Willy V Wonka Source Stroz Friedberg On The

Willy. V Wonka Source: Stroz Friedberg, “On The Pulse: Information Security In American Business, ” 2013

People Like You and Me

Information protection journey DEVICE PROTECTION Bit. Locker enhancements in Windows 8. 1 Protect data when device Instant. Go isrdlost or stolen 3 party adoption DATA PROTECTION THE GAP Rights Management Services (RMS) Accidental data. Protection leakage Enterprise Data Office Information Rights Protect data when …. . Management (IRM) Azure AD, Azure Rights Management in 2013

OTHER ATTEMPTS TO FILL THE GAP: PAIN POINTS

OUR VISION

Protects data at rest, and when roaming Platform integrated, no mode switching Corp data identifiable from personal Only IT-Allowed apps see business data IT controls keys, can remote wipe Common experience, x-plat support

Optional screen lock security policy System tosses decryption key on lock Blocks read when screen is locked Can encrypt new files and data Logon, unlock restores keys and access Helps mitigate system level attacks See session 639 “Microsoft Passport and Windows Hello: Moving beyond passwords and credential theft ”

Business/Personal One experience Data is isolated Data is encrypted at rest Business Apps & Data (Managed) Lync e. Mail Facebook One. Drive for Business Contacts Whats. App Block/audit data exchange Organization holds keys Office and One. Drive APIs for ISVs MDM managed Power. Point Calendar One. Drive PDF Reader Weather Photos Data exchange is blocked or audited Personal Apps & Data (Unmanaged)

Enterprise Data Protection PROVISIONING: KEYS AND POLICIES 1 2 User

Enterprise Data Protection DATA INGRESS User

Enterprise Data Protection DATA EGRESS User

Enterprise Data Protection CROSS PLATFORM DATA SHARING User Microsoft Intune SDK for i. OS & Android Common developer experience across platforms i. OS & Android apps enabled via Intune App SDK i. OS & Android enabled via Intune App Wrapping Tool for IT Pros Common MDM support across Windows, i. OS & Android with Microsoft Intune

Enterprise Data Protection REVOKE User

Local (productivity apps) Network capable (channel apps) Data Ingress Check for enterprise tag on data Check if host belongs to the enterprise AND Unwrap files (if necessary) Data In Use Set mode: Enterprise / Personal Data Egress Event handling Turn VPN On / Off Protect enterprise data Block sending to non-enterprise hosts OR Wrap files for transport Revoke: Close & cleanup Revoke: Stop enterprise sync completely Screen lock: Close content Screen unlock: Reopen content Screen lock: Stop uploads Screen unlock: Resume uploads

Get. Protection. Info. Async Takes an IStorage. Item Returns protection status and identity string

( && (Protection. Policy. Manager. Is. Identity. Managed(protection. Info. Identity))

Is. Identity. Managed Identity is an email address or domain Data managed only when identity managed

( && (Protection. Policy. Manager. Is. Identity. Managed(protection. Info. Identity))

Enterprise. Id Managed clipboard / share data is tagged Property is empty string when not managed

Local (productivity apps) Network capable (channel apps) Data Ingress Check for enterprise tag on data Check if host belongs to the enterprise AND Unwrap files (if necessary) Data In Use Set mode: Enterprise / Personal Data Egress Event handling Turn VPN On / Off Protect enterprise data Block sending to non-enterprise hosts OR Wrap files for transport Revoke: Close & cleanup Revoke: Stop enterprise sync completely Screen lock: Close content Screen unlock: Reopen content Screen lock: Stop uploads Screen unlock: Resume uploads

Get. Primary. Managed. Identity. For. Network. Endpoint. Async Takes a host name object Returns enterprise identity string Empty string means personal, not enterprise

