Information security is not a new topic, but it is still a large challenge for most clients I speak with. Many can say that there are at least written security policies around the handling of data, but how many are confident with the controls that are in place? How much technology enforcement of written policy truly exists? According to IBM, the average cost of a data breach globally is $3.86 million; the U.S. came in highest at $8.64 million. Then there is also the potential impact to the company’s reputation.
So where does someone even start? Well, I asked Connection’s Manager of Cyber Security Solutions Practice, Bill Virtue. He mentioned there are three areas to focus on:
- Understand the environment—Often, you’ll inherit the environment and the underlying configuration from a previous owner. You need a comprehensive understanding of what tools are in place and how well they are tuned.
- Understand the data—Where is all the data stored? Who has access to it? What data does the organization deem as sensitive? What data is in use?
- Understand the user environment—Even clients that had a good handle on this likely need to revisit with the remote work impact of the global pandemic. How has technology delivery evolved? Has the organization conducted a dark web analysis to identify any currently compromised credentials?
Microsoft’s Information Security Tools
What capabilities do your Microsoft products provide you? That depends on the level that your organization committed to already and the timing of these efforts. Like many things that tie back to Microsoft licensing, there are a lot of different ways to get to the end goal. You will need to identify the approach that makes sense for your organization.
If the Microsoft 365 ecosystem is just one of many software as a service (SaaS) platforms in use, bringing the framework and security rules through Microsoft Cloud App Security (MCAS) may be the way to go. This would allow the full Cloud Application Security Broker (CASB) functionality to support the information security initiatives across the multi-cloud structure.
If most of your organization’s active data will live within the Microsoft ecosystem, then leveraging the inherent tools may help accelerate the deployment of new capabilities. Azure Information Protection (AIP) contributes through rights management, the ability to apply sensitivity labels, retention labels and policies, and tools like AIP Scanner to help identify data in traditional shared storage.
To incorporate more automation, the Microsoft 365 E5 Information Protection and Governance bundle can be added, which is also part of the larger M365 E5 Compliance bundle (requires M365 E3) or full M365 E5 suite. As I said earlier, there are a lot of options depending on what is needed, and our Microsoft specialists are ready to answer any questions you might have.
Next time, we will start at the beginning of the maturity curve and talk about some of the introductory capabilities of Microsoft’s products. Please reach out to us here at Connection if you have any questions in the meantime.
Jake Giffin
Jake has over 10 years Microsoft experience. Jake holds certifications for volume licensing and software asset management, which have contributed to his presentations at industry conferences. Outside of work, he enjoys traveling, working on projects around the house (sometimes), market speculation, and playing volleyball.
