Downloaded 36 times
Uploaded byNathan Winters
Exch2010 compliance ngm f inal
The document discusses Exchange 2010's Information Protection and Compliance (IPC) features, emphasizing the importance of managing confidential information to avoid legal and financial repercussions. It outlines technical tools such as archiving, retention policies, and Rights Management Services (RMS) for safeguarding sensitive information while ensuring regulatory compliance. Solutions like the multi-mailbox search and personal archive are highlighted as effective strategies for managing email content and reducing data security risks.
More Related Content
Similar to Exch2010 compliance ngm f inal
More from Nathan Winters
![Governance, Deployment & Methodologies for Agentic Automation [2/3]](https://cdn.slidesharecdn.com/ss_thumbnails/agenticcommunityseries-day2-251112135038-a386476d-thumbnail.jpg?width=640&height=640&fit=bounds)
Exch2010 compliance ngm f inal
- 1. Exchange 2010 Protectionand ComplianceNathan Winters – Exchange MVP
- 2. Exchange 2010 IPCIntroductionto Information Protection and Compliance (IPC)The arsenal of Technical Tools!ArchivingMulti-Mailbox SearchLegal HoldIRMModerationEnhanced Transport Rule CapabilitiesMailTips
- 3. Why is IPCimportant?Large UK Retailer Leaks Payment Information via EmailThe Information Commissioner’s Office will be able to issue fines of up to £500,000 for serious data security breaches.Nearly 40% of workers have received confidential information that was not meant for them!Appeal Win Lets FSA Grab Evidence for SEC
- 4. Some of thelegal factorsPublic Sector - Freedom of InformationAll - Data protection actFinance – Financial Services Authority, SEC, BASEL2RIPA - Regulation of Investigatory Powers Act 2000Human Rights - Lawful business protection Electronic Communications Act – Adding DisclaimersUS – SOX, HIPAA etc
- 5. What does IPCmean to you?It’s a policy build around the relevant laws for your industry.Based on a bunch of technical tools which we try to automateMonitor email – content, recipients where is it goingKnow what is happening based on email attributesRetain and ProvideArchiving, Retention and DiscoveryControl and Protection – allow or preventGranular policiesSoft to Hard control
- 6. Protection & Control:Soft to HardEnsure that you target the correct data with the correct policy to maximise usabilityRetain and Provide mail where required with Archiving, Retention and Discovery
- 7. Exchange 2010 Archiving,Retention & DiscoveryBetter mailbox management
- 8. Why Archive? AVicious Cycle of Volume vs. ControlPSTs difficult to discovery centrally
- 9. Regulatory retention schedulescontribute to further volume/ storage issues Increasing storage and back-up costs Users forcedto manage quotaQuota management often results in growing PSTs (Outlook auto-archive)
- 10. Breaking the CycleWithlarge mailbox architecture and archivingLarge Mailbox Architecture maintains performance
- 11. provides optionfor DAS-SATA storage to reduce costs Archivingsimplifies discovery, retention and legal hold Archivingenables simple migration of PSTS back to server
- 12. Personal ArchiveOverview –What is it and where does it live?User goals and assumptionsSimple to use – OWA & OutlookIT Pro goals and assumptionsGet rid of PSTs!Easy to enable.
- 13. Personal ArchiveUser experienceUsercan view, read, navigate, flag and reply to archived mail same as live mail Folder hierarchy from primary mailbox maintained Reply to message in archive puts message in live mail sent items (same as PSTs) User gets conversation view scoped to Archive (same as PSTs)
- 14. Personal Archive SearchOptionto search archive only or both live and archived mail Advanced search options work across live and archived mail12
- 15. Message RetentionMove Policy:automatically moves messages to the archiveOptions: 6 months, 1 year, 2 years (default), 5 years, NeverUser Impact: Helps keep mailbox under quotaWorks like Outlook Auto-Archive – without PSTs!Delete Policy: automatically deletes messagesUser Impact: removes unwanted itemsHelps keep mailbox under quotaDelete policies are Global (they travel to the Archive)Per-item policies take priority over per-item policies
- 16. Retention PolicesAt thefolder or item levelPolicies can be applied directly within an email Policies can be applied to all email within a folderDelete policies Archive policies Expiration date stamped directly on e-mail
- 17. Legal HoldHold Policycaptures all edits/deletes irrespective of user or admin access.User workflow is unchanged, items captured in hidden folders in Dumpster 2.0. Multi-mailbox search can retrieve items indexed in Dumpster 2.0. ISSUE – Consider that the whole mailbox is put on hold, not just the granular info that you need on hold!
