There are several things that comes to my mind when thinking about the stuff that needs to be secured on Windows Azure. At the infrastructure level, I am sure it is well-taken care off by Microsoft data centers and there are tonnes of whitepapers that we can find in the Microsoft Global Foundation Services website to read about it.
On the application level, we would still need to practice standard security principles such as encrypting our sensitive data, hashing passwords, using HTTPS for transport where applicable, impose proper authentication and authorization mechanisms in our applications and securing any WCF end-points that we are exposing from Windows Azure. Some people may assume that cloud solutions are either a silver-bullet to their security problems or they are very insecure because "everyone can access it".
There is no difference at the application-level. Cloud or on-premise, proper security practices should be in-place. I realized that from interactions with people, the main concerns of security are usually the infrastructure and application, However, there is a tiny concern that most people seem to overlook. The weakest point to our Windows Azure assets is neither the infrastructure or application, it is the Windows Live ID that is used to login to the Windows Azure Portal. Yup! The same ID we used for our Live Messenger and XBOX Live.
If the Windows Live ID is compromised, an attacker can easily delete services, change certs, hi-jack administrative control, block access to data or just provision extra instances to bomb your credit card (Luckily, the default maximum instance is only 20). It is very common that organizations will either use the Infra Manager's or CTO's Live ID for Windows Azure. This is somewhat dangerous because the Windows Live ID is a personal thing and we are unsure whether the Live ID is compromised (i.e. clicked on those "Hey! Here is a picture of you" links in Live Messenger).
Therefore, I would suggest creating a separate "Company Windows Live ID" for your organization, tie the credit card to that ID and entrust it with the person who is in-charge of deploying the applications. This Windows Live ID should not be used for e-mail, chat or even XBOX :p
P.S. Remember to change the password of the Windows Live ID when the person changes role or no longer works for the company.
Popular Post
-
Have been hooked on Zuma lately (an online game provided by MSN). Never imagined that such a simple game can be so addictive. Previously, I...
-
Have you ever been handled over an abandoned system where you have no idea of it and asked to maintain or complete it? Lately, there were s...
-
Have been learning up NUnit nowadays and trying to use it for my Paladin project. It is a nice tool and I strongly encourage you to use it...
-
"Too many cooks spoil the broth" As the famous saying goes but will too many developers spoil the code ? It actually depends on ...
-
The task of delivering software solutions on-time and on-demand has become a great challenge for many project teams nowadays with businesses...
-
Have you ever wished to be able to work from home? You know like, sitting on that nice comfy chair (or slumber on the bed), listening to the...
-
Just returned from an adhoc night-out with Cherine (Buttercup). She has been craving for a Pocket PC for the past weeks and when I called he...
-
Just came back from watching The Village. Not sure on how to comment about the movie. The feeling I had is like you went into the cinema and...
-
I managed to get a colleague to give an unofficial preview on the upcoming O2 product line-ups today. Fans of O2 will definitely appreciate ...
No comments:
Post a Comment