Cloud Email Security: Call the Sheriff

This week, I had the opportunity to record an interview with Tom Shinder and Yuri Diogenes of Microsoft; the topic was security in cloud-based email systems, including Microsoft Office 365. It was an interesting interview; it hasn't been posted yet, but you should eventually be able to see it on From End to Edge and Beyond. There was one aspect of this topic that I wanted to go into in more detail.

Oftentimes, customers who are considering hosted services, or considering outsourcing their current services to on-site staff from another company, express concern that the hosting providers or outsourced employees will do something malicious. "How can I protect my business and data?" they ask.

The only answer to that question used to be the phrase made famous by long-time Exchange MVP Ed Crowley: "There are seldom technological solutions to behavioral problems." Given the new technical controls that Microsoft Exchange Server 2010 gives us, is that still true?

The answer is simple: It's more true than ever.

The advent of hosted email solutions means that the number of people who could potentially read or tamper with your mail is probably greater than it would be if you maintained an on-premises system. The good news is that Microsoft has taken a number of visible steps to reduce the security risks associated with hybrid or pure-hosted Exchange deployments:

In the end, though, the same two factors that protect your on-premises environment still reign supreme in the cloud world. The first factor is financial: Most rational people won't do anything that they know will cost them large sums of money. This rule is generally true of companies as well as individuals; Microsoft has a strong vested interest in maintaining the security of its customers' data because a serious breach would drive customers away en masse.

The second reason, of course, has to do with the sheriff, or whoever provides your local law enforcement. There's a small minority of administrators who might be tempted to misuse their access, but within that minority, the vast majority of would-be miscreants are well aware of the legal risks they'd face from stealing data, so they don't do it. For the rest, well, that's why you need good audit logs and forensic skills, so you can prove your case against them.

Privacy and cloud-based email, however, is a very different matter. I'll have more to say about that issue in a future UPDATE.