Getting secure in a mobile-first world with EMS

getting-secure-in-a-mobile-first-world-with-ems

We live in a time where a generation of workers has never plugged in a cable to get on the Internet. And while this mobile-first world has been great for productivity, it’s led to greater risk and challenges for the security team.

Today, security is so much more than just a firewall. As we saw in our recent webinar, co-hosted with Microsoft to discuss their new Enterprise Mobility + Security Suite, breaches are resulting from weak end-user passwords or error, as well as a lax attitude toward SaaS and third party “Shadow IT.” Add to that infrastructure complexity brought on by cloud and hybrid environments and everything you knew about security is changing.

[Read more…]

Security and legal concerns with Office 365

Security and legal concerns with Office 365

Security concerns about the public cloud are on the decline – but they continue to slow down adoption.

In fact, in a recent survey of hundreds of IT decision makers, security was the leading reason (48.5% of respondents) why businesses haven’t yet made the leap to the cloud.

why businesses haven't yet made the leap to the cloud

In a strange twist, though, that same study — conducted by a cloud migration expert SADA — showed that cloud security was also the key driver of its adoption (51.5%). So, simply put: cloud security is both scaring business away and attracting it en masse.

What gives? Office 365 Adoption Shift is slow-moving.

As the ZDnet writer Joe McKendrick puts it, public opinion about the public cloud is shifting, but it’s a trend that has been evolving — slowly — over the last few years.

The reality is that public cloud has its own security risks and concerns, just like anything. But when closely examined, most leaders would have to agree the cloud offers more security, better compliance options, far more control and transparency than the fears would have you believe.

This was the key topic of discussion in our latest webinar on Office 365, where we dug into the security and legal concerns present with adopting the cloud productivity suite.

Key Security Concerns with Office 365: 

The core concerns about Office 365 centre around security, access, visibility, and encryption, namely:

  • Is my content safe in your data centers?
  • Who has access to my organization’s content in the service?
  • What visibility do I have into the activity on my content in the service?
  • Can I encrypt everything so that it’s not possible for you (Microsoft) to have access to my content?

As we have shown in our expert-hosted webinar, which was attended by IT leaders from across North America, is that under each of those key categories, Office 365 delivers a safe, secure and business friendly set of tools and solutions.

  • Security: Office 365 offers the highest security on all levels, from content to the network to the admin and all things in between. On top of this, it offers continuous security best practices and services, like penetration testing and granular end-user controls over configurations.
  • Privacy: With it’s “privacy by design” ethos, no one is ever able to use your data in a way that you do not approve of. This means Microsoft builds no back doors and provides no unfettered governmental access to your data.
  • Compliance: Microsoft’s broad and thorough approach to compliance is a big positive and helps to relieve a major concern many businesses are struggling to overcome. With it, you meet out-of-the-box standards such ISO 27001, HIPAA, FedRAMP/FISMA and SOC. You also have access to deep analytical auditing and reporting and much control over how your data is handled and where.
  • Transparency: With the “Transparency Hub” you get up to date insight on how law enforcement and other agencies attempt to request data and what Microsoft provided. You can easily see where your data is stored geographically, too, at any given time.

Of course, this does not mean that you are completely “off the hook.” Security on the cloud is always a shared responsibility — and you are still charged with much of the access, admin, and connections with the cloud applications that could provide other security issues not handled by Microsoft.

For a much deeper dive into all of the topics above, watch the recorded webinar above.

Cloud security is a shared responsibility: Azure tools and webinar

Cloud security

Even if cloud providers take most of the hard work off your plate, you shouldn’t take lightly your own responsibilities – what Amazon or Microsoft aren’t going to do for you.

One of the most important of these responsibilities is – security – or at least some aspects of it. When you are leveraging the cloud as a platform for business applications, security duties are split between you and the provider.

[Read more…]

Important Notice about Certificate Expiration for Exchange 2013 Hybrid Customers

 Important Office 365 Certificate Update for Exchange 2013 with hybrid deployments

If you’re running Exchange 2013 and you’ve configured a hybrid deployment with Office 365, this post contains important information that might impact you. Please evaluate this information and take any necessary action before April 15, 2016.

