Securosys 365 DKE

1.Preparation: 

• Minimum 50 users
• Microsoft 365 E5 & Microsoft 365 Office Apps for Enterprise (version 18.2008.12711.0 or later)
• From 1 to 10 sensitivity label names compliant with your organization's information protection policies. Examples provided in the resources

2. Installation (30 minutes)

• Download & install the Azure Information Protection Unified Labeling Client (version 2.14.93.0 or later) on each computer (3 minutes per user)
• Enable DKE

3. Configuration (1-4 hours)

• Log in and retrieve your Securosys365 admin credentials through our support portal
• Create & publish sensitivity labels in your Azure tenant
• Test

We can offer a 30-minute demo with one of our Senior Product Engineer to address the most common questions.

Unfortunately, we cannot provide consulting resources to work on your infrastructure and perform the installation on your behalf.

However, we would be happy to recommend consulting partners to support you with the installation.

• Liaise internaly with the relevant stakeholders. Most likely the CISO
• Assess the complexity of the solution, the pre-requisites, the technical & human resources needed. Appoint external resources if needed
• Install Azure Information Protection on your environment and link it to your Securosys365 tenant (30 minutes)
• Choose and implement security labels (1-4 hours)
• Run some tests as an end-users on Excel, Word, PowerPoint, Outlook, to cover your most important use cases

The monthly subscription includes:

• Infrastructure/hardware costs - Primus HSM, etc.
• Software costs with continuous improvement
• Online console to manage your key
• 24/7 support & maintenance

Not included:

• Azure & Microsoft desktop App licences
• Any consulting/training/support for the Proof of Concept PoC & onboarding - We can recommend some partners instead

To install S365, you need to understand the following concepts:

• Azure Fundamentals
• Azure Information Protection (AIP)
• Azure Active Directory (AAD)

which would be most likely CISO, IT Manager/Director, System Administrator, Security Analyst, Security Engineer, Security Architect. They can be supported by Security Consultant, IT Auditor, Data Protection Officer (DPO), Compliance Officer, Risk Manager.

Securosys365 works with the Double-Key Encryption (DKE) protocol from Microsoft, which is only included in E5 licences.

If you don't have an E5 licence, Microsoft offers a 30-day free trial here

The data would remain encrypted and could not be used by anyone

Before your subscription ends, we recommend the following exit process:

• Decrypt all your documents and move them to their new location
• If you have a lot of documents, you can run a PowerShell script to decrypt any DKE-encrypted protected files.

Please contact us at least 1-month before the termination to ensure a smooth exit process.

While Microsoft Office does include default encryption for data, Securosys365 goes beyond by providing additional layers of security. Our solution not only enhances encryption but also empowers you to control who can encrypt/decrypt data, offering advanced threat detection and customization options tailored to your organization's specific needs. This ensures a comprehensive and customizable approach to safeguarding your sensitive data alongside the default encryption provided by Microsoft Office.

No, Securosys cannot access your data because:

• Securosys doesn't have access to your Azure tenant
• The decryption is performed on the client's device by the Office Apps

Within your organization, you might have different groups of users with different roles & duties. The permissions will be different for each of them.

Thus, you will need a specific sensitivity labels to match each use cases.

• Security vulnerabilities in complex hyperscaler environments
• Malicious activities by hyperscalers or employees
• Loss of intellectual property

If the Securosys365 key is lost, you could not decrypt your data anymore.

However, this risk is being eliminated as your key is stored in an HSM which is redundant.