2. @jseghers – http://www.j-solutions.be/blog Jethro Seghers

3. @jseghers – http://www.j-solutions.be/blog J-Solutions.be  Located in Belgium  Provides IT Business Consultancy  SharePoint 2010 and Online  Cloud Services – Office 365 and Windows Intune  IT as a service – MOF and ITIL v3

4. @jseghers – http://www.j-solutions.be/blog Agenda  Office 365  Terminology  Infrastructure settings  Exchange Online  Lync Online  SharePoint Online  Sources of Information

5. Data Security

6. The protection of data from unauthorized (accidental or intentional) modification, destruction, or disclosure

7. Data Compliance

8. Compliance is either a state of being in accordance with established guidelines, specifications, or legislation or the process of becoming so

9. BRINGING TOGETHER CLOUD VERSIONS OF OUR MOST TRUSTED COMMUNICATIONS AND COLLABORATION PRODUCTS WITH THE LATEST VERSION OF OUR DESKTOP SUITE FOR BUSINESSES OF ALL SIZES.

10. Infrastructure

11. @jseghers – http://www.j-solutions.be/blog Overview  Microsoft Datacenters & their locations  DataFlow  Privacy  Encryption  Identity Protection  Password Policies

12. @jseghers – http://www.j-solutions.be/blog Microsoft Datacenters.  Physical Security  Secure physical access for authorized personnel only  State of the Art datacenters  Hosted Applications Security  Anti SPAM  Encryption Mail  Security Development Lifecycle  Potential threats while running a service  Exposed aspects of the service that are open to attack

13. @jseghers – http://www.j-solutions.be/blog Microsoft Datacenters..  Secured Office 365 Services Infrastructure  Server Monitoring via System Center  Secure Remote Access via RDS  Intrusion Detection  Network-level Security Measures  Customer Access via SSL  Uptime 99,9 %  Identity & Access Management  Access control follows the separation of duties principle and granting least privilege.

14. @jseghers – http://www.j-solutions.be/blog Where is our data stored: Example: EMEA  A primary data center is where the application software and the customer data running on the application software are hosted.  A backup data center is used for failover purposes  Data center Dublin: Primary for F.O.P.E.  Data center The Netherlands: SharePoint Online  Dublin + The Netherlands: interchangeably Exchange Online + Lync Online

15. @jseghers – http://www.j-solutions.be/blog What is stored in the US: EMEA  Customer Information  Microsoft Online Portal  Routing Lync Online Communications  Office 365 Authentication  Additionally, Microsoft abides by the Safe Harbor Framework for transfer of data between the European Union and the United States.

16. @jseghers – http://www.j-solutions.be/blog Privacy. Microsoft Online Services Customer Data Usage DataAccount and Address Book Data Customer Data (excluding Core Customer Data) Core Customer Data Operating and Troubleshooting the Service Yes Security, Spam and Malware Prevention Yes Improving the Purchased Service, Analytics Yes No Personalization, User Profile Promotions NoYesNo Communications (Tips, Advice, Surveys, Promotions) NoYesNo

17. @jseghers – http://www.j-solutions.be/blog Privacy.. Microsoft Online Services Customer Data Usage DataAccount and Address Book Data Customer Data (excluding Core Customer Data) Core Customer Data Voluntary Disclosure to Law Enforcement No AdvertisingNo

18. @jseghers – http://www.j-solutions.be/blog Encryption  HTTPS Communication with portal.microsoftonline.com  HTTPS Communication between clients and Exchange Online for all protocols  PGP: Transportation and storage of Exchange Online Messages  Lync Online: Instant Messaging, IM Federation  SharePoint Online: HTTPS Connection (only for Enterprise)

19. @jseghers – http://www.j-solutions.be/blog Identity Protection  Identity stored in Microsoft Online  Identity federation via SSO  Granular Licenses  Different Administrator Roles

20. Bronze Sky customer premises Identity architecture: Identity options 1.Microsoft Online IDs AD MS Online Directory Sync Provisioning platform Provisioning platform Lync Online Lync Online SharePoint Online SharePoint Online Exchange Online Exchange Online Federation Gateway Active Directory Federation Server 2.0 Trust IdP Directory Store Admin Portal Authentication platform IdP Service connector Microsoft Office 365 Services

