Compliance Settings

In the discussion in this chapter, we will group information into these categories. For example, HIPAA requires you to manage certain types of data in a way to protect information. To meet HIPAA requirements, you must protect personal information by encrypting the information before it is sent externally to the organization. One of the HIPAA requirements is that the service you are using provides a Business Associates Agreement (BAA ) for the services you are using. If you are subject to HIPAA, you need to ensure that you have completed a yearly a HIPAA assessment audit to make sure you comply with the regulations. The fines are significant, and the federal government is looking into business of all sizes to make sure the business complies with the regulation.

Information review typically means that the information is subject to an audit and is immutable—meaning it cannot be changed or deleted by the users or the organization—prior to review. Any type of regulator review requires that the data is immutable. The most common is litigation. When an organization enters into litigation, all information is frozen at that period in time. We refer to that as a litigation hold . Regulator reviews such as FINRA and SEC are nothing more than an extension of a litigation hold in conjunction with business process reviews.

Business data retention is nothing more than the business processes used to maintain information, subject to the regulatory requirements. As an example, if the business policy (or user policy) deletes information subject to the retention policy, the information is deleted from the user perspective but may be kept for a very long time subject to the compliance needs of the organization. The user may delete information, but the compliance setting keeps the information in an area where it is immutable and fully searchable and hidden from the user.

The Office 365 administrator has complete control over the configuration of the compliance and retention polices. The administrator can enable these settings, and all actions are auditable. The settings can be changed by using the Security & Compliance Center or by using PowerShell commands. As Microsoft enhances the Office 365 service, these settings will be simplified in an easy-to-use graphical interface. The rest of this chapter discusses these concepts for data governance and provides a step-by-step implementation with examples of data loss protection (compliance), regulatory review (discovery), and business data retention policies.

Best Way to Proceed

The best way to understand the Security & Compliance Center is to look at the Trust Center. After looking at the Trust Center, the next step is to review NIST-CSF, the cybersecurity framework, and to review the NIST-800-35 compliance framework. There is a lot of work to be completed.

The Security & Compliance Center gives you a focal point for the security process in the organization. However, security starts with your IT team. If your IT team lacks the capability to do the necessary work, you need to address this quickly and either fix the internal problem or contract the security services externally. This book was designed to help you determine what you need to do and how you should do it. If you consciously choose not to secure your Office 365 environment, you are the breach. The ownership is with you and your IT team and not your license provider. Let’s continue our journey through the Compliance & Security Center.

Data Governance Concepts

Data governance provides a policy-based management service on Office 365 that meets or exceeds the regulatory compliance. The policy-based service is applied across subscriptions and aligns with the Azure policy manage process. The data in Office 365 (and the subscription types) is managed and owned by the company. The Office 365 business owners need to look at the business and decide what makes business sense based on the needs of the business. To put this in perspective, when an external entity looks at e-mail storage, it is considered modifiable by the user and is noncompliant to certain regulations. A compliant system requires that the email and document storage systems must be incapable of being modified, or immutable. The owner of a mailbox must not be able to go in and delete information or documents. These capabilities are options in the Office 365 enterprise plan and are included at no charge in some of the subscription suites (such as the Enterprise E3/E5 subscription).

You are probably familiar with the various CSI and NCIS shows on TV. A key message that these shows highlight lies in the evidentiary collection of information and that there must be a “chain of custody” regarding information collected. Think of data governance in the same context. It is all about chain of custody. Data governance on Office 365 is the same. Access to information that is under discovery or access cannot be tampered with. Further, access is recorded and auditable for all those who access the information. This is the data governance model of Office 365.

Traditional approaches, such as journaling, record information external to the organization structure and mostly just contain copies of the e-mail communications. This archaic journaling approach does not address the changing landscape of data governance and data management. Journaling does not link data from storage sites and draft documents in an integrated form. An archive is nothing more than another mailbox that is used to store information.

Immutability, audit policy, archive/retention, and data loss prevention are all part of the Office 365 data governance structure. It is designed around chain of custody and the preservation of information. If information is tampered with, then a full audit trail of access, as well as the original information that was modified, is created.

