3. Pre-adoption concern 60% cited concerns around data security as a barrier to adoption 45% concerned that the cloud would result in a lack of data control SECURITY Design/Operation Infrastructure Network Identity/access Data PRIVACY COMPLIANCE

4. Reduce cost High assurance that your data is safe Meet compliance requirements Central control over all assets Move incrementally to Azure Let your apps reason over data Deploy quickly Scale infinitely Make your data highly available

7. If we receive a government demand for data held by a business customer, we take steps to redirect the government to the customer directly, and we notify the customer unless we are legally prohibited from doing so. In the first half of 2014, Microsoft only received five requests from law enforcement for five users associated with an enterprise customer. In all five cases, the requests were rejected or law enforcement was successfully redirected to the customer.

9. Reduce cost High assurance that your data is safe Meet compliance requirements Central control over all assets Move incrementally to Azure Let your apps reason over data Deploy quickly Scale infinitely Make your data highly available

10. Economies of scale Pay-for-use pricing Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Unified identity management Ease to deploy, and to scale Great HYBRID options Huge investment in security Strong built-in security controls Optional security controls for customers Virtually infinite storage

11. Economies of scale Pay-for-use pricing Unified identity management Ease to deploy, and to scale Great HYBRID options Optional security controls for customers Virtually infinite storage Part 1 of this presentation: Built-in controls in Azure Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Huge investment in security Strong built-in security controls

12. Economies of scale Pay-for-use pricing Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Ease to deploy, and to scale Huge investment in security Strong built-in security controls Virtually infinite storage Part 2 of this presentation: Controls available for Azure customers Unified identity management Great HYBRID options Optional security controls for customers

16. 100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Malware Protection Center Microsoft Security Response Center Windows Update 1 st Microsoft Data Center Active Directory SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH Digital Crimes Unit SOC 2 E.U. Data Protection Directive Operations Security Assurance 19891995200020052010

17. 100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Windows Update 1 st Microsoft Data Center Active Directory SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH Digital Crimes Unit SOC 2 E.U. Data Protection Directive Operations Security Assurance 19891995200020052010 Malware Protection Center Microsoft Security Response Center

18. 100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Malware Protection Center Microsoft Security Response Center Windows Update 1 st Microsoft Data Center Active Directory SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH SOC 2 E.U. Data Protection Directive Operations Security Assurance Digital Crimes Unit 19891995200020052010

19. 100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Malware Protection Center Microsoft Security Response Center Windows Update 1 st Microsoft Data Center Active Directory Digital Crimes Unit SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH SOC 2 E.U. Data Protection Directive 19891995200020052010 Operations Security Assurance

20. DataApplicationNetworkHost Security Identity & Access ManagementPhysical 24x7x365 Incident Response

21. REDUCE SECURITY COSTS + MAINTAIN FLEXIBILITY, ACCESS, & CONTROL CustomerMicrosoft On-PremisesIaaS PaaSSaaS Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime

22. Data location Customer Choice Chooses region where data resides Configures data replication options Microsoft Creates multiple copies of data in the datacenter Geo-replication in a datacenter 400+ miles away Does not transfer Customer Data outside of a geo

24. Data Deletion Data retention and destruction Disk Handling Data Retention

25. Protect data in transit Secured by TLS best practices Perfect forward secrecy 2048-bit keys Strong ciphers are used / FIPS 140-2 support Import / Export Service (Physical Media Shipment) Only accepts BitLocker encrypted data disks Datacenter to Datacenter Encrypts customer data transfer between Azure datacenters by EOY Data in transit between a user and the service Protects user from interception of their communication and helps ensure transaction integrity Data in transit between data centers Protects from bulk interception of data

26. Microsoft operator access & logging Operator requests access Grants temporary privilege on specific asset No standing access to Customer Data Grants least privilege required to complete a task Multi-factor authentication required for all administration Locked down admin console used for operator access Access is audited, logged, and analyzed Just in Time & Role Based Access Microsoft Network Azure

