Office 365 Security and Compliance Overview 6/16/2018 10:30 PM BRK3136 Office 365 Security and Compliance Overview Rudra Mitra Director, Office 365 Program Management Alym Rayani Director, Office 365 Marketing © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Which one is the hacker? 6/16/2018 10:30 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Our unique approach Platform Intelligence Partners Microsoft Inspire 6/16/2018 10:30 PM Our unique approach Platform Intelligence Partners © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Areas of Focus Intelligence powered insights Identity & access management Areas of Focus Threat protection Intelligence powered insights Reduce total cost of ownership Protection beyond Office 365 Platform Information protection Security management Compliance solutions

Office 365 Security & Compliance Offerings Threat protection Information protection Security management Compliance solutions Protect against advanced threats and recover quickly when attacked Ensure documents and emails are seen only by authorized people Meet your compliance obligations while managing your risk and reducing cost Gain visibility and control over security tools Security & Compliance Center Office 365 Cloud App Security Secure Score Data Loss Prevention Office Message Encryption Exchange Online Protection Office 365 Advanced Threat Protection Office 365 Threat Intelligence Advanced Data Governance Advanced eDiscovery Customer Lockbox Service Assurance Compliance Manager * = new and updated capabilities

Office 365 Threat Protection ENABLING OUR CUSTOMERS TO PROTECT DETECT RESPOND THE MICROSOFT SECURITY GRAPH POWERED BY THE EXCHANGE ONLINE PROTECTION Preventing signature-based spam, malware, etc ADVANCED THREAT PROTECTION Preventing compromise from “unknown” threats THREAT INTELLIGENCE Developing proactive cybersecurity strategy IN-DEPTH, INTEGRATED, INTELLIGENT

Advanced Threat Protection that works across Office 365 Office 365 Advanced Threat Protection (ATP) is the most powerful solution available that secures your ENTIRE Office 365 ecosystem from today’s most advanced and sophisticated threats Office 365 Advanced Threat Protection (ATP) is the most used advanced malware and phish protection service with Office 365; more than all other products in the same category combined

Threat Protection Demo 6/16/2018 10:30 PM Threat Protection Demo Phil Newman © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Exchange Online Protection Cloud-based email protection for online and on- premise users Native capability of Microsoft Exchange Online Protect your messaging environment against malware Improve productivity by blocking spam NEW Security Dashboard for centralized management NEW Insights for configuration improvements NEW Reports with action call outs and common remediation's

Advanced Threat Protection Time-of-click protection against malicious URLs Zero-day protection against malicious attachments Critical insights into external threats Integrated across apps & services Intelligence sharing across Windows devices NEW Enhanced Anti-phish capabilities NEW Expanding to SharePoint, OneDrive for Business, Teams workloads NEW Safe Links for Internal Emails

Microsoft Worldwide Partner Conference 2016 6/16/2018 10:30 PM Threat Intelligence Broad visibility into attack trends Billions of data points from Office, Windows, and Azure Integrated data from external cyber threat hunters Proactive security policy management Intuitive dashboards with drill-down capabilities NEW Threat Tracker NEW Threat Trend Insights NEW New real-time activity (user/content) intelligence Threat Explorer © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft’s approach to Information Protection 6/16/2018 10:30 PM Microsoft’s approach to Information Protection Comprehensive protection of sensitive data throughout the lifecycle – inside and outside the organization Detect Classify Protect Monitor Scan & detect sensitive data based on policy Classify data and apply labels based on sensitivity Apply protection actions, including encryption, access restrictions Reporting, alerts, remediation Devices cloud On premises © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Sensitive data detections in Office 365 Microsoft Worldwide Partner Conference 2016 6/16/2018 10:30 PM Sensitive data detections in Office 365 Microsoft’s information protection solutions help you protect sensitive data throughout the lifecycle – inside and outside the organization 6x Increase 7.5x Increase © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Information Protection Demo 6/16/2018 10:30 PM Information Protection Demo Alex Li © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Information Protection Labeling 6/16/2018 10:30 PM Information Protection Labeling GOAL: Consistent & persistent labeling across information protection solutions A label is a simplified way for end-users to classify & protect their content Today, may require configuration in multiple places & add-in for Office client apps COMING SOON Consistent label configuration and application COMING SOON Built-in native labeling support for Office apps – Mac and web to start; Windows, iOS & Android thereafter © Microsoft Corporation. All rights reserved.

Data Loss Prevention Detect sensitive information across Office 365 6/16/2018 10:30 PM Data Loss Prevention Detect sensitive information across Office 365 Choose from 80+ sensitive information types – or create your own Customize policies, exclusions and actions Block accidental sharing and educate users View and monitor reports, alerts, events NEW Custom sensitive information types NEW HIPAA sensitive information types NEW Large dictionary support © Microsoft Corporation. All rights reserved.

Office 365 Message Encryption capabilities 6/16/2018 10:30 PM Office 365 Message Encryption capabilities Protect and mitigate the risk of data loss and unintended disclosure of emails through encryption and rights protection Control sensitive data through flexible policies or ad hoc customer controls that’s built into Office 365 Meet Compliance obligations that require data encryption or encryption key control NEW End-user encryption controls NEW Enables B2B and B2C collaboration NEW BYOK in Azure Information Protection © Microsoft Corporation. All rights reserved.