- 18. Hold PolicyIW istold how to comply (no action needed for e-mail)URL links to additional info
- 19. Multi-Mailbox Search Simple,role based GUIDelegate access to search to HR, compliance, legal manager Search all mail items (email, IM, contacts, calendar) across primary mailbox, archivesFiltering includes: sender, receiver, expiry policy, message size, sent/receive date, cc/bcc, regular expressions, IRM protected items
- 20. Multi-MailboxSearchAdditional e-discovery featuresSearchspecific mailboxes or DLSExport search results to a mailbox or SMTP addressSearch results organized per original hierarchy Request email alert when search is complete API enables 3rd tool integration with query results for processing
- 21. Exchange 2010 Protectionand Control
- 22. Information LeakageCan becostly on multiple frontsLegal, Regulatory and Financial impactsNon-compliance with regulations or loss of data can lead to significant legal fees, fines, and moreDamage to public image and credibility with customersFinancial impact on companyLoss of Competitive AdvantageDisclosure of strategic plansLoss of research, analytical data, and other intellectual capital
- 23. Message Confidentiality?Enforcement toolsare required—content protection should be automated.
- 24. Automatic Content-Based PrivacyExchangeServer 2010 provides a single point in the organization to control the protection of e-mail messages.Automatic Content-based Privacy:Transport Rule action to apply RMS template to e-mail message
- 25. Transport Rulessupport Regex scanning of attachments in Exchange 2010 (including content)
- 26. Internet Confidentialand Do Not Forward Policies available out of box22
- 27. What is RightsManagement Services?Windows Platform Information Protection TechnologyBetter safeguard sensitive information Protect against unauthorized viewing, editing, copying, printing, or forwarding of informationLimit file access to only authorized usersAudit trail tracks usage of protected files Persistent protection Protects your sensitive information no matter where it goesUses technology to enforce organizational policies Authors define how recipients can use their information
- 28. Protection via TransportRulesNew Transport rule action to “RMS protect”Transport Rules support regular expression scanning of attachments in Exchange Server 2010“Do Not Forward” policy available out of the box Office 2003, Office 2007, Office 2010, and XPS documents are supported for attachment protectionAbility to route email for Moderation
- 29.
- 30. Rights Management ServicesIntegration in Outlook Web Access
- 31. Protected Content inOutlookRMS Protection is applied both to the message itself and to the attachments.Saved attachments retain the relevant protection (e.g. rights to view, print or copy content).
- 32. Rights Management ServicesIntegration in Unified MessagingUnified Messaging administrators can allow incoming voice mail messages to be marked as “private”Private voice mail can be protected using “Do Not Forward”, preventing forwarding or copying contentPrivate voice mail is supported in Outlook 2010 and Outlook Web Application (OWA)
- 33. Rights Management ServicesIntegration in Unified Messaging
- 34. Business to BusinessRMSSecurely Communicate with PartnersToday customers can communicate using RMS between organizations by deploying ADFS and setting up trustsADFS requires a separate trust between each partnerADFS isn’t supported by ExchangeIn Exchange Server 2010, customers can federate with the Microsoft Federation Gateway instead of each partnerA single federation point replaces individual trustsAllows Exchange to act on-behalf-of users for decryptionSenders can control how their data is accessed by 3rd partiesBy using federation, RMS can allow organizations and applications to access data on-behalf-of individualsSpecifically they can specify whether recipient organizations can archive e-mails in the clearRMS administrator can control which 3rd parties can access data using federated authentication (allow/block list)
- 35. Outlook Protection RulesAllowsan Exchange administrator to define client-side rules that will protect sensitive content in Outlook automaticallyRules can be mandatory or optional depending on requirementsRules look at the following predicates:Sender’s department (HR, R&D, etc.)Recipient’s identity (specific user or distribution list)Recipient’s scope (all within the organization, outside, etc.)Rules are automatically retrieved from Exchange using Autodiscover and Exchange Web Services
