Securing the Microsoft Cloud Infrastructure. Reto Häni Chief Security Officer Microsoft Western Europe MEET SWISS INFOSEC!

Transcription

1 Securing the Microsoft Cloud Infrastructure Reto Häni Chief Security Officer Microsoft Western Europe MEET SWISS INFOSEC!

2

3 Certification & Security Reliance Microsoft s cloud environment Application Software as a Service (SaaS) Consumer and small business services Enterprise services Third-party hosted services Microsoft Cloud Customers IaaS PaaS Physical Cloud Infrastructure and Operations Datacenters Operations Global Network Security 3

4 Cloud security challenges 4

5 Specific concerns we hear from customers Why should I trust Microsoft? What industry audits and security certifications cover Microsoft s Cloud Infrastructure? If I run my service in your cloud, can I meet my compliance needs? How should an enterprise evaluate cloud providers when it comes to security, privacy and compliance? 5

6 Why should I trust the Microsoft cloud? Proven Track Record History of meeting obligations associated with the delivery of over 200 cloud services Scale Spreading cost of robust security and compliance across large number of customers provides a trusted cloud at lower cost Security at our Foundation Years of experience through our Trustworthy Computing Initiative 6

7 Trustworthy foundation Compliance built on Microsoft experience and innovation First Microsoft Datacenter Active Directory Trustworthy Computing Initiative Malware Protection Center SAS 70 SOC 1 UK G-Cloud Level 2 SOC 2 Operations Security Assurance Microsoft Security Response Center Windows Update PCI DSS (infrastructure) Security Development Lifecycle Digital Crimes Unit FISMA P-ATO HIPAA/ HITECH FedRAMP ATO Azure PCI DSS Level 1 ISO/IEC 27001:2005 E.U. Data Protection Directive 7

8 Why should I trust the Microsoft cloud? Proven Track Record History of meeting obligations associated with the delivery of over 200 cloud services Scale Spreading cost of robust security and compliance across large number of customers provides a trusted cloud at lower cost Security at our Foundation Years of experience through our Trustworthy Computing Initiative 8

9 7+ billion worldwide queries each month 50+ billion minutes of connections handled each month 250+ million active users 85% Fortune 500 users 2.4+ million s per day 30+ trillion objects stored 3.5+ million subscribers 48+ million users in 41 markets 50+ million active users 400+ million active users 18+ billion Active Directory authentications per week 200+ Cloud Services 90+ markets worldwide 9

10 Evolving services to hyper-scale Delivering hyper-scale services requires a radical restructuring of technology, processes, and people Enterprise IT Hyper-Scale Enterprise IT Hyper-Scale Seats Talent Data Quality Data Access Assessment Supply Chain Budget Architecture Application integration Infrastructure Reach 10,000 Custodians Directional Pull Physical Process Fixed Cost Siloed Loose Overhead Regional 1,000,000,000 Designers Foundational Push Statistical Strategic Rates Integrated Tight Enabler Global Hardware Deployment Availability Operability Reliability Security Network downtime Network availability Design Deployment time System admin Custom Manual Infrastructure MTBF Hardware Audit Impacting % Primary/Backup Weeks UI Commodity Automated Service MTTR Software Intrinsic Irrelevant 99.9% Active/Active Minutes API 10

11 Microsoft s datacenter evolution Generation 1 Generation 2 Generation 3 Generation 4 Generation PUE PUE PUE PUE PUE Colocation Density Containment Modular SW-Defined Server Capacity 20 year Technology Rack Density & Deployment Minimized Resource Impact Containers, PODs Scalability & Sustainability Air & Water Economization Differentiated SLAs ITPACs & Colocations Reduced Carbon Right-Sized Faster Time-to-Market Outside Air Cooled Fully Integrated Resilient Software Common Infrastructure Operational Simplicity Flexible & Scalable 11

12 Where is my data? Where is data stored? Azure customers may specify the region where data is stored Y(Europe, US, Asia) Who accesses and what is accessed? How to get notified and what do we share? Core customer data accessed only for troubleshooting and malware prevention We notify you of changes in data map information We notify you about new subcontractors We make available a summary of our audit reports upon request 12

13 Microsoft s global datacenter footprint Microsoft Internet connectivity global Azure datacenter by country regions footprint Microsoft s network is one of the two largest in the world Internet users 500,000, ,000, ,999,999 50,000,000 99,999,999 25,000,000 49,999,999 5,000,000 24,999, ,000 4,999,999 50, , ,999 *Operated by 21Vianet 1 million+ servers 100+ Datacenters in over 40 countries

