News

Microsoft Issues Security Guidelines for Windows Azure

• By Jeffrey Schwartz
• June 15, 2010

When it comes to cloud services, Microsoft is said by outside observers to have done a respectable job at ensuring that its Business Productivity Online Services and, more recently, its Windows and SQL Azure offerings are secure. But deploying applications to the cloud requires additional considerations to ensure data doesn't get into the wrong hands.

As a result, Microsoft this week released a version of its Security Development Lifecycle, which focuses on how to build security into Windows Azure applications. Microsoft over the years has updated its SDL, a statement of best practices to those building Windows and .NET applications, to ensure security of those apps.

Those practices however were not designed for the cloud, warns, Michael Howard, principal security program manager of Microsoft's Security Development Lifecycle team, speaking in a pre-recorded video statement embedded in a blog entry published this week. "Many corporations want to move their applications to the cloud but that changes the threats, the threat scenarios change substantially," Howard says.

The 26-page white paper, called "Security Best Practices for Developing Windows Azure Applications," is divided into three sections. The first describes some of the security technologies that are part of Windows Azure including the Windows Identity Foundation, Windows Azure App Fabric Access Control Service and Active Directory Federation Services 2.0. The latter, ADFS 2.0, is a core component for providing common logins to Windows Server and Azure and was released last month, as reported.

The second part of the paper explains how developers can apply the various SDL practices to build more secure Windows Azure applications. Among numerous recommendations, it outlines various threats such as namespace configuration issues and the impact of scoping cookies. It also recommends data security practices such as how to generate shared-access signatures and use of HTTPS in the request URL.

It also identities various threats including denial of service, spoofing, eavesdropping/packet sniffing and the impact associated with multi-tenant hosting and side-channel attacks. The final portion of the paper is a matrix that identifies various threats and how to address them.

"Some of those threat mitigations can be technologies you use from Windows Azure and some of them are threat mitigations that you must be aware of and build into your application," Howard says.

Security is the number one inhibitor to cloud adoption and Microsoft has addressed many key issues, according to experts. "By Microsoft providing extensive training and guidance on how to properly and securely use its cloud platform, it can overcome customer resistance at all levels and achieve revenue growth as well as dominance in this new area.," said Phil Lieberman, president of Lieberman Software Corp., a Microsoft Gold Certified Partner that specializes in enterprise security. "This strategy can ultimately provide significant growth for Microsoft."

Scott Matsumoto, a principal consultant with Washington, D.C.-based Cigital Inc. (a consultancy firm that specializes in security), agreed. "I especially like the fact that they discuss what the platform does and what's still the responsibility of the application developer," Matsumoto said in an e-mail. "I think that it could be [wrongly] dismissed as a rehash of other information or incomplete -- that would be unfair."

The paper can be downloaded here.