Microsoft Trusted Cloud Security, Privacy & Control, Compliance, Transparency

1. 11:26
Donnerstag, 21. April 2016
Microsoft Trusted Cloud
Security,Privacy&Control,Compliance, Transparency
DI. Harald Leitenmüller
Chief Technology Officer
Microsoft Österreich GmbH.
#ftAustria

2. Sind meine Daten sicher?
Gehören meine Daten mir?
Hab ich die Kontrolle?
Was bedeutet das Ende von
Safe Harbor?

3. “The court of justice declares that the
Commission’s US Safe Harbor Decision is invalid”
Press Release No 117/15
EU-US Privacy Shield

4. Private Cloud
Konsolidierte Daten
Operationen
MICROSOFT SOLUTIONS
Windows Server
System Center
Windows Azure Pack
Microsoft Cloud Portfolio - EUROPE
4
Konsistente Platformen und Anwendungen | Eine einzige Management Konsole
Public Cloud
“Europa”
Hohe Skalierung,
Flexibilität und
Kosteneffizienz
MICROSOFT SOLUTIONS
Microsoft Azure
Office 365
Dynamics CRM Online
Public Cloud
“Deutschland”
Hohe Skalierung,
Flexibilität und Deutsche
Datentreuhand
MICROSOFT SOLUTIONS
Microsoft Azure Deutschland
Office 365 Deutschland
Dynamics CRM Online Deutschland
Hybrid Cloud
Schritt in die Cloud
MICROSOFT SOLUTIONS
Risk Assessment and Data
Governance services

5. 5
Unsere “Trust Principles”
New: https://trustportal.office.com

6. Readable customer data
disclosed to a third party
Customer data disclosed
to a third party
Accidental data spillage
1
1.1.1
1.1
Customer data is
readable
1.2
AND
Data disclosure due to
law enforcement /
intelligence request
1.1.2
Deliberate compromise
leading to disclosure of
customer data
1.1.3
Cloud service provider
(CSP) infrastructure
compromised
1.1.3.1
Customer infrastructure
compromised
1.1.3.2
Compromise of systems
outside cloud provider
or customer control
1.1.3.3
Customer data
permanently lost
2
Disruption of cloud service
3
Threat Tree 1 : Overview
Threat Tree 3
Threat Tree 2
Threat Tree 4 Threat Tree 5
Threat Tree 6
Threat Tree 7
Root Risk
Event
Conditions
Technical
Controls
Process
Controls
Legend:
Consumer
Applied
Control

7. Customer data is
readable
1.2
Data is not encrypted
1.2.1
Encryption keys become
known
1.2.2
Data is weakly encrypted
1.2.3
Encryption keys lost by
the cloud provider
1.2.2.1
Encryption keys lost by
the customer
1.2.2.2
Customer infrastructure
compromised
1.2.2.2.1
Breakdown in key
management enabling
attacker access to keys
1.2.2.2.2
AND
Link: 1.1.3.2
Threat Tree 5
Cloud provider
infrastructure
compromised
1.2.2.1.1
Breakdown in key
management enabling
attacker access to keys
1.2.2.2.2
AND
Link: 1.1.3.1
Threat Tree 4
Protected Key
Storage
Key
Management
Practices
Protected Key
Storage
Key
Management
Practices
Encryption at
Rest
Data
Classification
Encryption in
Transit
Cryptographic
standards
Policy on Use of
Cryptographic
Controls
Threat Tree 1.2 : Customer Data is Readable
Local Data
Encryption
Root Risk
Event
Conditions
Technical
Controls
Process
Controls
Legend:
Consumer
Applied
Control

8. 8
Ihre Daten sind sicher Ihre Daten gehören Ihnen Sie haben die Kontrolle
 Encryption of all data at rest
 Encryption of all data in transit
 Enhanced event and admin /
service access logging
 Advanced security monitoring
and threat management
 Clear guidelines on data location
 Greater transparency and
simplicity of data use policies and
choices
 Data accessed only to improve
customer experience
 Law enforcement requests
redirected to the customer
 Notification of customers of
lawful requests for information;
challenging of gag orders
 Ability of customers to hold
encryption key and revoke
Microsoft copy
 Complete deletion of data on
customer request and on
contract termination
 Customer choice of data
location
 Customer option to limit
Microsoft access to data
Microsoft Trusted Cloud

9. Microsoft Cloud Verträge
MIOL
(Microsoft
Irland)
Kunde in
Österreich
Microsoft
Corporation
(USA)
European
Economic Area
(EEA)
EU Model Clauses*
Safe Harbor
Auftraggeber
Dienstleister
OST
(Online Services Terms)
EU-US Privacy Shield
Betroffene
* vorab genehmigungspflichtig
Article 29 WP Letter: http://ec.europa.eu/justice/data-protection/article-29/documentation/other-document/files/2014/20140402_microsoft.pdf

10. EMEA Data Maps
http://o365datacentermap.azurewebsites.net/

11. Standardvertragsklausel für Online Dienste

12. Gibt es auch andere legale Möglichkeiten
personenbezogene Daten in die USA zu senden?
Quelle: http://www.dsb.gv.at/site/6218/default.aspx

13. Compliance
sorgfältige
MicrosoftCustomer

14. Zertifizierung & EU Standardvertragsklauseln
Yes

15. ISO 27018
Standard für digital Privatsphäre in der Cloud
6 Prinzipien für Cloud Service Provide
1. Keine Datenverwendung ohne
Zustimmung
2. Transparenz: Speicherort, Nutzung
3. Kunde behält Kontrolle über
Datennutzung
4. Information über Rückgabe und
Datenlöschprinzipien von Kundendaten
5. Breach Notification von
personenbezogenen Daten
6. Unabhängiger Audit

16. Weiterführende Links
Brad Smiths Blog
The collapse of the US-EU Safe Harbor
http://blogs.microsoft.com/on-the-issues/2015/10/20/the-collapse-of-the-us-eu-safe-harbor-solving-the-new-
privacy-rubiks-cube
A message to our customers
http://blogs.microsoft.com/on-the-issues/2015/10/06/a-message-to-our-customers-about-eu-us-safe-harbor/
EU Article 29 WP Letter
http://ec.europa.eu/justice/data-protection/article-29/documentation/other-
document/files/2014/20140402_microsoft.pdf
Stellungnahme der öst. Datenschutzbehörde
http://www.dsb.gv.at/site/6218/default.aspx
Online Service Terms
http://www.microsoftvolumelicensing.com/DocumentSearch.aspx?Mode=3&DocumentTypeId=31
Microsoft Cloud in Deutschland
http://aka.ms/MSCloudDE
Trust-Portal: https://trustportal.office.com
Trust-Center: https://www.microsoft.com/en-us/TrustCenter/default.aspx
Microsoft Cloud Assurance: http://www.microsoftcloudassurance.com/
http://www.guara.org/

17. Ihre Daten sind sicher!
Ihre Daten gehören Ihnen!
Sie haben die Kontrolle!