Who is responsible for Microsoft Office365 data security?
Data protection is critical, and businesses running Microsoft Office 365 are faced with some staggering challenges. IBM found that global data breaches cost businesses $3.92 million per incident, with a loss of more than 25,000 records. For U.S. businesses it’s even worse: Typical breaches run more than $8.19 million per incident.
It’s little wonder that so many execs are examining how their Microsoft products stack up against the trials of the digital age. Where does Microsoft’s responsibilities begin and end? Does Microsoft back up Office 365 data? With today’s tightening regulatory climate and the need to fend off cyberattacks, a business must prepare to guard one of its most ethereal and precious assets.
What Microsoft provides
Microsoft has created a powerful solution for enterprises that use Office 365. The company takes data protection seriously, but there are limits to what any manufacturer can actually do. For example, Microsoft takes ownership of the uptime of the Office 365 system. It also is responsible for its data centers’ redundancy and replication. In addition, Microsoft provides a (very limited) undelete functionality for files that have been moved to the user’s recycle bin.
Microsoft is responsible for the physical and logical security of the Office 365 data, and it provides application-level security and user access controls. However, considering that Office has more than 13 million daily active users (with the total number of users estimated at more than 130 million), it’s not possible for Microsoft to be responsible for all its clients’ files and libraries.
A business’s responsibility
The data a business owns is a valuable resource, and so every company should view security as a shared responsibility. For Microsoft users, this means they are directly responsible for their own user and administrative access to Office data. The IT department or manager should be cautious about distributing rights and allow access to data and apps only on an as-needed basis.
By being cautious about access, companies can stave off many problems with accidental access and data loss from employee mistakes. They can also reduce the chances of a disgruntled employee engaging in corporate sabotage or theft. Systems should be secure enough to protect against the accidental or intentional introduction of malware or ransomware.
Of course, forensic software, such as programs that detect deliberate tampering (anomaly detection programs) can help boost data security. Companies are responsible for maintaining a point-in-time backup of data, which, ideally, should be stored in a different location to prevent tampering or physical destruction.