- 36. Outlook Protection RulesStep1: User creates a new message in Outlook 2010.Step 2: User adds a distribution list to the To line.Step 3: Outlook detects a sensitive distribution list (DL) and automatically protects as MS Confidential.Company Confidential - This content is confidential and proprietary information intended for company employees only and provides the following user rights: View, Reply, Reply All, Save, Edit, Print and Forward. Permission granted by: [email protected]
- 37. Manage Inbox OverloadHelpReduce Unnecessary and Undeliverable E-Mail Through New Sender MailTipsRemove Extra Steps and E-MailLimit Accidental E-MailReduce Non-Delivery Reports33
- 38. Key takeawaysPersonal Archivegives seamless user experience and removes need for PSTsDeep support for IRMAutomation enables ease of use and administrationWide range of granular controls from Soft to Hard
Editor's Notes
- #4 Data losseshttp://news.bbc.co.uk/1/hi/technology/8455123.stmThe new rule is expected to come into force in the UK on 6 April 2010. It has been approved by Jack Straw MP, Secretary of State for Justice. The size of the fine will be determined after an investigation to assess the gravity of the breach. Other factors will include the size and finances of the organisation at fault. Large UK Retailer Leaks Payment Information via EmailPlain text credit card data embedded in order confirmation messageshttp://news.softpedia.com/news/Large-UK-Retailer-Leaks-Payment-Information-via-Email-136724.shtmlSurf Control Surveyhttp://news.bbc.co.uk/1/hi/technology/3809025.stmNearly 40% of workers have received confidential information that was not meant for them according to a poll conducted by e-mail filtering firm SurfControl. Another 15% admit sending confidential information by mistake and 17% of those are unable to retrieve the data. Appeal Win Lets FSA Grab Evidence for SEC http://www.complianceweek.com/blog/glimpses/2010/03/05/appeal-win-lets-fsa-grab-evidence-for-sec/Britain’s Financial Services Authority says it is committed to helping the Securities and Exchange Commission with overseas investigations, after winning an appellate court battle that aimed to block its efforts to obtain confidential evidence for its U.S. friends.
- #5 Data ProtectionThree stage test1. Check relevant business purpose and laws (HR, Finance) for legal retention period2. Business purposes not covered by law – how long do you need it for operations3. Secondary purposes – to defend legal rights in court – only keeping on a risk basis – must assess risk on a per issue basis – keep this type of dataHR pensionable + 10 yearsFinance - 6 years + 1 to get rid of dataHuman Rights - Lawful business protection Must have policy about monitoring, get sign off – only look at email that’s relevantHealth Insurance Portability and Acountability Act
- #11 A secondary mailbox that is configured by the administrator Appears alongside a user’s primary mailbox in Outlook or Outlook Web Access. PSTs can be dragged and dropped to the Personal ArchiveMail in primary mailbox can be moved automatically using Retention Policies Archive quota can be set separately from primary mailboxPreserve or improve PST experience for the userPreserve or improve workflow for the user irrespective of regulatory or storage constraintsUsers will only have one Archive in E2010Archive is online onlyMail folders automatically moved to archive by defaultDelete policies are global (they travel with messages as they move to Archive)Explicitly-set policies evaluated on most-specific wins basisPreserve mailbox management experience across primary and archive for the IT ProArchive is associated with a primary mailboxArchive and primary share the same user accountIT-Pro can provision only one archive per user Outlook and OWA should work against the archive exactly the same as the primary
- #14 Slide Objective: Instructor Notes: We need an automated way to move data from primary to archive and make auto archive better.Let’s talk about records management first. In Exchange Server 2007, we essentially had two policies—the move policy and delete policy. Move Policy simply defines where items will live after a set amount of time. The delete policy defines how long your message will live wherever it is. Exchange Server 2010 will ship with a default set of move policies that define when data will be moved from primary to online archive: 6 months, 1 year, 2 years, or 5 years. Additionally in Exchange Server 2010, you can choose to apply this policy either at the folder level or at an individual message level.
