I want to know what the U.S. (or E.U. countries) policy is towards the use of Microsoft Office (particularly local versions) and potentially sensitive information requiring clearance. In particular, this could be compounded by a lack of good firewall rules on non-rooted android mobile devices, which are now as big of a concern as desktops or laptops.
While the U.S. has often been shown to be behind when it comes to security, I am curious to know if they have assessed this situation with the increase in encrypted telemetry being collected by Microsoft. Yes, there is a little bit of good enough for them, good enough for me.
According to Microsoft, they collect the following:
- File names in the Most Recently Used list: pretty much every file used at some point.
- User name and computer name: could be used to identify specific targets.
- How office files and solutions are "used": whatever this encompasses.
- Information about crashes or critical errors: could happen any time when working with sensitive information.
- They mention checking on metadata, but not actually collecting it.
Does this pose a security risk? What are the alternatives? I suppose it would be nice to hear from informed folks or those personally involved with MS Office products and sensitive information. If not U.S. policy, please mention country.