Microsoft Azure Security Privacy Compliance PJ Zargarzadeh Microsoft

Microsoft Azure Security, Privacy, & Compliance PJ Zargarzadeh, Microsoft

Technology trends: driving cloud adoption ORGANIZATIONS ARE EAGER TO REALIZE CLOUD BENEFITS 70% Cloud Trend: of CIOs will embrace a cloud -first strategy in 2016 (IDC CIO Agenda webinar) Microsoft Azure Drivers Agility Scale 2 weeks Scale from to deliver new services vs. 6 -12 months with traditional solution (Case Study: Harper. Collins Publishers) Economics 30, 000 250, 000 to site visitors instantly (Case Study: Autocosmos) $25, 000 in the cloud would cost $100, 000 on premises (Microsoft Azure BI Team, STMG Proof Points Central)

Before cloud migration concerns Concerns 60% Cloud Trend: Security as the main barrier for moving to the cloud (Microsoft com. Score Survey) Security Privacy Compliance 40% Cloud Trend: Cloud would result in lack of data control Microsoft Azure (Microsoft com. Score Survey)

After cloud migration… 94% Cloud Trend: Experienced security benefits they didn’t previously have on-prem (Microsoft com. Score survey) Microsoft Azure Concerns Security Privacy Compliance 62% Cloud Trend: Experienced increased privacy and data protection as the result of moving to the cloud

Trustworthy Computing Initiative 1 st Microsoft Data Center Active Directory Microsoft Azure Malware Protection Center Assume Breach UK G-Cloud Level 2 SOC 1 1989 1995 2000 Windows Update Microsoft Security Response Center Microsoft Azure Global Data Center Services 2005 Security Development Lifecycle Fed. RAMP/ FISMA 100+ Data Centers Operations Security Assurance 2010 Digital Crimes Unit CSA Cloud E. U. Data Controls Matrix Protection ISO/IEC Directive HIPAA/ 27001: 2005 HITECH PCI DSS Level 1

Shared responsibility On-Premises Iaa. S Paa. S Applications Data Users Middleware Operating System Virtualization Hardware Networking Physical Security Microsoft Azure Your organization Microsoft Saa. S

Pick your services…

Microsoft approach in action Microsoft Azure 9

Privacy by design Control over data location Microsoft Azure Restricted data access & use Contractual commitments 101010101010101010101010101010101010101010

Control over data location Central US Iowa US Gov Iowa West US California South Central US Texas North Europe Ireland North Central US Illinois West Europe Netherlands China North Beijing East US Virginia East US 2 Virginia US Gov Virginia India West TBD Japan East Saitama China South Shanghai India Eat TBD Japan West Osaka East Asia Hong Kong SE Asia Singapore Australia East Sydney Brazil South Sao Paulo One of the top 3 networks in the world (coverage, speed, connections) 2 x AWS and 5 x Google DC Footprint Microsoft Confidential Australia West Melbourne Announced Operational

Government access No Back Doors We don’t provide any government with direct or unfettered access to your data Enhanced Security Microsoft Azure 1010101010101010 12 10101010101010101010101010

Government access No Back Doors We don’t assist government efforts to break our encryption or provide any government with encryption keys used to protect data in transit, or stored on our servers Enhanced Security Microsoft Azure 1010101010101010 13 10101010101010101010101010

Government access No Back Doors We don’t engineer back doors into our products and we take steps to ensure 3 rd parties can independently verify this. Enhanced Security Microsoft Azure 1010101010101010 14 10101010101010101010101010

Government access No Back Doors If, as press reports suggest, governments are engaging in broader surveillance of communications, it is being done without the knowledge or involvement of Microsoft Enhanced Security Microsoft Azure 1010101010101010 15 10101010101010101010101010

Legal requests for your data No Back Doors We will redirect third party request to the customer Enhanced Security Microsoft Azure 1010101010101010 16 10101010101010101010101010

Legal requests for your data No Back Doors We will promptly notify the customer, unless legally prohibited from doing so, and if prohibited, will challenge the request in court Enhanced Security Microsoft Azure 1010101010101010 17 10101010101010101010101010

Legal requests for your data No Back Doors We will fight legal demands for customer data stored in another country Enhanced Security Microsoft Azure 1010101010101010 18 10101010101010101010101010

Transparency We will fight legal demands for customer data stored in another country Enhanced Security http: //www. microsoft. com/about/corporatecitizenship/en-us/reporting/transparency/ Microsoft Azure 1010101010101010 19 10101010101010101010101010

Recognized for its commitments https: //www. eff. org/who-has-your-back-government-data-requests-2014 Microsoft Azure 20

Simplified compliance ISO/IEC 27001 SOC 2 PCI DSS L 1 version 3 Cloud Security Alliance Cloud Security Matrix Fed. RAMP HIPAA (Healthcare) FIPS 140 -2 Life Sciences Gx. P Family Educational Rights & Privacy Act European Union Model Clause United Kingdom G-Cloud China Multi Layer Protection Scheme China CCCPPF Singapore Multi-Tier Cloud Security Australian Signals Directorate I-RAP Assessment Sarbanes Oxley Criminal Justice Information System Defense Information Systems Agency L 2 ITAR Defense Information Systems Agency L 3 -5 ISO / IEC 27018

Security Infrastructure protection • • • 24 -hour monitored physical security Firewalls Patch management System monitoring and logging Antivirus protection Threat detection Microsoft Azure Network Protection • • Network Security Group Virtual Networks Site-to-site VPN Express. Route Data Protection • • • Data in transit Data at rest Data segregation 22

Trusted by leading Canadian companies Microsoft Azure

§ Microsoft Azure Trust Center § Azure security, privacy and compliance Whitepaper § Azure security infographic poster Microsoft Azure

Microsoft Azure