Nathan WintersMVP Exchange ServerMMMUG – www.mmmug.co.uk

Exchange 2010 Protection and Compliance

3

Exchange 2010 IPC

Introduction to Information Protection and Compliance (IPC)The arsenal of Technical Tools!

ArchivingMulti-Mailbox SearchLegal HoldIRMModerationEnhanced Transport Rule CapabilitiesMailTips

Demonstration Scenarios

4

Why is IPC important?Large UK Retailer Leaks Payment Information via Email

Nearly 40% of workers have received confidential information that was not meant for them!

The Information Commissioner’s Office will be able to issue fines of up to £500,000 for serious data security breaches.

Appeal Win Lets FSA Grab Evidence for SEC

5

Some of the legal factorsPublic Sector - Freedom of InformationAll - Data protection actFinance – Financial Services Authority, SEC, BASEL2RIPA - Regulation of Investigatory Powers Act 2000Human Rights - Lawful business protection Electronic Communications Act – Adding DisclaimersUS – SOX, HIPAA etc

6

What does IPC mean to you?

It’s a policy build around the relevant laws for your industry.

Based on a bunch of technical tools which we try to automateMonitor email – content, recipients where is it going

Know what is happening based on email attributesRetain and Provide

Archiving, Retention and DiscoveryControl and Protection – allow or prevent

Granular policiesSoft to Hard control

7

Retain and Provide

mail where required

with Archiving, Retention

and Discovery

Protection & Control: Soft to HardEnsure that you target the correct data with the correct policy to maximise usability

Alert

• Allow delivery but add a warning

Classify

• Allow delivery but apply classification

Modify

• Allow delivery but modify message

Append

• Allow delivery but add a disclaimer

Protect

• Allow delivery but prevent forwarding

Review

• Block delivery until moderated

Redirect

• Block delivery and redirect

Block

• Do not deliver!

• Personal Archive• Retention Policy• Legal Hold• Multi-Mailbox Search

Archiving, Retention & Discovery

9

Exchange 2010 Archiving, Retention & DiscoveryBetter mailbox management

• Secondary mailbox node• PST /Primary Mailbox Management

Personal Archive

• Folder/Item Level • Archive/Delete policies

Retention Policies

• Role-based GUI Multi-Mailbox Search

• Edited and Deleted Items • Searchable with MM Search Legal Hold

10

Organization Archive• Keeps all E-mail • Allows Org Control• Optimized for Search

World Today: Email Repositories

Exchange(MBs)

Org Archive(PBs)

Personal Archive

(TBs)

Outlook PSTs(GBs)

BackupBackup

• Tape/Disk Backups Common

• Item Level BackupsCommon

• Backups uncommon and difficult• Users do manual

backups• IT does unsupported

backups

• Replication Common• Backups Less Common

• Replication Only Choice

• Datasets Require Replication

End User Access

PSTs• Circumvents Quota• Highly Portable

Mailbox• Highly Available• Rich Client Access

Personal Archive• Circumvent Quota• Allows Org Control

Replicated Backups

Replicated Backups

11

PSTs present a problem

IT Pro• Storage of old email on expensive SAN inefficient• Hard to discover content for legal request• Hard to prevent changes to content for legal hold• Management for Backup and Recovery expensive

End User• Only Stored on one machine• Corruption increases when stored on network share• No access through browser• Requires management by end user• Stability/responsiveness is an issue with large PST files

12

Why Archive? A Vicious Cycle of Volume vs. Control

Growing E-mail Volume

Performance & Storage

Issues

Mailbox Quota PSTs

Discovery and Compliance

Issues

Increasing storage and back-up costs

Users forced to manage quota

Quota management often results in growing

PSTs (Outlook auto-archive)

•PSTs difficult to discovery centrally

•Regulatory retention

schedules contribute to

further volume/ storage issues

13

Breaking the CycleWith large mailbox architecture and archiving

Growing e-mail volume

Performance & Storage

Issues

Mailbox Quota PSTs

Compliance/Discovery

Issues

Large Mailbox Architecture• maintains performance • provides option for DAS-SATA storage to reduce costs

Archivingenables simple migration

of PSTS back to server

Archivingsimplifies discovery,

retention and legal hold

14

Large Mailbox Lower Costs, Better Performance

0

0.2

0.4

0.6

0.8

1

DB IOPS/Mailbox

IOPS/Mailbox

+90% Reduction!

Challenge SolutionLong recovery time

• High availability features allow for up to 16 mailbox database copies

• Can provide replication with 30 second database-level failover

High storage costs

• 70% reduction in I/O • + Smoother I/O patterns • = Option to use larger, slower, cheaper disks

(SATA)• 3+ database copies enables JBOD/RAID-less

storage Slow Outlook (online)/OWA performance

• Optimized for 100,000 items vs. 20,000 in Exchange 2007

Large Volume Search

• Index optimized for large mailboxes in Exchange 2007; further enhanced in Exchange 2010

15

Personal Archive

Oveview – What is it and where does it live?User goals and assumptions

Simple to use – OWA & OutlookIT Pro goals and assumptions

Get rid of PSTs!Easy to enable.

16

Message RetentionOverview

Move Policy: automatically moves messages to the archive

Options: 6 months, 1 year, 2 years (default), 5 years, NeverUser Impact: Helps keep mailbox under quotaWorks like Outlook Auto-Archive – without PSTs!

