{"id":89574,"date":"2019-06-25T09:20:29","date_gmt":"2019-06-25T16:20:29","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=89574"},"modified":"2023-05-15T22:57:21","modified_gmt":"2023-05-16T05:57:21","slug":"3-strategies-building-information-protection-program","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/06\/25\/3-strategies-building-information-protection-program\/","title":{"rendered":"3 strategies for building an information protection program"},"content":{"rendered":"
Five years ago, we started on a journey to update and simplify information protection at Microsoft. We had a manual data classification process that our users didn\u2019t use effectively and didn\u2019t work with our data storage or database technology. We had to find ways to re-classify data and build effective tools while protecting our most important asset, customer, and employee information.<\/p>\n
We\u2019ve learned a lot about data protection and tools and today we\u2019re sharing some of our best practices for:<\/p>\n
Identifying the location of data<\/strong>\u2014The first step to creating a strategy is discovering where your data and major storage places are so you can create a data landscape. Do you have data on your endpoints? Start by looking across your organization to identify your customer data, regulatory data, and other sensitive information.<\/p>\n Classifying the data<\/strong>\u2014Classifying data is the most important and most difficult step. At Microsoft, we used a custom three-level manual label classification process but found that no one understood how to apply them correctly. We worked with legal, HR, and other groups to identify labels that made sense for our company with a goal that they could be applied automatically.<\/p>\n Our objective is to ensure that our data and our customer data is handled properly, classified correctly, and is protected. We\u2019re a global company and the General Data Protection Regulation (GDPR)<\/a> is the baseline\u2014and one of our key tenets\u2014for how we think about our information and how we protect it. We replaced the manual classification labels with a more intuitive labeling taxonomy that better aligns with industry standards:<\/p>\n Identifying and resolving old data<\/strong>\u2014Before you roll out new tools, there may be old data that you need to review and resolve. For example, you may need to clean up, delete, or protect your data. When reviewing data, consider the age of the data and if anyone is still using a document. Prioritize and create rules for saving, deleting, and protecting data.<\/p>\n Protecting the data<\/strong>\u2014You want to protect the data based on classification. Protecting customer and personal information is at the core of what we\u2019re trying to protect at Microsoft. For smaller companies\u2014or companies just starting to develop an information protection program\u2014your biggest return will be finding customer data so you can protect it. Building customer trust and protecting customer information is key to an information protection program.<\/p>\n Protecting our identities is an extremely important part of the information protection journey. But what if you come across a document with trade secret information? You should probably work with the group that handles trade secrets at your company. We have a white glove program with HR where we build specific programs for specific business units. Using products like Key Vault<\/a> can help protect sensitive data.<\/p>\n If you\u2019re just starting to build an information protection program, we recommend the following three-step process:<\/p>\n Building an information protection program is not one-size-fits-all, but if you choose classification terms, terms that are easy to understand and implement, proactively educate users, and bake information protection into existing processes to minimize impact, you can increase the success of the program.<\/p>\n\n
Protecting trade secrets<\/h3>\n
Starting your information protection journey<\/h3>\n
\n