- #17 Slide Objective: Instructor Notes: When reasonable expectation of litigation exists, organizations are required to preserve e-mail relevant to the case as part of discovery. This expectation can occur well before one knows the specifics of the case and preservation is often broad. Frequently, organizations will preserve all e-mail relating to a specific topic (or all e-mail, period) for certain individuals. In some cases, end users are instructed to carry out the preservation themselves by not deleting certain e-mail. This can lead to insufficient preservation. In other instances, e-mail is copied or moved to an archive. This can increase costs by requiring manual effort to copy items and/or third party products to collect and store e-mail.Exchange Server 2007 scenario: Retention Hold executed through Powershell, placing workload on IT rather than legal team. It stops automatic deletion but does not stop the user from moving or deleting items. Also, users must be informed of Hold manually, through email. This places the burden on the end user to remember what to do and can lead to insufficient preservation if the user forgets. The search capabilities are limited and the process is slow because export-mailbox copies the entire mailbox (regular mail and dumpster) to the destination and then searches it. There’s no way to search the dumpster directly.Exchange Server 2010 scenario: Retention Hold can now be carried out on a per mailbox basis though Exchange Control Panel (ECP) and delegated to non-IT staff using Role-Based Access Control (RBAC). For Exchange Server 2010, as in Exchange Server 2007, Powershell is the mechanism for handling these operations in bulk. This feature makes a copy of both deleted and edited items. It also enables setting of Outlook litigation hold comment for each mailbox to inform the user of the hold. The user continues to read e-mail and soft-delete it when it is no longer needed. Each time an item is soft-deleted or modified (certain message properties only, detail below), a copy is placed in the dumpster. Since the user hardly ever goes to the dumpster, he does not realize that items are no longer purged from it or that he can no longer manually empty it. When the two litigating organizations have agreed on what must be produced, the legal team performs a discovery search that includes the dumpster. If the mailbox is moved, items that are on hold are moved with it (today, dumpster data is lost during move mailbox). So if you have content in the primary mailbox and you have legal retention hold enabled, that content will go into the recoverable items folder. In Exchange Server 2010, we have a recoverable items folder that replaces the dumpster and is available in both locations (architecturally, before dumpster was this query that showed a view of deleted data, but it had a lot of problems in that it wasn’t index-able, it wasn’t portable (move mailbox). And so you can imagine a scenario where you don’t have archive and turn on legal hold – so content will go into your recoverable items folder. If you do have an archive and enable legal hold, then content will go into recoverable items folder of the archive. And so essentially that makes your archive the repository.
- #21 Most Data leaks are not maliciousMailTipsReply to AllSend to the wrong person same name (int and ext)There are both horizontal examples (executive or sensitive e-mails, board communications, financial data, proprietary operations information, sales data such as price lists, and HRand legal information in addition to corporate governance that goes across many organizations, such as Sarbanes Oxley in the U.S.) as well as examples across multiple verticals….Information ProtectionFinancial Services: In the case of Mergers & Acquisitions, banks have to ensure that the internal M&A deal teams have to keep their workpapers and related information separate & distinct from each other. These ethical boundaries are required because the deal teams are selected with people who have no conflicts of interest in the deal that they are working on to ensure fair treatment of the deal. However, there is no easy way to enforce these walls from a technology perspective. If the information is leaked at the wrong time, there is tremendous financial impact to how the deals get priced. For e.g., typically the markets lower the price of the acquirer but run up the price of the acquire. This can cause a loss of leverage in the deal.Clinical Trials: The drug business is a very complicated process. Pharmaceutical firms spend 100s of millions and decades developing a drug. This is their lifeblood. They cannot have their drug formulae and testing information leak and result in loss of their competitive advantage as well as take a financial beating in the markets. And additional challenge in the healthcare business is privacy. Regulations like HIPAA mandate that information shared between the pharma and the doctors during clinical trials be protected to ensure privacy of the patients in the trials. Penalty for violation include both financial and legal penalties. Thus, these firms need to manage risk but also collaborate freely. There is a need for secure collaboration in this industryManufacturing/High