Session 5: Shared Responsibility Model - Azure AZ-900 Fundamentals

What is the Shared Responsibility Model?

The Shared Responsibility Model is like having a hotel versus owning a house. In a hotel, the hotel manages the building, security, utilities, and maintenance, while you're responsible for your belongings and activities in your room. In cloud computing, Azure handles the infrastructure, while you manage your data, applications, and access.

🏗️ Fundamental Principle

Azure's Responsibility

"Security OF the Cloud"

🏢 Physical Infrastructure

Data centers, servers, networking equipment, power, cooling

🔐 Physical Security

Building access, guards, cameras, environmental controls

🌐 Network Infrastructure

Internet connectivity, Azure backbone, DDoS protection

💾 Hypervisor Layer

Virtualization platform, isolation between customers

Your Responsibility

"Security IN the Cloud"

📊 Information & Data

Your files, databases, intellectual property, customer data

👥 Identity & Access

User accounts, passwords, permissions, authentication

📱 Devices & Apps

Mobile devices, client applications, endpoint security

🏗️ Architecture

Network design, encryption, access controls, compliance

🏨 Hotel Analogy: Understanding Responsibilities

Hotel Management = Azure

Infrastructure & Services

• Building security: Guards, cameras, key card systems
• Utilities: Electricity, water, heating, Wi-Fi
• Maintenance: Cleaning, repairs, room service
• Compliance: Fire codes, health regulations
• Infrastructure: Elevators, plumbing, structure

Hotel Guest = You

Your Content & Behavior

• Personal items: Your belongings, valuables
• Room security: Locking door, using safe
• Guest behavior: Following hotel policies
• Privacy: Who you share room access with
• Content: What you bring into the room

🤝 Shared Responsibilities

Communication: Hotel provides guest services, you request help when needed

Incidents: Hotel handles emergencies, you report issues promptly

Standards: Hotel sets policies, you follow them

📊 Responsibility Shifts by Service Model

As you move from IaaS → PaaS → SaaS, more responsibilities shift from you to Azure. It's like moving from a house (IaaS) to an apartment (PaaS) to a hotel (SaaS).

IaaS Infrastructure as a Service (IaaS)

Most Responsibility Most Customer Responsibility

75% You 75% Your Responsibility

You manage: OS, applications, runtime, data, middleware, networking

PaaS Platform as a Service (PaaS)

Shared Responsibility

50% Shared 50% Shared

You manage: Applications, data, access. Azure: OS, runtime, middleware

SaaS Software as a Service (SaaS)

Least Responsibility Least Customer Responsibility

25% You 25% Your Responsibility

You manage: Data, user accounts, permissions. Azure: Everything else

IaaS: Infrastructure as a Service

IaaS is like renting a house - you get the basic structure and utilities, but you're responsible for everything inside. You manage the operating system, applications, data, and security configurations while Azure handles the underlying hardware.

🏗️ IaaS Responsibility Matrix

🔴 Your Responsibilities (Customer)

💾 Information and Data

All your files, databases, business data, intellectual property

• Backup strategies • Data classification • Data retention

🔐 Identity and Access Management

User accounts, passwords, multi-factor authentication

• Azure AD configuration • RBAC setup • Conditional access

💻 Operating System

Windows/Linux OS, patches, updates, configuration

• Security patches • Antivirus • OS hardening

📱 Applications

Software installation, configuration, maintenance

• Application security • Updates • License management

🌐 Network Controls

Firewalls, NSGs, VNets, subnets, routing

• Security groups • VPN setup • Traffic rules

🔵 Azure's Responsibilities (Provider)

🏢 Physical Infrastructure

Data centers, servers, storage, networking hardware

• Hardware maintenance • Power systems • Cooling

🔒 Physical Security

Building access, guards, surveillance, badges

• Biometric access • 24/7 monitoring • Secure disposal

🌍 Network Infrastructure

Internet backbone, Azure network, DDoS protection

• Global connectivity • Traffic engineering • Peering

💽 Virtualization Host

Hypervisor, VM isolation, resource allocation

• Hyper-V security • Resource limits • Isolation

📊 Service Health

Uptime, availability, service monitoring

• 99.9% SLA • Health dashboards • Incident response

🏭 Real-World Example: Manufacturing Company Migration

📋 The Scenario:

TechManufacturing Inc. wants to move their on-premises ERP system to Azure VMs. They need to understand their security responsibilities.

