t a Foresight Consulting, GPO Box 116, Canberra ACT 2601, AUSTRALIA e info@foresightconsulting.com.au foresightconsulting.com.

Transcription

1 e Mr. James Kavanagh Chief Security Advisor Microsoft Australia Level 4, 6 National Circuit, Barton, ACT September 2014 Microsoft Azure IRAP Assessment Letter of Compliance Dear Mr. Kavanagh, This document is to act as a letter of compliance for the Microsoft Azure service. From June through September 2014 Foresight Consulting was engaged to conduct an IRAP assessment of the Microsoft Azure service, consistent with the process prescribed in the Australian Government Information Security Manual(ISM) and Protective Security Policy Framework. The assessment was conducted by Peter Baussmann and Greg Mansill who are both registered assessors within the Australian Signals Directorate Information Security Registered Assessors Program (IRAP). Microsoft Azure was assessed with regard to ISM controls for unclassified but sensitive information referred to as UNCLASSIFIED (DLM). Within the ISM, these are identified as Government system (G) controls. The scope of assessment included the following services: Virtual Machines, Cloud Services, Storage Services, Virtual Network, Azure SQL DB, Azure Active Directory; Global Foundation Services (Providers of the global network and physical infrastructure); and Australian Data Centre facilities. Microsoft Azure provides a range of additional cloud services that in general are considered to inherit the security controls and attributes of the assessed core services. Foresight conducted the IRAP assessment in two stages: The first stage determined whether the system architecture (including information security documentation) is based on sound security principles and has addressed all applicable controls from the ISM. The second stage determined whether the controls, as approved by the system owner and reviewed during the first stage, have been implemented and are operating effectively. Validation included onsite inspections, personnel interviews, process demonstrations, configuration reviews and review of existing certification reports and evidence. Foresight Consulting also reviewed the Australian Azure System Security Plan and have prepared a detailed Report of Compliance documenting applicability and compliance with specific controls. A summary of assessment findings is provided in the attached table. The principal finding of this assessment process is that the applicable Information Security Manual controls are in place and fully effective within Microsoft Azure for the processing, storage and transmission of UNCLASSIFIED (DLM) Australian Government data. If in the future, a significant change occurs to services within scope of this assessment, Microsoft should advise an IRAP assessor for consideration of reassessment. Microsoft should also review the latest versions of the Australian Government Information Security Manual as they are published for changes to controls applicable to the service. Regards, Peter Baussmann, CISSP, CISM, CCSA, PCI-QSA, PCI-P, ASD IRAP Assessor Principal Security Consultant, Foresight Consulting 1

2 e Not Information Security Risk Management Risk Assessment Foresight found the controls in place to be effective for the management of Azure information Security Risk Management Plan security risks. Roles and Responsibilities Chief Information Security Officer Foresight found that the roles identified met the IT Security Advisor intent of the roles described within the ISM and that team responsibilities were clearly defined. IT Security Manager IT Security Officer System Owner System Users Information Security Documentation Documentation Framework The Information Security Policies in place provide clear policy guidance and are considered to be an Information Security Policy effective security control for Azure. System Security Plan Standard Operating Procedures Incident Response Plan Business Continuity and Disaster Recovery Plan Information Security Monitoring Vulnerability Management The Microsoft Azure Australia SSP clearly details security controls for the system and is considered to be an effective security documentation control for the Azure service. The Microsoft Standard Operating Procedures reviewed addressed all security control areas and are considered to meet the intent of the applicable controls within the ISM. Microsoft Incident Management Standard Operating Procedures meet the ISM requirements for an Incident Response Plan and are assessed to be effective security controls. Business continuity and disaster recovery are suitably addressed and Azure is considered compliant with the ISM controls relating to availability, business continuity and disaster recovery. Microsoft s vulnerability management practices are assessed as effective for the identification, 2

3 e Not assessment, remediation and ongoing management of vulnerabilities. Change Management The change management process is considered an effective security control for managing changes to the Azure service. Cyber Security Incidents Detecting, Reporting and Managing Cyber Security Incidents Microsoft s incident management practices are considered compliant with the ISM and an effective security control for detecting, reporting and managing security incidents relating to the Azure service. Physical & Environmental Security Physical Security for Systems The physical security controls in place meet or exceed ISM requirements for storage of UNCLASSIFIED (DLM) data. Personnel Security for Information Systems Information Security Awareness & Training Authorisations, Security Clearances & Briefings Review of personnel security measures and interviews with security personnel provided assurance to Foresight that personnel security is managed effectively within the organisation. Communications Security Communications Security Communications security within Azure data centres is considered effective to meet the intent of the applicable controls within the ISM Communications Security section for the handling of UNCLASSIFIED (DLM) information. Product Security Product Security Microsoft s product security processes, combined with supporting vulnerability management, software and media security processes are assessed as an effective implementation of the ISM Product Security controls. Media Security Media Security Foresight found effective media security controls are in place for the handling, sanitisation, destruction and disposal of media. 3

4 e Not Asset Management Software Security SOE Application Whitelisting Software Application Development Database Systems Access Privileged Access Event Logging and Auditing Secure Administration Secure Administration Network Security Network Management, Design and Configuration Ensuring Service Continuity Foresight found that asset management is performed effectively within Microsoft consistent with the requirements for UNCLASSIFIED (DLM) information. Operating system security controls are considered effective for the handling and storage of The application whitelisting controls in place within Azure meet the intent of the ISM for the effective control of permitted executables. Foresight found that the approach Microsoft takes to software security including secure development and deployment meets or exceeds the security requirements of the ISM. Microsoft Azure SQL DB security controls meet the compliance requirements for Database Systems within the ISM. Privileged access to systems is appropriately managed and monitored with controls assessed as effective with regard to applicable ISM controls. Azure s collection and management of system and network event logs is a thorough and effective mechanism and meets the ISM requirements for event logging and auditing. Foresight found that the reviewed security controls for secure administration are considered effective. The network management and configuration mechanisms are considered effective security controls for the transmission and handling of UNCLASSIFIED (DLM) data. The DDoS controls in place are considered operationally effective and meet the service continuity compliance requirements of the ISM. 4

5 e Not Intrusion Detection and Prevention Cryptography Cryptographic Security Cross Domain Security Cross Domain Security Data Transfers Data Transfers The intrusion detection mechanisms within Azure are considered effective security controls for detecting malicious or unusual activities within a cloud environment and meet the intent of the controls contained within the ISM. The cryptographic functions used within Azure are considered to be effective security controls. The firewalling capability implemented within Azure is considered effective for the protection of The security mechanisms in place for data transfer meet the intent of the ISM and are considered effective security controls for the transfer of 5