30. Economies of scale Pay-for-use pricing Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Ease to deploy, and to scale Huge investment in security Strong built-in security controls Virtually infinite storage Part 2 of this presentation: Controls available for Azure customers Unified identity management Great HYBRID options Optional security controls for customers

31. Virtual Machine with custom app Storage …

33. ■■■■■■ @microsoft.com

39. Virtual Machine with custom app StorSimple … Protection elements Access control: No change. StorSimple appliance appears like a NAS (via iSCSI) Encryption: Automatic. StorSimple protects all data that it writes to Azure with AES-256 + SHA-256. Keys stay on-premises. Logs: StorSimple emits audit logs. Availability: Azure takes care of this automatically. Protection elements Access control: No change. StorSimple appliance appears like a NAS (via iSCSI) Encryption: Automatic. StorSimple protects all data that it writes to Azure with AES-256 + SHA-256. Keys stay on-premises. Logs: StorSimple emits audit logs. Availability: Azure takes care of this automatically.

42. Protection elements Access control: Stays on-premises, no change. Encryption: Use TDE. You have choice of crypto algorithm. Keys stay on-premises, and can be offloaded to HSM of your choice. Logs: SQL Server audit log, no change. Availability: Azure takes care of this automatically. Protection elements Access control: Stays on-premises, no change. Encryption: Use TDE. You have choice of crypto algorithm. Keys stay on-premises, and can be offloaded to HSM of your choice. Logs: SQL Server audit log, no change. Availability: Azure takes care of this automatically.

44. Virtual Machine with custom app Storage …

45. Protection elements Access control: No change, same as on-premises SQL server. Encryption: Use TDE. Keep key in Azure or install optional EKM provider to offload to an on-premises HSM. Logs: No change. SQL Server audit log. Availability: Azure takes care of this automatically. Protection elements Access control: No change, same as on-premises SQL server. Encryption: Use TDE. Keep key in Azure or install optional EKM provider to offload to an on-premises HSM. Logs: No change. SQL Server audit log. Availability: Azure takes care of this automatically.

47. Azure SQL DB Virtual Machine with custom app Storage … Protection elements Access control: Username/password per server, controlled by Azure subscriber who created server. Encryption: N.A. Logs: Azure SQL DB audit feature, now in preview. Availability: Azure takes care of local redundancy automatically. You can optionally make it geo- redundant. Protection elements Access control: Username/password per server, controlled by Azure subscriber who created server. Encryption: N.A. Logs: Azure SQL DB audit feature, now in preview. Availability: Azure takes care of local redundancy automatically. You can optionally make it geo- redundant.

49. Virtual Machine Virtual Machine with custom app Storage … Active Directory Users, machines Key Manager e.g. HSM Protection elements Access control: BitLocker key protector. Encryption: Bitlocker. Multiple “protectors” available to protect key – password, certificate, AD group, … Logs: Windows event log. Availability: VHD is stored in Azure storage, which automatically replicates it. Protection elements Access control: BitLocker key protector. Encryption: Bitlocker. Multiple “protectors” available to protect key – password, certificate, AD group, … Logs: Windows event log. Availability: VHD is stored in Azure storage, which automatically replicates it. Azure storage

51. Virtual Machine boot volume encryption and pre-boot authorization Virtual Machines

53. Virtual Machine with custom app Storage … Protection elements Access control: Storage access key + custom Encryption: Custom Logs: Azure Storage logs Availability: Azure takes care of this automatically. Protection elements Access control: Storage access key + custom Encryption: Custom Logs: Azure Storage logs Availability: Azure takes care of this automatically. Virtual Machine in Azure

56. Virtual Machine with custom app Storage … App/device outside your organization

57. Virtual Machine with custom app Storage … Active Directory Users, machines Key Manager e.g. HSM App/device outside your organization

58. Virtual Machine with custom app Storage … Active Directory Users, machines Key Manager e.g. HSM App/device outside your organization

62. www.microsoft.com/learning http://developer.microsoft.com http://microsoft.com/technet http://channel9.msdn.com/Events/TechEd