Microsoft Issues Security Guidelines for Windows Azure

When it comes to cloud services, Microsoft is said by outside observers to have done a respectable job at ensuring that its Business Productivity Online Services and, more recently, its Windows and SQL Azure offerings are secure. But deploying applications to the cloud requires additional considerations to ensure data doesn't get into the wrong hands.

As a result, Microsoft this week released a version of its Security Development Lifecycle, which focuses on how to build security into Windows Azure applications. Microsoft over the years has updated its SDL, a statement of best practices to those building Windows and .NET applications, to ensure security of those apps.

Those practices however were not designed for the cloud, warns, Michael Howard, principal security program manager of Microsoft's Security Development Lifecycle team, speaking in a pre-recorded video statement embedded in a blog entry published this week. "Many corporations want to move their applications to the cloud but that changes the threats, the threat scenarios change substantially," Howard says.

The 26-page white paper, called "Security Best Practices for Developing Windows Azure Applications," is divided into three sections. The first describes some of the security technologies that are part of Windows Azure including the Windows Identity Foundation, Windows Azure App Fabric Access Control Service and Active Directory Federation Services 2.0. The latter, ADFS 2.0, is a core component for providing common logins to Windows Server and Azure and was released last month, as reported.

The second part of the paper explains how developers can apply the various SDL practices to build more secure Windows Azure applications. Among numerous recommendations, it outlines various threats such as namespace configuration issues and the impact of scoping cookies. It also recommends data security practices such as how to generate shared-access signatures and use of HTTPS in the request URL.

It also identities various threats including denial of service, spoofing, eavesdropping/packet sniffing and the impact associated with multi-tenant hosting and side-channel attacks. The final portion of the paper is a matrix that identifies various threats and how to address them.

"Some of those threat mitigations can be technologies you use from Windows Azure and some of them are threat mitigations that you must be aware of and build into your application," Howard says.

Security is the number one inhibitor to cloud adoption and Microsoft has addressed many key issues, according to experts. "By Microsoft providing extensive training and guidance on how to properly and securely use its cloud platform, it can overcome customer resistance at all levels and achieve revenue growth as well as dominance in this new area.," said Phil Lieberman, president of Lieberman Software Corp., a Microsoft Gold Certified Partner that specializes in enterprise security. "This strategy can ultimately provide significant growth for Microsoft."

Scott Matsumoto, a principal consultant with Washington, D.C.-based Cigital Inc. (a consultancy firm that specializes in security), agreed. "I especially like the fact that they discuss what the platform does and what's still the responsibility of the application developer," Matsumoto said in an e-mail. "I think that it could be [wrongly] dismissed as a rehash of other information or incomplete -- that would be unfair."

The paper can be downloaded here.

About the Author

Jeffrey Schwartz is editor of Redmond magazine and also covers cloud computing for Virtualization Review's Cloud Report. In addition, he writes the Channeling the Cloud column for Redmond Channel Partner. Follow him on Twitter @JeffreySchwartz.

comments powered by Disqus


  • Death of the Dev Machine?

    Here's a takeaway from this week's Ignite 2020 event: An advanced Azure cloud portends the death of the traditional, high-powered dev machine packed with computing, memory and storage components.

  • COVID-19 Is Ignite 2020's Elephant in the Room: 'Frankly, It Sucks'

    As in all things of our new reality, there was no escaping the drastic changes in routine caused by the COVID-19 pandemic during Microsoft's big Ignite 2020 developer/IT pro conference, this week shifted to an online-only event after drawing tens of thousands of in-person attendees in years past.

  • Visual Studio 2019 v16.8 Preview Update Adds Codespaces

    To coincide with the Microsoft Ignite 2020 IT pro/developer event, the Visual Studio dev team shipped a new update, Visual Studio 2019 v16.8 Preview 3.1, with the main attraction being support for cloud-hosted Codespaces, now in a limited beta.

  • Speed Lines Graphic

    New for Blazor: Azure Static Web Apps Support

    With Blazor taking the .NET web development world by storm, one of the first announcements during Microsoft's Ignite 2020 developer/IT event was its new support in Azure Static Web Apps.

  • Entity Framework Core 5 RC1 Is Feature Complete, Ready for Production

    The first release candidate for Entity Framework 5 -- Microsoft's object-database mapper for .NET -- has shipped with a go live license, ready for production.

Upcoming Events