Review Microsoft Office 365 in Germany

download report

Transcript Review Microsoft Office 365 in Germany

Some information relates to pre-released product which may be substantially modified before it’s commercially
released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Global, hyper-scale, enterprise-grade infrastructure offering data residency and business
continuity in 13 worldwide regions
Enterprise reliability via 100+ data centers
and Microsoft’s global network edge
Compliance leadership with standards including
ISO 27001, FISMA, and EU Model Clauses
No standing access to data, transparent
operational model, and financial-backed 99.9% SLA
Secure by design operationalized at the physical,
logical, and data layers
A physical and logically separate instance of Microsoft Azure, Office 365, and
Dynamics available to all customers and partners in EU/EFTA
Key features
A commitment that
all customer data
and required
supporting systems
reside in German
datacenters
A dedicated network
within Germany
datacenters,
independent from
the public cloud
network
A commitment to
meet applicable
compliance
requirements and
certifications
A German Data
Trustee that controls
physical and logical
access to customer
data
The most complete, secure cloud productivity service
Authoring
Mail & Social
Sites, Content &
Projects
Chat, Meetings
& Voice
Analytics
Skype
Power BI
Word
Outlook
OneDrive
Excel
Exchange
SharePoint
PowerPoint
Delve
OneNote
Planner
Visio
Project
MyAnalytics
Sway
Secure and Compliant
Manageable
Extensible
Always up to date
5
According to Gartner1, privacy requirements have severely impacted the deployment of
all forms of cloud-based services in the region
Regional
regulation
Data privacy regulations in the European Union (EU) are among the strictest
and strongest in the world.
Local
regulation
German privacy regulations are outlined and enforced through Federal Act
and individual state laws.
Data
residency
Customers want to know where their customer data resides, who has access to
it, and which country's laws govern that access.
1Gartner,
Market Trends: Cloud-Based Security Services Market, Worldwide, 2014, October 2013
Users
Partners
Customer Data
The distribution of your user
population is an important aspect
of choosing the cloud that best fits
your needs. Connectivity to our
cloud and local support need to be
taken into consideration.
Think about the partners you work
with and your level of
collaboration. The increased data
protection guarantees for German
customers in Microsoft Cloud
Germany may pose challenges
when working beyond these
predefined borders.
Office 365 is built from the ground
up to provide enterprise-grade
security, privacy and compliance
capabilities. The Microsoft Cloud
Germany adds an additional layer
of control for those customers that
require that.
Office 365 cloud consideration
Where are most of your users
working from?
The distribution of your user population is an
import aspect in choosing the cloud that fits you
best. Connectivity to our cloud and local support
need to be taken into consideration.
Office 365 Germany
Office 365 EMEA
Centralized in Europe?
Distributed over multiple regions?
The Microsoft Cloud Germany takes
advantage of a dedicated network
between German datacenters,
independent from the global cloud
network.
The global Microsoft network improves
the experience for a globally distributed
workforce and employees who travel
outside of their home region.
You will be responsible for choosing the
network of your choice to connect your
users outside of Germany to the
segregated Office 365 Germany network.
Technical support will be delivered 24/7,
locally, out of Germany in German and
English. Escalations will, as needed,
leverage the broader worldwide support
or engineering teams.
As a customers in our global network, you
take advantage of a highly distributed
infrastructure, including local front end
servers to allow faster connectivity across
the Microsoft global network.
Technical support is available 24/7 by a
global network of experts. Live technical
phone support is available in Arabic,
Bahasa, Brazilian Portuguese, Chinese
(Cantonese, Mandarin), English, French,
German, Hebrew, Italian, Japanese,
Korean, Polish, Portuguese, Russian,
Spanish, Thai, and Turkish.
Office 365 cloud consideration
Where are your internal and external
business partners?
It’s important to think about the partners you
work with and your level of collaboration with
them. The isolated nature of the Microsoft Cloud
Germany imposes limitations in working beyond
those predefined borders.
Office 365 Germany
Office 365 EMEA
On premise or in all the Microsoft Cloud
Germany?
Distributed over multiple datacenter
regions?
