With Office 365, Microsoft corporate users can access and share data from anywhere, on any device, and be more productive by using all of its collaboration features. On the other hand, it’s easier to inadvertently share sensitive information with others both inside and outside of the company.
To manage security risk, Microsoft IT created a solution that uses the Office 365 Management Activity API and the data loss prevention (DLP) features of Office 365. The solution gathers data about sharing from Microsoft Exchange Online, SharePoint Online, OneDrive for Business, and Azure Active Directory. It also includes a custom governance solution to help protect data. Microsoft Power BI dashboards visualize the data to show how Microsoft corporate users share information.
The dashboards help answer four business questions that have direct business impact on risk, and the answers help leadership make decisions that reduce risk. Microsoft IT uses an agile process to answer these questions:
- Which sites are capable of external sharing?
- What is the classification of externally shared sites?
- Which files are shared externally?
- What operations are performed by external users on those externally shared files?
Microsoft IT tests hypotheses about how various policies and programs might improve users’ sharing behavior and then check the dashboards to see if the behavior has changed. Besides dashboards, the solution improves sharing behavior by giving users visual cues about appropriate sharing. The solution automatically sends email to users who violate security policies by sharing too much, asking them to change their behavior. This helps manage and respond to information security risks.
Information security policies
To protect valuable intellectual property, Microsoft has corporate policies for handling and sharing data. Using business rules based on these policies, the solution detects and reports when users share documents and if the sharing is in or out of compliance with the rules. For example, Microsoft data handling policy states that sensitive business information must be encrypted both at rest and in flight. And, when shared externally, users are accountable for who they share it with.
The solution audits the following types of sharing:
Regulated information. Regulated information includes government identification numbers such as social security numbers and passport numbers, financial data such as credit card numbers and financial records, or medical information. Regulated information must always be protected by encryption.
Business information. At Microsoft, sensitive business information is called High Business Impact (HBI) data. Users can store HBI data on SharePoint Online and OneDrive for Business if they comply with Microsoft policies for HBI data storage and transmission; however, to share HBI content externally, users must get a policy exception from the Microsoft IT security and privacy team.
Low Business Impact (LBI) and Medium Business Impact (MBI) data is permitted on SharePoint Online and OneDrive for Business with no special approval. Users must review all classifications to understand how to classify, protect, and handle data that they create, and ensure that it is properly categorized for use at Microsoft. See the Data Classification Wizard to learn more about how Microsoft classifies information.
How users share too much
Inappropriate sharing occurs when users make information accessible to others in a way that violates information security policies. There’s rarely malicious intent behind inappropriate data sharing. Rather, the main reasons for it are:
- The feeling of importance associated with having sought-after, inside information.
- Lack of understanding about the sensitive nature of the information or the security level of the site where it’s shared.
Users often don’t grasp the implications of sharing information with many people. While some users do understand appropriate sharing, there are people who share all information indiscriminately.
Some common inappropriate sharing scenarios are:
- When sharing a document internally, a user doesn’t set appropriate security settings to limit the ability to open or edit the document to named users or groups.
- A user shares a sensitive business document or regulated information on a SharePoint Online or OneDrive for Business site, and the site has users who shouldn’t have access to that document or information. For example, with OneDrive for Business, a user might inadvertently select the “share with everyone” folder for highly sensitive information.
- A user includes a credit card number, driver’s license number, password, or other regulated information in email.
- A user sends a sensitive business document in email and does not set appropriate Microsoft Rights Management permissions on the document.
Detecting inappropriate sharing
Organizations subscribing to Office 365 can use DLP to detect regulated and sensitive information that users share. In addition, Office 365 provides audit data for all file-related events, such as open, upload, download, and delete. Organizations can access audit data through the Office 365 Security and Compliance Center and use search and PowerShell cmdlets to get different views. They can also use Office 365 APIs in custom solutions.
Microsoft IT wanted to do advanced analytics and statistical analysis on this raw data and give the results in a Microsoft Power BI dashboard. A custom solution was built to automatically detect, analyze, and report on sharing behavior. The solution uses the following types of information:
- Sharing activities. The solution audits how files are shared on SharePoint Online, OneDrive for Business, and Exchange Online. It also audits login activities on Azure Active Directory. To obtain audit data, it uses the Office 365 Management Activity API.
- Regulated information. Adhering to international information privacy regulations, Microsoft IT configured rules for DLP to monitor regulated information contained in Exchange Online email and in files on SharePoint Online and OneDrive for Business. The Microsoft IT solution uses DLP PowerShell cmdlets to create reports for further analysis and reporting. To learn more about configuring DLP rules and using the DLP cmdlets to get reports, see Data loss prevention and View DLP policy detection reports.
- Documents containing usernames and passwords. In addition to the DLP data about how users share regulated information, Azure Machine Learning looks for shared documents and email that contain usernames and passwords.
Technical solution components
The main components of the technical solution are:
- Office 365 Management Activity API provides endpoints for Azure Active Directory, Exchange Online, and SharePoint Online (including OneDrive for Business) from which to download audit data. The endpoints are Audit.AzureActiveDirectory, Audit.Exchange, and Audit.SharePoint. Office 365 lets organizations acquire complete audit data on their users’ file actions, such as upload, download, open, close, and delete.
- DLP in Office 365 identifies regulated information shared on SharePoint and OneDrive for Business and in Exchange Online email. It informs users when their content is sensitive and, if necessary, restricts sharing.
- Get-DlpDetailReport is a PowerShell cmdlet that returns detailed information for the previous seven days about specific DLP rule matches for SharePoint Online, OneDrive for Business, and Exchange Online. The organization subscribing to Office 365 defines the DLP rules for the types of information to detect in their users’ files and email messages.
- Azure Data Factory extracts, transforms, and loads DLP data.
- The Office 365 Management Activity API webhook notifies the solution’s webhook endpoint when new audit data is available.
- The webhook endpoint hosts a custom API that was developed to receive notifications and acquire audit data from Office 365.
- Microsoft SQL Server 2014 running in an Azure virtual machine hosts a staging database. For security reasons and to allow data archiving, a second SQL Server virtual machine hosts the aggregated data used by the solution.
- Azure Blob Storage provides data storage.
- Azure HDInsight provides search and transformation for the raw DLP data.
- AutoSites manages SharePoint Online site classifications (LBI, MBI, or HBI) and sends users email about inappropriate sharing sensitive information. AutoSites is a governance solution that Microsoft IT developed. Design information and sample code for this solution is available on GitHub.
- Azure Machine Learning detects when files and email messages contain usernames and passwords.
- Microsoft R Server supports forensic data analysis.
- Microsoft Power BI provides reports, data visualizations, and dashboards.