21. Identity options comparison 1. MS Online IDs Appropriate for Smaller organizations without AD on-premise Pros No servers required on- premise Cons No SSO 2 sets of credentials to manage with differing password policies Users and groups mastered in the cloud 2. MS Online IDs + Dir Sync Appropriate for Orgs with AD on-premise Pros Users and groups mastered on- premise Enables co-existence scenarios Cons No SSO 2 sets of credentials to manage with differing password policies Single server deployment 3. Federated IDs + Dir Sync Appropriate for Larger enterprise organizations with AD on-premise Pros SSO with corporate cred Users and groups mastered on- premise Password policy controlled on- premise Enables co-existence scenarios Cons High availability server deployments required

22. @jseghers – http://www.j-solutions.be/blog Password Policy  Password Restriction: 8 characters minimum and 16 characters maximum  Values allowed:  A-Z  a-z  0-9  ! @ # $ % ^ & * - _ + = [ ] { } | \ : ‘,. ? / ` ~ “ ( ) ;  No UNICODE  Cannot contain the username alias (part before @ symbol)  Password expiry duration:  This is set to 90 days and is not configurable

23. @jseghers – http://www.j-solutions.be/blog Password Policy  Password expiry:  Can be enabled/disable via powershell at user level  Password strength  Strong passwords require 3 out of 4 of the following:  Lowercase characters  Uppercase characters  Numbers (0-9)  Symbols (see password restrictions above)  Password history  Last password cannot be used again

24. @jseghers – http://www.j-solutions.be/blog Password Policy  Account Lockout  After 10 unsuccessful logon attempts (wrong password), the user will need to solve a CAPTCHA dialog as part of logon.

25. Is this Independently Verified?

26. @jseghers – http://www.j-solutions.be/blog MS Online Certification and Compliance Finder  Certified for ISO 27001  EU Safe Harbor  HIPAA-Business Associate Agreement  Data Processing Agreement  FISMA

27. Exchange Online

28. @jseghers – http://www.j-solutions.be/blog Exchange Online.  Archiving  100 GB for E Subscriptions – 25 GB for P Subscriptions  Moderation Security/Distribution Groups  Item Level Recovery  14 days  Transport Rules  Retention Policies – Managed Folder Assistent  Deleted Mailbox Recovery  Within 30 days

29. @jseghers – http://www.j-solutions.be/blog Exchange Online..  Journaling  F.O.P.E.  Auditing  Retention Hold  Only via PowerShell  Disables Retention Policies on Mailbox  Litigation Hold  Only via PowerShell  Logging of every change on a Mailbox  Mobile Device

30. DEMO

31. Lync Online

32. @jseghers – http://www.j-solutions.be/blog Lync Online  Privacy Settings  External Communications  User Defined Settings  Sending files via IM  Make audio and video calls  Record Call and conferences  Federation with Lync users in other organizations  Federation with Users of public IM service providers  Dial-in Conferencing

33. DEMO

34. SharePoint Online

35. @jseghers – http://www.j-solutions.be/blog SharePoint Online.  Information Management Policy – Records  Use Of Term Store & Required Fields – Content Types  Drop Off Library  Audit  Blocked File Types  Security  Versioning  Recycle Bin  Backup: 14 days

36. @jseghers – http://www.j-solutions.be/blog SharePoint Online..  Governance defines your security and compliancy  Very hard to maintain and to make it required.  Missing functionalities that are available on Premise.

37. DEMO

38. @jseghers – http://www.j-solutions.be/blog 3rd Party Tools  Backup SharePoint Online:  Metavis  AvePoint: DocAve Online  Compliance Tools:  Axceler: Control Point  AvePoint: DocAve Online

39. @jseghers – http://www.j-solutions.be/blog Sources Of Information  Office 365 Trust Center : http://www.microsoft.com/en- us/office365/trust-center.aspxhttp://www.microsoft.com/en- us/office365/trust-center.aspx  Service Description  Office 365 Password Policy  Security White Paper  Data Boundaries

40. Questions