Enterprise grade security in your Hadoop clusters on Azure Microsoft 2016 4/17/2018 5:35 PM BRK3186 Enterprise grade security in your Hadoop clusters on Azure Saurin Shah Sr. Program Manager © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Session Objectives Key Takeaways Microsoft Ignite 2016 4/17/2018 5:35 PM Session Objectives Overview of HDInsight – Hadoop and Spark offering on Azure cloud. Configure Perimeter security using Virtual networks Integrate HDInsight with Azure Active Directory Configure multi-user authentication, authorization, auditing using Apache Ranger Encryption of Data at Rest with HDInsight Key Takeaways HDInsight is the solution that will you need if you want enterprise grade security capabilities for your Hadoop environment on cloud © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

What is HDInsight? 4/17/2018 5:35 PM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Quickly create an HDInsight cluster Microsoft Ignite 2016 4/17/2018 5:35 PM Demo Quickly create an HDInsight cluster © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Move to Enterprise Readiness 4/17/2018 5:35 PM Move to Enterprise Readiness © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Hadoop clusters have grown by 60% in the last 2 years Microsoft Ignite 2016 4/17/2018 5:35 PM Hadoop clusters have grown by 60% in the last 2 years 89% of enterprise users consider Hadoop as opportunity for innovation Forrester report predicts that Hadoop will grow by 33% annually in next five years Hadoop is shifting from a buzzword to a real production service Ownership is shifting from department teams to Central IT. © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Meet Samer, Director of IT 4/17/2018 5:35 PM Meet Samer, Director of IT © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Microsoft Ignite 2016 4/17/2018 5:35 PM CustomerId Name CellPhone Email Address City State Zip Credit Card 413707 LUNA PARK 3122049789 luna.park@gmail.com 3250 W FOSTER AVE CHICAGO IL 60625 4147202109819679 391234 MARIE 3121069067 marie@outlook.com 4729 N LINCOLN AVE 5166550002516678 413751 MANU WORKY 8471909522 manu.work@gmail.com 11601 W TOUHY AVE 60666 5159550002367622 413708 STEVE BENCH 3122049411 steve.bench@outlook.com 325 N LA SALLE ST BLDG 60654 4149098188760969 … ... CustomerId Reviews Rating 413707 SPICY, YET HEALTHY. WOULD ORDER AGAIN 9.3 391234 HATS OFF TO MAINTAIN PROPER 4.6 413751 AMAZING FOOD PREPARED RIGHT AT 9.4 413708 Decent Food 7.1 … …. Id CustomerId OrdersPlaced Discount Date Revenue 102456 68252 277 $526.30 8/1/2016 $2,243.70 102457 413488 282 $84.60 $2,735.40 102458 250405 134 $281.40 $1,058.60 102459 114533 141 $253.80 $1,156.20 102460 315209 289 $346.80 $2,543.20 … Id Customer ID Time Taken Cost Date 102456 68252 63 $224.00 8/1/2016 102457 413488 65 $235.00 102458 250405 67 $245.00 102459 114533 71 $227.00 102460 315209 72 $213.00 … © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Product demand analysis Delivery and Operations Microsoft Ignite 2016 4/17/2018 5:35 PM Cluster Admin Product demand analysis Delivery and Operations Developer 2 Data Scientist 2 Developer 1 Data Scientist 1 © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

