O365 - Office cloud - pro's, con's and best practices

There is a massive move to the cloud, in particular Microsoft. What are pro's, con's and issues to think about.

Pro's & Con's moving into O365

• https://www.taylored.com/blog/what-are-the-pros-and-cons-of-office-365/
• https://brandongaille.com/12-pros-and-cons-of-office-365/
• https://www.intradyn.com/pros-and-cons-of-office-365/
  

Security considerations

• An open letter from ~20 full professors in security to the boards of Universities in the Netherlands
• 21i-CSRE-027-Open-brief-ACCSS-over-Amerikaanse-Cloud.pdf (Dutch)
• Open Letter - Switch to the Cloud, think before you start (Eng translation)
  
• What You Need to Know about Ransomware Attacks and Office 365
  
• https://spanning.com/blog/need-know-ransomware-attacks-office-365/
  

Costs

• The Cost of Cloud, a Trillion Dollar Paradox
• https://a16z.com/2021/05/27/cost-of-cloud-paradox-market-cap-cloud-lifecycle-scale-growth-repatriation-optimization/
  

Gathering info:

• https://www.forbes.com/sites/rachelsandler/2020/11/25/microsofts-new-productivity-score-lets-your-boss-monitor-how-often-you-use-email-and-attend-video-meetings/?sh=29f43a351a46
• Quote: “This whole thing just looks like Microsoft trying to upsell products and make you become completely dependent on the entire suite,” he said.
• Here are some of the data points employers can see about individual workers:
• Days sent email: Number of days the user sent an email in the last 28 days.
• Days used Teams chat: Number of days the user sent a chat message on Microsoft Teams in the last 28 days.
• Days in Outlook (desktop): Number of days the person was active on Outlook in the desktop platform.
• Days in Outlook (web): Number of days the person was active on Outlook in the web platform.
• Days in Outlook (mobile): Number of days the person was active on Outlook in the mobile platform.
• Days read content: Number of days the user has accessed content (files of type Microsoft Word/Excel/PowerPoint/OneNote or PDF) on OneDrive or SharePoint in the last 28 days..
• Days created content: Number of days the user has created, modified, or uploaded content (files of type Microsoft Word/Excel/PowerPoint/OneNote or PDF) on OneDrive or SharePoint in the last 28 days.
• OneDrive: Boolean value indicating if the person had access to OneDrive for at least 1 of the last 28 days.
• SharePoint: Boolean value indicating if the person had access to SharePoint for at least 1 of the last 28 days.
• Meetings attended: Number of online Microsoft Teams meetings in the last 28 days
• Meetings with screen sharing attended: Number of online Microsoft Teams meetings that had screen sharing in the last 28 days
• Meetings with video attended: Number of online Microsoft Teams meetings that had video in the last 28 days
• Hours of meetings: Number of hours spent in online Microsoft Teams meetings attended in the last 28 days
• DPIA Office 365 Online and mobile Office apps - Government.nl
• 2020:
• https://www.rijksoverheid.nl/binaries/rijksoverheid/documenten/rapporten/2020/06/30/data-protection-impact-assessment-office-365-for-the-web-and-mobile-office-apps/DPIA+Office+for+the+Web+and+mobile+Office+apps+30+June+2020.pdf
• 2019
  
• https://www.government.nl/documents/publications/2019/07/23/dpia-microsoft-office-365-online-and-mobile-slm-rijk-23-july
• Windows 10 users complain about intrusive new OneDrive adverts
• https://www.theguardian.com/technology/2017/mar/10/windows-10-users-complain-new-microsoft-subscription-onedrive-adverts
• Office 365 – The Good, the Bad, the Ugly
  
• https://cogitogroup.net/office-365-the-good-the-bad-the-ugly/
• Data mining potential – While they don’t share it with advertisers or disclose data to federal agents unless required by law, Microsoft do mine your data for their own purposes, which is never good.
  
• Nederlandse veiligheidsbelangen kwetsbaar voor activiteiten andere landen
  
• https://www.aivd.nl/actueel/nieuws/2021/02/03/nederlandse-veiligheidsbelangen-kwetsbaar-voor-activiteiten-andere-landen
• Microsoft Double Key Encryption. Analyse voor SLM Microsoft Rijk en het NBV van de AIVD.
  
• https://www.rijksoverheid.nl/documenten/publicaties/2021/01/13/analyse-microsoft-dke
• Microsoft Teams: The good, the bad, and the ugly
  
• https://www.theregister.com/2019/10/14/microsoft_teams_the_good_the_bad_and_the_ugly/
• OneDrive Security: How Safe Are Your Files in 2021?
  
