Staying Secure In The Cloud

Lately, I have been thinking more about how to build secure cloud applications and the implications of such an endeavor. Interestingly enough, as I sat down to write this post I stumbled upon some news today about how an Azure customer had saved Microsoft from a security disaster, you can read all the details about it here: http://www.infoworld.com/article/3144661/security/azure-customer-saves-microsoft-from-an-rhel-disaster.html
Essentially, Microsoft dropped the security ball. And this happened to a company that is security conscious when it comes to the cloud, even to the point of providing high level guidance on Azure Security Management to include auditing and policy enforcement. In any case, luckily the incident was remediated and I am sure Microsoft and the folks behind that event learned quite a bit from the fiasco.

Nevertheless, I still think that the public cloud offers a competitive advantage when it comes to building applications securely in the cloud, because of all the services available to secure an application that you would either have to build yourself or buy off the shelf from another vendor if possible.

So just to name a few services that I have been looking into, that make the Azure public cloud security offering a compelling one, I will summarize just some of them:

• Azure Active Directory This service is the foundation for most of the services offered by Azure. It is essentially the gatekeeper to all of your application data and assets. And it is the same identity foundation used by Office 365 and the Microsoft Graph, which powers millions of authenticated users per day.

• Azure Key Vault Are you still deploying your configuration settings in plain text in your application? Well, Azure Key Vault secures your cryptographic keys and secrets used by your cloud applications while adhering to the highest levels of encryption.

• SQL Azure AD Authentication In the on-premises era, it was usually a good idea to use a service account to connect to your SQL Server instance; now that same secure approach is available in Azure with the unmatched scale of the cloud.

• Azure Storage Service Encryption To me this is a no brainer, essentially you just flip a switch to enable encryption of your storage accounts and your data is encrypted using 256-bit AES. The encryption keys are managed by Microsoft, but I suppose that could change in the future.

• Transparent Data Encryption with Azure SQL Database This feature offers "transparent data encryption" by performing real-time encryption and decryption of your application's database at rest without requiring changes to your application.

• Visual Studio Team Services (VSTS) Now, this may seem like an unusual choice given that VSTS does not necessarily correlate directly as a security service; however, if you look closely you will see that VSTS is indeed a good example of keeping data safe in the cloud by utilizing the security services offered by Azure. For more information on VSTS and how it leverages the cloud to keep your data secure see this link: https://www.visualstudio.com/en-us/articles/team-services-security-whitepaper

These are just a few of the services that Microsoft Azure offers in order to provide a secure foundation for all your applications to build upon. With these types of security services so readily available, and an existing good example of using them effectively in highly available production scenarios such as VSTS, I would highly recommend taking a closer look at these services and strongly consider using them.
I am surprised sometimes to still find developers and technical staff that are tinkering on how to roll their own security services, whatever they may be, which have already been done for them in a public cloud offering at scale. This is not isolated only to software, as infrastructure folks can also spend too much time and effort building private clouds when they should just be taking advantage of what the public cloud already offers IMO.
I would argue that this is where the focus of your application should be, in adding new features, and at the same time working on integrating these types of cloud security services into your architecture and let Azure worry about the security details. Besides, unless you really know what you are doing, it is best to leave it to the experts to write the secure services and libraries for the rest of us developers to consume.

I believe we are living in interesting but dangerous times, just take a look at the San Francisco Transit Hack. Unfortunately, this incident is just one of the myriad incidents that have occurred in 2016 alone, and with 2017 around the corner I am bracing for impact. :)
So as you think about how to keep your applications and infrastructure secure, you also have to think of what will be your response when the executives or stakeholders ask you what you are doing to mitigate the risk of a breach. Do you encrypt your data at rest? Do you utilize a state of the art authentication system? Do you secure access to your APIs? Do you use leverage group policy to segregate individual responsibilities? Do you have security auditors that provide checks and balances for your administrative accounts activities? Do you conduct due diligence regarding rotation and management of certificate keys? Do you have a data retention policy in place and how do you enforce it? These are all questions to ask during the design of a secure application, because they will surely be the questions management asks when a breach occurs. Finally, just remember that the least expensive way to build security into an application is always from the start.

Until next time, stay secure.