Prepare for GDPR – Protect Your Most Sensitive Data with Azure Information Protection

Leave a comment

The main objective of General Data Protection Regulation (GDPR) is to protect all European Union (EU) citizens from privacy and data breaches. This regulation impacts every organization located in the EU and it also applies to organizations located outside of the EU if they offer goods or services to EU data subjects. To ensure that there is proper security of such data, you should consider implementing solutions and processes that enable you to identify, classify, and protect data regardless of where it resides.

My most recent work has provided me with an opportunity to work with Microsoft Azure Information Protection (AIP) in Office 365. This technology provides persistent data protection, by classifying, labeling, and protecting documents and emails. In my previous posts, Classifying Data with Azure Information (AIP) – Introduction and Classifying and Protecting Data in Office 365, I provided an overview of AIP including descriptions of labels, how they are created, and how to classify your documents and emails. Additionally, Azure Rights Management (Azure RMS), the protection technology used by AIP, allows for encryption and authorization, ensuring users must successfully authenticate to access the documents and emails.

What are labels?

In AIP, a classification label is used to identify data based on its level of sensitivity and the impact to your business.  Most common sensitivity levels are categorized as restricted, confidential, official use, and public.

Unified Labeling and Protection

If you’ve worked with Office 365 and Azure Information Protection in the past, you may have noticed that there are two different technologies where labels can be created in Security and Compliance Center and Azure portal; this caused quite a bit of confusion of when to use which technology. Microsoft has been working towards providing a more consistent classification, labeling, and protection model that will be used across Office 365 and AIP.

The consistent protection model Private Preview will start soon, no announcement has been made as to when this will be generally available. The consistent labeling model will help ensure that sensitivity labels are recognized across Azure Information Protection, Office 365 Advanced Data Governance, Office 365 DLP and Microsoft Cloud App Security.

The following images show one central location where a label can be created, protection can be configured, and a retention policy can be applied.

Automatic Labeling (Classification)

The ability to automatically classify data is a critical part of helping organizations achieve GDPR goals. Azure Information Protection has 80+ built-in sensitive information types that can be used to detect and classify your data. Microsoft is working on releasing a GDPR template which will include additional information types such as addresses, telephone numbers, and medical information to help detect and classify personal data relevant to GDPR. This new sensitive information template will make it simpler to detect, classify, and protect GDPR related personal data.

Closing

The European Union’s General Data Protection Regulation (GDPR) will be enforced on May 25, 2018. Organizations can be fined up to 4% of annual global turnover or €20 million for breaching GDPR. If your organization collects, hosts, or analyzes personal data of EU residents, you should not delay in implementing solutions to ensure compliance with GDPR.

Advertisements

Azure Information Protection Automatic Classification

Leave a comment

Another interesting behavior I came across when adding conditions and the way labels are applied.

My Confidential AIP labels are configured as shown below.

LabelOrder

I configured the parent label (Confidential) to automatically classify documents.

LabelConditions

I entered the text below to trigger one of the conditions. I noticed that the document was labeled as ‘Confidential \ Restricted’ which is the last child label listed in my AIP portal. Well, this was, obviously, not what I expected.

ConditionChild

To further test if it will always default to the last child label, I reordered the child labels. I moved the ‘Restricted’ child label up and now ‘Anyone (not protected)’ is listed as the last child label.

LabelOrderAfter

Just as I expected, the new document was labeled as ‘Confidential \ Anyone (not protected)’ automatically.

ConditionLastChild

In this experience, I learned that I need to configure the conditions at the specific child label level to get the anticipated results.

Thanks for reading!

 

Encrypt E-mail with Attachments

Leave a comment

As I continue to test different settings in Azure Information Protection, I want to share one that I find interesting.

I configured AIP for e-mail message with attachments to automatically apply a label that matches the highest classification of those attachments.

I created an e-mail where a default label ‘Official Use’ is automatically applied to my e-mail message. I then attached a document classified as ‘Restricted’, the classification of my e-mail message automatic changed to ‘Restricted \ All Employees’. This is the expected behavior.

I then sent the e-mail with the attachment to a trusted partner (in this case myself with a different domain) which I have configured ‘Viewer’ rights to view and reply the e-mail and the attachment.

Below is the e-mail message I sent to the trusted partner.

EmailRestrictedAttachment

However, when the trusted partner (again, myself with a different domain) received the e-mail and tried to click on the ‘Read the message’ link (image below shows e-mail message received by the trusted partner), the trusted partner received “You do not have permission to view this message.”

EncryptedMessage

After much testing, in order to allow my trusted partner to read the message, I had to change permissions from ‘Viewer’ to ‘Reviewer’ in Azure Information Protection.

As I continue to work with Azure Information Protection, I find myself learning new things every day.

Thanks for reading!