Local (productivity apps) Network capable (channel apps) Data Ingress Check for enterprise tag on data Check if host belongs to the enterprise AND Unwrap files (if necessary) Data In Use Set mode: Enterprise / Personal Data Egress Event handling Turn VPN On / Off Protect enterprise data Block sending to non-enterprise hosts OR Wrap files for transport Revoke: Close & cleanup Revoke: Stop enterprise sync completely Screen lock: Close content Screen unlock: Reopen content Screen lock: Stop uploads Screen unlock: Resume uploads

Load. File. From. Container. Async Takes a containerized file Makes a new file with local encryption

var temp. Folder = Application. Data. Current. Temporary. Folder; var app. Data. Folder = Application. Data. Current. Local. Folder; // Get a handle to the downloaded containerized file. var container. File = await temp. Folder. Get. File. Async("my. App. Data. File. dat");

Local (productivity apps) Network capable (channel apps) Data Ingress Check for enterprise tag on data Check if host belongs to the enterprise AND Unwrap files (if necessary) Data In Use Set mode: Enterprise / Personal Data Egress Event handling Turn VPN On / Off Protect enterprise data Block sending to non-enterprise hosts OR Wrap files for transport Revoke: Close & cleanup Revoke: Stop enterprise sync completely Screen lock: Close content Screen unlock: Reopen content Screen lock: Stop uploads Screen unlock: Resume uploads

Get. For. Current. View Identity Puts App. View (i. e. window) into enterprise mode Windows enforces clipboard & share policy

Local (productivity apps) Network capable (channel apps) Data Ingress Check for enterprise tag on data Check if host belongs to the enterprise AND Unwrap files (if necessary) Data In Use Set mode: Enterprise / Personal Data Egress Event handling Turn VPN On / Off Protect enterprise data Block sending to non-enterprise hosts OR Wrap files for transport Revoke: Close & cleanup Revoke: Stop enterprise sync completely Screen lock: Close content Screen unlock: Reopen content Screen lock: Stop uploads Screen unlock: Resume uploads

Create. Current. Thread. Network. Context Marks thread for enterprise network access Sockets created on the thread get VPN

Local (productivity apps) Network capable (channel apps) Data Ingress Check for enterprise tag on data Check if host belongs to the enterprise AND Unwrap files (if necessary) Data In Use Set mode: Enterprise / Personal Data Egress Event handling Turn VPN On / Off Protect enterprise data Block sending to non-enterprise hosts OR Wrap files for transport Revoke: Close & cleanup Revoke: Stop enterprise sync completely Screen lock: Close content Screen unlock: Reopen content Screen lock: Stop uploads Screen unlock: Resume uploads

Protect. Async Takes IStorage. Item and enterprise ID string Encrypts file with key tagged to enterprise ID

Protect. Async Takes IBuffer and enterprise ID string Returns new IBuffer encrypted to enterprise

File. Save. Picker Enterprise. Id Takes enterprise identity string Sets encryption dropdown to match (if managed)

Local (productivity apps) Network capable (channel apps) Data Ingress Check for enterprise tag on data Check if host belongs to the enterprise AND Unwrap files (if necessary) Data In Use Set mode: Enterprise / Personal Data Egress Event handling Turn VPN On / Off Protect enterprise data Block sending to non-enterprise hosts OR Wrap files for transport Revoke: Close & cleanup Revoke: Stop enterprise sync completely Screen lock: Close content Screen unlock: Reopen content Screen lock: Stop uploads Screen unlock: Resume uploads

Protected. Content. Revoked Register your event handler for revoke

Protected. Access. Suspending Protected. Access. Resumed Register event handlers for both events Tip: Can’t read enterprise under lock, but Can create new files, buffers, streams Tip: Close as much enterprise data as possible

See session 709 “Single Sign-On with Secure Authentication” by Karanbir Singh

Guidelines for roaming app data Quickstart: Roaming app data How to roam data between a Windows Store app and a Windows Phone Store app Blog: Roaming your app data Application. Data. Roaming. Folder | roaming. Folder property Application. Data. Roaming. Settings | roaming. Settings property Application. Data. Signal. Data. Changed | signal. Data. Changed method

http: //aka. ms/kw 2 vwj Link Link Link