Before we discuss the practical aspects of the configuration of retention policy and eDiscovery, we need to frame the discussion with a definition of each of the four key areas of data governance to put them in perspective. There has been much written about information immutability, and there are many misconceptions as to what this is and how it is managed in Office 365. The definition is simple: the preservation of data in its original form cannot be changed and is kept in a form that is discoverable.

Recall the discussion of chain of custody. The information that you are accessing and providing for data governance needs cannot be changed, and you must not have the ability to change it. In addition, any access to the information must be fully traceable. If you access information, the information that you extract will not change the underlining information.

The best example is to look at an e-mail that flows in or is created by a user in the cloud (see Figure 6-11). In this case, information that arrives or is in a user mailbox can be changed and modified by the user. This is the normal process that we use in writing an e-mail. An e-mail that is immutable, on the other hand, keeps all parts of the message in a form that can be fully discoverable through searches. When an e-mail message is drafted, all changes and drafts are kept and not deleted. Nothing is purged—all information is fully discoverable.

When we refer to compliance, we are referring to our ability to access communications and documents that are immutable. Retention rules are based on business policies in the management of e-mail communications, specifically what e-mail is visible to the user in the mailbox and what is kept in the archive. For example, you may have a business policy that dictates the movement of e-mail from a user mailbox to an archive if the e-mail is too old or if the user deletes an e-mail. One company has a retention policy of 90 days; after 90 days, a user’s incoming e-mail is moved into the compliance archive. These retention rules move the mail from the user mailbox (or delete folder) into the archive. These rules can be systems level (the user has no control), they can be local level (the user has complete control), or they can be any combination thereof.

A litigation hold is an action that is placed on a mailbox to meet compliance requirements for future discovery and searching. What a litigation hold does is to ensure that the data in a user mailbox is immutable. As an example, if the user tries to delete an e-mail, the e-mail is deleted (or purged) from the user’s view, but the litigation hold function blocks the e-mail from being deleted in the system and is fully discoverable by the administrator (or compliance officer).

Referring to Figure 6-11, we see the life of an e-mail in a user’s mailbox. In Figure 6-11, the user only sees the message in steps 1–3. The compliance officer has access to all transactions in steps 1–6. When a discovery action—a search—is executed, all information is displayed in the search request, including the information in the deleted items, purges, and draft folders.

Audit Policy

Companies in the cloud need to know who has access to their company data. The ability to monitor and produce the necessary reports are part of the Office 365 audit capability. Companies need to do the following:

• Verify that their mailbox data isn’t being accessed by Microsoft

• Enforce compliance and privacy regulations and access by nonowners

• Have the ability to determine who has access to data at a given time in a specific mailbox

• Have the ability to identify unauthorized access to mailbox data by users inside and outside your organization

The ability to monitor the mailbox data is a fundamental part of the Office 365 organization (see Figure 6-12). Once the audit capabilities are enabled (via PowerShell), the audit reports can be generated by the administrator or an individual who has been given this capability.

The audit reports are displayed in the search results shown in Figure 6-12. However, the audit report must be enabled. To enable the audit reports, select the “Start recording user and admin activities” option. The audit reports are only for 90 days and can be extended via PowerShell. Typically, I set audit reports for a 12-month period. Each audit report contains the following information:

• Date of access

• IP address of the access

• User who performed the activity

• Activity performed

• Detailed description of the item

• Detailed description of the activity (usually the object’s name such as a file name)

The first step in setting up a compliant organization is to enable the audit capabilities to ensure that you have a complete record of all accesses to user mailbox data by nonowner users. This information is used to supplement future reports.

Note

Earlier we mentioned that the organization needs to have a policy of collecting the primary three logs and archiving them in a SharePoint site for future forensic analysis. This is extremely important. Every month you need to download a copy of the audit logs, the Azure sign-in logs, and the Azure audit logs.

The audit reports that are generated contain detailed information about who has accessed the information and how they have changed it. As you’ll see in Figure 6-8, once audit logs are enabled, all information is tracked. The discovery center adds another level of detail in tracking information accessed under legal hold.

