Kategorie: Microsoft Azure

Provisioning for true zero-touch secure identity management for IoT

When you’re on a mission to deliver an awesome, complex IoT experience, the last thing you want to be doing is babysitting device identities at any stage of your solution. If you’re building a smart vehicle experience, you want to be thinking fleets, services, operational telemetry and not how to transfer vehicle identities between owners, renters, insurance companies, and service providers. If you’re developing for a mobile factory experience like a cruise ship or an airline, you want to be thinking geography optimal predictive maintenance, and not about cloud connection points and sovereign cloud specific requirements. How you provision your IoT devices makes a world of a difference with operational efficiency. Provisioning for true zero-touch secure identity management is the promise to minimize operational burden and maximize focus on the experience.

Until now, most claims for zero-touch provisioning have been about giving devices identities to connect to a cloud. What happens thereafter has largely been a mystery relegated to the IoT solutions developer. Developers of complex solutions are often left with no choice but to hack custom accommodations for their backends or manually manage hand-off of device identities in operations. Both options are costly, burdensome, and most of all, detracts focus from envisioned experience. Shouldn’t secure device identity and complete lifecycle management be a scalable building block in the IoT solution developer’s toolbox, so they can focus on just IoT experience?

Well, we believe it should. Microsoft has been building towards answering this very question, and in the past few months, collaborated with partners to make this a reality. The solution originates with anchoring trust in secure silicon, from which standards are used to derive device unique certificate identities that are ingested, authenticated, and lifecycle managed at scale by Azure Device Provisioning Service (DPS).

Earlier this year, as part of Microsoft’s commitment to IoT security, we announced adoption of Trusted Computing Group’s DICE standard and new HSM partners committed to availing DICE hardware. We now extend this announcement to welcome Microchip into the fold. Microchip has made availability of DICE hardware a reality through its CEC1702 family of secure silicon chips and evaluation kit offering. You may also learn about this offering from the Azure IoT Catalog and purchase directly from the Microchip Website. Designed for security and trust from the ground up, CEC1702 roots trust in secure silicon hardware and implements the DICE standard to generate device unique certificate identities that are trusted by any cloud service including Azure DPS.

Azure DPS takes it from here to fully realize provisioning for a truly zero-touch secure identity management for the lifecycle of IoT devices. DPS extends trust from the secure silicon hardware into the cloud domain where it creates registries to facilitate managed identity services to include location, mapping, aging, and retirement. This wealth of capability is exposed to the IoT solutions developers as simple routing rules to keep their full attention on the IoT experience they are creating. They only need to add a DPS compliant secure hardware like CEC1702 into their IoT devices.

IoT has evolved to the stage where connecting to a cloud is no longer a novelty. Secured and lifecycle-managed device identity should just be another component of the IoT developers standard toolbox. Microsoft in collaboration with secure silicon partners is making this a reality. To learn more about Azure Device Provisioning Service, please visit our tutorial documentation. 
Quelle: Azure

End-to-end monitoring solutions in Azure for Apps and Infrastructure

Today at the Ignite 2017 conference in Florida, we announced a range of new monitoring and analytics capabilities in Azure bringing together application and infrastructure monitoring in a unified curated overview in Azure Monitor. We are significantly optimizing your experience with the new log analytics, metrics exploration, application performance monitoring and failure investigations. We also announced integration of Azure alerts with IT Service Management tools and new solutions for Container Monitoring.

Bringing together monitoring services in Azure Monitor

From Azure Monitor you can now get at-a-glance reporting on the health and performance of all your cloud resources, from virtual machines to applications to individual lines of codes in the applications. Azure Monitor will now offer in public preview a unified overview as a starting point for navigation and on-boarding to various monitoring services in Azure. Customers will be able to see notable issues across applications & infrastructure in a single place and navigate to them in context.

Azure Monitor will now provide near real-time alerting in public preview for platform metrics from Azure services such as Virtual Machines, Networking, ServiceBus, EventHubs, etc. A complete list of all resources supported by near real-time alerting can be found here in our documentation. Azure Monitor is also enabling new metrics and logs to be surfaced from many services such as, Networking, Storage, Traffic Manager, Network Interfaces, Express Routes, Load Balancers, Data Lake Store, Data Lake Analytics, etc. A complete list of all the resources and their metrics available via Azure Monitor can be found here in our documentation.

