Intro to the Office 365 Security & Compliance Center By Craig Jahnke

About Craig Jahnke – Strategic Advisor at AvePoint, Inc. Working with SharePoint for last 8 years M.S. in Information Systems Organize SPS Chicago Suburbs and Cloud Saturday Chicago www.craigjahnke.com @TechJahnke on Twitter

Platinum Sponsors

Platinum Sponsors

Gold Sponsors

Attendee Shirts

Reinventing Productivity

Electronic Data Is Exploding

Attack Risks

Agenda The Security & Compliance Center Alerts Permissions Threat Management Data Governance Search & Investigation Reports Service Assurance PowerShell for the Security & Compliance Center

Security & Compliance Center The Office 365 Security & Compliance Center is your one-stop portal for protecting your data in Office 365 https://protection.office.com/#/homepage

Security & Compliance Matrix https://technet.microsoft.com/en-us/library/dn933793.aspx

Alerts View and manage alerts for your Office 365 organization, including Advanced Security Management alerts. How alert Policies work: An admin in your organization creates, configures, and turns on an alert policy by using the Alert policies page in the Security & Compliance Center. A user performs an activity that matches the conditions of an alert policy. Office 365 generates an alert that's displayed on the View alerts page in the Security & Compliance Center. Also, if email notifications are enabled for the alert policy, Office 365 sends an notification to a list recipients. An admin manages alerts in the Security & Compliance Center. Managing alerts consists of assigning an alert status to help track and manage any investigation.

Permissions Grant permissions to people who perform compliance tasks like device management, data loss prevention, eDiscovery, and retention Relationship of members, roles, and role groups A role grants permissions to do a set of tasks; for example, the Case Management role lets people work with eDiscovery cases. A role group is a set of roles that lets people perform their job across the Security & Compliance Center; for example, the Compliance Administrator role group includes the roles for Case Management, Content Search, and Organization Configuration (plus others) because someone who’s a compliance admin will need the permissions for those tasks to do their job. The Security & Compliance Center includes default role groups for the most common tasks and functions that you’ll need to assign people to. It is recommended to add people as members to the default role groups You can edit or delete the existing role groups, but don’t!!! Instead of editing a default role group, you can copy it, modify it, and then save it with a different name.

Data Loss Prevention A DLP policy helps you identify, monitor, and automatically protect sensitive information that’s subject to common industry regulations. You choose what types of sensitive information to protect, and what actions to take when content containing such sensitive information is detected. A DLP policy can notify the compliance officer by sending an incident report, notify the user with a policy tip on the site, and optionally block access to the document for everyone but the site owner, content owner, and whoever last modified the document. Finally, the policy tip has an option to override the blocking action, so that people can continue to work with documents if they have a business justification or need to report a false positive.

Data Governance Allows for the import email from other systems, enables archive mailboxes or set policies for retaining email and other content within your organization Import - Import PST files to Exchange mailboxes then you can use the Intelligent Import feature to filter the items in PST files that actually get imported to the target mailboxes. Archive - Enable or disable a user's archive mailbox, which provide users with an alternate storage location for historical messaging data. Retention - Manage the lifecycle of email and documents by keeping the content you need and removing content after it’s no longer required. While your organization may be required to retain content for a period of time because of compliance, legal, or other business requirements, keeping content longer than required might create unnecessary legal risk. Supervision - Define supervision policies that capture email and 3rd-party communications in your organization so they can be examined by internal or external reviewers.

Threat Management Manage mobile devices and set up data loss prevention for your organization. Help protect inbound and outbound messages from malicious software and spam. Manage which apps have access to Office 365 Use Threat management to help control and manage mobile device access to your organization's data, help protect your organization from data loss, and help protect inbound and outbound messages from malicious software and spam. Use threat management to protect your domain's reputation and to determine whether or not senders are maliciously spoofing accounts from your domain.