The Microsoft Cloud Germany will
support most of the existing Office 365
hybrid scenarios (on premise and Office
365 Germany).
The global data center regions support all
current hybrid and cross-tenant
collaboration scenarios, including across
tenants in different global data center
regions.
Most cross-tenant collaboration scenarios
will be supported especially if
participating tenants are within the
Microsoft Cloud Germany.
Are you looking to span multiple
datacenter regions? The isolated nature
of the Microsoft Cloud Germany has an
obvious impact on our future
multinational capabilities. Therefore, and
in order to ensure our commitments, we
will not be able to offer these capabilities
at first. Further investigation is planned.
In the future Office 365 will allow tenants
to span multiple datacenter regions.
Although this capabilities are still on our
roadmap, they are planned to come in
several phases and first to customers
within our global regions.
Collaboration between an Office 365 tenant in Germany and…
On premise
w/hybrid
On
premise
Office 365 tenant
in Germany
Office 365 tenant
Global
Email: Sending and receiving emails
Yes
Yes
Yes
Yes
Free/Busy: Allow for organizations to share free/busy
across environments
Yes
Yes
Yes
Yes
Instant Messaging: Instant messaging with Skype
users outside of the organization
Yes
Yes
Yes
Yes
Peer to Peer Calling: Placing Skype calls with external
parties also using Skype over IP
Yes
Yes
Yes
Yes
Document sharing: Inviting external parties rights to
co-author and edit documents stored in SharePoint or
OneDrive for Business
Yes
Yes
Yes
Yes++
(Sharing with external parties via
email attachment)
Security and distribution groups: Adding external
individuals to security or email
distribution groups
Yes
Yes
Yes
Yes
Azure Rights Management/Office 365 Message
Encryption: Sharing of rights-protected emails and
documents users outside of the tenant.
Yes++
Yes++
Yes++
Yes++
++ Work
on these features are in progress and they will be available after General Availability
Office 365 cloud consideration
Where are you legally permitted to
store your data?
Office 365 is built from the ground up to provide
enterprise-grade security, privacy and
compliance capabilities. The Microsoft Cloud
Germany adds an additional layer of control for
those customers that require that.
Office 365 Germany
Office 365 EMEA
All customer data stored at rest within
Germany and all access is controlled by a
German Data Trustee under German law?
All of our foundational principles with
core customer data at rest within the EU ?
The Microsoft Cloud Germany ensures
your customer data resides in Germany,
access to your customer data is controlled
by an independent German data trustee
or directly by you, the customer, and the
data trustee will not produce your data to
a third party except as required by
German law.
Already operational with Office 365 in
another data center region? Unless you
are explicitly looking for the additional
levels of control and data protection
within the Microsoft Cloud Germany,
there’s no reason to change your mind.
The best practice is to stay within your
current data center region.
Security: Our priority is to safeguard your
data with state-of-the-art technology,
processes, and encryption.
Privacy and control: You control the
privacy of your data and access to it—
take it with you or delete it from our
servers, it's your call
Compliance: Depend on the largest
portfolio of compliance standards and
certifications in the industry.
Transparency: You have visibility into
where your data is located and how it's
managed.
Datacenters are in Germany, with access controlled by
German data trustee
Microsoft can only
gain access from the
German data trustee
German data trustee
controls all access and
monitors and audits any
access given
Operations center located in Germany
A dedicated network between datacenters
operating inside Germany
German data Trustee controls access to customer data,
datacenters, and operations center
Customer data at
rest does not leave
Germany
The German data trustee performs or monitors any operations or other tasks that require
access to customer data or the infrastructure in which customer data resides.
Role Based Access Control
(RBAC) tools enforce all
access to customer data.
Microsoft personnel
do not have any standing
access rights to grant
access to customer data.
Access for deployment of
software updates must be
granted by the German data
trustee
Service health monitoring
tools do not have access
to customer data
Microsoft personnel
cannot log in to the
servers that hold customer
data without approval of
data trustee.
Microsoft cannot grant itself
access rights. Only the
German data trustee can
grant access to servers that
hold customer data.
All customer data
• Virtual machines
• Emails, attachments,
images
• Storage blobs
• Database contents
The German data trustee contractually commits that it will not allow access to customer
data by Microsoft and its subcontractors unless:
The German data trustee grants temporary
access to resolve a customer support problem
or perform maintenance or improvements.
