learn. connect. explore
TRANSCRIPT
Learn. Connect. Explore.Learn. Connect. Explore.
Does my provider obey local privacy
requirements on behalf of their customers?
How is my data separated and secure from others
in a shared cloud environment?
How does my cloud service
provider support me in the
case of data failure?
What measures are taken by my cloud
provider, if illegal activity is found
within the data center?
Can I Trust Microsoft Azure?
Data Privacy and Security in Microsoft Azure
Wasim Bloch
Senior Consultant
Session Objectives
Describe the Microsoft Azure Platform security features and functionality
Help you understand Microsoft Azure data protection capabilities
Discuss Application Security Architecture for Microsoft Azure
How Microsoft Azure addresses customer privacy requirements
Technology trends: driving cloud adoption
450B+ Microsoft Azure AD
authentications
280% year-over-year
database growth in
Microsoft Azure
57%of Fortune 500 use
Microsoft Azure
$25,000in the cloud would cost
$100,000 on premises
EconomicsScale
30,000 to
250,000
Scale from
site visitors instantly
2 weeksto deliver new services
vs. 6-12 months with
traditional solution
Speed
Benefits
Azure Adoption
96%of SMBs shifting to cloud see security as benefit(A study conducted by ComScore)
70%of CIOs will embrace a cloud-first strategy in 2016(IDC CIO Agenda webinar)
Cloud innovation
Security
• Design/Operation
• Infrastructure
• Network
• Identity/access
• Data
• Application
Privacy
Pre-adoption concern
60%cited concerns around data
security as a barrier to
adoption
45%concerned that the cloud
would result in a lack of data
control
Benefits realized
94%experienced security benefits
they didn’t previously have
on-premise
62%said privacy protection
increased as a result of
moving to the cloud
Barriers to Cloud Adoption study, ComScore, September 2013
Gartner 7 cloud computing security risks
• Data location
• Data segregation
• Recovery
• Investigation support
• Privileged user access
• Regulatory compliance
• Long-term viability
Microsoft approach in action
Design & Operations
Security embedded
in planning, design,
development &
deployment
Rigorous controls to
prevent, detect,
contain & respond to
threats
Hardening cloud
services through
simulated real-world
attacks
Global, 24x7 incident
response to mitigate
effects of attacks
Operational security controls
Assume breach
Incident response
Security Development Lifecycle (SDL)
Security Development Lifecycle
Establish release criteria & sign-off as part of FSR
IncidentResponse (MSRC)
Guide product teams to meet SDL requirementsAdminister and track security training
Training Requirements Design Implementation Verification Release Response
Education Process Accountability
Ongoing Process Improvements
Assume breach
Prevent Breach
• Threat Model
• Code Review
• Security Testing
Assume Breach
• Live site penetration testing
• Logging and monitoring
Customer
• Assume breach identifies & addresses potential gaps
• Scope ongoing live site testing of security response plans to drastically improve mean time to detection & recovery
• Reduce exposure to internal attack (ensuring once inside, attackers do not have broad access)
Incident Response
EventDetected
Security TeamEngaged
Security Event Confirmed
EventStart
DevOps Engaged
Incident Assessment
Determine Customer Impact
Azure CustomerNotification
Customer ProcessStep 1
Determine Affected
Customers
Customer Notification
Infrastructure protection
• 24 hours monitored physical security
• Secure multi-tenant environment
• Firewalls
• Patch management
• System monitoring and logging
• Antivirus/antimalware protection
• Threat detection
• Forensics
Network protection
Network Isolation
• Prevents traffic from other customers/internet to customer cloud environment
Virtual Networks
• Connects one or more cloud services using private IP addresses
Cloud to on-premises connections
• Site to site, point to site, and ExpressRoutehelp enable secure connections to Azure
Identity and Access
Enterprise cloud identity –Azure Active Directory
Multi-Factor Authentication
Enterprise cloud identity –Azure AD
Azure
• Provides enterprise cloud identity & access management
• Enables single sign-on across cloud applications
• Offers multi-factor Authentication for enhanced security
Customer
• Centrally manages users and access to Azure, O365, and cloud applications
• Builds Azure AD into their web and mobile applications
• Can extend on-premises directories to Azure AD
Multi-Factor Authentication
Azure:
• Addresses user demand for a simple sign-in process while also helping address the organization's security and compliance standards
• Offers enhanced protection from malware threats, and real-time alerts notify your IT department of potentially compromised account credentials
Advantages:
• More security, fewer hoops
• Deploy it on-premises or in the cloud
• Works with Office 365, Salesforce, and more
• More protection for Azure administrators
Customer