Also released for Azure Monitor is a public preview of a completely revised metrics exploration experience that now supports rendering charts for both multi-dimensional and basic metrics. You can plot charts overlaying metrics from different resources and simultaneously view multiple charts to visually correlate trends, spikes and dips in metrics values. For the resources that support multi-dimensional metrics (e.g. Application Insights or Storage), you can apply filters on the desired dimension/value combinations, and/or add grouping to see a line for each dimension value.

 

Azure Monitor is enabling integration with your IT Service Management (ITSM) tool of choice (System Center Service Manager, Service Now, Provance or Cherwell) through the new ITSM action in Action groups. The ITSM action enables users to automatically create work items (incidents, events or alerts) in their ITSM tool when an Azure alert fires. This ITSM action is built on top of ITSM Connector Solution in Azure Log Analytics. Through the solution, customers can combine the power of help desk data (such as incidents and change requests) and log data (such as activity and diagnostic logs, performance and configuration changes) to mitigate incidents quickly.

New Log Analytics & Container Monitoring Solutions

Azure Application Insights and Azure Log Analytics are offering a public preview of cross-resource querying, which will allow users to query across multiple Application Insights applications or multiple Log Analytics workspaces. This will enable querying across multi-tiered or geo-distributed applications as well as across multiple logical infrastructure groups. The new and improved Log Analytics, whose upgrade rollout was launched a month ago, is now providing REST APIs for the new query language.

Container Monitoring Solution is now supported for Windows Kubernetes Environment providing container monitoring for performance, logs, events, and inventory as well as Kubernetes events. Helm, a package manager which helps, share, and use software built for Kubernetes, is getting the solution integrated, enabling customers to easily find and deploy Container Monitoring onto their Linux Kubernetes environment. With the GA of Service Fabric on Linux as a container orchestrator, Log Analytics will be capturing container monitoring information with the Azure Monitoring Agent.

Revamped user experience in Azure Application Insights

Application Insights has completely refreshed the user experience for Performance Monitoring and Failure Diagnostics (in public preview) to provide an interactive experience and show contextual insights. Customers can now quickly triage which specific end-user experiences are slow in production and visualize a duration distribution to get a holistic statistical view of both the good and the bad user experiences. Effective transitions to code level visibility (profiler) and diagnostic information on slow dependencies are only a click away.

With the new failure investigation experience, you can quickly identify and fix your top failing operations, exception types, failing dependencies behind their failures and see how end users are impacted.

Visual Studio Mobile Center announced that their users can now connect to Application Insights and continuously export a copy of all their usage telemetry events. From there, they can query and analyze their Mobile Center data with the richer set of capabilities that Application Insights provides around ad-hoc querying, filtering, segmentation, and richer usage analytics.

Get started today

Azure monitoring and analytics services help you to gain greater visibility into your environment with advanced data analysis and visualization, and make it easy to turn insights into action. Learn more about the capabilities of our Monitoring Solutions, and how they can help you reduce complexity for a hybrid cloud environment.
Quelle: Azure

Introducing SQL Vulnerability Assessment for Azure SQL Database and on-premises SQL Server!

I am delighted to announce the public preview of our latest security development from the Microsoft SQL product team, the new SQL Vulnerability Assessment (VA). SQL Vulnerability Assessment is your one-stop-shop to discover, track, and remediate potential database vulnerabilities. The VA preview is now available for Azure SQL Database and for on-premises SQL Server, offering you a virtual database security expert at your fingertips.

What is VA?

SQL Vulnerability Assessment (VA) is a new service that provides you with visibility into your security state, and includes actionable steps to investigate, manage, and resolve security issues and enhance your database fortifications. It is designed to be usable for non-security-experts. Getting started and seeing an initial actionable report takes only a few seconds.

Vulnerability Assessment report in the Azure portal.

This service truly enables you to focus your attention on the highest impact actions you can take to proactively improve your database security stature! In addition, if you have data privacy requirements, or need to comply with data protection regulations like the EU GDPR, then VA is your built-in solution to simplify these processes and monitor your database protection status. For dynamic database environments where changes are frequent and hard to track, VA is invaluable in detecting the settings that can leave your database vulnerable to attack.

VA offers a scanning service built into the Azure SQL Database service itself, and is also available via SQL Server Management Studio (SSMS) for scanning SQL Server databases. The service employs a knowledge base of rules that flag security vulnerabilities and deviations from best practices, such as misconfigurations, excessive permissions, and exposed sensitive data. The rule base is founded on intelligence accrued from analyzing millions of databases, and extracting the security issues that present the biggest risks to your database and its valuable data. These rules also represent a set of requirements from various regulatory bodies to meet their compliance standards, which can contribute to compliance efforts. The rule base grows and evolves over time, to reflect the latest security best practices recommended by Microsoft.