Information Immutability

Information immutability takes this one step further and integrates Skype for Business and SharePoint documents (as well as OneDrive for Business document synchronization) into the equation. The Office 365 approach is designed to reduce the amount of information by removing duplicate information. This reduces the complexity of the searches and allows the compliance officer to clearly see the thread of the information and the root cause (if any) of the discovery request. The searched data can be exported in the industry-standard Electronic Discover Reference Model (EDRM) standard in an XML format to provide content to a third party. The Office 365 approach is designed to remove duplicate data from searches and does not remove any data from the user’s SharePoint or e-mail mailbox. The data stays where it is and is immutable.

The configuration of the eDiscovery search is robust and allows you to specify the areas and mailboxes that you need to search. The scope of the discovery is reduced to the specific set of key words and mailboxes (see Figure 6-14) and can be easily restricted to a few users in question. It is not uncommon that an eDiscovery request on Office 365 would cost 90 percent less than an eDiscovery request using an older journaling system for e-mail communication management.

As you read the rest of this chapter, the discussion on archive and retention polices is built around data immutability to manage an organization’s compliance needs. In Office 365, this is referred to as compliance management . Administrators are enabled to set up controls based on the business polices of the organization.

Office 365 Archiving and Retention

The term archive is overused. It often implies more than what it really is. An archive is nothing more than a second mailbox designed for long-term storage. The relevancy of an archive is based on the business process rules that are used to manage it. This is where immutability and retention policies come into play. Immutability refers to how information is retained (in a form that can’t be changed) in the mailbox and the archive. Retention policies describe the length of time you need to keep the data that is not subject to any legal action (legal hold to guarantee immutability).

It is important to describe the length of time you need to keep the data that is not subject to any legal action (legal hold to guarantee immutability). These policies are located under Retention (see Figure 6-15).

It is easy to create a new retention policy. In Figure 6-15, just click + Create and set up the policy. The wizard will walk you through the process. The retention policy created is almost the same way the retention policy was created in the Exchange admin center. So, depending on how you want to approach the problem, you can create a legacy retention policy or a new policy. The legacy retention policy is composed of retention tags. A group of retention tags constitutes a retention policy, as shown in Figure 6-16. The new retention policy is a wizard that allows you to fill in the same information.

There are two types of archives in Office 365: personal archives and Office365 Exchange server mailbox archives. The Office 365 Exchange server archives can be immutable (meaning they can be configured to ignore any change via a litigation hold or in-place hold). Personal archives are stored locally on the user desktop and are not immutable (users can change the contents). The retention policies refer only to the moving of data from the user mailbox to the archive. To make an archive and retention policy work, you need to enable the archive in the Exchange admin console (edit the mailbox in the Exchange admin console and select Enable for archive; this is discussed in Chapter 8). This feature will be moving to the Security & Compliance Center at a later date. Litigation hold (or in place hold) locks the Office 365 Mailbox from having contents deleted - regardless if it is in the main mailbox or the archive mailbox. Users will see data being deleted, but administrators can access data in the Security & Compliance center under Search and Discovery.

Retention Policy

A retention policy consists of the business processes that define the movement of data to the archive or delete folders. Retention policies are a set of rules that are executed concerning a message (see Figure 6-17). A retention policy is a combination of different retention tags, which are actions placed on a message. You can have only one retention policy applied to a mailbox. In an organization where you have compliance requirements, retention tags are used to manage the user mailbox information and to control mailbox sizes. As an example, you can have a retention tag that deletes messages in a mailbox after 30 days. If the mailbox is under legal hold, the user will see the data deleted, but the deleted data is recoverable.

Retention tags define and apply the retention settings to messages and folders in the user mailbox. These tags specify how long a message is kept and what action is taken when a message reaches the retention age. Retention tags are used to control the amount of information that is on the user’s desktop. Typically, this means that a message is moved to the archive folder or it is deleted. Looking at Figure 6-17, you can see three types of retention tags: default retention tags, policy retention tags, and personal retention tags.

Default	The default policy applies to all items in a mailbox that do not have a retention tag applied.
Policy	Policy tags are applied to folders (inbox, deleted items, and so on) and override the default policy tags. The only retention action for a policy is to delete items.
Personal	Personal tags are used only for Outlook clients to move data to customer folders in the user’s mailboxes.

