FR-05 · Program · Worldwide Clinical Trials · 2021–2026
Email security for regulated data
Roughly 200 gateway policies, authenticated mail, a closed bypass, and phishing triage with the SOC.
- active Mimecast policies
- about 200
- policy categories
- more than 35
- of phishing reports triaged each month
- hundreds
Context
Email carried PHI, PII, and clinical-trial data for a global clinical research organization under HIPAA. It was also where phishing arrived.
Constraints
- Regulated data in outbound mail had to be caught by DLP.
- Sender authentication had to hold for every domain in the tenant.
- Hundreds of user-reported messages a month had to be triaged with the SOC.
What I did
- Administered roughly 200 Mimecast policies across more than 35 categories, including DLP for PHI, PII, and clinical-trial data.
- Enforced DMARC, SPF, and DKIM tenant-wide.
- Closed a mail-flow bypass that let senders deliver straight to the tenant endpoint around the Mimecast gateway.
- Worked phishing triage, message-trace forensics, and quarantine with the SOC, and ran Defender for Office 365 investigations to remove malicious mail and senders.
Outcome
Outbound mail ran through DLP policies for regulated data, inbound mail could no longer skip the gateway, and user-reported phishing had a working triage path with the SOC.
Takeaway
A gateway only protects the mail that actually passes through it.
Field Notes
- DMARC has a new RFCSheet 17 / 30
Tags
- Mimecast
- DLP
- DMARC
- Defender for Office 365
- HIPAA