Windows 10: Windows Information Protection: data leakage prevention for Windows 10

Brink · May 15, 2018

Have you always wished you could have mobile application management (MAM) on Windows?

Now you can!

Windows Information Protection (WIP) is an out-of-the box data leakage prevention feature for Windows 10 that can automatically apply protection for work files and data to prevent accidental data leakage. With 600 million active Windows 10 devices, corporate customers continuing to deploy in earnest throughout 2018, and support for WIP built right into Office 365 ProPlus, its benefits are within easy reach.

Sixty to eighty percent of data leakage is accidental (see ICO data for 2016 and 2017). WIP is a key feature that offers much needed data protection for files at rest on the Windows platform, for any organization with sensitive data, big or small. In today’s security ecosystem, companies are spending $93B on security features (enough to host seven Olympic Games!). Yet companies still saw a 29 percent increase in data leakage worldwide between 2016 and 2017. WIP comes as a timely solution.

With Windows 10, Microsoft is providing a fundamental solution to this growing problem. Recognizing that the risk of leak comes from both fully managed devices and personal devices accessing work resources, we designed WIP to be deployed on PC and mobile devices running Windows 10. WIP is designed for organizations of all shapes and sizes, as a scalable solution that works to prevent accidental data leakage for end users.

WIP protects users and organizations from accidental leaks via copy-and-paste, drag-and-drop, removable storage (e.g., USB thumb drives), and unauthorized applications (e.g., non-work cloud storage providers). Windows shell integration appears in clear but unobtrusive ways. Elements like File Ownership are displayed and selectable in Explorer and File Save As dialog. Helpful briefcase icons mark resources when you are in a work context in places like window title bars, and Microsoft Edge’s navigation bar. Unauthorized applications are blocked from single sign-in with work credentials. WIP also includes the ability to perform selective wipe of business information, while leaving personal data behind.

WIP has three simple policy enforcement modes. It lets you choose how and whether the user experience in the clipboard, save dialog, and similar data-sharing cases have options (overrides) to move work content to non-work context. You can decide to Hide Overrides, Allow Overrides for your users, or even deploy in Silent mode just for auditing. Silent mode does not restrict unmanaged apps from opening work data the way Hide Overrides and Allow Overrides do, so you can get away with configuring less, yet still benefiting from the BYOD selective wipe capability for your work data, such as data downloaded from OneDrive for Business and Outlook email. This means when you or your user decides to unenroll their work account from their personal device, that work data stops being accessible.

WIP policy can be deployed in a few clicks in Microsoft Intune for MAM-only (“without enrollment”) targeting, MDM (“with enrollment”), or both. Being able to apply MAM-only policy will help you finally enable BYOD in regions and situations where fully managing the personal device is unacceptable. For companies that are not yet fully in the cloud, WIP policy can also be set on domain-joined computers using System Center Configuration Manager. Then, when you’re ready for co-management, you can move the WIP policy management authority to Microsoft Intune.

Your corporate files can also be automatically encrypted with a local key when downloaded to WIP-managed devices. You can do this by configuring your corporate network boundary. Using network isolation policies, you can identify your LAN and corporate cloud resources, which Edge and other applications will use to recognize work sites and encrypt the data that comes from there. This works even better when combined with Conditional Access controls on Exchange Online and SharePoint Online to ensure that only managed devices can reach that data.

Additionally, WIP Learning lets you see the applications you didn’t know are used with work data. It reports any app not in your policy that tries to access a work resource. You can see this data in Microsoft Intune or your Windows Analytics portal, if you have Azure Log Analytics (formerly Microsoft Operations Management Suite or OMS). WIP Learning allows you to tune your app policy to add legitimate work apps and even detect apps that should not be trying to access work data. Combined with Silent mode, you can deploy and see the immediate benefit of selective wipe control and auditing, while tuning your app list for different deployment groups in preparation for enabling boundary enforcement.

WIP provides a robust and automatic solution for protecting work data coming to the Windows device, but it also pairs well with Azure Information Protection (AIP). AIP adds the ability to control and help secure email, documents, and sensitive data that are shared, even outside your company and in the Azure cloud. WIP, combined with AIP, provides application-level access control capabilities while preventing unauthorized applications from accessing business information at rest and in flight. At the same time, WIP’s simple “business vs personal” information classification system ensures simplicity and ease of use.

