365 & Office 365 includes many security and information protection C Find and Identify and capabilities. Microsoft Enterprise Mobility + Security (EMS) protect classify sensitive includes additional capabilities for protecting data, identities, sensitive assets. Define data the technologies and devices with Office 365. EMS includes Microsoft Intune and processes and Azure Active Directory Premium. It can be challenging for to automatically large organizations to determine which capabilities to apply security implement and in what order. The article provides help. controls. D Protect high Establish the Deciding which capabilities to use value assets strongest (HVAs) protection for Our cybersecurity consulting team recommends taking a assets that have methodical approach to planning and implementing security a disproportionate and information protection features. If you don’t already have impact on the an established approach, here is a recommended starting organizations point. mission or Step 1: Set information protection standards profitability. Perform First, agree on a set of standards that can be applied across stringent your organization. Here is an example of what this can look analysis of HVA like. lifecycle and security A Establish The first step of dependencies, information protecting establish protection information is appropriate priorities identifying what security controls to protect. and conditions. Develop clear, simple, and Step 2: Classify data by sensitivity level Three levels is a good starting point if your organization guidelines to doesn’t already have defined standards. identify, protect, and monitor the Step 3: Map service capabilities to data sensitivity levels most important data assets Some information protection capabilities broadly and can anywhere they be used to set a higher minimum standard for protecting all reside. data. Other capabilities can be targeted to specific data sets for B Set Establish protecting sensitive data and HVAs. organization minimum This table includes an example of how capabilities can be minimum standards for mapped to data sensitivity levels. There are two examples for standards devices and accounts level 1 because the default service will meet this need for some accessing any organizations while others require greater protection. data assets belonging to the Level Standard Description organization. 1 Data is This of This can include encrypted protection is device and available provided by configuration only to default for compliance, authenticated data stored in device wipe, users Office 365 enterprise data services. Data protection is encrypted capabilities, user while it resides authentication in the service strength, and and in transit user identity. between the
365 & Office 365 includes many security and information protection capabilities. Microsoft Enterprise Mobility + Security (EMS) includes additional capabilities for protecting data, identities, and devices with Office 365. EMS includes Microsoft Intune and Azure Active Directory Premium. It can be challenging for large organizations to determine which capabilities to implement and in what order. The article provides help. Deciding which capabilities to use Our cybersecurity consulting team recommends taking a methodical approach to planning and implementing security and information protection features. If you don’t already have an established approach, here is a recommended starting point. Step 1: Set information protection standards First, agree on a set of standards that can be applied across your organization. Here is an example of what this can look like. A Establish information protection priorities The first step of protecting information is identifying what to protect. Develop clear, simple, and guidelines to identify, protect, and monitor the most important data assets anywhere they reside. B Set organization minimum standards Establish minimum standards for devices and accounts accessing any data assets belonging to the organization. This can include device configuration compliance, device wipe, enterprise data protection capabilities, user authentication strength, and user identity. C Find and protect sensitive data Identify and classify sensitive assets. Define the technologies and processes to automatically apply security controls. D Protect high value assets (HVAs) Establish the strongest protection for assets that have a disproportionate impact on the organizations mission or profitability. Perform stringent analysis of HVA lifecycle and security dependencies, establish appropriate security controls and conditions. Step 2: Classify data by sensitivity level Three levels is a good starting point if your organization doesn’t already have defined standards. Step 3: Map service capabilities to data sensitivity levels Some information protection capabilities broadly and can be used to set a higher minimum standard for protecting all data. Other capabilities can be targeted to specific data sets for protecting sensitive data and HVAs. This table includes an example of how capabilities can be mapped to data sensitivity levels. There are two examples for level 1 because the default service will meet this need for some organizations while others require greater protection. Level Standard Description 1 Data is encrypted and available only to authenticated users This of protection is provided by default for data stored in Office 365 services. Data is encrypted while it resides in the service and in transit between the
Office_365-Everything_You_Wanted_to_Know.docx