Protect and Manage Sharing of Sensitive Documents

Leave a comment

In my previous post, Classifying and Protecting Data in Office 365, I created an AIP (Azure Information Protection) label / policy that applied a footer text with “Sensitivity: Confidential”.

In this post, I’ll describe how you can take advantage of the properties stored in the document, by applying a rule to protect information sharing.

For example, to protect documents from being sent to external organizations via e-mail, you can configure a rule in Exchange to detect the document properties with a sensitivity label. Here’s an example of the configuration I created.

Exchange Mail Flow Rule

When a user within your organization attempts to send an e-mail with an attachment labeled with ‘Confidential’, the mail flow rule blocks it and the message sender receives the following delivery failure message as seen below (with the recipients e-mail addresses grayed out).

BlockedByMailFlowRule

However, if you need to send to your trusted partners or customers, you can add their specific domains to the exception list in the mail flow rule. In the example below, I added one trusted domain to the rule.

MailflowException

With this exception, I was able to send the document labelled with ‘Confidential’ to the external recipients with the domain specified.

With the latest and greatest changes to AIP, and Office 365 Message Encryption capabilities, announced during the recent Microsoft Ignite Conference, the user experience of protecting and sharing your documents may be different than what is written in this post. I’ll continue provide updates and new information becomes available.

If you’re interested in learning more about data classification and protecting your organization’s information assets, feel free to connect with us at http://www.centricconsulting.com.

Retention and AIP Protected Documents

Leave a comment

This is a follow up to my previous post (Which Office 365 Retention Policy Should You Use?).

Before I jump in, I want to provide additional information on documents stored in my SharePoint site.

I configured Azure Information Protection labels and published them. Note that All Employees sub-label of Restricted label is configured with protection. I created several documents, applied these labels manually and automatically, and uploaded them to SharePoint.

AIP Labels2

After applying retention policies to these documents (my previous post), one thing I noticed after the retention policies automatically applied to these documents, two of my documents classified as ‘Restricted All Employees‘ have no policies applied to them.  I waited additional days thinking that I was just too impatient.  After several days, still nothing.

AIP RMS Enabled

I have always known that AIP protected documents are not viewable in Office Web Apps, but I couldn’t understand why retention policies were not able to apply to these documents.

After researching more on this behavior, I’ve learned that SharePoint is not able to index AIP protected documents.  Because of this there are no metadata available for the retention policies to query on these documents.

I hope this helps explaining why O365 retention and SharePoint don’t always give you the expected results.

Which Office 365 Retention Policy Should You Use?

1 Comment

As I started to work on applying retention policies to documents stored in SharePoint using Office 365 Security & Compliance Center, I was confused why the retention policies were not working as I had hoped.

My objective was to have retention policies automatically applied to documents stored in SharePoint without needing the end-user to select the correct retention policy. I created several labels and policies under Classifications, configured one of them to detect content that contains specific words or phrases, and set them to auto-apply to my SharePoint site.  It gave me a warning that it may take up to seven (7) days for the label to apply.

ClassificationsLabels2

I waited for seven days, but nothing showed up in my SharePoint site.

After a bit of digging I found that label policies created under Classifications only appear for users to manually select from SharePoint.

SharePointLabelPolicies2

Since this did not meet my objective, I deleted these label policies from O365 Security & Compliance Center.

After more research and testing, I found that in order to achieve my objective, I had to create the retention policies under Data Governance.

DataGovernanceRetention

Again, I had to wait.  But this time it only took one day for the policies to auto-apply.

AutoApplyRetentionPolicies

In summary, if you want users to manually select retention policy, use Label Policies under Classifications.  If you want an automated method, use Retention under Data Governance.  I hope this helps others who have tried to make sense of which retention policy method to use.

Microsoft Information Protection (MIP)

Leave a comment

While I’m at Microsoft Ignite in Orlando this week, many new announcements were made including AI integration, mixed reality, and of course, cloud technology across Office 365. My area of focus today is Security and Compliance.

With the current version of Azure Information Protection, you can create an AIP label and apply Rights Management to classify and protect data. In order to apply retention to data, you would need to access Security and Compliance Center, create label and a retention policy.

Microsoft announced a new product called Microsoft Information Protection (MIP). This new product consolidates Azure Information Protection (AIP) and Security Retention Labels into one.

Here are a couple of screenshots I took during the sessions I attended.

MIPProtection

MIPVisualMarkings

As you can see from these screenshots that you can apply protection and visual markings to documents from Security and Compliance Center where these features are only available in Azure Information Protection Portal today. For those who have already created labels in Azure Information Protection, no worries, they will automatically synchronize to MIP, so you do not need to recreate them.

Other new features include event based retention where you can associate specific events, e.g. employee termination, contract expiration, etc. when configuring the retention settings.

This screenshot shows the roadmap of what will be available this year and next.

MIPRoadmap

I will continue to share as I learn more about Microsoft Information Protection product.

Older Entries