Global Security Microsoft Office System Customer Solution Case Study Tunisia, Egypt, Libya 2011 Civil unrest. Political instability. Organization Size 37 employees Organization Profile Headquartered at Microsoft s Redmond, Washington, campus, Microsoft Global Security manages all aspects of physical security at every Microsoft facility worldwide. Business Situation In early 2011, protesters and government forces clashed in Tunisia, Egypt, and Libya. The resulting civil unrest led to mass arrests, killings, and international involvement. The safety of Microsoft people and property was at high risk. Response Microsoft GSOC EMEA launched local Incident Management Teams in Tunisia, Egypt, and Libya to manage communications, coordinate security assistance, and minimize risk to personnel traveling to and within the affected areas. Outcome Close collaboration the local IMTs and the GSOC minimized harm to Microsoft people and assets. All personnel were safely accounted for, and campus security was maintained throughout the crises. Microsoft and partner technologies facilitated the vital teamwork. Microsoft manages events in the Middle East using internal and partner technologies and Enterprise Incident Management processes In early 2011, in the wake of civil unrest and political instability in Tunisia, Egypt, Libya, and elsewhere, Microsoft s Global Security Operation Center (GSOC) in the Europe/Middle East/Africa region (EMEA) activated local and enterprise Incident Management Teams (IMTs). Working closely with the GSOC, local IMTs maintained constant communication with their personnel and provided security advice for all affected staff and travelers. Microsoft employees were kept safe and informed, and our assets were protected. Situation Protesters took to the streets of Tunisia, Egypt, and Libya, clashing with government forces and, in some cases, pro-government demonstrators or militias. Violence, property damage, and casualties ensued, leading to more uprisings and government crackdowns. Within Libya, armed clashes occurred between rival militias that had once fought together against pro-qaddafi forces. In Egypt, fresh protests erupted over the pace of reform, and sectarian tensions fueled violence. Microsoft s presence in the region includes 304 employees across 64,000 square feet of office space in five buildings. Response GSOC EMEA (located in the United Kingdom) activated Incident Management Teams in the early days of the protests to manage their local effects and to limit the overall impact on Microsoft. The IMTs started processes for managing communications, locating travelers, and providing security services, all to mitigate risk to assets and help personnel on the ground stay safe and informed.
Software and Services Microsoft Office InfoPath 2010 Microsoft Office SharePoint Server 2010 Microsoft SQL Server 2008 Bing Maps Microsoft Lync 2010 IDV Solutions Visual Fusion ConTgo Mobile Travel Assistant Inca X geocasting Vertical Industries IT Services, Physical Security blue dots = Microsoft facilities Country/Region Middle East and Africa Communication The IMTs used the GSOC to provide background information, daily situation briefings, and security advisories. The teams used several tools to reach and collaborate with key decision makers and staff, regardless of their location and network access: Visual Fusion, a partner mapping tool from IDV Solutions, was used to check the proximity of Microsoft offices to the center of the demonstrations. Custom maps were disseminated with situation updates. InfoPath allowed the storage of all relevant documents, regardless of format, in a centrally accessible portal. Lync connected IMT members in live meetings through laptops. It was the preferred communication tool, as it brought together voice, video, and documents and was not affected by landline disruptions. AtHoc, a partner messaging tool, used SMS (texting) to alert IMT members and senior leadership about upcoming meetings, situation changes, and advisories. Mike Howard, Microsoft s Chief Security Officer, notes: With our communication software tools, our IMT members around the world could work together and share maps and documents, without being in the same room or time zone. Areas in crisis may lose their landline phone service, and mobile phone systems may collapse or become overloaded, but as long as the Internet is available, we can still communicate. Lync provides a rich presence, displaying photos of participants and showing who is currently available. Mike Foynes, Senior Director of Operations, Microsoft Global Security, adds: Visual Fusion helps you literally envision the situation in a complex 2
disaster environment so you can plan and carry out response and recovery. With Lync, I would hold 10 to 15 conference calls at once, jumping from one to another. By clicking on a team member s name, I could bring the person into a conversation immediately, forming and reforming discussion groups as needed. With our array of tools, we were able to move from assessment to action quickly. Traveler Location GSOC EMEA worked to make sure all travelers in or on their way to the region received timely updates and relevant security guidance. Again, software aided the effort: Mobile Travel Assistant (MTA) from partner ConTgo helped GSOC EMEA confirm the location of all Microsoft travelers. Those en route to or already in the area were told of the unfolding situation via an alert message. That message required a response from the traveler to verify well-being. Mr. Howard notes: Within minutes, we could tell who was where and what facilities were near the dangers. We could determine how many travelers we had in-country and ping them quickly. Inca X, a partner product providing Web-accessible GPS location data, was installed on the mobile phones of deployed Regional Security Advisors to provide on-the-ground support and detailed threat information. Advisors physical locations were tracked using Inca X as long as satellite coverage remained available. Security Services GSOC EMEA provided security advice, support, and facilities to all personnel affected by the disaster. Several software tools were used: