TRUSTED CLOUD. Our commitment to provide a cloud you can trust. Fernando Machado Píriz September 2014

Size: px

Start display at page:

Download "TRUSTED CLOUD. Our commitment to provide a cloud you can trust. Fernando Machado Píriz September 2014"

Cory Perkins
8 years ago
Views:

2 TRUSTED CLOUD Our commitment to provide a cloud you can trust Fernando Machado Píriz September 2014

3 Technology Trends Driving cloud adoption 71% of strategic buyers cite scalability, cost and business agility as the most important drivers for using cloud services Leverage economies of scale and expertise Speed 2 weeks to deliver new services vs months with traditional solution Reshape how you engage with customers Scale Scale from 30,000 to 250,000 site visitors instantly Drive new and more rapid sources of innovation Economics $25,000 in the cloud would cost $100,000 on premises

4 Technology Trends Momentum continues to accelerate If you re resisting the cloud because of security concerns, you re running out of excuses.

5 The Microsoft Trusted Cloud 200+ cloud services 1+ million servers $15B+ infrastructure investment Online 1 billion customers 90 countries worldwide

6 Shared Responsibility Reduce security costs and maintain flexibility, access, and control

7 Trusted Cloud Principles Commitment to principles worthy of your organization s trust Your content should be protected by strong security, safeguarded from hackers and unauthorized access with the state-of-the-industry technology, process and certifications. Your content should also be encrypted in transit and at rest. You are in control of your content, so it should only be used and shared as permitted by you. You should always have access to it, be able to take it with you when you leave, and have it deleted upon request. You can meet your obligations, your content should be stored and managed in compliance with applicable laws, regulations and key international standards. You know what is happening with your content, with clear, plain-language explanations of how your cloud provider uses, manages and protects your content. You should be told how your cloud provider will respond to law enforcement requests to access your content.

8 Security Strong security protects content Secure Development and Operations Secure Development Lifecycle (SDL) Operational Security Assurance (OSA) Encryption Commitment Data in transit between a user and the service (SSL, PFS) Data in transit between datacenters (TSL, IPsec) Best-in-class industry cryptography (PFS, 2048-bits key lengths) Data at rest (EFS, Bitlocker) End-to-end encryption of communications (S/MIME, PGP, RMS) Enhanced event and administrative access logging Data segregation Identity & Access Multi-factor Authentication Access monitoring Event and incident response team operating 24x7 Physical Security Platform security Network security Device Guard 8

Privacy Customers control their content Privacy by Design Content and data is not used for advertising and marketing Protection from Government Surveillance No Standing Access policy Deletion of

9 Privacy Customers control their content Privacy by Design Content and data is not used for advertising and marketing Protection from Government Surveillance No Standing Access policy Deletion of customer data on request and on contract termination Customer choices for data location Redirect law enforcement requests to the customers Ongoing Product investments: Customer generated and controlled encryption keys protect data at rest Customer Lockbox for Office 365 brings the customer into the approval workflow

10 Compliance Customers can store and manage their content in compliance History and Expertise Key security certifications and attestations ISO Certification ISO/IEC SOC 1, SOC 2, Cloud Security Alliance Cloud Controls Matrix, EU Model Clauses, HIPAA BAA, FedRAMP, PCI DSS Compliance-enabled controls FISMA/FedRAMP Privacy protected in contractual terms Microsoft Trust Centers give visibility into compliance efforts Certification Audit

11 Transparency Customers know what is happening Transparent and easy-to-understand data use policies Visibility into where data is stored Visibility into how data is accessed and used Visibility into processes, policies and practices via Trust Centers Visibility into access and usage reporting CSA STAR Microsoft Law Enforcement Requests Report Government Security Program

12 Uruguay Security in Public Sector Risk data in Central Administration Other data in Central Administration Other Government Agencies Should be stored in secure servers in the country There are no restrictions Just for Presidency, Ministries, and its dependencies. No restrictions for other agencies

13 Uruguay Security and privacy National regulations International standards: ISO Privacy standards: ISO There re no specific regulations on security for cloud providers URyCDP recommends adopting ISO 27001; Microsoft s cloud is certified New standard in personal information protection; Microsoft s cloud was first and only certified

14 A cloud you can trust Commitment, confidence, credibility Commitment to principles worthy of your trust Standards of excellence worthy of your confidence Experience and advocacy for a cloud-first world

16 Microsoft Enterprise Cloud Microsoft Azure Trust Center Office 365 Trust Center Dynamics CRM Online Microsoft Law Enforcement Request Report Cyber Trust Blog

Microsoft Azure. White Paper Security, Privacy, and Compliance in

Microsoft Azure. White Paper Security, Privacy, and Compliance in White Paper Security, Privacy, and Compliance in Security, Privacy, and Compliance in Executive Summary The adoption of cloud services worldwide continues to accelerate, yet many organizations are wary