Results of the assessment include actionable steps to resolve each issue and provide customized remediation scripts where applicable. An assessment report can be customized for each customer environment and tailored to specific requirements. This process is managed by defining a security baseline for the assessment results, such that only deviations from the custom baseline are reported.

How does VA work?

We designed VA with simplicity in mind. All you need to do is to run a scan, which will scan your database for vulnerabilities. The scan is lightweight and safe. It takes a few seconds to run, and is entirely read-only. It does not make any changes to your database!

When your scan is complete, your scan report will be automatically displayed in the Azure Portal or in the SSMS pane:

Vulnerability Assessment report in SSMS. Currently available in limited preview.

The scan results include an overview of your security state, and details about each security issue found. You will find warnings on deviations from security best practices, as well as a snapshot of your security-related settings, such as database principals and roles, and their associated permissions. In addition, scan results provide a map of sensitive data discovered in your database with recommendations of the built-in methods available to protect it.

For all the issues found, you can view details on the impact of the finding, and you will find actionable remediation information to directly resolve the issue. VA will focus your attention on security issues relevant to you, as your security baseline ensures that you are seeing relevant results customized to your environment. See “Getting Started with Vulnerability Assessment” for more details.

You can now use VA to monitor that your database maintains a high level of security at all times, and that your organizational policies are met. In addition, if your organization needs to meet regulatory requirements, VA reports can be helpful to facilitate the compliance process.

Get started today!

We encourage you to try out Vulnerability Assessment today, and start proactively improving your database security stature. Track and monitor your database security settings, so that you never again lose visibility and control of potential risks to the safety of your data.

Check out “Getting Started with Vulnerability Assessment” for more details on how to run and manage your assessment.

Try it out, and let us know what you think!
Quelle: Azure

Announcing the public preview for Azure File Sync

Extend your on-premises file servers to Azure Files with Azure File Sync

Since Azure Files became generally available, we’ve consistently heard from our customers that they want to embrace the power and flexibility of the cloud without giving up the locality of their on-premises file server. Today, we are excited to announce the preview of a great new feature in Azure Files that enables you to get the best of both the cloud and on-premises worlds: Azure File Sync.

Azure File Sync keeps your Azure File share in-sync with your on-premises Window Servers. The real magic of Azure File Sync is the ability to tier files between your on-premises file server and Azure Files. This enables you to keep only the newest and most recently accessed files locally without sacrificing the ability to see and access the entire namespace through seamless cloud recall. With Azure File Sync, you can effectively transform your Windows File Server into an on-premises tier of Azure Files.

Since Azure File Sync is a multi-master sync solution, it makes it easy to solve global access problems introduced by having a single point of access on-premises, or in Azure by replicating data between Azure File shares and servers anywhere in the world. With Azure File Sync, we’ve introduced a very simple concept, the Sync Group, to help you manage the locations that should be kept in sync with each other. Every Sync Group has one cloud endpoint, which represents an Azure File share, and one or more server endpoints, which represents a path on a Windows Server. That’s it! Everything within a Sync Group will be automatically kept in sync!

Azure File Sync also helps you leverage Azure to get control over your on-premises data. Since cloud tiering moves old and infrequently accessed files to Azure, it effectively helps you make unpredictable storage growth predictable. When disasters strike, Azure File Sync can help. Simply set up a new Windows Server, install Azure File Sync, and the namespace is nearly instantly synced down as your cache is rebuilt.

Azure File Sync will be available, as a preview offering, this week (week of 9/25) – try it out! Please see our documentation for additional information about how to setup and configure Azure File Sync. If you are attending Ignite, come to our great sessions on Azure Files and Azure File Sync:

 

Session
Time
Place

BRK2286: Microsoft Azure File Sync – seamlessly extend file services across servers and cloud

Tuesday, September 26, 2017

10:45 AM – 12:00 PM ET

Hyatt Regency Windermere X

BRK2161: Maximize storage efficiency and conquer distributed file access with Windows Server and Azure Files

Tuesday, September 26, 2017

12:30 PM – 1:45 PM ET

OCCC West Hall F2

BRK2158: Windows Server Fall Release technical foundation

Wednesday, September 27th

10:45 AM – 12:00 PM ET

OCCC West Hall E1

THR2015: Microsoft Azure File Sync – setup, configuration, and management

Wednesday, September 27th

5:35 PM – 5:55 PM ET

TBD

Quelle: Azure

Azure DDoS Protection Service preview

This blog post was co-authored by JR Mayberr,y Principal PM Manager & Anupam Vij, Senior Program Manager, Azure Networking.