In such circumstances, the German data
trustee monitors access and access is
terminated once the issue gets resolved.
The customer grants access to Microsoft
personnel for assistance with resolving a
customer support incident.
In such circumstances, the customer – not the
German data trustee – is responsible for
controlling and monitoring access.
1
Microsoft makes a request for access based on a specific need.
2
The German data trustee verifies that request is for a permitted purpose.
3
The German data trustee grants access, scoped to a specific service and only for the time necessary to accomplish
the permitted purpose. During access, Microsoft personnel have their activities logged and can be monitored by
the data trustee in real time. The data trustee can terminate access immediately at any time.
4
Upon completion of the task, access terminates. If more time is needed, the individuals must obtain a
new approval.
Microsoft Cloud Germany contains automated tools that allow Microsoft to resolve many
incident requests without accessing customer data. For example, rebooting a server in
the highly redundant system through tools that do not allow access to customer data.
Examples of automated access
Automated
system
deployment
Deployment
queue
German data
trustee review
and approval
Review
and
approval
Provisioning
Patching
No
Change rejected
Yes
Change
implemented
Where a Microsoft on-call engineer (OCE) needs to take actions that cannot be done
without potential access to customer data or systems that store customer data, the OCE
must request access from the German data trustee. No access is provided until the
German data trustee approves (for example, via the escort or lockbox methods).
Examples of manual access
No
Change/
incident
management
Manual
request
queue
German data
trustee review
and approval
Initiate manual
process
Finished
work
Yes
Change
& incident
management
Diagnostics
Terminate
session
When an incident or system update requires Microsoft engineers to have access to
Microsoft Cloud Germany systems, there are two processes which assure that the
German data trustee maintains control of access to all customer data:
Lockbox
system
Enables the German data trustee to approve
access for the OCE to complete an explicit
task during a limited time frame.
Escort
model
A process in which the German data trustee
gives the OCE temporary access while
monitoring all activity.
Lockbox is a system that allows the German data trustee to provide approval for limited
duration to the OCE to execute task and access servers housing customer data.
German
data trustee
approval
Submits
request
Microsoft on-call
engineer
Just-in-time and access
for limited duration
Access is granted for limited
duration once German data
trustee approves
Lockbox
system
German data
trustee
OCE completes task,
access terminates
Just enough access
Audit logs for all access
Least privilege and highly scoped
access is granted to perform
the task
All access approvals as well as task
operations are logged
What is escort session?
• The escort process is designed to give the OCE temporary access to the German cloud for technical
support involving systems that hold customer data.
How does an escort
session work?
How does an escort
meet German cloud
requirements?
Microsoft requests escort for a permitted purpose.
The German data trustee connects to a virtual machine and invites the OCE to shadow his session.
The German data trustee then establishes a remote connection into the server with his credentials.
The German data trustee then hands over the control to the OCE and supervises the entire session as
the developer is performing his tasks.
• The German data trustee can terminate the session anytime if he needs to, and the Microsoft developer
loses connection immediately.
•
•
•
•
• Microsoft employees don't have access to customer data in the German cloud.
• Microsoft employees can only have temporary access to systems processing customer data in the
German cloud when the German data trustee allows it, and where the OCE provides business
justification as approved by the German data trustee.
• The German data trustee will supervise the session to make sure that no customer data is extracted.
Physical access needs to be
escorted*
The German data trustee also controls
physical access to the operations facilities
and the datacenter facilities that hold
customer data. If a third party needs access
(e.g., to perform maintenance on the
servers) the German data trustee reviews
the request and supervises access through
an escort model.
*First responders in case of an emergency don’t have to be escorted
(i.e. firefighters, paramedics, etc.)
Access to customer
data is controlled
exclusively by the
customer and the
German Data Trustee.
