Trust. It’s perhaps the main element in any decision you make regarding computer & communication services for your company and yourself. You need to feel you can trust your provider to keep your data secure, your personal information private, and your communications protected from eavesdroppers.
Millions of people trust services like Microsoft Office 365 with their most prevalent communications, including email using Exchange Online and instant messaging, voice and video over Skype and Skype for Business (formerly Lync). While it is likely that they implicitly trust these services because they are provided by Microsoft, the world’s largest software company, you should stop to ask what it actually is that Microsoft is doing to earn this trust. Yes, they have vast resources, but what are they doing with them?
A post on the Office Blogs from the Office 365 Team answers this question very thoroughly. “From Inside the Cloud: What does Microsoft do to prepare for emerging security threats to Office 365?” introduces us to Chang Kawaguchi, a group engineering manager for security for Office 365, Travis Rhodes lead security software engineer for Office 365 and Vijay Kumar, a senior product manager for Office 365. These are three of the people who spearhead Microsoft’s strategy for keeping Office 365 and Microsoft Azure cloud services secure and trustworthy.
Assume Breach
The post features an excellent short video that describes several of the security strategies employed by the group, beginning with one that would seem to just be common sense: Assume people are trying to break into your network and data at all times. Constant vigilance. Oddly, most people seem to assume that nobody would ever bother attacking them. Microsoft invests heavily in an “Assume Breach” approach which causes them to constantly be on the lookout for new threats.
Color War!
Assuring viewers that no customer data is ever threatened or even touched in their work, the video describes the work of the “Red” and “Blue” teams constantly “at war” with each other to battle-test the armor that protects these systems.
The Red Team, “an internal dedicated team of “white hat” hackers from varied industry backgrounds such as broader technology industry, defense and government,” constantly conduct penetration testing on Microsoft’s systems. Counterbalancing them is the Blue Team, “whose role it is to monitor activities within the system to detect anomalous behavior and take action. As hard as the Red team is trying to find and exploit vulnerabilities the Blue team is trying to detect, investigate and mitigate security events.”
As the post concludes, “The combined efforts of our teams go toward improving detection by evolving our machine learning algorithms for the detection of anomalous activity as well as incident response.”
Any IT manager responsible for system security will find valuable insight in this post and the included video. Those wishing to continue to learn more should regularly visit the Red team blog. If you have any questions about anything you read, please reach out to your CloudStrategies Advisor for more information!
The post Protecting Office 365 and Microsoft Azure from Emerging Threats appeared first on CloudStrategies.
