True Information Security only a click away for anyone"

Transcription

1 True Information Security only a click away for anyone" Webinar, Tuesday 22nd July /22/2014 WEBINAR on "True Information Security only a click away for anyone" 1

2 Agenda Where the industry is going vis-à-vis information security (10m) By Tim Davies, Principal Program Manager Lead, Microsoft Best-practices for information classification and protection (10m) By Joe Stocker, Principal Consultant, Catapult Systems RightsWATCH for Individuals. Classification & Protection only a click away (15m) By Rui Melo Biscaia, Director of Product Management, Watchful Software Questions & Answers (5m) 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 2

3 Some Quick Guidelines for the Webinar You are muted centrally. You don t need to mute/unmute yourself This webinar is being recorded. The recording will be available tomorrow at The Q&A session will be at the end You are welcomed to enter questions anytime, using the Questions feature in the GoToWebinar Control Panel 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 3

4 Where the industry is going visà-vis information security Presenter: Tim Davis, Principal Program Manager Lead, Microsoft 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 4

5 Industry trends Consumerization of IT Users need access, from any device Externalization of IT Applications are on-premises and in the cloud More Data, Stored in More Places Dispersed enterprise data needs protection Social Enterprise Data is shared between people and applications The traditional perimeter is rapidly eroding IT needs continuous data protection that work across classic boundaries 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 5

6 Our approach Protect any file type Delight with Office docs, PDF, Text, and Images. Protect in place, and in flight Data is protected all the time Share with anyone B2B sharing is most important with B2C on the rise Important applications and services are enlightened Delight with Office docs, PDF, Text, and Images. Meet the varied organizational needs Protection enforced in the cloud, or on-premises; with data in both places. CSOs and Services can reason over data Delegated access to data with bring-your-own-key 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 6

7 Information Protection Microsoft Directions Strongly rooted in identity management using AD Azure AD as the basis All about borderless networks and collaboration Recognized importance of customer choice of deployment topology Renewed investment for on-premises RMS Information protection integrated further across the Microsoft ecosystem: More O365 workload scenarios (OneDrive 4 Business, DLP with RMS, auditing and policy management) Enterprise mobile device management with RMS integration Broad end user reach in devices/applications (Office/iPad, Window v.next, 3rd parties with CAD/CAM formats, Adobe,...) Consistent policy and encryption key use extended into core Azure scenarios (customer provided keys used in datacenters as well as docs) Continued close partnership with Information Protection ISVs and SAAS providers... 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 7

8 Peeking ahead.. Q3 14 Q4 14 Q1 15 Q2 15 Mobile Device Extension for ADRMS 2012 GA AD RMS migration to Azure RMS toolkit Simplified AD to Azure AD Directory Sync (Required properties 113 ~11) (fun feature for end users.) Document tracking + revocation Preview Departmental Policy Templates RMG-NG Preview 1 Document tracking + revocation GA Policies extension (Everyone@contoso.com, *.* authenticated users) Admin BI/reporting portal (Preview) RMG-NG Preview 2 (Azure AD collaboration) Multi-factor authentication per document/policy Conditional access policies and claims (Workplace Joined,.) Dynamic Policies (Confidential<MyWorkgroup>, Cross-org universal groups) RMS-NG GA 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 8

9 Best Practices for an Information Control Policy Presenter: Joe Stocker, Principal Consultant, Catapult Systems 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 9

10 Access Control Policy Overview Should answer the who and how is authorization for access granted to systems and business applications. User Access How will users be authenticated: Passwords, biometrics, or Multi-Factor? How is access and use monitored? Who is responsible for monitoring and reviewing access rights? Who is responsible for creating and removing accounts? Who is responsible for granting access to systems and manage privileges? 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 10

11 User Responsibilities How are users educated and made aware of the organization s information control policies overall? How are users to be educated and made aware of access responsibilities? What are users responsibilities for access and passwords? How will users comply with information control policies? What systems are in place to detect and prevent phishing attacks? 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 11

12 Best Practice: Separation of Duties The same person who creates accounts or assigns privileges should not be the same person who monitors access to data. Privileged accounts should not have the ability to clear access logs. The person or system that monitors an event occurred should not be the same person who is responsible for responding they should notify only. Otherwise a conflict of interest can occur where over time they take less action. Classic Application Specific example: An accountant who creates a vendor in the system should not be the same person who can cut a check to the vendor (they or a friend could pose as that vendor). Classic IT example: Software developers accessing production systems Consider Role-Based Access Control (RBAC) to sensitive information ensuring that people only have access on a need to know basis per their role in the organization 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 12

