MEC 2014 4/22/2017 5:53 AM © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Advanced Data Loss Prevention (DLP) in Exchange 4/22/2017 5:53 AM EDC302 Advanced Data Loss Prevention (DLP) in Exchange Jack Kabat Lead Program Manager Microsoft © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Data Loss Prevention in Exchange TechReady 17 4/22/2017 Data Loss Prevention in Exchange Identify Protect Monitor End user education Helps to identify monitor protect sensitive data through deep content analysis © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Out of the box DLP policies TechReady 17 4/22/2017 © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Customizing Your DLP Deployments TechReady 17 4/22/2017 Customizing Your DLP Deployments Identify Protect Monitor End user education Custom policy templates Tuning of built-in types Custom sensitive types Real-time incident reports Policy rule reports Policy audit mode End-user false positive reporting Configurable end-user education content Flexible policy authoring system Rich policy conditions and actions © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DLP Deployment Phases Plan Start with built-in templates to assist meeting your business or regulatory requirements Customize policy rules, sensitive types and scope Target a pilot group of users Tune Set policies to test and notify modes Enable incident reports to assess impact of rules Tune based on false positive reports and hit rates Enable Switch policies to enforce mode Continue to tune based on report data trends

DLP policy templates Built-in templates based on common regulations TechReady 17 4/22/2017 DLP policy templates Built-in templates based on common regulations Import DLP policy templates from partners Build your own © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

What are DLP policy templates? TechReady 17 4/22/2017 What are DLP policy templates? XML configuration that define policy objectives Built atop of Exchange transport rules Management and deployment Exchange standard interfaces – Web and PowerShell XML Name Policies Conditions Content to monitor User action Mail flow actions contains Classification rules Credit cards EU debit cards © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DLP policy rules Built on transport rules TechReady 17 4/22/2017 DLP policy rules Built on transport rules Rules applied in sequential order Set of conditions and resulting actions that describe the policy objective Take action to enforce policy Range of actions including: Hold, block, audit & provide notification for email that contains sensitive business data Conditions Actions Exceptions © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Customizing DLP policies TechReady 17 4/22/2017 © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Incident Reports Match details Rule details Classification Audit data

Content analysis process Microsoft Exchange 4/22/2017 Content analysis process Examples: Get Content Joseph F. Foster Visa: 4485 3647 3952 7352 Expires: 2/2015 RegEx Analysis 4485 3647 3952 7352  a 16 digit number is detected Function Analysis 4485 3647 3952 7352  matches checksum 1234 1234 1234 1234  does NOT match Additional Evidence Keyword Visa is near the number A regular expression for date (2/2015) is near the number Verdict There is a regular expression that matches a check sum Additional evidence increases confidence © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Sensitive content type customizations TechReady 17 4/22/2017 Sensitive content type customizations Policy level configuration based on counts Tune existing built-in types to add corroborative evidences and exclusions (keywords, regular expressions) Add different patterns with different confidence scores for difference policy actions Define custom sensitive types that can leverage internally defined functions (dates, keywords, Credit Cards, Passport Numbers) XML Patterns Confidence score Proximity specification Identifier Match Conditions contains Functions / regular expressions Corroborative evidence Keywords / functions Entities Name © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Customizing sensitive content types TechReady 17 4/22/2017 © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Document Fingerprinting – New in SP1 Matching derivative document from a previously configured template A tax firm needs to detect and encrypt standard tax forms, like the 1040 EZ, W2, etc. A Law firm can fingerprint legal forms, and have them detected automatically for policy application Integrates with the existing DLP infrastructure as a custom sensitive information type Surfaced in Exchange, Outlook and OWA Contoso Pharma Confidential PATENT TITLE: INVENTORS List the names of the inventors DESCRIPTION Describe your invention Contoso Pharma Confidential PATENT TITLE: Foo Bar INVENTORS List the names of the inventors Shobhit, Alex DESCRIPTION Describe your invention Foo Bar helps in curing diseases. Matches Filled in Template

Document Fingerprinting - Configuration Microsoft Exchange 4/22/2017 Document Fingerprinting - Configuration Fingerprint generation from template documents Fingerprint stored as custom sensitive type Configured in policy rules as any other custom sensitive type Get Template Content Fabrikam Patent Form Tracking Number Author Date Invention Title Names of all authors... CLASSIFICATION RULE with FINGERPRINT Create Fingerprint Condensed representation of the hashed template content Stored as a custom sensitive information type CONFIGURATION Refernce in Policy Rule Add fingerprint to policy rules together with other conditions Map to desired actions © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Document Fingerprinting - Runtime Microsoft Exchange 4/22/2017 Document Fingerprinting - Runtime Fingerprint generated at run-time for target attachment Fingerprint evaluated against configured fingerprints for template documents Match declared based on ‘containment coefficient’ POLICY RULES REFERENCES TO PREVIOUSLY GENEATED FINGERPRINTS Get Email Content Fabrikam Patent Form Tracking Number 12345 Author Alex Date 1/28/2014 Invention Title Fabrikam Green Energy... Evaluation + verdict Create Fingerprint Temporary in memory representation Used for comparson with source fingerprint created at config time RUNTIME FINGERPRINT GENERATION Verdict Compare the two fingerprints Evaluate a ’containtment coefficient’ to declare a matcb © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