Extranet pages of the Global Security website were used to publish travel restrictions and office closure information. Use of the extranet meant personnel did not need access to the corporate network to obtain information. Lenel, the access control system used to monitor all Microsoft campuses and buildings, demonstrated its durability by remaining fully operational throughout the events. Mr. Foynes adds: The software created a virtual war room. With Lync I could communicate with GSOC EMEA, help them set a course, and pass along instructions and other information. InfoPath helped us share data about all our facilities in the region so we could reach out to them directly. Enterprise Collaboration The Tunisian, Egyptian, and Libyan IMTs fostered the internal coordination necessary to monitor the impact of the political instability and to serve Microsoft personnel during those critical months. Global Security sent a Regional Security Advisor to Egypt and Tunisia to provide detailed threat information to Global Security and local IMTs and to assist on the ground. Hotel rooms were obtained by local IMTs as safe havens for any staff and family members threatened by the escalating violence. In Libya, a third-party security company 3
planned and executed a successful evacuation of Microsoft employees and dependents to neighboring Tunisia. Mr. Howard notes: In the first half of 2011, we had half a dozen IMTs activated in the region, all at once. The scenario required a tremendous amount of coordination. Other Microsoft groups providing input and support to the regional security team included: Global Security Intelligence Group, which provided counsel on raising individual country risk ratings to High and Extreme. The group also monitored the rapidly changing situations on the ground and reported findings to enterprise and security leadership. This information enabled key decision makers to effectively deal with threats to life safety and potential impact to the business. EMEA Education & Awareness, which published advisories and individual employee guidance. GSOC EMEA, which provided all outreach, event notifications, and situation updates. GSOC EMEA activated all IMT calls, located travelers, issued formal communications, and monitored access to all Microsoft facilities as long as the IMTs operated. By early April 2011, all local IMTs had moved to a monitoring status. Outcome In all three countries, the former leaders were forced from power, although the military remains in control in Egypt. Elections have begun in Egypt and are planned in Tunisia and Libya. Mr. Foynes observes: In the Middle East, despite the turmoil, we did not lose even one employee. With the right tools and planning, we were able to scale up quickly to manage multiple incidents with a small number of staff. For Microsoft, the political unrest tested the GSOC and Incident Management Teams to the fullest. Working collaboratively with GSOC EMEA, the local IMTs provided continuous communication with affected personnel, ensuring their safety and access to help. Microsoft and partner technologies played a critical role in the success of the IMTs. Lync enabled voice and instant messaging among Microsoft staff, as well as sharing of screens and documents. Lync also enabled callers to join meetings from landline, mobile, or laptop devices. InfoPath and the IMT portal allowed easy, immediate access to relevant documents, regardless of location or format. Partner tools AtHoc and ConTgo s Mobile Travel Assistant allowed instant access to staff affected by the unrest, ensuring that all personnel were accounted for. Finally, as governments often shut off corporate network access during political crises, the use of extranet pages on the Global Security website provided timely and relevant communication with the people who 4
For More Information For more information about Microsoft products and services, call the Microsoft Sales Information Center at (800) 426-9400. In Canada, call the Microsoft Canada Information Centre at (877) 568-2495. Customers who are deaf or hard-of-hearing can reach Microsoft text telephone (TTY/TDD) services at (800) 892-5234 in the United States or (905) 568-9641 in Canada. Outside the 50 United States and Canada, please contact your local Microsoft subsidiary. To access information using the World Wide Web, go to www.microsoft.com. For more information about Microsoft Global Security, visit WHAT ADDRESS. The Microsoft GSOC team uses a range of customizable, offthe-shelf solutions for physical security, including Microsoft technologies integrated with third-party products. This strategy helps create an enterprise security solution that reduces costs and improves customer service. For more information, visit www.microsoft.com/ government/ww/safetydefense/articles/pages/globalsecurity-operations-center.aspx. needed it most, regardless of network disruptions. Keys to Success Mr. Howard names the following as vital parts of the enterprise response to the political upheaval: Planning and strategy. The response was no knee-jerk reaction. The enterprise was prepared and had a written plan. Connecting planning and strategy to technology. The effort ran on offthe-shelf software from Microsoft and its partners. Users can set up the solutions on their own, without excessive customizing. Exercise and practice. The teams practiced their roles in advance and improved the plans as needed. Alignment with C-suite goals. The executive overseeing response shares vetted information with enterprise leaders, ascertains their priorities, and ensures that resources are made available to help the IMTs do their work. Mr. Howard notes, Given the complexity of the situation, our success is a testament to our planning, our technology, and our people. Microsoft Office System The Microsoft Office system is the business world s chosen environment for information work, providing the programs, servers, and services that help you succeed by transforming information into impact. For more information about the Microsoft Office system, go to www.microsoft.com/office. This case study is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. Published March 2012 5