Pre-adoption concern 60% cited concerns around data security as a barrier to adoption 45% concerned that the cloud would result in a lack of data control SECURITY Design/Operation Infrastructure Network Identity/access Data PRIVACY COMPLIANCE

Reduce cost High assurance that your data is safe Meet compliance requirements Central control over all assets Move incrementally to Azure Let your apps reason over data Deploy quickly Scale infinitely Make your data highly available

If we receive a government demand for data held by a business customer, we take steps to redirect the government to the customer directly, and we notify the customer unless we are legally prohibited from doing so. In the first half of 2014, Microsoft only received five requests from law enforcement for five users associated with an enterprise customer. In all five cases, the requests were rejected or law enforcement was successfully redirected to the customer.

Reduce cost High assurance that your data is safe Meet compliance requirements Central control over all assets Move incrementally to Azure Let your apps reason over data Deploy quickly Scale infinitely Make your data highly available

Economies of scale Pay-for-use pricing Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Unified identity management Ease to deploy, and to scale Great HYBRID options Huge investment in security Strong built-in security controls Optional security controls for customers Virtually infinite storage

Economies of scale Pay-for-use pricing Unified identity management Ease to deploy, and to scale Great HYBRID options Optional security controls for customers Virtually infinite storage Part 1 of this presentation: Built-in controls in Azure Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Huge investment in security Strong built-in security controls

Economies of scale Pay-for-use pricing Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Ease to deploy, and to scale Huge investment in security Strong built-in security controls Virtually infinite storage Part 2 of this presentation: Controls available for Azure customers Unified identity management Great HYBRID options Optional security controls for customers

100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Malware Protection Center Microsoft Security Response Center Windows Update 1 st Microsoft Data Center Active Directory SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH Digital Crimes Unit SOC 2 E.U. Data Protection Directive Operations Security Assurance

100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Windows Update 1 st Microsoft Data Center Active Directory SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH Digital Crimes Unit SOC 2 E.U. Data Protection Directive Operations Security Assurance Malware Protection Center Microsoft Security Response Center

100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Malware Protection Center Microsoft Security Response Center Windows Update 1 st Microsoft Data Center Active Directory SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH SOC 2 E.U. Data Protection Directive Operations Security Assurance Digital Crimes Unit

100+ Data Centers Trustworthy Computing Initiative Security Development Lifecycle Global Data Center Services Malware Protection Center Microsoft Security Response Center Windows Update 1 st Microsoft Data Center Active Directory Digital Crimes Unit SOC 1 CSA Cloud Controls Matrix PCI DSS Level 1 FedRAMP/ FISMA UK G-Cloud Level 2 ISO/IEC 27001:2005 HIPAA/ HITECH SOC 2 E.U. Data Protection Directive Operations Security Assurance

DataApplicationNetworkHost Security Identity & Access ManagementPhysical 24x7x365 Incident Response

REDUCE SECURITY COSTS + MAINTAIN FLEXIBILITY, ACCESS, & CONTROL CustomerMicrosoft On-PremisesIaaS PaaSSaaS Storage Servers Networking O/S Middleware Virtualization Data Applications Runtime

Data location Customer Choice Chooses region where data resides Configures data replication options Microsoft Creates multiple copies of data in the datacenter Geo-replication in a datacenter 400+ miles away Does not transfer Customer Data outside of a geo

Data Deletion Data retention and destruction Disk Handling Data Retention

Protect data in transit Secured by TLS best practices Perfect forward secrecy 2048-bit keys Strong ciphers are used / FIPS support Import / Export Service (Physical Media Shipment) Only accepts BitLocker encrypted data disks Datacenter to Datacenter Encrypts customer data transfer between Azure datacenters by EOY Data in transit between a user and the service Protects user from interception of their communication and helps ensure transaction integrity Data in transit between data centers Protects from bulk interception of data

Microsoft operator access & logging Operator requests access Grants temporary privilege on specific asset No standing access to Customer Data Grants least privilege required to complete a task Multi-factor authentication required for all administration Locked down admin console used for operator access Access is audited, logged, and analyzed Just in Time & Role Based Access Microsoft Network Azure