Tech: Collaborative product designGovernment: RFP Process – governments put a lot of their work out to bid via RFPs. The process is sensitive and requires that bids received be protected carefully and not shared with other participants either overtly or by accident. They require solutions to support these ethical boundaries.Regulatory ComplianceGLB: The Gramm-Leach-Bliley Act Safeguards Rule requires companies to prevent unauthorized access of personal information. The California Security Breach Information Act (SB 1386) states that companies must alert customers whenever “unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person.” NASD 2711: Best practices and regulations such as NASD 2711 stipulate that investment banking be run separately from research and trading to ensure trust in the public markets. New technologies that improve communications, such as email, can serve as a conduit of improper communication. This is often referred to as the “Chinese or Ethical Wall” scenarioHIPAA: requires companies to prevent unauthorized access of personal health information (PHI). For example, it is important that information shared between pharmaceutical companies and contract research organizations remain secure. Employers need to ensure that all PHI data exchanged between plan members and plan providers remains secure and confidential.Sarbanes Oxley: The Sarbanes-Oxley Act makes corporate executives explicitly responsible for establishing, evaluating and monitoring the effectiveness of internal controls over financial reporting. Spreadsheets are the most broadly used financial application, however password protection and file-level access controls do not satisfy these requirements. The act requires user authorization, protection of sensitive information from unauthorized access or modification during transmission or storage, and monitoring of user actions.
- #22 Slide Objective: You need tools to enforce Confidentiality where it is required.Instructor Notes:Many of you may receive e-mails similar to this one in which the author is essentially begging and pleading with the recipient to “do the right thing” with the information—and prior to RMS we saw a lot of these inside Microsoft as well. In this case, while the organization may have a “policy” for what should and should not be done with the information, there are no mechanisms in place to digitally enforce that policy. You cannot rely on the fact that all end-user will apply confidentiality measures where required, even with training.
- #23 Today an employee may accidentally include sensitive information that belongs to a consumer in an e-mail which is sent in cleartext over the internet. If that data is accidentally emailed the organization may face considerable reputation damage, legal exposure and reduction in company’s market value. To address this the Exchange Server can be configured to encrypt messages that contain personal information or critical business information.Sensitive e-mail can be detected using Transport Rules, by filtering the content of a message (including content of supported attachments). Regular expressions are supported.Internet Confidential and Do Not Forward policies are available out of the box. An RMS infrastructure is required.For example:Ed is a nurse at Northwind Traders, a large hospital. Ed is sending Chris the results of his recent blood test.When Ed’s email reaches the Exchange Server, the server is able to examine the message and determine that personal information is included in the mail.Because personal information is included in the message, the Exchange Server encrypts the message before it leaves the organization.The message that gets to Chris is an encrypted copy of the message.Protect message in transit via Transport Rules actionProtect messages by default at Outlook ClientPrivate Voice message automatically protected by Unified Messaging (UM)
- #24 Exchange Server 2010 Supported on Windows Server® 2008 Planned support for Windows Server 2008 R2RMS integration features require:RMS on Windows Server 2008 SP2or Windows Server 2008 R2Information rights Management addresses the following essential elements:• Trusted entities: individuals, groups of users, computers, and applications that are trusted participants in an Active Directory RMS system. Helps protect information by enabling access only to properly trusted participants. • Usage rights and conditions: Assign usage rights and conditions define how specific trusted entity can use content. Examples of usage rights are permission to read, copy, print, save, forward, and edit. Usage rights can be accompanied by conditions, such as when those rights expire.• Encryption: Active Directory RMS encrypts information. Only trusted entities that were granted usage rights can unlock or decrypt the information in an Active Directory RMS-enabled application or browser. Some Benefits of RMS:No need to manage a Public Key Infrastructure (PKI):RMS is easier to manage and deployNo requirements for X.509 CertificatesProtection travels with content, even outside of the mailbox Offers persistent protection even outside of the mailbox Users cannot change policy by mistake.Policies are defined centrally by an administrator.
