Cloud services: Security, Compliance and Privacy. Nasos Kladakis Solutions Specialist Microsoft Hellas

Transcription

1 Cloud services: Security, Compliance and Privacy Nasos Kladakis Solutions Specialist Microsoft Hellas

2 Risk Management Program Overview Information Security Policy Security Privacy & Regulatory Service Continuity Compliance Management

3 Certifications Services (Office 365 and FOPE) Data Centers ISO ISO SAS 70 Type II Microsoft Safe Harbor More to come

4 Security

5 Multi-Layered Defense Strategy: deploy a risk-based, multi-dimensional approach to safeguarding services and data Security Management Threat & Vulnerability Management, Monitoring & Response Data User Application Host Internal Network Network perimeter Facility Access Control & Monitoring, File/Data Integrity Account Mgmt, Training & Awareness, Screening Secure Engineering (SDL), Access Control & Monitoring, Anti- Malware Access Control & Monitoring, Anti-Malware, Patch & Config Mgmt Dual-factor Auth, Intrusion Detection, Vulnerability scanning Edge Routers, Firewalls, Intrusion Detection, Vulnerability scanning Physical controls, video surveillance, Access Control 5 Microsoft Confidential

6 Data Encryption at Rest Solution

7 Enhanced Security Features Require TLS for all mail between customer and partner domain (in and outbound) Centralized mail control (all mail for domain sent/received from customer servers) Enables custom filtering and archiving Outbound mail delivery to a smarthost Enables additional processing, e.g. DLP Future: Expanded DLP capabilities in Forefront Online Protection for Exchange (FOPE)

8 More Security Features Block all external access to online services based on the IP address of the external client Block all external access to online services except Exchange Active Sync; all other clients such as Outlook are blocked. Block all external access to online services except for passive browser based applications such as Outlook Web Access or SharePoint Online

9 Privacy

10 What is Privacy? Our approach to protecting customer privacy: we ensure we use the right policy and principles that help customers and end-users maintain control over their personal information (PII) Control over PII means we respect our customer s information by: being transparent about how we gather and use PII allowing customers to direct how we use their PII limiting our use of PII providing a means by which customers can update their PII to ensure accuracy striving to keep PII secure working to ensure customers can access their data Common privacy regulations customers comply with while using Microsoft Online: HIPAA, GLBA, FERPA, Mass 201, PIPEDA, and the EU Data Protection Directive along with the EU Model Clauses and security requirements in EU national privacy laws

11 Why Is Privacy Compliance Important? It s the law Helps ensure to Customers that they ve made the right choice by entrusting their data to Microsoft It s the right thing to do

12 Global Privacy Regulations Microsoft Online Services has been built focusing on transparency, allowing customers control over their data, and enabling them to adhere to recognized privacy principles Example: Many locales require a privacy notice and a recording notice. It's ultimately the responsibility of the customer to comply, but we built one in as a default so customers are assisted Microsoft complies with global privacy norms. It abides by the Safe Harbor privacy framework regarding the collection, use, transfer, and retention of data from the European Union, the European Economic Area, and Switzerland Each of Microsoft Online Services has a privacy statement that details how customers data will be treated Longer term We work with governments and partners to adapt regulations to our type of services

13 Government Subpoenas Will Microsoft turn over my data to US companies or the US government? Microsoft believes customers should control their own information When compelled by U.S. law enforcement to produce customer records, Microsoft will first attempt to redirect these demands to the customer Microsoft will notify the customer unless it cannot, either because Microsoft is unable to reach the customer or is legally prohibited from doing so Microsoft will only produce the specific records ordered by law enforcement and nothing else

14 Data Transfers Microsoft set the bar high across the service we adhere to the requirements from the strictest markets, like the EU Data Protection Directive, so that we can legally store and use data in compliance with legal requirements Microsoft offers transparency around location of customer data Microsoft tracks major international privacy laws so we know what is coming and are ready to address it

15 Compliance

16 Compliance Management Framework Business Rules for protecting information and systems which store and process information A process or system to assure the implementation of policy System or procedural specific requirements that must be met Step by step procedures

17 Addressing Audit Needs Microsoft offers: Alignment and adoption of industry standards Comprehensive set of practices and controls in place to protect your data Focus on solutions for millions of users worldwide Independent third party attestations of Microsoft security, privacy, and continuity controls This allows Microsoft Online to provide assurances to customers at scale

18 Supporting Customer Compliance Customizable and feature-rich Microsoft Online offerings to suit a customer s compliance needs Use our features to implement your policies Retention policies, archiving, legal hold, etc. Third party audits and attestations Compliance from end to end (physical infrastructure to services development & operation)

19

20 What is it? What does it cover? Who gets it?

21 Compliance What is it? What does it cover? Who gets it or when?

22 What is it? What does it cover? Who and how to get it?

23 What is it? What does it cover? Who gets it and when?

24 ISO All customers Available Now EU Safe Harbor EU customers Available Now SSAE 16 (Statement on standards for Attestation Engagement) Type I compliance Primarily US customers Q4 CY 2011 SSAE 16 Type II compliance Primarily US customers H2 CY 2012 FISMA US Government H1 CY 2012 HIPAA/BAA EA Customers Exchange Online: Available Now Lync Online: Available Now SharePoint Online: Q4 CY2011 EU Model Clauses EU Customers EA customers can sign June 1, effective Q4 CY2011 Effective for all customers Q4 CY2011 Data Processing Agreement EA Customers Available Now

25 Service Continuity

26 Service Continuity Program Framework 26 Microsoft Confidential

27 Continuity Concerns What drives the need to have a continuity plan in place? To protect the customer and the service from any major outage Does Microsoft have a formalized continuity program in place? Yes, a robust service continuity program is in place based on industry best practices and provides the ability to recover subscribed services in a timely manner Does each service have the ability to recover from a disastrous event? Yes, all offerings have redundancy and resiliency to ensure that any major outage is minimized Is the plan exercised (tested) on a regular basis? The plan and solution are validated at least on an annual basis

28 Question & Answer