• https://www.cloudwards.net/onedrive-security/
• Exchange Server hybrid deployments
• https://docs.microsoft.com/en-us/exchange/exchange-hybrid
• Microsoft Online Subscription Overeenkomst
  
• https://azure.microsoft.com/nl-nl/support/legal/subscription-agreement/
• U.S. National Security Orders Report for Microsoft
• https://www.microsoft.com/en-us/corporate-responsibility/us-national-security-orders-report?activetab=pivot_1:primaryr2
  

Authoriteit persoonsgegevens & Privacy Issues

• Controle van werknemers
• https://www.autoriteitpersoonsgegevens.nl/nl/onderwerpen/werk-uitkering/controle-van-personeel#welke-voorwaarden-gelden-voor-de-heimelijke-controle-van-werknemers-4621
• Werken op waarde geschat: Grenzen aan digitale monitoring op de werkvloer door middel van data, algoritmen en AI
• >RAPPORT-Werken-op-waarde-geschat.pdf

Privacy Issues by others

• Privacy Company: Assessment MS Office 365 Web & apps: Microsoft promises measures to mitigate 6 high privacy risks
• https://www.privacycompany.eu/blogpost-en/assessment-of-microsoft-office-365-for-the-web-and-apps-microsoft-promises-measures-to-mitigate-high-privacy-risks
  
• TU/E issues during introduction: "Introduction of Office 365 postponed for employees", but later the move happened anyway.
  
• https://www.cursor.tue.nl/en/news/2018/september/week-1/introduction-of-office-365-postponed-for-employees/
  

Data Protection Impact Assessment (DPIA) zakelijke microsoft intune dienst; vijf lage privacyrisicos

• Pricacy Company: In opdracht van het Ministerie van Justitie en Veiligheid heeft Privacy Company onderzoek gedaan naar de privacyrisico’s van het gebruik van de zakelijk Intune software van Microsoft. Daarmee kunnen systeembeheerders bijvoorbeeld informatie versleutelen op de apparaten van gebruikers. Privacy Company heeft ook onderzoek gedaan naar de privacyrisico’s van de browserversie van Microsoft Office 365 en de Office apps voor iOS en Android mobiele telefoons. Met toestemming van het Ministerie publiceren wij twee blogs over onze bevindingen, deze blog over Intune:
• https://www.privacycompany.eu/blogpost-nl/nieuwe-dpia-zakelijke-microsoft-intune-dienst-vijf-lage-privacyrisicos
• en de tweede blog over de browserversie en de app-versie van Office 365:
• https://www.privacycompany.eu/blogpost-nl/onderzoek-naar-microsoft-office-365-for-the-web-en-apps-microsoft-belooft-nieuwe-maatregelen-om-hoge-privacyrisicos-te-verlagen

NCSC advise when moving to cloud

• National Cyber Security Center: 5 adviezen voor veilige inkoop van clouddiensten
• https://www.isaca.org/resources/news-and-trends/isaca-now-blog/2018/before-you-commit-to-a-vendor-consider-your-exit-strategy

Exit Strategies

• Cern MAlt: The Microsoft Alternatives project: Taking back control using open software
  
• https://home.cern/news/news/computing/migrating-open-source-technologies
  
• Exiting Office 365 with Your Encrypted Messages and Documents
• https://petri.com/exiting-office-365-encrypted-messages-documents
• Insider Tips for Office 365 - So Good, It’s Almost Criminal
  
• https://www.cio.com/article/2369986/insider-tips-for-office-365.html
• Exit Planning for MS Cloud Services
• https://www.linkedin.com/pulse/exit-planning-ms-cloud-services-tom-deprins
  

Other stuff

• Article: "Heads in the Clouds: Measuring the Implications of Universities Migrating to Public Clouds", Tobias Fiebig, Seda Gürses, Carlos H. Gañán, Erna Kotkamp, Fernando Kuipers, Martina Lindorfer, Menghua Prisse, Taritha Sari, TU Delft, Netherlands and TU Wien, Austria.
• https://arxiv.org/pdf/2104.09462.pdf
• local copy
  
• Microsoft Security Shocker As 250 Million Customer Records Exposed Online
• https://www.forbes.com/sites/daveywinder/2020/01/22/microsoft-security-shocker-as-250-million-customer-records-exposed-online/
• The Digital Freedom Pass: Emancipation from Digital Slavery
• https://www.g20-insights.org/policy_briefs/the-digital-freedom-pass-emancipation-from-digital-slavery/
• Analysis of Microsoft Office 365 Data Protection Compliance
• https://www.trilateralresearch.com/analysis-of-microsoft-office-365-data-protection-compliance/
• The Digital Freedom Pass: Emancipation from digital slavery
• https://voxeu.org/article/digital-freedom-pass-emancipation-digital-slavery
• You Are Now Remotely Controlled
• https://www.nytimes.com/2020/01/24/opinion/sunday/surveillance-capitalism.html
• Stop forcing us to use Cortana! - Microsoft Community
  
• https://answers.microsoft.com/en-us/windows/forum/windows_10-win_cortana-winpc/stop-forcing-us-to-use-cortana/a7e38a21-8e48-4b9b-99b1-4596556ddacb

• STOP forcing us to use CORTANA! - Microsoft Community Tech support scams are an industry-wide issue where scammers trick you into paying for unnecessary technical support services. You can help protect yourself from scammers by verifying that the contact is a Microsoft Agent or Microsoft Employee and that the phone number is an official Microsoft global customer service number. answers.microsoft.com

• How to disable Cortana in Windows 10
• https://www.hows.tech/2019/04/disable-cortana-in-windows-10.html#_Why_Should_You_Disable_Cortana_in_Windows_10?
• Life in the cloud in the analog world: Das Leben der Anderen
• https://de.wikipedia.org/wiki/Das_Leben_der_Anderen