If Microsoft receives a
third-party demand
for customer data, it
will redirect to the
customer or the
German Data Trustee
The Data Trustee
contractually commits
to customers to
handle all third-party
requests in
accordance with
German law or as the
customer directs
The Data Trustee is a
German company in
every respect –
headquartered in
Germany, incorporated
in Germany, owned
and controlled in
Germany
Datacenter Location
Data residency
Access control
• Two German datacenters are
interconnected via a network
that physically stays in
Germany
• Restricted data stays in
Germany and cannot be
copied out of German
datacenters
• Restricted data and elevated
privileges are solely
managed by the German
data trustee
• The German network is a
dedicated and isolated
spine with three paths to
provide high availability and
two paths to the Microsoft
backbone for management
and two for ingress/egress
• Non-restricted data may be
copied over to worldwide
Microsoft datacenters
• Microsoft employees and
vendors will have persistent
access to non-restricted data
• Non-restricted data may be
stored in some cases (e.g.,
commerce) in worldwide
Microsoft datacenters
• Elevated access to customer
data is provided to Microsoft
employees via either the
escort or lockbox processes
Microsoft Cloud Germany is built upon the world-wide instance of the Microsoft Cloud and includes the robust
security and compliance controls in the world-wide instance
Majority of Microsoft Cloud Germany would be covered
under existing audits
• Uses the same security and controls
• Includes ISO 27001/18 and SSAE16/ISAE 3402
Would require
additional audit(s)
Data centers would undergo audits like any other
expansion
Unique Microsoft Cloud Germany controls (data trustee)
would be audited separately
Planning
Additional data trustee controls
that would be independently
assessed by accredited auditors
as part of both SOC, ISO and
PCI-DSS audits for each
Microsoft cloud service
(PCI-DSS is applicable only
for Azure)
Unique data
trustee
controls
Covered by world-wide
certifications
Restricted
systems
in Germany
Worldwide
Management
Layer
Evaluating
A customer white
paper is planned to
provide customers
with guidance on how
to meet their
compliance obligations
such as
IT-Grundschutz, etc.
IT-Grundschutz
certification
BSI Cloud Computing
Compliance Controls
Catalogue C5
TÜV certification based
on data center
standard EN 50600
Microsoft Proprietary- for discussion purposes only. This document also contains information on pre-released services, which may be substantially modified before it is commercially released. Microsoft makes no warranties, express or implied, with
respect to the information provided here.
Consider the regions and regulations where you do business:
Germany
EU
Global
What is the most suitable Office 365 cloud for me?
Where are your internal and external business partners?
Where are you legally permitted to maintain data residency?
What is the most suitable Office 365 cloud for me?
Office 365 Germany
Office 365 EMEA
Pricing
Future needs
Clients
Yammer
Product releases
The incremental value
offered by Office 365
Germany is available at
a 25% higher price than
the Office 365 global
datacenter regions
Microsoft does not
offer migrations
between the Microsoft
Cloud in Germany and
other datacenter
regions.
Office 365 Germany will
only support our most
secure authentication
protocols. Office 2016
(and later) and Office
ProPlus will be the
supported clients.
To fulfill our
commitment to storing
all of your data in
Germany we are unable
to offer Yammer in the
German cloud.
Some features may not
be released until after
the global availability of
Office 365 Germany
and/or may be subject
to delays as compared
to the global datacenter
regions
Global offerings
Europe*
United Kingdom*
• Globally connected cloud
services
• Globally connected cloud
services
• Customer data is stored at rest
within Europe**
• Customer data at rest is stored
within the UK**
• Complies with EU model clauses
2010/87/EU
• Complies with EU model clauses
2010/87/EU
• Azure services open to all public
cloud customers globally; Office
365 and Dynamics 365 services
open to all customers and
partners in Europe
• Azure services open to all public
cloud customers globally; Office
365 and Dynamics 365 services
open to all customers and
partners in the UK
Sovereign cloud offerings
Microsoft Cloud Germany
• Physically and logically separate instance of Microsoft Azure, Office 365,
and Dynamics 365
• Dedicated network between Germany datacenters, independent from the
public
cloud network
• German Data Trustee controls physical and logical access to customer data
under German law
• All customer data and required supporting systems reside in German
datacenters
• Open to all customers and partners in EU/EFTA
*Azure regions can be selected, including access to WW regions, while Office 365 and Dynamics 365 regions are pre assigned.
**See the Microsoft Trust Center for updated compliance information and data residency details
http://fasttrack.microsoft.com/
http://techcommunity.microsoft.com
http://myignite.microsoft.com
https://aka.ms/ignite.mobileapp