13 Best Practice: Principle of Least Privilege (POLP) An end-user should not have full control to an entire file share. Instead: Information should be categorized, Custodians should be identified, Access and usage rights should only be granted with those who have a need to know An end-user should not have local administrator rights to their computer. Outsourced maintenance personnel should be restricted to the systems they are working on. Administrators should have a helpdesk ticket documenting when they need to grant themselves access to full access to a mailbox, and access should be removed when the ticket is closed. Many modern applications implement POLP through Role Based Access Control (RBAC) 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 13

14 Other Information Control Policy Considerations Industry specific Gov t regulations Industry specific compliance, ex: EU Safe Harbor, PCI-DSS, ISO, HIPPA, etc Markings/disclaimers can help with liability, auditability & compliance Metadata tagging can help system enforce policy 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 14

15 RightsWATCH for Individuals. Classification & Protection only a click away Presenter: Rui Melo Biscaia, Director of Product Management, Watchful Software 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 15

16 The RightsWATCH for Individuals promise to decrease liability to enhance compliance Data Governance, Classification, Loss Prevention and Protection in one single package; CLASSIFICATION GOVERNANCE LOSS PREVENTION Plug&Play installation; to uphold policies PROTECTION to apply policies Immediately begin classifying, tagging and marking information; Encrypt and Protect information 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 16

17 RightsWATCH for Individuals User Experience Simple Standard Interface for Zero learning curve & best-in-class User Experience; Industry Standard Information Security Policy To bring a world-class security model to anyone; Content & Context Aware rules built-in For dynamic & policy driven classification; Azure RMS- ready for controlled access and usage rights over the information; Watermarking, Tagging & Marking for user awareness and liability. 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 17

18 Industry Standard Information Security Policy AZURE RMS DO NOT FORWARD Prevents Copy, Print, Export from, and Forward an message CONFIDENTIAL Prevents Copy, Print, Export Restricted to approved parties (CONFIDENTIAL) VIEW ONLY Enables Read Only Restricted to approved parties CLASSIFICATION PUBLIC Default No restrictions or markings INTERNAL Triggered by keywords and PII Footer applied. Metadata tagged RESTRICTED Triggered by keywords and PII Watermark applied. Metadata tagged 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 18

19 RW4I Information Security Policy CLASSIFICATION RULES MARKINGS PUBLIC Default rule No Header, Footer nor Watermarks. Adds Metadata INTERNAL Keywords: Internal Use Only ; Internal Information ; Internal Data Metadata: Category = Internal Use Only ; Category = Internal Information ; Category = Internal Information Subject line: Internal File Size > 10MB Subject Line: [Classification: Internal] Header: Yes Office File Header: Internal Use Only Alert: User is presented with an explanation RESTRICTED Keywords: "Restricted Access ; "Restricted Information ; "Restricted Data ; "Restricted Use Only ; "Do Not Disclose Metadata: Category = Restricted Use Only; Category = Restricted Information ; Category = Restricted Data Regular Expressions: (1) US Social Security ; (1) Credit Card Subject Line: [Classification: Restricted] Header: Yes Office File Watermark: Restricted Information Alert: User is presented with an explanation Awareness: User allowed to change level Subject Line: "Restricted ; "Sensitive ; "Do Not Disclaimer: User is asked to acknowledge changing 7/22/2014 WEBINAR Disclose" on "True Information Security only a click away for anyone" the classification level 19

20 RW4I Information Security Policy AZURE RULES MARKINGS DO NOT FORWARD Keywords: "Do Not Forward Subject Line: [Protection: Do Not Forward] Header: Yes Metadata: Yes Alert: User is presented with an explanation CONFIDENTIAL Keywords: "Company Confidential" Subject Line: [Protection: Confidential] Header: Yes Metadata: Yes Office File Header: Confidential Use Only Alert: User is presented with an explanation VIEW ONLY Keywords: "Company Confidential View Only" Subject Line: [Protection: View Only] Header: Yes Metadata: Yes Office File Watermark: View Only Information 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 20 Alert: User is presented with an explanation

21 Pick the best #RightsWATCH for you Define a Multi-level Security Model Role-Based Access Control Watermarking & Fingerprinting Easy User Experience Content & Context Aware Policy Rules Apply RMS Access and Usage Rights PDF & other file types Smartphones & Tablets Exchange & SharePoint Centralized Admin Interface Audit Trail & Forensics 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 21

22 3 minutes to World-Class Info Security! Download RightsWATCH for Individuals (1 minute) Enroll in Azure RMS (for Individuals) (2 minutes) Have your sensitive data tagged and protected! Immediate!! 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 22

23 Questions & Answers The recording of this webinar will be available tomorrow at 7/22/2014 WEBINAR on "True Information Security only a click away for anyone" 23