1

I'm trying to determine the best solution that allows me to assure our CEO that his Office 365 mailbox cannot be read by anyone, including myself, an admin.

Obviously the mailbox is already locked down for his access only, but I could grant myself access and nose around if I were that way inclined. I'm certainly not, but the sensitivity of the data means we need an airtight solution. Auditing of the mailbox/server is not enough.

I'm thinking that mailbox permissions can never lock an admin out 100%, so some form of encryption of the messages will be required, so that even if I were to access the mailbox, I could not read the messages. He will be sending and receiving emails internally and externally, and uses Outlook on Mac/PC, and iOS to access his emails. I can't account for the external recipients' email clients, and ideally need to avoid any additional client side software.

Please could someone help with a suitable suggestion and give a high-level overview of what the solution entails? If you need more info please let me know.

Many thanks,

1

2 Answers 2

1

There is a reason we refer to elevated accounts as "privileged" - there has to be some implicit level of trust you are granting Administrators as they have the ability to grant themselves access to most of your content.

For "protecting mailbox data" I would enable legal hold on it, all changes to mailbox items are kept and you can't delete items, they are kept until legal hold is removed.

When protecting - a better word is mitigating, against Malicious admins you have to use a combination of Audit controls, Monitoring of those controls, Protected backups, data protection like legal holds, and separation of duties. There is no single best way to protect against this threat - you can only minimize the risk.

5
  • +1 for legal hold, to retain the original items intact. Bear in mind this may be exactly what the CEO doesn't want. The whole part of OP's question where the CEO doesn't trust anyone with admin access or otherwise sketches me out, big time.
    – blaughw
    Jul 1, 2016 at 16:26
  • Right Management (RMS) and Data Loss Protection (DLP) rules probably come into play too - though those are usually applied as they go thru EOP, unless user applies templates directly - which usually never works that well or stays consistent. But of course - an Admin somewhere will have access to the encryption keys. Jul 1, 2016 at 16:43
  • As an admin I'm totally with you on the trust element, but this requirement has been stipulated as part of something which is happening in the business, and is too much detail to go into here. I think I'm thinking more along the lines of encryption really. Something like S/MIME? I believe this would protect data from prying eyes even if they gained access to the mailbox. From my research it seems this is natively supported on iOS and doesn't require additional client software. Ideally I'm after info from someone who has experience of implementing this or similar in an O365 environment. Thanks
    – Tony Blunt
    Jul 1, 2016 at 21:04
  • S/MIME can work - but you need to rollout certs, and if you use an internal CA - your emails start having flags for external users. Further, it does not protect incoming messages unless the other party has also encrypted the messages. Like I said - you won't find one magic bullet to solve this problem. Best of luck to you. Jul 2, 2016 at 17:31
  • 1
    Thanks for your help, and sorry for the late reply. I've tested S/MIME on our internal network as we already have a PKI in place. Like you say, it's not a full solution and I'm yet to figure out how I could apply it in O365 as that account is not linked to an AD domain. So I think it's time to push back on the request and 'manage expectations'!
    – Tony Blunt
    Jul 7, 2016 at 22:04
1

You should instead look at auditing access control changes and non-owner access to mailboxes. Office 365 can do this, but only alerts on such incidents at the highest tier E5 plan today.

If this is on your roadmap, then you are practically solved.

2
  • Thanks for your reply, but I mentioned in my question that auditing would not suffice in this case. I need to ensure that data is safe in the first place, and that I can physically protect the data in the mailbox, rather than reporting after the fact.
    – Tony Blunt
    Jun 28, 2016 at 23:24
  • You could lock down client access by protocol type and user agent, but Outlook on Windows remains a pretty large hole. Long story short, if a user (admin) has access to the mailbox, they're going to be able to see folder contents. Short of using a PGP-like solution and dropping mobile client access, I can't think of a solution.
    – blaughw
    Jun 28, 2016 at 23:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .