WIXLIB

Software and servicesSecure Development Lifecycle (SDL)Privacy and security considerations are embedded throughthe SDL, a software development process that helpsdevelopers build more secure software and address securityand privacy compliance requirements. The SDL includes: Risk assessments Attack surface analysis andreduction Threat modeling Incident response Release review and certificationProactive testing and monitoringLearn more.Microsoft Digital Crimes UnitMicrosoft's Digital Crimes Unit (DCU)seeks to provide a safer digital experiencefor every person and organization on theplanet by protecting vulnerablepopulations, fighting malware, andreducing digital risk.Secure developmentacross the MicrosoftcloudMicrosoft Azure, Office 365,Dynamics CRM Online, and allother enterprise cloud servicesuse the processes documentedin the SDL.Learn more.SecurityDevelopmentLifecyclePrevent Breach, Assume BreachIn addition to the “prevent breach” practices of threatmodeling, code reviews, and security testing, Microsoft takesan “assume breach” approach to protecting services and data: Simulate real-world breaches Live site penetration testing Centralized security loggingand monitoring Practice security incidentresponseRead more.Microsoft EnterpriseCloud Red TeamingMicrosoft Cyber Defense Operations CenterThe Microsoft Cyber Defense Operations Center is a 24x7cybersecurity and defense facility that unites our security expertsand data scientists in a centralized location. Advanced softwaretools and real-time analytics help us protect, detect, andrespond to threats to Microsoft's cloud infrastructure, productsand devices, and our internal resources.Datacenter infrastructure andnetworking securityOperational Security for Online Services (OSA)OSA is a framework that focuses on infrastructure issues tohelp ensure secure operations throughout the lifecycle ofcloud-based services.Private connectionCustomers can useExpressRoute to establish aprivate connection to Azuredatacenters, keeping theirtraffic off the Internet.Learn more.Microsoft AzureExpressRouteLearn more.Operational Securityfor Online Services(OSA)Physical datacenter security24-hour monitored physical securityDatacenters are physically constructed, managed, andmonitored to shelter data and services from unauthorizedaccess as well as environmental threats.Zero standing privilegesMicrosoft maintains a No Standing Access policy oncustomer data. We've engineered our products so that amajority of service operations are fully automated and onlya small set of activities require human involvement. Accessby Microsoft personnel is granted only when necessary forsupport or operations; access is carefully managed andlogged, then revoked when no longer needed. Datacenteraccess to the systems that store customer data is strictlycontrolled via lock box processes.December 2018Data destructionWhen customers delete data or leave a service, they can taketheir data with them and have it deleted permanently fromMicrosoft servers. Microsoft follows strict standards foroverwriting storage resources before reuse, as well as for thephysical destruction of decommissioned hardware. Faultydrives and hardware are demagnetized and destroyed.Learn more.Video: Microsoft Cloud AzureData Center(s) – The InsideLong Tour 2018 Microsoft Corporation. All rights reserved. To send feedback about this documentation, please write to us at CloudAdop t@microsoft.com.

Microsoft Cloud Securityfor Enterprise ArchitectsWhat IT architects need to know about security andtrust in Microsoft cloud services and platformsThis topic is 4 of 5 in a series12345Customer responsibilities and roadmapTake a systematic approach to security for on-premises and in the cloudWhile Microsoft is committed to the privacy and security of your data andapplications in the cloud, customers must take an active role in the securitypartnership. Ever-evolving cybersecurity threats increase the requirements forsecurity rigor and principles at all layers for both on-premises and cloudassets. Enterprise organizations are better able to manage and addressconcerns about security in the cloud when they take a systematic approach.Moving workloads to the cloud shifts many security responsibilities and coststo Microsoft, freeing your security resources to focus on the criticallyimportant areas of data, identity, strategy, and governance.Refer to these example solutions for implementation guidance:Microsoft Security Guidance for Political Campaigns, NonprofitOrganizations, and Other Agile OrganizationsMicrosoft 365 Enterprise DocumenationOffice 365 security roadmap – Top priorities for the first 30 days, 90 days, andbeyondImportant: How to use this pageThis page includes a methodical list of actions that Microsoft recommendsto defend your data, identities, and applications against cybersecuritythreats. These actions are categorized and presented in a stack. Categoriesat the top of the stack apply across SaaS, PaaS, IaaS, and private cloud. Thescope of categories decreases further down the stack.SaaSSoftware as a ServicePaaSPlatform as a ServiceIaaSInfrastructure as a ServicePrivate cloud1. Security strategy, governance, and operationalization: Provide clear vision, standards, and guidance for your organizationA. Develop cloud security policiesB. Manage continuous threatsD. Contain risk by assuming breachPolicies enable you to align your securitycontrols with your organization’s goals, risks,and culture. Policies should provide clearunequivocal guidance to enable good decisionsby all practitioners. Document security policies in enough detailto guide personnel into quick and accuratedecisions while adopting and managing cloudservices. Ensure you have sufficient detail onpolicy areas that are well-established andcritically important to your security posture. Balance security and usability. Securitycontrols that overly restrict the ability ofadmins and users to accomplish tasks will beworked around. Build buy-in through boththreat education and inclusion in the securitydesign process. Document protocols and processes forperforming critically important security taskssuch as using administrative credentials,responding to common security events, andrecovering from significant security incidents. Embrace “Shadow IT.” Identify theunmanaged use of devices, cloud services,and applications. Identify businessrequirements that led to their use as well asthe business risk that they bring. Work withbusiness groups to enable requiredcapabilities while mitigating risks.The evolution of security threats and changesrequire comprehensive operational capabilitiesand ongoing adjustments. Proactively managethis risk. Establish operational capabilities to monitoralerts, investigate incidents, initiate remediationactions, and integrate lessons learned. Build external context of threats usingavailable resources such as threat intelligencefeeds, Information Sharing and Analysis Centers(ISACs), and other means. Validate your security posture by authorizedred team and/or penetration testing activity.When planning security controls and securityresponse processes, assume an attacker hascompromised other internal resources such asuser accounts, workstations, and applications.Assume an attacker will use these resources asan attack platform.Modernize your containment strategy by: Identifying your most critical assets such asmission-critical data, applications, anddependencies. Security for these must be at ahigher level without compromising usability. Enhancing isolation between security zonesby increasing rigor of exception management.Apply threat modelling techniques to allauthorized exceptions and analysis of theseapplication data flows including identitiesused, data transmitted, application andplatform trustworthiness, and ability to inspectinteraction. Focus containment within a security zoneon preserving integrity of the administrativemodel rather than on network isolation.Continued on next pageWhite paper: Microsoft Enterprise Cloud RedTeamingC. Manage continuous innovationThe rate of capability releases and updates fromcloud services requires proactive management ofpotential security impacts. Define a monthly cadence to review andintegrate updates of cloud capabilities,regulatory and compliance requirements,evolving threats, and organizational objectives. Prevent configuration drift with periodicreviews to ensure technologies, configurations,and operational practices stay in compliancewith your policies and protocols.