HDInsight Security – Rings of Defense Microsoft Ignite 2016 4/17/2018 5:35 PM HDInsight Security – Rings of Defense Perimeter Level Security Virtual Network Network Security (i.e. Firewalls) Gateway Authentication Kerberos Active Directory Authorization Hive policies HBase policies File and Folder level ACLS Data Security Encryption @ Rest © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Perimeter Security 4/17/2018 5:35 PM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Using Virtual Network and Gateway Service Microsoft Ignite 2016 4/17/2018 5:35 PM Using Virtual Network and Gateway Service Perimeter Level Security Virtual Network Network Security (i.e. Firewalls) Gateway © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Gateway HiveServer2 Head Node Ambari Worker node (s) Oozie Services Microsoft Ignite 2016 4/17/2018 5:35 PM DataScientist Gateway Head Node HDInsight Cluster WASB ADLS VNET HiveServer2 Ambari Oozie Worker node (s) Services © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Setup HDInsight cluster inside a VNET Microsoft Ignite 2016 4/17/2018 5:35 PM Demo Setup HDInsight cluster inside a VNET © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Authentication, Authorization and Auditing 4/17/2018 5:35 PM Authentication, Authorization and Auditing © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Integration with Azure Active Directory Microsoft Ignite 2016 4/17/2018 5:35 PM Integration with Azure Active Directory Authentication Kerberos Active Directory © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Application and Data-Level Authorization Microsoft Ignite 2016 4/17/2018 5:35 PM Application and Data-Level Authorization Authorization Hive policies HBase policies File and Folder level ACLS © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Azure VNET to VNET peering Microsoft Ignite 2016 4/17/2018 5:35 PM Active Directory Domain Services AAD tenant DataScientist 1 DataScientist 2 Domain Credentials VNET VNET Gateway Head Node HDInsight Cluster WASB ADLS Worker node (s) Kerberos AuthN Kerberos Ticket HiveServer2 Ambari Oozie LDAP Azure VNET to VNET peering Services Ranger Ranger DB OAuth Ticket © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Demo Authentication, Authorization and Auditing Microsoft Ignite 2016 4/17/2018 5:35 PM Demo Authentication, Authorization and Auditing © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Secure Endpoints in HDInsight cluster Access to all users Access to only Cluster Admin HiveServer2 Ambari & Views Ranger SSH WebHCat Oozie

Encryption of data @ Rest 4/17/2018 5:35 PM Encryption of data @ Rest © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Transparent Server Side Encryption Microsoft Ignite 2016 4/17/2018 5:35 PM Transparent Server Side Encryption Data Security Encryption @ Rest © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Transparent Server Side Encryption Azure Data Lake Storage Windows Azure Storage Blob Public Preview ALWAYS ON transparent encryption All reads/writes are encrypted/decrypted Service managed keys as well as Customer managed keys General Availability ALWAYS ON transparent encryption All reads/writes are encrypted/decrypted Service managed keys

Public Preview & Roadmap 4/17/2018 5:35 PM Public Preview & Roadmap © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Public Preview (in next few weeks) AAD Integration Multi-user Ambari Ranger for Hive All Tooling (Excel, Visual Studio, SDKs)

Session Objectives Key Takeaways Microsoft Ignite 2016 4/17/2018 5:35 PM Session Objectives Overview of HDInsight – Hadoop and Spark offering on Azure cloud. Configure Perimeter security using Virtual networks Integrate HDInsight with Azure Active Directory Configure multi-user authentication, authorization, auditing using Apache Ranger Encryption of Data at Rest with HDInsight Key Takeaways HDInsight is the solution that will you need if you want enterprise grade security capabilities for your Hadoop environment on cloud © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Free IT Pro resources To advance your career in cloud technology Microsoft Ignite 2016 4/17/2018 5:35 PM Free IT Pro resources To advance your career in cloud technology Plan your career path Microsoft IT Pro Career Center www.microsoft.com/itprocareercenter Cloud role mapping Expert advice on skills needed Self-paced curriculum by cloud role $300 Azure credits and extended trials Pluralsight 3 month subscription (10 courses) Phone support incident Weekly short videos and insights from Microsoft’s leaders and engineers Connect with community of peers and Microsoft experts Get started with Azure Microsoft IT Pro Cloud Essentials www.microsoft.com/itprocloudessentials Demos and how-to videos Microsoft Mechanics www.microsoft.com/mechanics Connect with peers and experts Microsoft Tech Community https://techcommunity.microsoft.com © 2016 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

Please evaluate this session 4/17/2018 5:35 PM Please evaluate this session Your feedback is important to us! From your PC or Tablet visit MyIgnite at http://myignite.microsoft.com From your phone download and use the Ignite Mobile App by scanning the QR code above or visiting https://aka.ms/ignite.mobileapp © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.

4/17/2018 5:35 PM © 2014 Microsoft Corporation. All rights reserved. MICROSOFT MAKES NO WARRANTIES, EXPRESS, IMPLIED OR STATUTORY, AS TO THE INFORMATION IN THIS PRESENTATION.