Chapter 12: Deploying Data Loss Prevention and eDiscovery

In this chapter, we'll discover recipes involving both Data Loss Prevention (DLP) and eDiscovery in Office 365. With the right data loss prevention settings in place, your organization's sensitive data will be protected from creation through its entire content lifecycle. eDiscovery adds to your organization's ability to perform investigations involving placing legal holds on content, creating cases for in-depth analysis of content across several apps and services and more.

We'll cover these specific recipes related to DLP and eDiscovery:

• Creating a DLP policy to protect content with HIPAA-protected data detected
• Using DLP to automatically report HIPAA incidents
• Creating a DLP policy for content with custom keywords in the name or subject
• Tuning a sensitive information type's confidence level
• Creating an eDiscovery case
• Managing eDiscovery cases
• Creating an advanced...

Technical requirements

You should be a global or compliance administrator to complete most recipes in this chapter.

Creating a DLP policy to protect content with HIPAA-protected data detected

In this chapter, we'll be utilizing the Microsoft 365 compliance admin center to create a DLP policy that detects HIPAA-protected content, warns users about sharing the protected content, and blocks people from outside the organization from accessing it. It will also provide users with the opportunity to override for false positives (HIPAA-protected content detected but not actually present) or with business justification.

Getting ready

You should be a global or compliance administrator to complete this recipe.

How to do it…

1. Go to the Microsoft 365 compliance center at https://compliance.microsoft.com.
2. Click Show all from the left navigation menu.
3. Select Data loss prevention:

   Figure 12.1 – Data loss prevention link in the left-hand navigation menu of the Microsoft 365 compliance center

4. Click Create policy:

   Figure 12.2 – The Create policy button on the Data...

Using DLP to automatically report HIPAA incidents

In the previous recipe, we created a DLP policy that detected HIPAA-protected content and sent an incident report as part of its handling. In this recipe, we'll edit an existing DLP policy and add an incident report as part of its response.

Getting ready

You should be a global or compliance administrator to complete this recipe.

How to do it…

1. Go to your DLP policies directly at https://compliance.microsoft.com/datalossprevention. You could also go to the Microsoft 365 compliance center and select Show all > Data loss prevention from the left navigation menu.
2. Select the policy for which you're configuring an incident report, then click Edit policy:

   Figure 12.11 – The Edit policy button available for a selected DLP policy

3. Select Policy settings > expand the content specifications > Edit rule:
   

   Figure 12.12 – Edit rule button available for a specific rule in the selected policy...

Creating a DLP policy for content with custom keywords in the name or subject

Earlier in this chapter in the Using DLP to automatically report HIPAA Incident Reports recipe, you created a DLP policy based on pre-defined criteria (HIPAA-protected data types). In this recipe, we'll create another DLP policy, but this one will look for content that includes custom keywords we specify. Specifically, we'll be looking for content that contains any reference to our top-secret, fictional Project Wildebeest.

Getting ready

You should be a global or compliance administrator to complete this recipe.

How to do it…

1. Go to the Microsoft 365 compliance center at https://compliance.microsoft.com.
2. Choose Data classification from the left-hand navigation menu.
3. Choose Sensitive info types:

   Figure 12.15 – The Sensitive info types button on the top navigation menu of the Data classification page

4. Click Create info type.
5. Name and describe the sensitive...

Tuning a sensitive information type's confidence level

When you're creating a DLP policy, you can use sensitive information types (such as Project Wildebeest in the previous recipe). Matches are based on specific patterns and confidence level. The higher the confidence level, the more certain the match must be whereas a lower confidence level will catch more similar matches (though these will include false positives).

You may wish for a higher confidence level when you're more absolutely certain data that should be caught follows a specific pattern each time, such as a routing number within a certain proximity of an account number or SSN. Lower confidence levels will be more inclusive of potential matches and may be helpful for more loosely structured data where, perhaps, a confidential project may be discussed or referenced in numerous ways and structures.

In this recipe, we'll adjust a sensitive information type from the previous recipe (Project Wildebeest...

Creating an eDiscovery case

Think of an eDiscovery case as a container for an investigation or search for content related to a specific inquiry. Perhaps the legal team requires access to search all content in the environment related to a user—an eDiscovery case would be a way to containerize the scope of their search and provide them access. You may also be asked to investigate a user's inbox or a specific site, placing a hold on it first with an eDiscovery case. In this recipe, we'll create an eDiscovery case to provide specific people access to review specific content related to a fictional investigation.

Getting ready

You should be a global, compliance, or eDiscovery administrator or an eDiscovery manager to complete this recipe.

How to do it…

1. Go to the Microsoft 365 compliance center at https://compliance.microsoft.com.
2. Select Show all > eDiscovery > Core from the left-hand navigation menu:

   Figure 12.37 – The Core eDiscovery...

Managing eDiscovery cases

In the previous recipe, you created an eDiscovery core case and shared it with members for review. In this recipe, we'll cover a couple more things you can do when managing eDiscovery cases.

Getting ready

You should be a global, compliance, or eDiscovery administrator to complete this recipe. You could also be an eDiscovery manager if only managing cases you created or were assigned to.

How to do it…

1. Go to the Microsoft 365 compliance center at https://compliance.microsoft.com.
2. Select Show all > eDiscovery > Core from the left-hand navigation menu:

   Figure 12.47 – The Core eDiscovery link on the left-hand navigation menu of the Microsoft 365 compliance center

3. Click Export to get a CSV file of all cases and their top-level details:

   Figure 12.48 – Example CSV file of exported case details

4. Use the Group by, Search, and Filter buttons to quickly find and organize your cases. You might, for example, use...

Creating an advanced eDiscovery case

In the Creating an eDiscovery case recipe earlier in this chapter, you created a basic eDiscovery case. In this recipe, you'll create an advanced eDiscovery case that has a few more options and abilities.

Getting ready

You should be a global or compliance administrator to complete this recipe. eDiscovery also requires an Office 365 or Microsoft 365 E5 subscription.

How to do it…

1. Go to the Microsoft 365 compliance center at https://compliance.microsoft.com.
2. Select Show all > eDiscovery > Advanced from the left-hand navigation menu:

   Figure 12.51 – The Advanced eDiscovery link on the left-hand navigation menu of the Microsoft 365 compliance center

3. Click Cases.
4. Click Create a case.
5. Enter a Case name, Case number (optional), and Case description for the case:

   Figure 12.52 – Case basic details configuration

6. Change Do you want to configure additional settings after creating this case? to...

Changing who has access to an advanced eDiscovery case

In the last recipe, you created an advanced eDiscovery case. In this recipe, we'll modify an existing case to add members and role groups to have access.

Getting ready

You should be a global, compliance, or eDiscovery administrator or an eDiscovery manager to complete this recipe.

How to do it…

1. Go to the Microsoft 365 compliance center at https://compliance.microsoft.com.
2. Select Show all > eDiscovery > Advanced from the left-hand navigation menu:

   Figure 12.54 – The Advanced eDiscovery link on the left-hand navigation menu of the Microsoft 365 compliance center

3. Click Cases.
4. Select the name of the case for which you're adding members or role groups to permissions.
5. Select Settings:

   Figure 12.55 – The Settings link along the top navigation of a specific eDiscovery case

6. Under Access & permissions, click Select:

   Figure 12.56 – The Select button under Access...