Economies of scale Pay-for-use pricing Azure platform certifications EU Model Clauses, UK G- Cloud, FedRAMP, SOC, ISO27001, PCI DSS, HIPAA Ease to deploy, and to scale Huge investment in security Strong built-in security controls Virtually infinite storage Part 2 of this presentation: Controls available for Azure customers Unified identity management Great HYBRID options Optional security controls for customers

Virtual Machine with custom app Storage …

Virtual Machine with custom app StorSimple … Protection elements Access control: No change. StorSimple appliance appears like a NAS (via iSCSI) Encryption: Automatic. StorSimple protects all data that it writes to Azure with AES SHA-256. Keys stay on-premises. Logs: StorSimple emits audit logs. Availability: Azure takes care of this automatically. Protection elements Access control: No change. StorSimple appliance appears like a NAS (via iSCSI) Encryption: Automatic. StorSimple protects all data that it writes to Azure with AES SHA-256. Keys stay on-premises. Logs: StorSimple emits audit logs. Availability: Azure takes care of this automatically.

Protection elements Access control: Stays on-premises, no change. Encryption: Use TDE. You have choice of crypto algorithm. Keys stay on-premises, and can be offloaded to HSM of your choice. Logs: SQL Server audit log, no change. Availability: Azure takes care of this automatically. Protection elements Access control: Stays on-premises, no change. Encryption: Use TDE. You have choice of crypto algorithm. Keys stay on-premises, and can be offloaded to HSM of your choice. Logs: SQL Server audit log, no change. Availability: Azure takes care of this automatically.

Virtual Machine with custom app Storage …

Protection elements Access control: No change, same as on-premises SQL server. Encryption: Use TDE. Keep key in Azure or install optional EKM provider to offload to an on-premises HSM. Logs: No change. SQL Server audit log. Availability: Azure takes care of this automatically. Protection elements Access control: No change, same as on-premises SQL server. Encryption: Use TDE. Keep key in Azure or install optional EKM provider to offload to an on-premises HSM. Logs: No change. SQL Server audit log. Availability: Azure takes care of this automatically.

Azure SQL DB Virtual Machine with custom app Storage … Protection elements Access control: Username/password per server, controlled by Azure subscriber who created server. Encryption: N.A. Logs: Azure SQL DB audit feature, now in preview. Availability: Azure takes care of local redundancy automatically. You can optionally make it geo- redundant. Protection elements Access control: Username/password per server, controlled by Azure subscriber who created server. Encryption: N.A. Logs: Azure SQL DB audit feature, now in preview. Availability: Azure takes care of local redundancy automatically. You can optionally make it geo- redundant.

Virtual Machine Virtual Machine with custom app Storage … Active Directory Users, machines Key Manager e.g. HSM Protection elements Access control: BitLocker key protector. Encryption: Bitlocker. Multiple “protectors” available to protect key – password, certificate, AD group, … Logs: Windows event log. Availability: VHD is stored in Azure storage, which automatically replicates it. Protection elements Access control: BitLocker key protector. Encryption: Bitlocker. Multiple “protectors” available to protect key – password, certificate, AD group, … Logs: Windows event log. Availability: VHD is stored in Azure storage, which automatically replicates it. Azure storage

Virtual Machine boot volume encryption and pre-boot authorization Virtual Machines

Virtual Machine with custom app Storage … Protection elements Access control: Storage access key + custom Encryption: Custom Logs: Azure Storage logs Availability: Azure takes care of this automatically. Protection elements Access control: Storage access key + custom Encryption: Custom Logs: Azure Storage logs Availability: Azure takes care of this automatically. Virtual Machine in Azure

Virtual Machine with custom app Storage … App/device outside your organization

Virtual Machine with custom app Storage … Active Directory Users, machines Key Manager e.g. HSM App/device outside your organization

Virtual Machine with custom app Storage … Active Directory Users, machines Key Manager e.g. HSM App/device outside your organization