Many companies are allowing their staff to work from home indefinitely raising
questions about how they can protect their company data on personal or
uncontrolled devices. So what can we do to protect company data on personal or
uncontrolled devices? Well, because we can lose company data in a variety of ways
there's actually a variety of different protection measures that we can put in
place, and let's take a look at the features in Microsoft 365 that can help
companies protect their data while users are working remotely. Starting with
Mobile Application Management. Despite the name Mobile Application Management
doesn't just apply to mobile devices, it can also be applied to Windows 10
devices. And mobile application management policies can protect company
data on both company-owned and user-owned devices.
And essentially it works by applying protections to the apps that your teams
use to access company data like Outlook Teams, OneDrive and SharePoint. And you
can enforce restrictions on these apps to prevent data from being saved, cut,
copied or pasted. You can also require a pin for your company apps or prevent the
app from running on a jailbroken phone or tablet. And the really cool thing
about Mobile Application Management is that you can actually selectively wipe
your company data from users personal devices. And prior to this what some
administrators would do, is they would use the Exchange ActiveSync device wipe feature
so when someone would leave the company they would wipe the person's entire
phone and that made a lot of people very mad, so being able to selectively wipe
company data is a really big plus. Especially when people are bringing
their personal devices in to access company data. Another method to prevent
company data from being lost or shared indiscriminately on an unmanaged device
is to use Conditional Access policies. These policies can enforce restrictions
on non-compliant or unmanaged devices. Such as blocking the device entirely or
preventing particular actions like stopping users from saving attachments
in Outlook on the web or syncing files to OneDrive. We can apply these
protections in other ways in OneDrive and SharePoint to prevent users from
accessing OneDrive or SharePoint via the apps or syncing it down, and limiting
them to a web-only experience. And these protections don't just apply to
Microsoft 365 apps like OneDrive SharePoint and Outlook we can use
Microsoft Cloud App Security to apply additional protections to apps like
Dropbox Business for example. Applying a protection to a third party app like
Dropbox Business can prevent users from saving Dropbox files to unmanaged
devices. Having said that, apps like Dropbox Business also have their own
security measures in place allowing you to unlink devices and having certain
devices be wiped of company data the next time that they come online. To
lessen the likelihood of the wrong people accessing your company data on a
shared device, we can configure idle session timeouts. And essentially what
these do is just sign you out after a period of inactivity just like your
bank does. Cloud app security also includes built-in alerts that trigger on
potentially suspicious activities we can use these to get notified about things
like mass deletions, mass downloads or unusual volumes of external sharing. Now
it's not just about ensuring that we're securing and controlling the
applications that access our data but we should also be applying protections to
the data itself. We can use data loss prevention to restrict or impose
conditions on the sharing of sensitive information. These data loss prevention
policies can trigger on certain keywords like project names or sensitive
information types like credit card numbers, driver's license details or tax
file information. Once a file containing this information is detected it can
either display a warning, it can be blocked from being shared or it can have
encryption applied. And again using cloud app security we can also apply
additional data loss prevention measures to third-party apps like Box and Dropbox
Business. But what happens if all of this fails and someone downloads our
sensitive company data to a personal or unmanaged device and we don't have any
control over how they share it or who they send it to? To protect against this
we can apply sensitivity labels and these labels define how sensitive a
particular piece of content is and in turn can enforce protections on our data.
And what's more these protections apply no matter where that file
ends up. These baked-in protections can limit who can access the file and what
they can do with it. Preventing the wrong people from saving, copying, forwarding,
printing or sending these documents or emails. And in many cases these
protections can be applied automatically by scanning for those same keywords and
sensitive information types that we were looking at in data loss
prevention. As you can probably tell by now there's a lot you can do to protect
your company data while people are working from home and if you need help
with any of this, whether you're managing company-owned devices or personal
devices or a mix of both, we'd be happy to assist. You can have a chat with us
today at GCITS.com