Distributed Denial of Service (DDoS) attacks are one of the top availability and security concerns voiced by customers moving their applications to the cloud. These concerns are justified as the number of documented DDoS attacks grew 380% in Q1 2017 over Q1 2016 according to data from Nexusguard. In October 2016, a number of popular websites were impacted by a massive cyberattack consisting of multiple denial of service attacks. It’s estimated that up to one third of all Internet downtime incidents are related to DDoS attacks.

As the types and sophistication of network attacks increases, Azure is committed to providing our customers with solutions that continue to protect the security and availability of applications on Azure. Security and availability in the cloud is a shared responsibility. Azure provides platform level capabilities and design best practices for customers to adopting and apply into application designs meeting their business objectives.

Today we're excited to announce the preview of Azure DDoS Protection Standard. This service is integrated with Virtual Networks and provides protection for Azure applications from the impacts of DDoS attacks.  It enables additional application specific tuning, alerting and telemetry features beyond the basic DDoS Protection which is included automatically in the Azure platform.  

Azure DDoS Protection Service offerings

Azure DDoS Protection Basic service

Basic protection is integrated into the Azure platform by default and at no additional cost. The full scale and capacity of Azure’s globally deployed network provides defense against common network layer attacks through always on traffic monitoring and real-time mitigation. No user configuration or application changes are required to enable DDoS Protection Basic.

Azure DDoS Protection Standard service

Azure DDoS Protection Standard is a new offering which provides additional DDoS mitigation capabilities and is automatically tuned to protect your specific Azure resources. Protection is simple to enable on any new or existing Virtual Network and requires no application or resource changes. Standard utilizes dedicated monitoring and machine learning to configure DDoS protection policies tuned to your Virtual Network. This additional protection is achieved by profiling your application’s normal traffic patterns, intelligently detecting malicious traffic and mitigating attacks as soon as they are detected. DDoS Protection Standard provides attack telemetry views through Azure Monitor, enabling alerting when your application is under attack. Integrated Layer 7 application protection can be provided by Application Gateway WAF.

Azure DDoS Protection Standard service features

Native Platform Integration

Azure DDoS Protection is natively integrated into Azure and includes configuration through the Azure Portal and PowerShell when you enable it on a Virtual Network (VNet).

Turn Key Protection

Simplified provisioning immediately protects all resources in a Virtual Network with no additional application changes required.

Always on monitoring

When DDoS Protection is enabled, your application traffic patterns are continuously monitored for indicators of attacks.

Adaptive tuning

DDoS protection understands your resources and resource configuration and customizes the DDoS Protection policy to your Virtual Network. Machine Learning algorithms set and adjust protection policies as traffic patterns change over time. Protection policies define protection limits, and mitigation is performed when actual network traffic exceeds the policies threshold.

L3 to L7 Protection with Application Gateway

Azure DDoS Protection service in combination with Application Gateway Web application firewall provides DDoS Protection for common web vulnerabilities and attacks.

Request rate-limiting
HTTP Protocol Violations
HTTP Protocol Anomalies
SQL Injection
Cross site scripting

DDoS Protection telemetry, monitoring & alerting

Rich telemetry is exposed via Azure Monitor including detailed metrics during the duration of a DDoS attack. Alerting can be configured for any of the Azure Monitor metrics exposed by DDoS Protection. Logging can be further integrated with Splunk (Azure Event Hubs), OMS Log Analytics and Azure Storage for advanced analysis via the Azure Monitor Diagnostics interface. 
  

Cost protection

When the DDoS Protection services goes GA, Cost Protection will provide resource credits for scale out during a documented attack.

Azure DDoS Protection Standard service availability

Azure DDoS Protection service is available now in East U.S., West U.S. and West Central U.S.

How do I get started?

DDoS Protection is in preview and there is no cost for the service during preview. Azure customers may register for the Azure DDoS Protection service here.

To learn more about the service, please see the Azure DDoS Protection service documentation.

We would love to hear your feedback, questions, comments through our regular channels including Forums, StackOverFlow, or Uservoice.
Quelle: Azure