Threat Management Dashboard, Threat explorer, and Incidents - Once enabled, these panes allow you to manage Office 365 Analytics and threat intelligence. Mail filtering - Fine-tune and monitor settings that help prevent spam in Office 365. Anti-malware - Protects against viruses and spyware traveling to or from your organization in Office 365. Viruses are malicious software programs that, when executed, replicate themselves and modify other programs and data on the computer. DKIM – Domain Keys Identified Mail (DKIM) helps ensure that other email systems trust messages that you send from Office 365. It does this by adding a unique digital signature to email messages that you send from your organization. Email systems that receive email from you can use this digital signature to help determine if the email is legitimate. *** Safe attachments - Safe attachments is part of Advanced Threat Protection. When enabled, email attachments are opened in a special, isolated environment that is separate from Office 365 before they are sent to recipient inboxes. Safe attachments is designed to help detect malicious attachments even before anti-virus signatures are available. Safe links - Safe links is part of Advanced Threat Protection. Safe links help prevent users from following links in email or in Office documents that point to web sites that are recognized as malicious. Quarantine - Set up Quarantine for incoming email messages in Office 365 where messages that have been filtered as spam, bulk, phishing, and malware mail can be kept for later review. Both users and admins can work with quarantined messages. Users can work with just their own filtered messages in quarantine. Admins can search for and manage quarantined messages for all users. Advanced threats - View the threat protection status report to see information about the malicious content found and blocked by Exchange Online Protection and Advanced Threat Protection.

Search & Investigation Search for content and review user activity. Use eDiscovery to manage cases and set up supervisory review policies to help you capture communication for review Use the search and investigation features in the Office 365 Security & Compliance Center to quickly find content in mailboxes and documents or search audit logs for various types of user and admin activity. You can also create eDiscovery cases to manage a group of users who may be involved in a legal investigation. The best part of Search & investigation is you can find all content and user activity—whether it’s in Exchange Online, SharePoint Online, or OneDrive for Business—providing you with unified protection for your Office 365 organization.

Reports Use a variety of reports to help you understand how your organization is using Office 365, including reports related to auditing, device management, Supervisory review, and data loss prevention. View user activity reports such as sign-ins for SharePoint Online, Exchange Online, and Azure Active Directory Use the View reports page to quickly access audit reports for your SharePoint Online and Exchange Online organizations. You can also access Azure Active Directory (AD) user sign-in reports, user activity reports, and the Azure AD audit log from the View reports page. This is because your paid Office 365 subscription includes a free subscription to Microsoft Azure. The first time that you try to access these Azure reports, you will have to complete a one-time registration process.

Service Assurance View details about how Microsoft keeps Office 365 customer data safe, and how Office 365 helps customers meet industry compliance requirements. Use Service Assurance to access documents that describe a variety of topics, including: Microsoft security practices for customer data that is stored in Office 365. Independent third-party audit reports of Office 365. Implementation and testing details for security, privacy, and compliance controls that Office 365 uses to protect your data. Office 365 can help customers comply with standards, laws, and regulations across industries, such as the: International Organization for Standardization (ISO) 27001 and 27018 Health Insurance Portability and Accountability Act of 1996 (HIPAA) Federal Risk and Authorization Management Program (FedRAMP)

PowerShell Remote PowerShell allows you to manage your Office 365 Security & Compliance Center settings from the command line. You use Windows PowerShell on your local computer to create a remote PowerShell session to the Security & Compliance Center. It’s a simple three-step process where Enter your Office 365 credentials. Provide the required connection settings. Then import the Security & Compliance Center cmdlets into your local Windows PowerShell session so that you can use them. https://technet.microsoft.com/library/mt587092(v=exchg.160).aspx

PowerShell Example Remote Login Set-ExecutionPolicy RemoteSigned $UserCredential = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange - ConnectionUri https://ps.compliance.protection.outlook.com/powershell-liveid/ - Credential $UserCredential -Authentication Basic -AllowRedirection Import-PSSession $Session Run Security & Compliance cmdlet Get-ActivityAlert | Format-List Disabled,Name,Description,Operation,UserId,NotifyUser Close Session Remove-PSSession $Session

Questions

Join us for SharePint! Immediately after the event! Dave & Busters 2215 D and B Drive SE Marietta, GA 30067