Keep in mind that a retention policy directly affects the amount of information kept in a user mailbox. A retention policy requires that an archive mailbox is enabled. The default configuration of Office 365 is to have the archive mailboxes disabled. Retention tags (which make up the retention policy) are just another tool used for information management. Depending on your business needs, you may have different retention polices to manage information of different groups in your organization. In one organization we managed, the data retention policy was 90 days, unless the mailbox was placed on an in-place hold for litigation or discovery.

Compliance archives may or may not have a retention policy applied to them. Typically, a compliance rule requires that all documents (emails, files etc) are placed on legal hold for the regulation hold period. The legal hold also includes documents in OneDrive and SharePoint site through the Compliance & Administration site. User mailboxes that are placed under a litigation hold with the external audit enabled meet all compliance requirements because the data is immutable. Later in this chapter, I will walk you through an eDiscovery search to collect information in response to a court-ordered subpoena. For now let’s continue with our review of the other features of the Security & Compliance Center.

Alert Types

There are different alert types that you can create or add. Some of the alerts are system-wide and are enabled based on other dashboards. The alert dashboard is a data aggregation dashboard in Office 365 (see Figure 6-20) with integration to other services. “Manage advanced alerts” is a link to Cloud App Security (CAS). Depending on how you configure CAS, you can have a number of alerts that show up in the alert dashboard. Figure 6-19 shows the alert dashboard with two types of alerts, those that are from other services (not highlighted) and those that were created in the alert dashboard (highlighted with an on/off slider). As the compliance officer in Office 365/Azure, you want to enable alerts to help you manage the environment for the necessary processes.

The issue that we all face is the quantity of information that we need to manage. It is important that you define a model for data collection and classification. If you have not set up a classification model, then step back and define the model that you want. In our case we organized information based on class of alerts, such as threat management and severity. Follow the wizard and add additional customization to the alert (see Figure 6-20). Once you are satisfied with the alert, click Save to create the alert (see Figure 6-21).

The processes that you use to create and review the alerts are the same. As you expand your security polices, you will establish different capabilities on access and how you want to enable the tracking in the environment. Alerts give you an early warning. You leverage information that is in the Security & Compliance Center along with the security information located in the Azure Security Center.

Step 1: Select the Campaign

The campaign we are using is the credential harvesting campaign. Click Launch to start the campaign. Name the campaign and click Use Template. Make sure you do not send more than a one campaign a week (see Figure 6-27).

Step 2: Customize the Offer

It is important to customize the offer so it mirrors an offer in your local market. A modification may be a free Amazon gift card, for example. Pick something that is unique and you can clone from your existing e-mail offers (see Figure 6-28). In this case of a “prize offer” I would use an Amazon gift notification or a survey, such as “Take the Survey, Get a $25 Amazon Card.” The goal is to make this as real as possible.

Step 3: Select the Distribution List for the Campaign

Select the distribution list to send to. If you do not have one, then create one for your organization. I recommend you create a dynamic list that is targeted to all users who have a license (see Figure 6-29).

Step 4: Select the Distribution List for the Campaign

Build out a web portal with a message to the end user. Let them know you been phished. Your web portal could contain a description of the attack and what to look for. Train your users, and be creative (see Figure 6-30)!

Step 5: Customize the E-mail

The best e-mail to use is one that you have received. Figure 6-32 shows one that I received from a vendor on a survey for IT services.

Step 6: Execute the Campaign

Send the e-mail (see Figure 6-32) and look for the responses from the simulated phishing.

Once you have executed the campaign, the next step is to review the results (see Figure 6-33). Like any other marketing campaign, you want to make the campaign as realistic as possible. Invest the time to train the user.

Make sure you review the threat dashboard for the status and trends. You have a responsibility to set up the necessary business process and training to keep your users informed. It is a battle between the good guys and bad guys. Figure 6-34 shows a status dashboard of the attacks against some users.

Discovery Walk-Through

The discovery process seems daunting at the start. The simplest way to understand the eDiscovery process is to walk through an eDiscovery search; then we can look at the process to set up the search. I have found that if you understand the end game, then it is easier to understand how to create an advanced search. To frame the situation, you are a compliance officer and your IT pro has set up your Office 365 site with the correct permissions and access. The IT pro has sent you an e-mail with a notification that your site is set up. Your response (like many of us) is simply, “Great, what do I do now?” Let’s walk through the process on what do you do next to put our mind at ease. Discovery is not that difficult; it just takes time.