SaaSSoftware as a ServicePaaSPlatform as a ServiceIaaSInfrastructure as a ServicePrivate cloud2. Administrative control: Defend against the loss of control of your cloud services and on-premises systemsA. Least privilege admin modelC. Use strong authenticationE. Enforce stringent security standardsApply “least privilege” approaches to youradministrative model, including: Limit the number of administrators ormembers of privileged groups. Delegate less privileges to accounts. Provide privileges on demand (“just in time”). Have existing administrators perform tasksinstead of adding additional administrators. Provide processes for emergency access andrare use scenarios.Use credentials secured by hardware, multifactor authentication (MFA), and conditionalaccess for all identities with administrativeprivileges. This mitigates risk of stolencredentials being used to abuse privilegedaccounts.Azure Multi-Factor AuthenticationAdministrators control significant numbers oforganizational assets. Rigorously measure andenforce stringent security standards onadministrative accounts and systems. Thisincludes cloud services and on-premisesdependencies such as Active Directory, identitysystems, management tools, security tools,administrative workstations, and associatedoperating systems.Securing Privileged AccessEnable Azure AD Privileged IdentityManagementUse privileged access management in Office 365B. Harden security dependenciesSecurity dependencies include anything that hasadministrative control of an asset. Ensure thatyou harden all dependencies at or above thesecurity level of the assets they control. Securitydependencies for cloud services commonlyinclude identity systems, on-premisesmanagement tools, administrative groups andaccounts, and workstations where theseaccounts logon.Microsoft Advanced Threat AnalyticsConditional access in Azure Active DirectoryAuthenticating identities without passwordsthrough Microsoft PassportD. Use dedicated admin accounts andworkstationsSeparate high impact assets from highly prevalentinternet browsing and email risks: Use dedicated accounts for privilegedadministrative roles for cloud services and onpremises dependencies. Use dedicated, hardened workstations foradministration of high-business impact ITassets. Do not use high privilege accounts on deviceswhere email and web browsing take place.Securing Privileged AccessWhite paper: Security Management in MicrosoftAzureF. Monitor admin accountsClosely monitor the use and activities ofadministrative accounts. Configure alerts foractivities that are high impact as well as forunusual or rare activities.Enable Azure AD Privileged IdentityManagementCloud App SecurityG. Educate and empower adminsEducate administrative personnel on likelythreats and their critical role in protecting theircredentials and key business data.Administrators are the gatekeepers of access tomany of your critical assets. Empowering themwith this knowledge will enable them to bebetter stewards of your assets and securityposture.3. Data: Identify and protect your most important information assetsA. Establish information protectionprioritiesThe first step to protecting information isidentifying what to protect. Develop clear,simple, and well-communicated guidelines toidentify, protect, and monitor the mostimportant data assets anywhere they reside.File Protection Solutions in Office 365Data classification toolkitB. Protect High Value Assets (HVAs)Establish the strongest protection for assets thathave a disproportionate impact on theorganizations mission or profitability. Performstringent analysis of HVA lifecycle and securitydependencies, and establish appropriate securitycontrols and conditions.C. Find and protect sensitive assetsD. Set organizational minimum standardsIdentify and classify sensitive assets. Define thetechnologies and processes to automaticallyapply security controls.Establish minimum standards for trusted devicesand accounts that access any data assetsbelonging to the organization. This can includedevice configuration compliance, device wipe,enterprise data protection capabilities, userauthentication strength, and user identity.File Protection Solutions in Office 365Secure SharePoint Online sites and filesPrevent data loss in Office 365Identity and Device Protection for Office 365Office 365 information protection for GDPRIdentity and device access for Office 365and other SaaS appsAzure Information ProtectionE. Establish user policy and educationAzure Key VaultUsers play a critical role in information securityand should be educated on your policies andnorms for the security aspects of datacreation, classification, compliance, sharing,protection, and monitoring.Always Encrypted (Database Engine)SQL database dynamic data masking4. User identity and device security: Strengthen protection of accounts and devicesA. Use Strong AuthenticationC. Educate, empower, and enlist usersUse credentials secured by hardware or multifactor authentication (MFA) for all identities tomitigate the risk that stolen credentials can beused to abuse accounts. User identities hosted in Azure ActiveDirectory (Azure AD). On-premises accounts whose authentication isfederated from on-premises Active Directory.Users control their own accounts and are on thefront line of protecting many of your criticalassets. Empower your users to be good stewardsof organizational and personal data. At the sametime, acknowledge that user activities and errorscarry security risk that can be mitigated butnever completely eliminated. Focus onmeasuring and reducing risk from users. Educate users on likely threats and their rolein protecting business data. Increase adversary cost to compromise useraccounts. Explore gamification and other means ofincreasing user engagement.Azure Multi-Factor AuthenticationMicrosoft Passport and Windows HelloPassword-less phone sign-in with the MicrosoftAuthenticator appB. Manage trusted and compliant devicesEstablish, measure, and enforce modern securitystandards on devices that are used to accesscorporate data and assets. Apply configurationstandards and rapidly install security updates tolower the risk of compromised devices beingused to access or tamper with data.Identity and device protection for Office 365 andother SaaS appsContinued on next pageProtect your account and devices from hackersand malware4 ways to stay safe online (pdf)4 ways to stay safe online (PowerPoint template)D. Monitor for account andcredential abuseOne of the most reliable ways to detect abuseof privileges, accounts, or data is to detectanomalous activity of an account. Identify activity that is normal and physicallypossible. Alert on unusual activity to enablerapid investigation and response. Use Cloud App Security to detect and alerton anomalous activity. For accounts in Azure AD, use the integratedanalytics to detect unusual activity.Cloud App SecurityWhite paper: Microsoft Azure Security andAudit Log ManagementActivity Reports in the Office 365 admin center