🎯 What They Must Handle:

Windows Server licensing and patching: Keep OS updated monthly
ERP application security: Configure antivirus, encryption
Network security groups: Define firewall rules for ERP access
Data backup strategy: Schedule backups, test restores
User access management: Set up Azure AD, assign permissions

✅ What Azure Handles:

Physical data center security: Guards, cameras, access controls
Hardware maintenance: Server repairs, replacements
Hypervisor security: VM isolation, resource limits
Network infrastructure: Internet connectivity, Azure backbone
Compliance certifications: SOC 2, ISO 27001, FedRAMP

💡 Key Lesson:

In IaaS, you have the most control but also the most responsibility. It's like renting an unfurnished apartment - you get the structure and utilities, but you furnish and secure everything inside.

⚠️ Common IaaS Security Mistakes

❌ What Goes Wrong:

"Azure handles security"

Assumption that Azure secures your OS and applications

Missing OS patches

Not applying security updates to Windows/Linux

Open network security groups

Allowing unnecessary inbound traffic

No backup strategy

Assuming Azure automatically backs up all data

✅ Best Practices:

Automated patch management

Use Azure Update Management for systematic patching

Principle of least privilege

Only allow necessary network traffic and user access

Comprehensive backup

Configure Azure Backup for VMs and data

Security monitoring

Enable Azure Security Center for continuous monitoring

PaaS: Platform as a Service

PaaS is like renting a furnished apartment - the furniture (platform) is provided, you just bring your belongings (applications and data). Azure manages the operating system, runtime, and middleware while you focus on your applications and data.

🏗️ PaaS Responsibility Matrix

🟢 Your Responsibilities

💾 Information and Data

Your application data, business logic, content

🔐 Identity and Access

User authentication, authorization, permissions

📱 Applications

Application code, configuration, deployment

📱 Client Devices

Mobile devices, browsers, endpoints

🟡 Shared Responsibilities

🌐 Network Controls

App-level firewalls, some network config

🔒 Application Security

Code security, authentication integration

📊 Monitoring

Application insights, custom metrics

🔧 Configuration

Platform settings, service limits

🔵 Azure's Responsibilities

💻 Operating System

OS management, patches, updates

⚙️ Runtime Environment

.NET, Java, Python, Node.js platforms

🏢 Physical Infrastructure

Servers, networking, data centers

🔐 Platform Security

Infrastructure security, compliance

🌐 Real-World Example: E-commerce Web Application

📋 The Scenario:

OnlineShop Inc. uses Azure App Service to host their e-commerce website. They want to understand their security responsibilities versus Azure's.

🎯 What They Must Handle:

Application code security: Input validation, SQL injection prevention
Database security: SQL Server connection strings, data encryption
User authentication: Azure AD B2C configuration, user management
API keys and secrets: Managing third-party integrations securely
Application monitoring: Custom metrics, error tracking

✅ What Azure App Service Handles:

Web server management: IIS configuration, load balancing
OS security patches: Automatic Windows updates
Network infrastructure: DDoS protection, CDN integration
SSL certificate management: Automatic certificate renewal
Platform monitoring: Service health, availability metrics

💡 Key Insight:

In PaaS, you focus on your application and data while Azure manages the platform. It's the sweet spot between control and convenience - perfect for developers who want to build, not manage infrastructure.

🔧 Common Azure PaaS Services & Responsibilities

🌐 Azure App Service

Web apps, APIs, mobile app backends

You manage:

• Application code and configuration

• Custom domains and SSL certificates

• Application-level authentication

🗄️ Azure SQL Database

Managed relational database service

You manage:

• Database schema and data

• User access and permissions

• Query performance optimization

⚡ Azure Functions

Serverless compute platform

You manage:

• Function code and triggers

• Environment variables and secrets

• Integration configurations

🚀 Azure Kubernetes Service (AKS)

Managed Kubernetes platform

You manage:

• Container images and deployments

• Kubernetes RBAC configuration

• Application networking policies

🧠 Azure Cognitive Services

AI and machine learning APIs

You manage:

• API keys and access policies

• Training data and models

• Application integration logic

📧 Azure Logic Apps

Workflow automation platform

You manage:

• Workflow design and logic

• Connector configurations

• Data transformation rules

SaaS: Software as a Service

SaaS is like staying in a full-service hotel - everything is provided and managed for you. You just use the software through a web browser while Microsoft handles everything from infrastructure to application updates. Your responsibility is minimal: just your data and user management.