This is a test. I love DLP and Fingerprinting. b-Bit Minwise Hashing INPUT TEXT This is a test. I love DLP and Fingerprinting. STEP 1 Break into Shingles of length 2 This is Is a a test test I I Love Love DLP DLP and And Fingerprinting Hash 1 (universal hash function) STEP 2 Convert to a 64 bit value (hash it!) 64 bit hash value of the shingle (e.g., This is  1010101010101110100111000111) Hash 2 (hash function with random dispersion) STEP 3 Map the 64 bit value randomly to 1024 other 64 bit values Apply a 16 bit mask STEP 4 Reduce each 64 bit value to a 16 bit value (LSB Mask)

Demo Document Fingerprinting TechReady 17 4/22/2017 © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

User education Outlook OWA Empower users to manage their compliance Contextual policy education Doesn’t disrupt user workflow Can work even when disconnected Admin customizable text and actions Outlook OWA

Customizing End User Policy Tips Microsoft Exchange 4/22/2017 Customizing End User Policy Tips Customize Policy Tip messages Messages for notification, block and override can be customized. Customize link for user education Specify an internal URL with company policies around handling sensitive content. Custom classification rule names are displayed here. © 2012 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Customizing end user Policy Tips TechReady 17 4/22/2017 © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

DLP extensibility points Custom DLP content: Supplemental DLP policy templates Supplemental DLP classification rules Incident reports integration with custom workflows Custom agents for additional conditions and actions Custom reporting solutions E.g. MessageStats Business Insights from Dell

Exchange DLP Feature Set TechReady 18 4/22/2017 Exchange DLP Feature Set EXCHANGE and OUTLOOK 2013 NEW in SP1 – EXCHANGE and OUTLOOK 2013 Deep content analysis engine 46 OOB sensitive information types 40 OOB DLP Templates Support for 3rd party defined DLP policy templates Policy Tips in Outlook 2013 Contextual user education and empowerment Incident management Rich reporting Policy Tips in OWA and Mobile OWA Advanced Document Fingerprinting in Exchange, Outlook, and OWA 5 new OOB sensitive information types © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Resources DLP in Exchange 2013 SP1 DLP policy templates TechReady 17 4/22/2017 Resources DLP in Exchange 2013 SP1 http://blogs.technet.com/b/exchange/archive/2014/02/25/data-loss-prevention-in-exchange-just-got-better.aspx DLP policy templates http://technet.microsoft.com/en-us/library/jj657730 Managing DLP policies http://technet.microsoft.com/en-us/library/jj673559 OOB DLP policy templates http://technet.microsoft.com/en-us/library/jj150530 Policy tips in Exchange 2013 http://technet.microsoft.com/en-us/library/jj150512 Supported file types http://technet.microsoft.com/en-us/library/jj674307 MessageStats Quick Guide http://mbidemo.quest.com/Insights/#page/home © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Related Sessions Session Title Timing Room SPR.202 Encryption in Exchange Tue 10:45 AM - 12:00 PM Ballroom E SPR.201 Eliminate the Regulatory Compliance Nightmare Tue 9:00 AM-10:15 AM MR 19ab SPR.UN.305 Exchange Online Protection: Notes from the field Wed 10:15 AM – 11:30 AM Ballroom G SPR.UN.304 Experts Unplugged: EOP & Encryption Wed 8:30-9:45 AM Wed 1:00-2:15 PM MR 18d MR 17b USX.206 What's New in Outlook Web App 9:00 AM - 10:15 AM SPR.401 Extending Data Loss Prevention For Your Business Wed 4:45 PM- 6:00 PM MR 18bc SPR.203 Protect your Organization with Exchange Online Protection (EOP) Mon 4:30 PM - 5:45 PM SPR.301 So how does Microsoft handle my spam? Tue 4:45 PM – 6:00 PM Using Connectors & Mail Routing Wed 2:45 PM - 4:00 PM ARC.304 Exchange Server 2013 Transport Architecture Tues 9:00 AM - 10:15 AM Ballroom F EDC.302 Advanced Data Loss Prevention in Exchange Tues 1:30 PM-2:45 PM EDC.UN.301 Experts Unplugged: Data Loss Prevention Tue 3:00 PM-4:15 PM Wed 10:15 AM-11:30 AM MR 13ab EDC.204 Data Loss Prevention in Exchange, Outlook, OWA Mon 2:45 Pm-4:00PM MNG.304 Reporting On O365 Mail flow and Mailbox Data Wed 1:00 PM-2:15 PM MR 17a

4/22/2017 5:53 AM © 2014 Microsoft Corporation. All rights reserved. Microsoft, Windows and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. © 2013 Microsoft Corporation. All rights reserved. Microsoft, Windows, and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.