On 19th February 2016, the Microsoft Exchange Team issued a technical advisory notice on the Exchange Team Blog.

On April 15 2016, the Office 365 TLS certificate will be renewed in the Office 365 datacenter. This certificate is used by Office 365 to provide TLS encryption between Office 365 and external SMTP servers. The new certificate, which will help improve the security of mail sent to and from Office 365, will be issued by a new Certificate Authority and it will have a new Issuer and Subject.

This change has the potential to stop hybrid mailflow between Office 365 and your on-premises Exchange servers if one of the following conditions applies to you:

  • Your on-premises Exchange servers are running Exchange 2013 Cumulative Update 8 (CU8) or lower.
  • You’ve upgraded the Exchange 2013 servers that handle hybrid mailflow to Exchange 2013 CU9 or higher. However, since upgrading to CU9, you HAVE NOT re-run the Hybrid Configuration wizard.

If one of the previous conditions applies to your organization, hybrid mailflow between Office 365 and your organization will stop working after April 15, 2016.  This only affects hybrid mailflow. Regular mailflow and TLS encryption is NOT affected.

Solution:

1. Use Hybrid Configuration Wizard (HCW)

  • If you are running Exchange 2013 CU8 or lower, follow these instructions to update to the latest version of Exchange 2013
  • When you update Exchange 2013, download the new HCW and run the wizard (Instructions are here)

2. Manual Update (if #1 fails)

  • Open Exchange Management Shell and within each Exchange 2013 server (hybrid mail flow only), run the following commands:

$rc=Get-ReceiveConnector |where {$_.TlsDomainCapabilities -like “*<I>*”}
Set-ReceiveConnector -Identity $rc.Identity -TlsDomainCapabilities “mail.protection.outlook.com:AcceptCloudServicesMail

3. Let Softchoice help you

  • We have Microsoft Exchange experts who can assist you with this, by scheduling a short virtual engagement to walk through this update with you or perform it for you. This typically doesn’t take longer than 2 hours.
  • We also recommend to take this opportunity to do a broader assessment of your Office 365 Exchange Online and On Premise hybrid deployment. We call this a Health Analyzer service that is designed to audit your features and functions configurations. Based on the results of that check, we then will provide you with recommendations and best practices. This engagement will typically last a day to 3 days depending on the scale of your environment and is typically done remotely.
  • Download this to learn more about our Office 365 services.

How to Overcome 4 Common Barriers to Office 365 Success

How to Overcome 4 Common Barriers to Office 365 Success

Microsoft Office 365 is a powerful tool for driving productivity and collaboration within your enterprise. Even so, as a cloud-based application, many organizations are concerned about security and meeting regulatory compliance requirements. That’s to say nothing about the challenges of supporting Office 365 in the context of a broader SaaS management strategy.

The good news is there are a number ways to address these obstacles. Here’s a look at four of the most common concerns around migrating to Office 365, along with some of the cloud-based solutions we recommend to help you move forward with confidence.

[Read more…]

Beyond Office 365: Building a Global SaaS Identity Strategy

global_strategy

If you are considering deploying Microsoft Office 365, you’re probably thinking about the challenges of managing user identities in the cloud. For many organizations, Office 365 represents their first “official” SaaS application and will likely pave the way for larger SaaS investments down the road.If you haven’t already, now is the time to think about the systems you need to support a global SaaS identity strategy.

A global SaaS identity strategy has two key components: authentication – or the process of confirming that users are who they say they are – and authorization – or determining what users are allowed to do after they log in. Put another way, you might have a valid passport (authentication), but you can’t board a flight without a ticket (authorization).

As more SaaS apps find their way into the workplace, the more authentication and authorization challenges you will face. Without an overarching strategy, you’ll need to address these challenges with every new SaaS provider – hardly a recipe for success. Here are five drivers that prompt many organizations to think beyond Office 365 and create a global SaaS identity strategy: [Read more…]