Office 365: Why Security Matters
To date Microsoft Office hasn’t faced a serious contender. Cloud-based software such as Google Docs hasn’t posed much of a threat.
Now that Office 365 deployment is underway, we are seeing a shift from on-premise Microsoft Office to cloud-based Office 365. Because Office has been on premise for quite a stretch, its security requirements have been well understood. Shifting the dominant toolset used by most people at work into the cloud requires thinking about security for Office in a whole new way.
Here are some issues to consider.
MPLS Congestion. Increased traffic flow from each user through a non-optimized network (ie a network that is not DCN enabled) will create user experience issues – especially when competing with traffic from high bandwidth applications (such as media streaming sites like YouTube).
Firewall load. Each Office 365 session opens dozens of initial connections and then maintains several persistent SSL connections. This increases the load on egress points such as firewalls and local proxies.
Visibility. Like most cloud software, traffic between the user and the Office 365 data center is encrypted with SSL. That’s good—and bad. It’s hard to manage what you can’t see, and compliance issues like data loss prevention become important concerns.
Protection against advanced threats. Office 365 offers basic scanning to defend against known viruses and malware. That’s far from the whole story. The attacks that have compromised high-profile sites are advanced threats. Traditional scanning doesn’t work when threats are either net-new (zero day) or polymorphic (changing just enough to evade signatures).
Mobile security is a key concern and was easier to manage when much work still happened on laptops and desktops. Attempting to edit Office documents on an iPad was more trouble than it was worth, particularly when available apps corrupted Office file formats. As more organizations move to Office 365 with its strong mobile device support, more productive work will be done on mobile devices. This makes mobile security even more critical.
Policy application. With so much key corporate data being moved to Microsoft’s cloud, it’s more important than ever to apply IT policies consistently and proactively for all users across all locations and all devices. Such uniformity is critical for audit and compliance.
Zscaler’s cloud-based security addresses all these issues, allowing IT to consistently administer policies across users and devices. Users who attempt to email a restricted file are stopped in real-time, preventing data loss. Zscaler analyzes all web page elements and leverages a large number of data points across billions of transactions in the cloud to protect against advanced threats. Attacks on web-based Office 365 interfaces are prevented through this advanced security architecture.
Office 365 is going to make it easier than ever to work from wherever we are, and provided we address the security and network issues surrounding this shift to the cloud proactively, we can all get a lot more done.