Security in the Government Community Cloud

Solution

The game-changer for the Gaming Commission: Security. Microsoft built the Government Cloud with unique security controls in place, enabling Arctic IT to create policies for their tenant that struck an equilibrium between security and accessibility. Policies implemented for this project included:

• Restricted Data Flow. To prevent leaks of sensitive information, we implemented Data Loss Prevention (DLP) to protect all the types of data they handle, including Personally Identifiable Information (PII). Policies were implemented to monitor sharing of PII, incident reports and other protected data on platforms like Teams chats and Outlook emails. Alerts are generated when protected data is detected in communication flows.
• Device Management Policy. The team had a need to conduct work while out of the office, so a policy was created to control and protect company data on personal devices (e.g., email and Word or Excel documents accessed on mobile devices).
• Extended Device Controls. Policies were added to extend DLP requirements by limiting functions such as copying protected data from company documents to personal devices and saving company data to other unsanctioned third- party cloud storage services like Dropbox, iCloud, etc. Other limitations included printing company data from mobile devices and the copying of company data from work documents to personal spaces like Apple Notes/Google Keep, etc.
• Device Configuration Policy. Configuration profiles were deployed to enforce secure configurations and security controls for all company Windows devices. Compliance policies evaluate each device to see if it meets the required health posture. If the device is not compliant either by an outdated version or missing required patches, it can be blocked from access until the deficiencies are addressed. Also, if the device storage is not encrypted, access to company resources from the device is restricted to avoid exposure of company data to unprotected storage.
• Continuous Device Security. Suppose a device’s antivirus gets temporarily turned off during a routine process like an update. In that case, security policies were put place to ensure that it gets turned back on after completing the tasks to maintain the endpoint’s security posture.
• Grace Period. The devices are consistently monitored in a way that provides notification if there are security or health issues. When an issue is identified, an alert is sent to both the employee and the administrator. The grace period puts a hold on rejecting the device for an allotted amount of time, allowing the employee to stay productive until the issue can be resolved.
• Microsoft Defender for Endpoint. More than an antivirus, this provides IT threat and vulnerability management for the organization’s devices. This service continually checks for vulnerabilities to ensure everything is up to date, highlights what is missing, and prioritizes remediation efforts.