Microsoft Locks Down the Cloud With Multifactor Authentication

 
 
By Pedro Hernandez  |  Posted 2013-06-13 Email Print this article Print
 
 
 
 
 
 
 

Microsoft makes its Windows Azure cloud services platform a bit more hacker-resistant with a security feature that Web-facing tech companies are increasingly embracing.

Businesses that offer employees, partners and customers access to their Windows Azure Active Directory (AD) managed apps can now add another layer of security to data that's stored on Microsoft's cloud.

Microsoft announced Active Authentication, a new multifactor authentication offering based on the company's PhoneFactor acquisition. The software giant bought the firm in October 2011 to add two-factor, mobile phone-based secure access capabilities to its growing cloud application portfolio. Following the deal, Bharat Shah, corporate vice president for the Server and Tools Division at Microsoft, said in a statement that the buy would "bring effective and easy-to-use multifactor authentication to our cloud services and on-premise applications."

"In addition, PhoneFactor's solutions will help Microsoft customers, partners and developers enhance the security of almost any authentication scenario," added Shah. Windows Azure director, Sarah Fender, announced in a June 12 blog post that the company is making good on some of its promises.

"Starting today, companies can enable multi-factor authentication for Windows Azure Active Directory identities to help secure access to Office 365, Windows Azure, Windows Intune, Dynamics CRM Online and many other apps that are integrated with Windows Azure AD," she wrote.

Active Authentication is also available for developers who are creating Azure-based apps, informed Fender. "Developers can also use the Active Authentication SDK to build multi-factor authentication into their custom applications and directories."

Typical of multifactor authentication schemes, Active Authentication secures Azure apps and data by "adding an extra step to the sign in process." In this case, a user is granted access by supplying a login ID and password and authenticating via the Active Authentication mobile app, an automated phone call or text message.

Alex Simons, director of Program Management for Active Directory, noted in an Active Directory Team Blog post that despite the extra precautions, users have some say in how they interact with the system.

"Of course, the app is my personal favorite but you might like receiving a phone call better and most of the folks on our team prefer the SMS messaging option. The great thing about the service is that your users can choose the method they like best and switch between methods without any additional configuration on your part," wrote Simons.

Microsoft is offering two pricing models. Organizations can opt for per-user, per-month plans or a per-authentication option that is based on the total number of authentications that are performed each month. Before Active Authentication is officially made generally available, the company is offering the service at the discounted price $1.00 per user per month or $1.00 for every 10 authentications.

Active Authentication for Windows Azure arrives just as big tech companies are rushing to deploy two-factor and multifactor authentication systems to protect their users.

In May, Twitter rolled out two-factor authentication to improve security after a spate of high-profile breaches that compromised the accounts of media organizations, including the Financial Times and BBC, and Twitter itself. Google got an early start by offering two-factor authentication for Google Apps in 2010.

 
 
 
 
 
 
 
 

0 Comments for "Microsoft Locks Down the Cloud With Multifactor Authentication"

  • Shreyasi Dongare June 15, 2013 2:37 pm

    A step ahead: a bit more hacker- resistant platform.........

  • Ulf Mattsson June 14, 2013 5:32 pm

    It is great that Microsoft Locks Down the Cloud With Multifactor Authentication . I think we have other security concerns and that sensitive data may not be secure in many public cloud environment. The customers also tend to forget that the liability responsibility and brand protection are in many cases with the client and not the cloud provider. The good news is the great guidelines for security and compliance in the document called PCI DSS Cloud Computing Guidelines that PCI Security Standards Council released in February 2013. I think that the PCI DSS rules and guidelines in general are relevant to all sensitive data. Below are some of the guidelines from this particular document: It is recommended that data-security needs are evaluated for all types of information being migrated to a cloud environment not only cardholder data. Regarding third-party or public clouds clients should consider that while they can outsource the day-to-day operational management of the data environment they retain responsibility for the data they put in the cloud. The client has no way of confirming whether other client environments are securely configured patched appropriately to protect against attack or that they are not already compromised or even designed to be malicious. Public-cloud providers often have multiple data storage systems located in multiple data centers which may often be in multiple countries or regions. Consequently the client may not know the location of their data or the data may exist in one or more of several locations at any particular time. Additionally a client may have little or no visibility int o the controls protecting their stored data. This can make validation of data security and access controls for a specific data set particularly challenging. In a public-cloud environment one client's data is typically stored with data belonging to multiple other clients. This makes a public cloud an attractive target for attackers as the potential gain may be greater than that to be attained from attacking a number of organizations individually. Strong data-level encryption should be enforced on all sensitive or potentially sensitive data stored in a public cloud. It is recommended that cryptographic keys used to encrypt/decrypt sensitive data be stored and managed independently from the cloud service where the data is located. Any data that is decrypted in the cloud may be inadvertently captured in clear text in process memory or VMs via cloud maintenance functions such as snapshots backups monitoring tools etc. . To avoid this risk clients may choose to keep all encryption/decryption operations and key management on their own premises and use a public cloud only for storage of the encrypted data. I read an interesting report from Aberdeen Group that revealed that Over the last 12 months tokenization users had 50% fewer security-related incidents e.g. unauthorized access data loss or data exposure than tokenization non-users���. The name of the study released a few months ago is Tokenization Gets Traction���. Ulf Mattsson CTO Protegrity +1-203-570-6919....

Leave a Comment

 
Manage your Newsletters: Login   Register My Newsletters























 
 
 
 
 
 
 
 
 
 
 
 
 
Rocket Fuel