- #25 Slide Objective: Introduce Transport Rule protection.Instructor Notes: Through Transport Rules we can scan messages in transit and classify as confidential. RMS protection is just another action within Transport rules. It can be combined with any other Transport Rules predicates and actions. It lets you choose which RMS template to use. RMS template can be either an official Rights Policy template created using the Active Directory Rights Management Administrative Console. Or, it can be the built-in policy available out of the box, Do Not Forward. Do Not Forward provides recipients with REPLY, REPLYALL, VIEWRIGHTSDATA, DOCEDIT, VIEW and EDIT rights. RMS protection is applied to supported attachments along with the message (a single Publishing License is created for all). We adopted SharePoint’s RMS protector implementation for Office 2003, Office 2007, Office 14 and XPS documents. There is currently no support for 3rd party protectors (for other file formats such as PDF or EML) If the message cannot be protected due to errors, we non-delivery report (NDR) the message back to the sender.
- #26 Protection a message with RMS is done through a Transport Rule action, working just like any other Transport Rule action. Multiple actions can be selected.Transport Rules Agent stamps an X-Org (X-MS-Exchange-Organization-RightsProtectMessage) header to the message. The header value is set to the RMS template globally unique identifier (GUID). Message does not get encrypted until it’s processed by the Encryption Agent later on onRouted.New Transport rule action to “RMS protect”Transport Rules support regular expression scanning of attachments in Exchange Server 2010 (Beta)“Internet Confidential” and “Do Not Forward” policies are available out of the box Office 2003, Office 2007, Office 14, and XPS documents are supported for attachment protection
- #27 In this example, we see an example of a user applying RMS protection when composing a new e-mail.Notice the “Permissions” button (the envelope with a red sign) in the Outlook Web Access interface.Create/Consume RMS protected messages natively, just like OutlookNo client download or installation requiredSupports:Firefox, Safari, Macintosh and WindowsConversation View, Preview paneFull-text search on RMS protected messages
- #28 Slide Objective: Example of RMS protection in Outlook.Instructor Notes:We see how an RMS protected message looks like to the end-user using Outlook 2007, as already supported using Exchange Server 2007.In this example, the user has received an confidential e-mail that cannot be forward to other recipients. The user may nevertheless reply to the sender.Notice the “Do Not Forward” banner in the message, that informs the user about the rights he has been granted on the content.The message, as well as RMS compatible attachments, will be protected.
- #29 Slide Objective: Introduce RMS protection with the Exchange Server 2010 Unified Messaging role.Instructor Notes:Using Exchange Server 2010 Unified Messaging, users can mark Voice Mail as “Private” when leaving a message. This option is available through a prompt over the phone.Unified Messaging policies can be created to automatically RMS protection to: All Voice mail, Private Voice Mail only, None.The RMS template that will be applied is “Do Not Forward”. This is not configurable.Using this feature, you can give the assurance to people leaving Voice Mail that the audio content cannot be forwarded to third parties, and will only be accessible to the intended recipient.
- #30 In this example, you can see a Voice Mail that has been received by an individual, which has been automatically protected by the Unified Messaging server.The message cannot be forwarded by the recipient.Unified Messaging administrators can allow incoming voice mail messages to be marked as “private”Private voice mail can be protected using “Do Not Forward”, preventing forwarding or copying contentPrivate voice mail is supported in Outlook 14 and Outlook Web Access (OWA)
- #31 Slide Objective: Introduce Business-to-Business RMS.Instructor Notes:Today, setting up RMS between two organizations is an involved process. To enable secure messaging using RMS between two separate organizations, both must deploy Active Directory Federation Services (ADFS) and create special trusts between the two organizations. This is an individual process for each partnership and it isn’t supported by Exchange for any of the features discussed today.In Exchange Server 2010, customers can create a single federation using the Microsoft Federation Gateway. This gateway is used by other services, such as the Microsoft Services Connector, as a trust broker between organizations. Exchange includes a built-in wizard to enable federation with the Federation Gateway. Once this wizard is run, Exchange can begin requesting delegation tokens for users within their organization. These tokens, which are SAML based, allow Exchange to give them to partners to authenticate on-behalf-of the users within the enterprise. The next slides show how Exchange uses these to license content on-behalf-of users for OWA.Slide Objective: Provide additional information of supported features for Business to Business scenarios.Instructor Notes:Now that we’ve seen how federation can allow Exchange to access content on-behalf-of a user, it is important to understand what controls we provide to ensure that remote organizations aren’t misusing your sensitive content. For example, as the content owner, Northwind Traders may not want Fabrikam archiving the protected mail in the clear using journal decryption. To mitigate this concern, Northwind Traders can specify on a per-template basis whether 3rd parties can archive that mail content in the clear. This means you can specify that all “Northwind Traders Confidential” data must always be stored in a protected format and cannot be decrypted and stored in a separate archive.Additionally, the web services in RMS that support SAML authentication can be disabled and/or block specific partners from using them. This limits the exposure an organization can have to 3rd parties that want to use federation for authentication purposes.Lastly, all of the RMS features we’ve talked about today work with SAML authentication, meaning they will work if the messages are protected against your internal RMS server or a 3rd party RMS server.
