online Protection for Exchange Multilayer spam and virus protection and policy enforcement External Senders / Recipients Legitimate Edge Blocking Antivirus Policy * Encryption Anti-spam Inbound Filtered Corporate Network Exchange Server EHS Directory Synchronization Tool Active Directory Junk Outbound Filtered About 90% of is junk Administrator Console End User Quarantine Messaging Administrator Employees * Requires additional Exchange Hosted Encryption License Also incorporates technology from

17 Forefront Online Protection for Exchange SLAs FOPE provides a comprehensive set of SLAs covering network performance and spam and virus filtering effectiveness Each SLA is backed by a financial commitment from Microsoft Spam and Virus Filtering Effectiveness 100% Virus Protection 98% Spam Detection 1:250,000 False Positive Ratio Against all known viruses Of all inbound s Filtering Network Performance % Network Uptime Rapid Delivery (Average delivery commitment of less than 1 minute) *Terms and conditions apply. Please visit Please contact your reseller or Microsoft Account Manager if you wish to view terms or have questions prior to signing up for the service.

18 Global Network Infrastructure Network infrastructure helps deliver reliability and scalability Services provisioned across a global network infrastructure Fully redundant and load-balanced architecture Scalability to handle all message volume variations Processes 2-4 billion s on average per day E-Hub traffic routed through US data centers only

19 E-Hub Statewide Policies

20 E-Hub Statewide Service Settings

21 So How Well Does It Work? Total Messages Inbound: 10,218,225 Delivered: 1,576,010 (15%) Spam: 8,642,215 (85%) Blocked at Edge (DirSynch): 278,334 File Scanned: 1,587,726 Virus: 3,047 (.03%) Quarantined: 1,221 (.01%) Total Message Volume in GB s: 263 GB s

22 Slide 22

23 MICROSOFT FOPE ENCRYPTION OVERVIEW Slide 23

24 Identity-Based Encryption (IBE) Breakthrough in Cryptography IBE - proposed 20 years ago as next generation encryption In 1984 Adi Shamir, co-inventor of the RSA Algorithm, challenged cryptographers to invent IBE IBE solution is created 2 decades later in 2001 Research funded by DARPA (DoD research) Boneh-Franklin Algorithm published at Crypto 2001 An award-winning breakthrough in security and usability Industry acceptance Over 1000 scientific publications on IBE/Pairings Dan Boneh awarded 2005 RSA Conference Award for Mathematics Standardization Efforts IBE being standardized by IEEE Invited by IETF to form new extension to S/MIME Voltage Toolkit FIPS certified; Common Criteria EAL2 certified (one of the only secure solutions to have this)

25 The Secret Sauce : Identity-Based Encryption Basic Idea: Public-key Encryption where Identities are Public Keys IBE Public Key: alice@corp.com RSA Public Key: Public exponent=0x10001 Modulus=

26 How IBE Works in Practice: Alice Sends a File or Message to Bob Key Server key request + authenticate bob@corp.com alice@corp.com bob@agency.gov

27 FOPE Encryption Policy-based encryption for the enterprise: Corporate Network TLS Encrypted E- mail Global Data Center Network Filtering Managed Anti-Virus Managed Anti-Spam Policy Enforcement Encrypt Rule Gateway Encryption Server Key Server Secure Reply via ZDM I N T E R N E T Recipient Network Policy-based encryption from sender to recipient - Policy-based encryption consistently and automatically encrypts messages at the gateway based on policy rules. IBE Technology uses a common ID for Public Key Web-based decryption and encrypted replies - The Zero Download Messenger enables Web-based decryption and encrypted replies for any recipient of encrypted messages with no end user training or software installation.

28 Lessons Learned Make sure you work with your IPM to implement your initial policies Do bring your policies from existing on premise hygiene systems Don t bring your white & black lists, let the service work first and then determine if you need to add allow or reject exceptions If you have Microsoft Premier Support make sure you notify your TAM that you re moving to EHUB

29 Questions? For answers to additional questions related to the E-Hub contact your OTech Customer Service Representative to schedule a meeting. Customer Delivery Division info@state.ca.gov (916) Slide 29