Delete Policy: automatically deletes messagesUser Impact: removes unwanted itemsHelps keep mailbox under quotaDelete policies are Global (they travel to the Archive)Per-item policies take priority over per-item policies

17

Legal HoldOverview

Hold Policy captures all edits/deletes irrespective of user or admin access.User workflow is unchanged, items captured in hidden folders in Dumpster 2.0. Multi-mailbox search can retrieve items indexed in Dumpster 2.0. ISSUE – Consider that the whole mailbox is put on hold, not just the granular info that you need on hold!

• Personal Archive• Retention Policy• Legal Hold• Multi-Mailbox Search

Demo

• Information Rights Management• MailTips• Moderation• Enhanced Transport Rules

Protection and Control

35

Exchange 2010 Protection and Control

• IRM in OWA• IRM Transport rules & Search

Information Rights Management

• Automated alerts for Users• OWA and Outlook 2010MailTips

• Route mail to moderator for reviewModeration

• Dynamic Signatures• Granular Conditions

Enhanced Transport Rules

36

Information LeakageCan be costly on multiple fronts

Legal, Regulatory and Financial impactsNon-compliance with regulations or loss of data can lead to significant legal fees, fines, and more

Damage to public image and credibility with customers

Financial impact on companyLoss of Competitive Advantage

Disclosure of strategic plansLoss of research, analytical data, and other intellectual capital

37

Enforcement tools are required—content protection should be automated.

Message Confidentiality?

Automatic Content-Based Privacy

Automatic Content-based Privacy:•Transport Rule action to apply RMS template to e-mail message• Transport Rules support Regex scanning of attachments in Exchange 2010 (including content)• Internet Confidential and Do Not Forward Policies available out of box

Exchange Server 2010 provides a single point in the organization to control the protection of e-mail messages.

38

39

What is Rights Management Services?Windows Platform Information Protection TechnologyBetter safeguard sensitive information

Protect against unauthorized viewing, editing, copying, printing, or forwarding of informationLimit file access to only authorized usersAudit trail tracks usage of protected files

Persistent protection Protects your sensitive information no matter where it goesUses technology to enforce organizational policies Authors define how recipients can use their information

40

Protection via Transport Rules

New Transport rule action to “RMS protect”Transport Rules support regular expression scanning of attachments in Exchange Server 2010“Do Not Forward” policy available out of the box Office 2003, Office 2007, Office 2010, and XPS documents are supported for attachment protection

41

Outlook Protection RulesAllows an Exchange administrator to define client-side rules that will protect sensitive content in Outlook automatically

Rules can be mandatory or optional depending on requirements

Rules look at the following predicates:Sender’s department (HR, R&D, etc.)Recipient’s identity (specific user or distribution list)Recipient’s scope (all within the organization, outside, etc.)

Rules are automatically retrieved from Exchange using Autodiscover and Exchange Web Services

42

Transport Pipeline DecryptionEnables Hub Transport agents to scan/modify RMS protected messages

Required for Antivirus scanning, Transport Rules or 3rd party agents

Decryption Agent Decrypts message and attachments, using RMS super-user privilegesOnly decrypts once per forest, on the first Hub, to improve performanceOption to non-deliver (NDR) messages that can’t be decrypted

Encryption AgentRe-encrypts messages, message forks and NDRs with original Publishing License

43

How does it work?Transport Decryption

1. Mail marked for protection or an already protected mail item.

2. On first use, Exchange does an SCP lookup for the RMS server.

3. Exchange requests a RAC and CLC for the “shared identity” account. These are saved and re-used. The RAC is a super-user RAC.

Dec

rypti

on

Encr

yptio

n

Tran

spor

t Ru

les

Jour

nalin

g

Fore

fron

t Se

curit

y fo

r Ex

chan

ge

3rd P

arty

Ag

ents

4. Incoming IRM mail is decrypted so all agents have access to the decrypted content.

5. At the end of the agent pipeline the message is re-encrypted, including any changes made by agents.

6. Process message is sent to next hop or delivered to the recipient.

Hub Transport

Active Directory AD RMS

• Information Rights Management• MailTips• Moderation• Enhanced Transport Rules

Demo

55

Rights Management Services Integration in Unified Messaging

Unified Messaging administrators can allow incoming voice mail messages to be marked as “private”Private voice mail can be protected using “Do Not Forward”, preventing forwarding or copying contentPrivate voice mail is supported in Outlook 2010 and Outlook Web Application (OWA)

56

Rights Management Services Integration in Unified Messaging

57

Business to Business RMSSecurely Communicate with Partners

Today customers can communicate using RMS between organizations by deploying ADFS and setting up trusts

ADFS requires a separate trust between each partnerADFS isn’t supported by Exchange

In Exchange Server 2010, customers can federate with the Microsoft Federation Gateway instead of each partner

A single federation point replaces individual trustsAllows Exchange to act on-behalf-of users for decryption

Senders can control how their data is accessed by 3rd partiesBy using federation, RMS can allow organizations and applications to access data on-behalf-of individualsSpecifically they can specify whether recipient organizations can archive e-mails in the clearRMS administrator can control which 3rd parties can access data using federated authentication (allow/block list)

• AD RMS Setup• MailTips• Enhanced Transport Rules

Demo

60

Key takeaways

Personal Archive gives seamless user experience and removes need for PSTsDeep support for IRMAutomation enables ease of use and administrationWide range of granular controls from Soft to Hard

Text Microsoft to 60300

Or

Tweet #uktechdays

Questions?

www.microsoft.com/uk/techdays

For resources, decks and video:

or my blog http://nathanwinters.co.uk

© 2008 Microsoft Corporation. All rights reserved. Microsoft, Windows, Windows Vista and other product names are or may be registered trademarks and/or trademarks in the U.S. and/or other countries.The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED

OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.