1. Using classification for access control and compliance
12/2/2018 1:30 AM
SAC-426T
Using classification for access control and compliance
Matthias Wollnik
Senior program manager
Microsoft Corporation
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

2. Agenda slide IT architects Data management overview
WHO WILL BENEFIT FROM THIS TALK
TOPICS
WHAT YOU’LL LEAVE WITH
IT architects
DLP developers
Security developers
Information Lifecycle app developers
Data management overview
File Classification Infrastructure and the Data classification toolkit
Classification Enhancements in Windows 8
Protecting sensitive data
Using classification to address key challenges in managing data across the organization
Controlling access, auditing and encryption based on classification
Developing products and LOB applications that use classification and native Windows Server 8 access, audit and encryption policies

3. Data Management Challenges
Growth of users and data ?
Budget Constraints
Distributed computing
Regulatory and Business Compliance ?

4. Business Needs → Storage Results
Need per-project share
Business needs can start simple
Ensure that business-secret files do not leak out
But adding policies can fragment the storage infrastructure
Retain contract data for 10 years
Complexity increases the chances of ineffective policies and prevents insight into business data

5. Lack of insight into your data means that you cannot manage your costs and risks

6. Manage Data Based On Business Value
Step 1
Classify Data
Apply policy according to classification
Step 2

7. How can you classify information?
Based on the Folder the file is created in
Driven by “Business owner” that sets up the folder
Location based
Specified by Information Worker
Templates of documents can be used for default settings
Data entry applications that marks files created by users
Manual
Automatic classification based on content and other characteristics
Great solution for classifying large amounts of existing information
Automatic classification
Line of business applications that store information on file servers
Data management applications
Application

8. File Classification Infrastructure Architecture
Set classification properties API for external applications
Classify Data
Store classification properties
Windows Server 2008 R2
File Classification Extensibility points
Apply Policy based on classification
Discover Data
Extract classification properties
Get classification properties API for external applications
Designed to enable an ecosystem around classification
Comprehensive API for solutions
Extensible classification infrastructure

9. File Classification Infrastructure Architecture
Set classification properties API for external applications
Classify Data
Store classification properties
Windows Server
File Classification Extensibility points
Apply Policy based on classification
Discover Data
Extract classification properties
Get classification properties API for external applications
Existing APIs retained and extended
Get/Set classification properties APIs now available to non-Admin

10. Classification in Windows 8

11. Baseline Classification Properties
Area
Properties
Values
Information Privacy
Personally Identifiable Information
High; Moderate; Low; Public; Not PII
Protected Health Information
High; Moderate; Low
Information Security
Confidentiality
Required Clearance
Restricted; Internal Use; Public
Legal
Compliancy
SOX; PCI; HIPAA/HITECH; NIST SP ; NIST SP ; U.S.-EU Safe Harbor Framework; GLBA; ITAR; PIPEDA; EU Data Protection Directive; Japanese Personal Information Privacy Act
Discoverability
Privileged; Hold
Immutable
Yes/No
Intellectual Property
Copyright; Trade Secret; Parent Application Document; Patent Supporting Document
Records Management
Retention
Long-term; Mid-term; Short-term; Indefinite
Retention Start Date
<Date Value>
Organizational
Impact
Department
Engineering ;Legal; Human Resources …
Project
<Project>
Personal Use

12. Centrally Defined Classification Properties
Resource Property Definitions
Impact <- High, Moderate, Low
Personally Identifiable Information
<- High; Moderate; Low; Public; Not PII

13. Automatic classification
Tagging information
Location based
Manual
Automatic classification
Application
Consume classification properties
Set classification properties
Automation-compatible COM API
Works with native code, managed code, or scripts
Available through IFsrmClassificationManager2 object

14. Tagging information Location based Manual Automatic classification
In-box content classifier
Location based
Manual
Automatic classification
Application
See modified / created file
FCI
3rd party classification plugin
Determine classification
3rd party classification plugin
Save classification

15. Automatic classification
Tagging information
Location based
Manual
Automatic classification
Application
FsrmClassificationManager cls =
new FsrmClassificationManager();
ICollection c = cls.EnumPropertyDefinitions
(_FsrmEnumOptions.FsrmEnumOptions_None);
foreach (IFsrmPropertyDefinition p in c) {
/*...*/ }

16. File Classification Infrastracture
12/2/2018 1:30 AM
demo
File Classification Infrastracture
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