Step 1: Log In to Office 365 and Click the Security Icon

To access the Security & Compliance Center, log in to Office 365, and click the Security & Compliance Center icon. Users need to be an Office 365 global administrator or a member of one or more Security & Compliance Center role groups. The Security & Compliance role groups are different than the Exchange Online Organization Management role group. These permissions are not shared.

If you do not see the Security & Compliance Center, this is because you do not have access. To access the Security & Compliance Center, a global admin will need to grant you permissions by adding you to the Organization Management role group.

Step 2: Select Search & Investigation, and Review Logs

Earlier, the IT support staff added us into the group where we have the correct permission to access the features in the Security & Compliance Center. Our job is simple; it is to perform a search on the data that we were requested to provide. In Figure 6-40, we expand Search & Investigation to begin our query on the eDiscovery process. There are three areas that we focus on: Content search, Audit log search, and eDiscovery.

In Figure 6-40, we are looking at the audit logs to verify who has access to the data and who has recently accessed the data in Office 365. The audit log search will provide that information to you. In our example, the admin has recently logged into the Security & Compliance Center and retrieved the compliance configuration.

Once you are satisfied, the next step is to review that a hold has been placed on the data for the content search.

Step 3: Verify That a Case Has Been Created to Place Data on Hold

There are different philosophies on this, but what works the best is to make sure that you have at least one case where all data that you are looking for has been placed on hold. The Office 365 Security & Compliance Center allows you to place multiple data sources on hold for specific searches. However, it is easy to lose yourself in the searches and accidently remove a legal hold and delete data. To prevent this from happening, go to the eDiscovery tool and verify that we have a case and the subject matter of our inquiry is placed on hold (see Figure 6-41).

If the data has not been placed on hold, a case needs to be created to lock the appropriate mailboxes and SharePoint sites and put the user’s OneDrive for Business sites on hold. Once this case is in place, our focus will be on using the Content Search tool.

Note

If you do not see a case, create a case and place the accounts you want to search on hold to protect data from accidently being deleted. If you make a mistake and delete the hold, the data will be deleted according to the retention policy. The case in this example has two mailboxes selected, and all data has been placed on hold. The hold is visible only to users who have permission to view the case (more about this later).

Step 4: Start the Content Search

The next step is to start the search for data and export the data for review. So far we have the data on hold (step 3), and we are searching for specific information. We select the content search and look for an existing case. If we do not see one, we create a new case and begin our search for information.

In Figure 6-42, we are creating a new search called Smart Phone Search, and we are looking at three different users’ mailboxes: Dan Jump (CEO), Karen Berg (VP of sales/marketing), and Amy (product manager). The process is similar to the actions in the eDiscovery Center; the difference in this case is that we are looking at specific information in user mailboxes, and we do not need to worry about the data being deleted since we have verified that we have all of the user mailboxes and SharePoint sites on hold.

As part of the search configuration, you specify the area of search. In this case, we are looking for all phones and what to exclude the term cell phone. If you have an existing case, you can edit the query or create a new query as part of the search setup (see Figure 6-43). Click Add and then Run. Correct any errors that you have (usually the location is not specified correctly); then click Save and name the search.

Step 5: Preview the Data

As the content search engine crawls the mailboxes, the information is displayed on the number of items and size of the items. The compliance officer can add additional searches as needed.

To preview the search data, select “preview search results” in Figure 6-44 to see the initial set of documents (documents in this case are any forms of communications: e-mails, Skype conversation, marketing materials, etc.)

Note

The compliance officer can add and delete searches as needed. Therefore, it is important to have a case created with all of the content under hold for eDiscovery. In the case of a content search, when the content search is deleted, the hold is also removed, unless you have another hold in a content search or under a case in the eDiscovery Center.

If your access is blocked at the preview stage, you need to request permission from the admin on the Security & Compliance Center to give you access to the search results. Otherwise, your results on the search preview will be displayed as shown in Figure 6-44. Keep in mind that search preview is limited. Complete review will require you to export the documents.