14 Driving operational excellence Investments $15B+ investment in cloud Infrastructure State-of-the-art datacenters One of largest networks globally Geo-replicated customer data Office 365 Windows Azure People 2,000+ people in cloud infrastructure engineering and operations 30,000+ software engineers involved in Cloud-based activities Carbon Footprint Reduction Power Usage Effectiveness (PUE)

15 Microsoft Operations Center (MOC) Organization overview 24x7 incident management teams Examples: Redmond, California, India Globally redundant Follow the Sun staffing model Key MOC programs Crisis management Automation and event management Infrastructure operations Service health monitoring Positioned to bridge interactions and workflows between our operation centers, service owners, and business groups 15

16 Growing Microsoft s networks to hyper-scale Geo-Redundant Service/Application Design All nodes active Network Device Count Growth FY09 FY10 FY11 FY12 FY13 FY14 FY15 Top 2 Most Connected Networks in the World DC-to-Internet Backbone DC-to-DC Backbone Dark Fiber Cache Node Edge Nodes Peer with over 3000 ISPs globally Multiple terabits Over 70 points of presence globally Global backbone connecting MS Datacenter to the Internet Multiple Terabits of Capacity Dark fiber based DC-DC backbone to enable high bandwidth between Datacenters 1.4 million+ route kilometers of 10G and 100G DWDM capacity deployed Backbone consists of over 100,000 route miles of fiber Hosting Services collocated at User location (metro) Multiple Terabits of Edge Interconnect capacity Interconnect over 1600 unique networks around the globe Decoupled DCs Separation of CPU s Storage, SQL Services IT Capacity Unit DC Capacity Unit or Workload Appliance 16

17 Why should I trust the Microsoft cloud? Proven Track Record History of meeting obligations associated with the delivery of over 200 cloud services Scale Spreading cost of robust security and compliance across large number of customers provides a trusted cloud at lower cost Security at our Foundation Years of experience through our Trustworthy Computing Initiative 17

18 Security at our foundation Product team coordination Teams work with all Microsoft Cloud Services to review their security posture Threat models review Teams analyze the product teams threat models to verify that they are complete and current Security bugs review All security bugs are reviewed and addressed using standard bug bars Tools use validation Teams ensure that product teams have correctly and appropriately made use of the tools, documented code, and available patterns and practices Training Requirements Design Implementation Verification Release Response 18

19 Taking the fight directly to cybercriminals We aggressively fight cybercrime and advocate extensively for enhancing cybersecurity / Big data Investigations Legal action Malware disruption IP protection Protection of vulnerable populations Making an impact Disrupting malware and taking down botnets, in partnership with government and commercial organizations, to clean and protect tens of millions of devices Improving products by embedding collected data and intelligence into our platform and services Disrupting and dismantling cybercriminal operations that promote a range of illegal goods and services Developed PhotoDNA to protect children from online exploitation 19

20 Information Security Management System Information Security Management System Predictable audit schedule Information security management forum Risk management program Information security policy program Compliance framework Test and Audit ISO / IEC 27001:2013 certification SSAE 16/ISAE 3402 SOC 1 AT101 SOC 2 and 3 PCI DSS certification FedRAMP P-ATO, FISMA certification and accreditation And more 20

21 Defense-in-depth: infrastructure security Physical Network Host Security Application Data Identity and access management Configuration and vulnerability scanning 24x7x365 Incident response 21

22 Data encryption points Protects user from interception of their communication and helps ensure transaction integrity Protects from bulk interception of data Protects from removal of physical media Protects from interception or loss of data in transit between users 22

23 Microsoft Azure incident response DevOps Engaged Event Detected Security Team Engaged Event Start Incident Assessment Security Event Confirmed Customer Notification Customer Process Step 1 Determine Affected Customers Determine Customer Impact Azure Customer Notification In-depth 9-step incident response process Focus on containment and recovery Makes contractual commitments regarding customer notification 23

24 Microsoft Cloud Compliance Certifications and Attestations as of 01/15/15

25

26 Microsoft cloud resources Microsoft Datacenters Website microsoft.com/datacenters Microsoft Cloud Infrastructure & Operations Blog blogs.technet.com/msdatacenters Microsoft Azure Trust Center azure.microsoft.com/support/trust-center Office 365 Trust Center trustoffice365.com Dynamics CRM Trust Center microsoft.com/dynamics/crm-trust-center Microsoft Intune Trust Center microsoft.com/intune-trust-center 26

27 2015 Microsoft Corporation. All rights reserved. The information herein is for informational purposes only and represents the current view of Microsoft Corporation as of the date of this presentation. Because Microsoft must respond to changing market conditions, it should not be interpreted to be a commitment on the part of Microsoft, and Microsoft cannot guarantee the accuracy of any information provided after the date of this presentation. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION. 27