In a blog post that got a lot of attention on social media yesterday, Microsoft's Alex Simmons explained over on the Enterprise Mobility and Security blog how the company approaches security when it comes to your data on the companies Azure Active Directory service.
In this article Simmons explains the security approach from both a physical and software based perspective which work together and provides protection for your companies data that resides on Microsoft Azure.
The first step in security is controlling physical access to the data centers housing data in these services and the actual machines hosting the information:
"Microsoft’s datacenter personnel must pass a background check. All access to our datacenters is strictly regulated and every entry and exit are monitored. Within these datacenters, the critical Azure AD services that store customer data are located in special locked racks—their physical access is highly restricted and camera-monitored 24 hours a day. Furthermore, if one of these servers is decommissioned, all disks are logically and physically destroyed to avoid data leakage."
The next element of protecting that data is the authentication process to grant just-in-time access on the system to manage Azure AD services through a managed admin workstation:
"We limit the number of people who can access the Azure AD services, and even those who do have access permissions operate without these privileges day-to-day when they sign in. When they do need privileges to access the service, they need to pass a multi-factor authentication challenge using a smartcard to confirm their identity and submit a request. Once the request is approved, the users privileges are provisioned “just-in-time”. These privileges are also automatically removed after a fixed period of time and anyone needing more time must go through the request and approval process again."
The systems hosting Azure AD services are scanned in a near real time basis to watch for threats that might impact the security of the customer data:
-- Breach detection: We check for patterns that indicate breach. We keep adding to this set of detections regularly. We also use automated tests that trigger these patterns, so we are also checking if our breach detection logic is working correctly!
-- Penetration tests: These tests run all the time. These tests try to do all sorts of things to compromise our service, and we expect these tests to fail all the time. If they succeed, we know there is something wrong and can correct it immediately.
-- Audit: All administrative activity is logged. Any activity that is not anticipated (such as an admin creating accounts with privileges) causes alerts to be triggered that cause us to do deep inspection on that action to make sure it not abnormal.
In addition, all data at rest on these systems are encrypted using BitLocker plus the API connections into the services are all web-based using SSL and HTTPS. That API access to that data is token based and only grants access to that customers data.
Learn more at the Enterprise Mobility and Security blog.
----------
But, wait...there's probably more so be sure to follow me on Twitter and Google+.
----------------------------------
Looking for an awesome, no-nonsense technical conference for IT Pros, Devs, and Devops? Check out IT/Dev Connections!