Step 6: Export the Documents

Once you are satisfied that you have all of the documents you are looking for, the next step is to export the documents for a full review. To export the document, click More and then “Export results” (see Figure 6-45). Follow the wizard to generate the document export. The documents are exported in PST format to be loaded in a local version of Outlook. At this stage you are creating an export job. The export data will need to be collected by Office 365 and scheduled for download.

Click Export, which will start the document export wizard. The first step is to confirm the export and destination. Because of the privacy concerns, documents exported are encrypted, and you will need to keep a copy of the key to decode the documents.

Select the Export tab and then select the job that was created (see Figure 6-47). This will start the data export process. The data will be downloaded to your PC in the format you specified earlier.

Note

If you are responding to a request for production (RFP) on a court order discovery order, you want to export all documents from the eDiscovery Center after you place the documents on hold. I have found it better to give all documents requested and not duplicate information. Most likely you will be using a third-party tool to process the documents and stamp them. We will look at document production later in this chapter.

The export process runs smoothly in the background. The export process starts and displays the status of the job (see Figure 6-48).

The export wizard handles large downloads. I completed a recent eDiscovery project where the export PSTs were over 30GB in size (about 407,000 e-mails and attachments.). To export the documents, select “download export results” to download the documents to your local system. When you download the documents, the documents are encrypted in transit (se Figure 6-48). Make sure you keep a copy of the key. You will need this key on the client to remove the encryption to access the PST files.

Note

If you are searching for information, the best way to search for information is to use the Content Search Center. In a discovery request, what I have found works is that you define a new user account for the response to an RFP, and you upload the data into the OneDrive for Business. This way you can use the Content Search tool to look for data. Also, if you are building bates-stamped documents, upload them to your OneDrive for Business account. This way you can search for the original document and find the bates-stamped document that matches your search. This saves a lot of time in preparing for litigation.

Once the data is ready, you can download the results. You will need the encryption key to unencrypt the data. All search data in the Compliance Center is encrypted. Once you have copied the key, click Download Results to start the download process. The files will be downloaded to your PC in an Exchange folder structure (see Figure 6-49). We will go through this process later in the chapter; I wanted you to understand the end results and what the discovery process looks like in a response to an RFP.

After the data is downloaded, it will be in a directory similar to Figure 6-26. Once the data is exported, you can now bates-stamp the material and filter it out as needed.

Step 7: Bates-Stamp the Discovery Production

Once we have completed the export of the data, the only step left is to bates-stamp the material in a response for production. Depending on your business size, you may have a department that will handle the production of the material. Most IT professionals stop at this step and turn over the production to the legal staff. However, if you are a small business, you will need to produce the material yourself to keep costs under control and add bates stamps. There are different tools that you use to process the production. I use a tool called Bates Express. What this tool from Bates Express provides is a unique number that is used to track documents in the legal system. This is called a bate-stamp. When you complete electronic discovery, you are producing millions documents, each page of the document needs to be numbered. This is one of the tools available to bate-stamp documents. I used this tools to process millions of pages in electronic discovery project.

What I like about this tool is that it is really easy to use. In the e-discovery production that I am creating in response to the subpoena, I have filtered Exchange information with 120,000 messages in each PST. With Bates Express, I configure the bates stamp (the header and footer on the document), and I point the tool to the downloaded PST. A few hours later, I have 120,000 PDF files, all searchable and all bates-stamped for production (see Figure 6-52).

The documents are produced with the necessary header and footers for your discovery project. Bates Express produced documents similar to those in Figure 6-53. The bates stamp I use in this production request is the string “Confidential - <case number> - < document ID>.”

Note

Every document that will be produced will need to be bates-stamped, and the document header “Confidential” may be optional but is subject to the production order. In some cases, there will be material designated as “Attorney Eyes Only.” In this case, “Confidential” is replaced with “Attorney Eyes Only.”

Production of material is not that difficult; it is just time-consuming. Traditional discovery firms charge around $1 a page for each document produced. You can see with automated tools you can sharply reduce the amount of time that it takes to produce material. At this point, you understand the discovery process enough that you can do your own search and produce the documents required. In the final sections of this chapter, we will review some additional configuration process configuration that you can use in your discovery project.

Sample AQS Query for Financial Review