Over the past few years, Microsoft has shifted to putting much of its muscle behind a future that will rely on massive swaths of interconnected services and devices transmitting boatloads of secure data via cloud computing. With as many moving parts as this scenario entails, many companies remain wary of shifting tried and true business models of on device and on-premise communications to relatively new cloud computing platforms.
With that being said, Microsoft is beginning to tackle the tough questions of cloud security as it continues to transition its service and customers to more cloud oriented solutions. Sara Manning Dawson, the principal group manager for the Office 365 Core Foundation team, addresses the various security concerns some businesses have with shifting to the cloud while attending the RSA Conference in San Francisco. Much of Dawson’s coverage on the topic assures many companies that choosing cloud solutions could improve their overall security advantage.
In a quick six-minute video, Dawson highlights how cloud computing allows for not only Intelligent Scale when applying security enabled features but also automation which leads to less human involved errors.
Intelligence at scale—The second unique property is what I refer to as “intelligence at scale.” Our detection footprint spans beyond what you could monitor in your own organization. With millions of activities going on in the service at any given point in time, we had to figure out how to sharpen the fidelity of what we surface as anomalies within a sea of signals. This allows us to quickly identify, anticipate and mitigate real and potential threats. We use our fundamental knowledge of what should and should not be happening in the service together with machine learning and analytics for real-time monitoring and analysis of millions of tenants. This gives us the ability to spot trends algorithmically before they are broadly exposed or known. In addition, as we learn of a vulnerability, such as malware on one customer tenant, we can mitigate the risk so that other tenants are not affected. For example, recent technologies in the service such as Advanced Threat Protection and Zero Hour Auto Purge allow us to proactively “purge” infected emails from all recipient inboxes.
Automation—To operate at scale, success means eliminating room for human interaction or error. Less human touch results in fewer mistakes and fewer opportunities for security breaches or insider threats. Through smart diagnosis and automated self-repairing—despite our continued growth in scale—we reduced the frequency in which our engineers have to get involved to triage issues.
We’ve created a solid boundary between your data and humans operating the service, including zero standing permissions for engineers. Diagnosing and troubleshooting the health of the system is done via hardened code paths. We like to say, “Human’s govern; code operates.” Operators need to request approval to run these scripts—even with approval, these are run remotely—with “just in time, just enough access.”
Based on our learnings, we’re also exploring new tools to give you an automated assessment of your security score. We’re working on providing you tools that can take a deep look at your security configuration and communications activity, assign you a security score and then make recommendations based on what it finds.
As a relatively nascent solution for companies, the road bumps that cloud computing is currently enduring are seemed to be receiving more scrutiny than their perceived benefits and for good reason. However, as the technology becomes more prevalent and refined, it appears that cloud technologies hold a much more positive day-to-day applications for most businesses.