• Safeguard access with mobile app, phone call, SMS
• Real-time fraud monitoring and alerts
• Reduce risk, meet compliance requirements
Data Protection
Data encryptions
Data location and redundancy
Data destruction
Data encryptions
Data location and redundancy
Data destruction
Data encryptions
Encryption in rest
Virtual Machines
• Data drivers – BitLocker encryption
• Boot drivers – BitLocker and partner solution
• SQL Server – data and column level encryption
Storage
• BitLocker encryption
• StoreSimple with AES-256 encryption
Applications
• Client side encryption with .Net Crypto API
Encryption in transit
Azure
• Encrypts most communication between Azure datacenters
• Encrypts transactions through Azure Portal using HTTPS
Customer
• Configures HTTPS endpoints for application running in Azure
• Encrypts traffic between Web client and server by implementing TLS on IIS
Data location and redundancy
Azure
• Creates three copies of data in each datacenter
• Offers geo-replication
• Does not transfer customer data outside of a geo
Customer
• Chooses where data resides
• Configures data replication options
Data destruction
• Immediately remove index of storage entities from primary location
• Asynchronously remove geo replicated copy of data
• Customer can only read from disk they have written to
• Defective disks are destroyed
Secure Cloud Application Design
Threat Modelling
Web Application Security Architecture
Web Service Security Architecture
Data Security Architecture
Threat Modelling• Helps you identify threats,
attacks, vulnerabilities, and countermeasures in the context of your application scenario
• Engage process during the design phase
• Uncover Security Design Flaws Using The STRIDE Approach
Threat Security
Properties
Potential Azure Platform
Mitigation
Spoofing Authentication Requires HTTPS connections
Tampering Integrity Validate SSL certificates
Repudiation Non-
repudiation
Enables Azure monitoring and
diagnostics
Information
Disclosure
Confidentiality Encrypt sensitive data at rest
using Service Certificates
Denial of
service
Availability Monitor performance metrics
for potential denial of service
conditions. Implement
connection filters.
Elevation of
Privilege
Authorization Windows Azure Active Directory
Access Control Services (AAD-
ACS)
Web Application Security Architecture
Scenario
Azure Environment
ASP.NET
App
On
Premise
AD
Client
Browser
Solution
On Premise
Client
Browser
Identity Provider
(ADFS2)
AD
Azure Environment
Web Role
Asp .NET
APP + WIF
SQL
User StoreRole Store
SSL
SAML Token
Trust
Relationship
Web Service Security ArchitectureSolution Azure Environment
Web Role
REST
Service
SWT (Simple
Web Token)
Azure AD
ACS
Application
Client
Trust
Relationship
oAuth
Claims
Scenario
Application
Client
Azure
Environment
REST
Service
Data Security Architecture
Scenario
On Premise
ASP.NET
App
Azure
Environment
WCF
ServiceSQL
Solution
Azure Environment On Premise
Web Server
ASP.NET
APPSQL
Server
SSL
Web Role
WCF
Service 443
1433
Privacy
Privacy controls
built into Azure design
and operations
Customer data is only
used to provide the
service and is never
used for advertising
Data Processing
Agreements, EU
Model Clauses,
HIPAA BAA
Restricted data access & use
Contractual commitments
Privacy by Design
Contractual commitments
EU Data Privacy Approval
• Microsoft makes strong contractual commitments to safeguard customer data
covered by HIPAA BAA, Data Processing Agreement, & E.U. Model Clauses
• Enterprise cloud-service specific privacy protections benefit every industry &
region
• Microsoft meets high bar for protecting privacy of EU customer data
• Microsoft offers customers EU Model Clauses for transfer of personal data
across international borders
• Microsoft’s approach was approved by the Article 29 committee of EU data
protection authorities – the first company to obtain this
Broad contractual scope
Recognized for its commitments
EU Data Privacy Approval
Broad contractual scopehttps://www.eff.org/who-has-your-back-government-data-requests-2014
Recommended/related sessions
Office 365 Security, Privacy and Compliance
Online Services, Hall, Day2 - 11.00 AM
1
2
Security Best Practices for Microsoft Azure Applications
Architecture, Hall, Day2 - 2.00 PM
ReferencesRelated references for you to expand your knowledge on the subject
• Talk to a Microsoft security expert
• Explore additional resources: Trustworthy Computing Cloud Services:
www.microsoft.com/trustedcloud
• Microsoft Trust Center for Microsoft Azure: http://www.windowsazure.com/en-us/support/trust-center
Datacenter security, privacy and compliance:
http://www.microsoft.com/en-us/server-
cloud/cloud-os/global-datacenters.aspx
technet.microsoft.com/en-in
aka.ms/mva
msdn.microsoft.com/
Tell us what you think
Scan the QR code to evaluate
this session.
< QR Code will be given a week before
Tech Ed >
Follow us online
Facebookfacebook.com/MicrosoftDeveloper.India
twitter.com/msdevindia
Twitter: @WasimBloch
Email:<optional>