PaaSPlatform as a ServiceIaaSInfrastructure as a ServicePrivate cloud5. Application security: Ensure application code is resilient to attacksA. Secure applications that you acquire Review the security development processesand operational practices of vendors beforeacquiring applications. Build this into youracquisition process. Follow security configuration guidance andrecommendations provided by the vendor forthe application. Apply all vendor security updates as rapidly asyour testing requirements allow. Ensure toupdate middleware and dependenciesinstalled with the applications. Discontinue your use of software before itreaches end of support status.B. Follow the Security DevelopmentLifecycle (SDL)Software applications with source code you developor control are a potential attack surface. Theseinclude PaaS apps, PaaS apps built from samplecode in Azure (such as WordPress sites), and appsthat interface with Office 365.Follow code security best practices in the MicrosoftSecurity Development Lifecycle (SDL) to minimizevulnerabilities and their security impact.See: www.microsoft.com/sdl6. Network: Ensure connectivity, isolation, and visibility into anomalous behaviorA. Update your network security strategyand architecture for cloud computingEnsure your network architecture is ready for thecloud by updating your current approach ortaking the opportunity to start fresh with amodern strategy for cloud services andplatforms. Align your network strategy with your: Overall security strategy and governance Containment model and identity strategy Cloud services capabilities and constraintsYour design should address securingcommunications: Inbound from the Internet Between VMs in a subscription Across subscriptions To and from on-premises networks From remote administration hostsMicrosoft Cloud Networking for Enterprise ArchitectsB. Optimize with cloud capabilitiesCloud computing offers uniquely flexible networkcapabilities as topologies are defined in software.Evaluate the use of these modern cloud capabilitiesto enhance your network security auditability,discoverability, and operational flexibility.C. Manage and monitor network securityEnsure your processes and technology capabilitiesare able to distinguish anomalies and variances inconfigurations and network traffic flow patterns.Cloud computing utilizes public networks, allowingrapid exploitation of misconfigurations that shouldbe avoided or rapidly detected and corrected. Closely monitor and alert on exceptions. Apply automated means to ensure your netwo

The security of your Microsoft cloud services is a partnership between you and Microsoft. Keys to success Enterprise organizations benefit from taking a methodical approach to cloud security. This involves investing in core capabilities within the organization that lead to secure environments. Security in