INTELLIGENT SECURITY & COMPLIANCE MANAGEMENT Advanced Security Management Secure Score Compliance Manager Security & Compliance Center INTELLIGENT SECURITY & COMPLIANCE MANAGEMENT Powered by the Intelligent Security Graph VISIBILITY CONTROL GUIDANCE Understand the security state and risks across resources Define consistent security policies and enable controls Enhance security through built-in intelligence and recommendations

Office 365 Secure Score Secure Score help you balance security and productivity by helping you understand controls are available and which ones you have enabled Tenants that use Secure Score on average have a score that is more than double of a tenant that has not used Secure Score

Security and Compliance Management Demo 6/16/2018 10:30 PM Security and Compliance Management Demo Sumit Malhotra © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Office 365 Security and Compliance Center 6/16/2018 10:30 PM Office 365 Security and Compliance Center Powerful for experts, and simple for generalists to use Scenario oriented workflows with cross-cutting policies spanning features Powerful content discovery across Office 365 workloads Proactive suggestions leveraging Microsoft Security Intelligence Graph NEW Reports with issue call out and recommended remediation's NEW Configuration improvement suggestions NEW More alerts and digest reports © Microsoft Corporation. All rights reserved.

Advanced Security Management 6/16/2018 10:30 PM Advanced Security Management Identify high-risk and abnormal usage, security incidents, and threats. Shape your Office 365 environment with granular security controls and policies. Gain enhanced visibility and context into your Office 365 usage and shadow IT. NEW New name – Office 365 Cloud Security NEW Support for DLP, Teams, Power BI, Yammer NEW Integration with AAD groups; user activity and IP address drill down experiences NEW EU data center availability © Microsoft Corporation. All rights reserved.

Preview Fall 2017 6/16/2018 10:30 PM Compliance Manager An intelligent score assessing your compliance posture against evolving regulations Recommended actions to improve your data protection capabilities Streamlined workflow and audit-ready reports Compliance Manager Preview is a dashboard that provides a summary of your data protection and compliance stature and recommendations to improve data protection and compliance. This is a recommendation, it is up to you to evaluate its effectiveness in your regulatory environment prior to implementation. Recommendations from Compliance Manager Preview should not be interpreted as a guarantee of compliance. © Microsoft Corporation. All rights reserved.

Data Governance momentum 6/16/2018 10:30 PM Data Governance momentum © Microsoft Corporation. All rights reserved.

Advanced Compliance capabilities in Office 365 Helping you meet your compliance obligations while managing your risk and reducing cost Added controls Help you meet internal and external compliance requirements Intelligent solutions Enable you to bring your data under control Visibility into actions Monitor and investigate actions taken on your data by the Advanced Compliance solutions Advanced Data Governance · Advanced eDiscovery · Customer Lockbox · Customer Key

Data Governance Demo Nishan DeSilva 6/16/2018 10:30 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

GDPR Dashboard

Advanced Data Governance 6/16/2018 10:30 PM Advanced Data Governance Automate data retention by leveraging recommendations driven by machine learning Automatically classify the data most relevant for your organization or industry Policy recommendations (delete, move, encrypt, or share) based on data insights and intelligence NEW Consistently manage records that have retention periods associated with specific event triggers NEW Manual disposition review to defensibly delete what’s redundant, trivial or obsolete NEW Supervise employee communications to comply with security and regulatory guidelines © Microsoft Corporation. All rights reserved.

6/16/2018 10:30 PM Advanced eDiscovery Train the system to automatically distinguish between relevant and non-relevant documents Group similar documents together with near- duplicate detection to make review more efficient Identify unique messages in an email thread and reduce the volume of data for review using Threading NEW Import case-specific copy of non-Office 365 data and analyze using Advanced eDiscovery NEW Quickly analyze and export data with one click using Express Analysis © Microsoft Corporation. All rights reserved.

6/16/2018 10:30 PM Customer Key Available Now Provide and manage your own keys used to encrypt Office 365 data Built into the Office 365 with no disruption to end user and with recovery key which adds protections against unintended key loss Actions are auditable and controls will be verified in next upcoming SOC audit © Microsoft Corporation. All rights reserved.

Office 365 Information Protection momentum 95 Million Office 365 users protected with our built-in security and compliance capabilities

Other Sessions and Resources Keep what you need but don’t horde everything with intelligent data governance in Office 365 - 9/26 9:00 Manage and control your data to help meet compliance needs with Customer Key - 9/26 12:30 GDPR and Office 365 - 9/27 10:45 Stay Ahead of the Cyberattacks with Office 365 Threat Intelligence - 9/28 14:15 Anti-phishing with Office 365 Advanced Threat Protection - 9/28 16:00 Insights into your Office 365 Mail Flow - 9/29 12:30 Resources Office 365 Trust Center - https://products.office.com/en- us/business/office-365-trust-center-welcome Compliance Manager Preview Program - https://aka.ms/compliance-manager-preview Security, Privacy & Compliance Tech Community - https://techcommunity.microsoft.com/t5/Sec urity-Privacy-Compliance/ct- p/SecurityPrivacyCompliance Ignite News Blog - https://aka.ms/ignite2017o365security Microsoft Mechanics - https://www.youtube.com/user/OfficeGarage Series

Please evaluate this session Tech Ready 15 6/16/2018 Please evaluate this session From your Please expand notes window at bottom of slide and read. Then Delete this text box. PC or tablet: visit MyIgnite https://myignite.microsoft.com/evaluations Phone: download and use the Microsoft Ignite mobile app https://aka.ms/ignite.mobileapp Your input is important! © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

6/16/2018 10:30 PM © Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.