- #32 Slide Objective: Introduce Outlook Protection rulesInstructor Notes:We’ve seen how a message can automatically be protected at the Transport Rule level. Alternatively, it is possible to have RMS encryption be automatically applied from the Outlook client. The Administrator can define a client-side rule that will be imported by the Outlook client via Autodiscover (i.e. every 24 hours).Filtering can be done on Sender’s department, Recipient’s identity or scope. Rules are defined using PowerShell.Using this method, you can ensure that RMS protection is already applied when the message is reaching the Exchange infrastructure. This supports scenarios where an organization does not necessarily “trust” the Exchange organization, for example when the Exchange infrastructure is hosted/managed by a 3rd party.Outlook 14 is required for this feature.
- #33 Slide Objective: Example of Outlook Protection RulesInstructor Notes:Here is an example, where a user sends an e-mail that will trigger a Outlook Protection rule.Step 1: theStep 2: the user adds a distribution list to the To line.- Nothing happens at this stage user creates a new messStep 3: the user clicks outside of the “To:” line, and Outlook will then evaluate the client-side rules.As it turns out in this example, there is an Outlook Protection Rule that has been configured to apply a “Microsoft Confidential” RMS template to this message. A banner is therefore displayed in the Outlook client, warning the user that RMS protection is going to be automatically applied.age in Outlook 14.
- #34 Situation:People send embarrassing e-mails (or worse) to the wrong recipients (think MS email of reporters dossier to that reporter, RNC lobbying efforts though White House accounts, or pharmaceutical email sent out with all recipients names visible); MailTips is designed to make sure your communications are right the first time and to avoid such embarrassing mistakes.Talking Points:Know someone is OOF before you send a message (look at the oof and send to the right person from the start)Be alerted to important issues like external recipients or large lists of people this will be sent toKnow things like booking a room too small for the number of people you’re invitingKnow internal rules that will block your message from being sent before you send it (too many attachments, too big of an attachment, recipient can’t receive the message, and other custom rules defined by the system administrator)Slide Objective:The audience should walk away from this slide seeing that Exchange helps users send more effective messages the first time. It helps them schedule the right size rooms, not send messages to which they will get an OOF response and avoid sending mail to external recipients or large lists of people that might create an embarrassing mistake.
- #35 Key takeawaysThe integrated e-mail archiving, retention, and discovery capabilities being delivered in Exchange 2010 offer a seamless user experience, leverage existing Exchange infrastructure investments and administrative skills, and helps reduced the need to implement potentially complex and expensive third-party archiving products The personal archive can help centralize PSTs for more efficient discovery while offering a fully integrated user experience directly from a user’s primary mailboxNew retention policies enable users to apply pre-defined policies to both items and folders and work across both the primary mailbox and personal archive Multi-mailbox search and legal hold functions can be delegated to non-IT staff such as compliance officers New actions such as moderation, dynamic signatures and MailTips and automated IRM protection provide a wider range of data control, enabling administrators to better match the right level of control to a scenarioUsing the enhanced transport rule functionality in Exchange 2010, administrators can now effectively identify sensitive content both within an e-mail and any Office file attachments Exchange 2010 features deeper support for Information Rights Management, including the ability to: apply IRM with transport rules, decrypt IRM-protected messages for journaling, filtering, search and transport rule application, read and reply to IRM-protected mail in OWA