Cloud security controls series: OneDrive for Business

One of the Microsoft cloud services that I get asked about most often is OneDrive for Business. It’s part of Office 365 – so many, many customers are already using this service. OneDrive for Business can help ensure that business files for organizations’ users are stored in a central location making it easy for users to search, share and collaborate on documents using a range of devices including Windows and … Read more »

Cloud security controls series: Rights Management

I talk to a lot of executives about various security topics. These days, when I talk to senior executives about leveraging cloud computing in their organization, the conversation they want to have tends to start with Rights Management and Rights Management Services (RMS). Top of mind for them is protecting their organization’s sensitive information from unauthorized access and exercising some control on how information is used within their organization and … Read more »

Cloud security controls series: Encrypting Data at Rest

In the last article I wrote in this series on cloud security controls I discussed controls that help protect data while its in-transit between Microsoft’s cloud services and our cloud service customers. Many of the customers I talk to are also interested in understanding the controls that are available to help manage the security of data stored and processed in Microsoft’s cloud services. There are many controls available that help … Read more »

Cloud security controls series: Encrypting Data in Transit

Whether organizations store and process data on-premise, in the cloud, or use a combination of both, it is important that they protect that data when it is transmitted across networks to information workers, partners and customers. For example, when an administrator is using the Microsoft Azure Portal to manage the service for their organization. The data transmitted between the device the administrator is using and the Azure Portal needs to … Read more »

Cloud security controls series: Azure AD Privileged Identity Management

Securely managing access to privileged accounts has been a challenge for many of the CISOs I talk to. Many of these CISOs worry that their organizations have too many permanent accounts with high levels of privilege in their environments. Some examples of the threats that keep these people up at night include malicious or rogue administrators, administrator credentials leaked via phishing attacks, administrator credentials cached on compromised systems, user accounts … Read more »

Cloud security controls series: Multi-factor Authentication

Recently I wrote an article on the risk of leaked credentials in which I discussed how credentials are stolen in bulk directly from organizations’ websites. As illustrated in Figure 1, during the eight months between November 2013 and June 2014, Microsoft tracked about 1,700 distinct website credential thefts, comprising a little more than 2.3 million credentials that were posted in public places on the Internet. This number represents only a … Read more »

Cloud security controls series: Azure Active Directory‘s Access and Usage Reports

Over the past several months I have had many, many conversations with business customers and governments about the security benefits of Microsoft’s Cloud service offerings. This video from the RSA Conference earlier this year will give you an idea of the types of topics we have been discussing with customers. These conversations have increasingly become less about whether the Cloud can be trusted, and more about the innovative security and … Read more »

The Risk of Leaked Credentials and How Microsoft’s Cloud Helps Protect Your Organization

This week the Microsoft Identity and Security Services Division announced another new security report feature is now in preview that helps protect Azure Active Directory Premium customers from the risk associated with leaked credentials. The Risk of Leaked Account Credentials One scenario that has unfortunately become all too common is where account credentials are stolen in bulk by criminals through website breaches. Credentials are also unwittingly provided directly by the … Read more »

Transparency & Trust in the Cloud Series: Mountain View, California

I was in Silicon Valley recently speaking at another Transparency & Trust in the Cloud event. Thank-you very much to all the customers that made time to join us at the Microsoft campus in Mountain View, California! This was another very well attended event with numerous large enterprise customers located in the vicinity in attendance. Like all the Transparency and Trust events prior to this one, I learned from the … Read more »

A cornerstone to trust in technology – compliance – proves foundational as more U.S. government organizations adopt cloud services

Government agencies want the economic benefits of cloud computing, but this alone isn’t always enough to make the case for change. To move forward, decision makers want to understand the security, privacy and compliance commitments of their cloud service provider. We continue to track and complete a number of attestations and compliance certifications, confirming controls are in place that help enable cloud solutions for government organizations. And, while compliance represents … Read more »