17. File Classification with Websense DLP
Accurate Content Classification
Hundreds of built-in classifiers
Patterns
Dictionaries
File properties
Precise ID NLP
> 1,000 out-of-the box policies
Performed locally on Windows Server 8
Easily customizable
Fully integrated with Websense Data Security Suite
Data Loss Prevention

18. File Classification with Websense DLP
Microsoft
“Windows Server 8”
Websense TRITON Manager
Websense Endpoint Agent
Websense DLP Policy Templates
Microsoft
FCI
Data Classifier
Policy Engine
Policy  Property
Mapping
System Architecture

19. Information governance policies
Determine Who can access information
Audit access to information
Encrypt information
Apply appropriate retention to information

20. Continuous File Management Tasks
See classification update
File Management Task
Match file to policy
Classify file
FCI
Apply Policy

21. Continuous Encryption
See classification update
File Management Task
Match file to policy
Classify file
FCI
RMS Encrypt

22. Model for central access and audit of information
Central Access and audit policy
Information labeling (FCI classification properties)
User claims
User.Company=Contoso
User.Department=Finance
User.Clearance=High
Machine claims
Access and audit Evaluation
Read request for: \\financeServer\Share\estimates.xlsx

23. Policy based on classification
12/2/2018 1:30 AM
demo
Policy based on classification
© 2010 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

24. Client Server Windows Server 8
Windows Explorer
Visual Indicators
Client
File Classification Infrastructure on Desktop
Server
Active Directory
Classification Schema
File Classification Infrastructure APIs
Exchange
Windows Server 8

25. Expanding the reach of Windows FCI on Windows Systems Enables enterprise-wide file classification
dataglobal dg incorporates Windows Server 8 FCI and extends its classification abilities in three areas:
Expands classification and Windows FCI to legacy windows servers (2000, 2003) and to ntfs-based NAS systems
Performs fast and automated classification of a vast number of existing files
Platform enabling 1
Enterprise-wide classification policies
Spans multiple data sources e.g. file systems, SharePoint, Exchange
Delegates administration over hundreds of servers
Enterprise readiness 2
Archiving
Compliance Management
Life Cycle Management
Renditions
Encryption
Multi-Tier Storage
… and much more …
Classification based actions 3
dataglobal is a global technology leader for the analysis, classification, management and archiving of enterprise-wide data. dataglobal and its Universal and Storage Information Management platform dg suite, is a close technology partner of the Microsoft Windows Server team. For more information, visit us at .

26. GigaTrust File Classification Protector
Windows 8 Server
AD RMS Server
Active Directory
FSRM
GigaTrust FCI Protector Extends FCI-RMS-protection to additional file types including PDF
Configured same as Office IRM Protector.
File Server Resource Manager (FSRM) configures File Management Task.
Based on classification, FCI applies task to protect files.
Rights enforced as files accessed by client either directly or as a copy.
File Share
Office IRM Protector 2 1
GigaTrust IRM Protector
File Management Task
RMS-protect Files 3 4 3 4

27. GigaTrust Central Access Policy Protector
Windows 8 Server
GigaTrust CAP Protector Combines claims-based access control with ADRMS protection
Global Access Policy pushed to AD RMS and File servers.
GigaTrust CAP protector extends ADRMS protection to include reference to the access policy.
GigaTrust Dynamic Policy Connector verifies the access policy claims.
Use license issued only if the claims are still satisfied. If claims are valid, then the ADRMS rights apply.
Active Directory Administrative Center
FSRM
AD RMS Server
File Share 1 1
Global
Policy
GigaTrust CAP Protector 2
GigaTrust Dynamic Policy Connector
File Mgmt Task
RMS-protect Files
With Global Policy 3 2 4

28. Developer opportunities for Classification in Windows 8
FCI provides many avenues to be part of end-to-end data lifecycle management solutions
Classification plugin – provide classification based on content, identity, regulations, etc.
Data management products – leverage in solutions to protect data and ensure compliance
Most extensions to FCI can be built for Windows 2008 R2 and work on Windows 8
Centrally defined properties in Active Directory for consistent classification
Data is automatically classified as it is created on the server
Sensitive data can automatically be encrypted shortly after it is created
Access to a file can be restricted based on the classification of the file

29. thank you Feedback and questions http://forums.dev.windows.com
Session feedback

30. 12/2/2018 1:30 AM
© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.
© 2011 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.
The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.