USB flash drives aren’t the only way data can leave a device. With the app restrictions on accessing work data, you can use WIP to guide users to use Outlook with their corporate email account to send work attachments, and SharePoint or OneDrive for Business to collaborate on work documents. This lets you enhance your overall data protection with Office DLP outbound rules, send email notifications, policy tips, and Office 365 Information Protection for GDPR.

WIP originally shipped in the Windows 10 Anniversary Update (version 1607) and since then, working across Microsoft and with industry, we have made a number of improvements, including:

Support for Office 365 ProPlus, Microsoft Teams, and numerous inbox apps

Simplified management – Intune quick setup, WIP Learning for Apps and Network Boundary policy

Manageable as MAM-only (i.e. without full device enrollment)

Improved Recovery (e.g. data access resumes via re-enrollment or re-adding your work account)

AIP integration to enable roaming data on removable storage (e.g. USB thumb drives)

Support from 3rd party apps such as from Citrix (ShareFile), DropBox (desktop sync client), Foxit (Reader, PhantomPDF), and WinZip (WinZip 21, WinZip 22)

With all these features available, WIP is easier than ever to deploy and maintain. Enable this fast, robust, user-friendly security solution to help ensure a more effortlessly secure user experience for your organization.

More information on Windows Information Protection (WIP) found in the following resources:

Introducing Windows Information Protection (WIP) [Blog]

Windows Information Protection (WIP) Explained – Windows 10 Creators Update [Blog]

Deploying and managing Windows Information Protection (WIP) [Presentation]

Windows Information Protection (WIP) Product [Documentation]

Click to expand...

Source: Use Windows Information Protection (WIP) to help make accidental data leakage a thing of the past Microsoft Secure

:)

Kiran Kishore · May 15, 2018

I have issues with security on how to protect data from Windows?

Hi Jose,

We appreciate you for being part of Windows 10.

I understand that you have issues with protecting Windows 10 from fraud and hackers?

We need to know which account you use to login to Windows 10? (Microsoft/Local)

You may try the below steps and protect the Windows from hackers/fraudsters:

Use the strong passwords to login to the computer

Turn on the windows firewall and change the settings of the Firewall to recommended settings

Use the security software’s to protect from the threats

You may try to use the secured browse engines and encryptions to protect the data when you browse through internet

Kindly let us know if you need any further assistance with Windows. We are glad to assist you.

Thank you.

Deepak Kodi · May 15, 2018

Password protect a folder in WIndows 10

Hi Bob,

Thank you for posting your query in Microsoft Community.

Let me answer you query to password protect a particular folder/file.

Please be informed that you cannot password protect a particular folder/file in windows 10, you may please use your favorite search engine to search for a third part software which can perform the task.

THIRD PARTY SOFTWARE DISCLAIMER:

Using Third Party Software, including hardware drivers can cause serious problems that may prevent your computer from booting properly. Microsoft cannot guarantee that any problems resulting from the use of Third Party Software can be solved. Using Third
Party Software is at your own risk.

However Encrypting File System (EFS) is a feature of Windows that you can use to store information on your hard disk in an encrypted format. Encryption is the strongest protection that Windows provides to help you keep your information secure.

How to encrypt a file

Right-click (or tap and hold) a file or folder and select Properties.

Select the Advanced... button and select the Encrypt contents to secure data check box.

Select OK to close the Advanced Attributes window, select Apply, and then select OK.

Reference: If you are using the Pro or Enterprise edition, you may use bit locker to encrypt the device.

BitLocker helps protect all of the personal and system files on your PC if it’s stolen, or if unauthorized users try to use the PC. Use BitLocker to encrypt all files on fixed data drives (like internal hard drives) and use BitLocker To Go to encrypt files
on removable data drives (like external hard drives or USB flash drives).

http://windows.microsoft.com/en-us/windows-10/turn-on-device-encryption

Hope the information helps, do reply if you need further assistance.

Thank you.

Windows 10: Windows Information Protection: data leakage prevention for Windows 10

Windows Information Protection: data leakage prevention for Windows 10

Windows Information Protection: data leakage prevention for Windows 10

Windows Information Protection: data leakage prevention for Windows 10 - Similar Threads - Information Protection data

Microsoft introduces Kernel Data Protection to Windows 10

Intel Processors Data Leakage Advisory

How to look at Windows Information Protection logs?

ram leakage

re windows 10 data mining prevention

Windows Data Protect crash

What Does This Mean?: "Windows Information Protection"

Data Protection or Virus Protection?

How to open/access "Windows Information Protection"