🏗️ SaaS Responsibility Matrix

🟣 Your Minimal Responsibilities

💾 Information and Data

Your files, emails, documents, business data

• Data classification • Access permissions • Content management

👥 User Account Management

Adding/removing users, assigning licenses

• User provisioning • Role assignments • License management

🔐 Access Control

Who can access what data and features

• Sharing permissions • Guest access • External sharing

📱 Client Devices

Computers, phones, tablets accessing the service

• Device security • Browser updates • Endpoint protection

🔵 Microsoft's Extensive Responsibilities

📱 Applications

Office 365, Teams, SharePoint, all software

• Software updates • Feature releases • Bug fixes

⚙️ Runtime & Middleware

Application runtime, databases, messaging

• Performance optimization • Scaling • Integration

💻 Operating System

Windows/Linux servers, patches, configuration

• Security patches • OS updates • System hardening

🌐 Network & Physical

Data centers, networking, physical security

• Global infrastructure • DDoS protection • Compliance

🔐 Platform Security

Identity platform, authentication, encryption

• Multi-factor authentication • Data encryption • Threat detection

📊 Service Management

Monitoring, backup, disaster recovery

• 99.9% uptime SLA • Automatic backups • Global redundancy

📧 Real-World Example: Microsoft 365 for Business

📋 The Scenario:

GlobalCorp uses Microsoft 365 (Outlook, Teams, SharePoint, OneDrive) for their 1,000 employees. They want to understand what they're responsible for versus what Microsoft handles.

🎯 What They Must Handle:

User lifecycle management: Onboarding, offboarding employees
Access permissions: Who can access SharePoint sites, Teams
Data classification: Marking sensitive documents appropriately
External sharing policies: Rules for sharing with partners
User training: Teaching employees how to use tools securely

✅ What Microsoft 365 Handles:

Automatic updates: Office applications, security patches
Data backup and recovery: Multiple geo-redundant copies
Anti-malware protection: Email and file scanning
Infrastructure management: Servers, networking, data centers
Compliance certifications: SOC 2, ISO 27001, HIPAA, GDPR

💡 The Beauty of SaaS:

With SaaS, you get enterprise-grade security, compliance, and reliability without needing IT experts. Microsoft handles 95% of the complexity - you focus on using the tools to grow your business.

📱 Common Azure SaaS Examples & Your Responsibilities

📧 Microsoft 365

Email, Office apps, collaboration

You manage:

• User accounts and licenses

• Email rules and policies

• Document permissions

• Teams and channels

💼 Dynamics 365

CRM and ERP platform

You manage:

• Customer data and relationships

• Sales processes and workflows

• Custom fields and entities

• User roles and permissions

🔐 Azure AD B2C

Customer identity management

You manage:

• User flows and policies

• Brand customization

• External identity providers

• Customer data policies

📊 Power BI Service

Business intelligence and analytics

You manage:

• Data sources and connections

• Report design and content

• Dashboard sharing

• Workspace permissions

📱 Intune

Mobile device management

You manage:

• Device enrollment policies

• App deployment rules

• Compliance policies

• Conditional access rules

🔒 Azure Information Protection

Data classification and protection

You manage:

• Classification labels

• Protection policies

• User training

• Label application rules

Security Incidents & Compliance

🚨 Security Incident Response Responsibilities

🔴 When Security Incidents Occur

Security incidents can happen at any layer of the cloud stack. Understanding who responds to what is crucial for effective incident management.

🏢 Infrastructure Incidents

Data center outages, hardware failures, network issues

Azure handles: Detection, response, resolution, communication

🖥️ Platform Incidents

Service outages, performance degradation

Shared responsibility: Azure fixes platform, you may need to restart apps

📱 Application Incidents

Code vulnerabilities, data breaches, access violations

Your responsibility: Investigation, remediation, user notification

🔵 Incident Response Matrix

IaaS Incident Response

Azure handles:

• Hardware failures

• Network outages

• Hypervisor issues

You handle:

• OS security breaches

• Application vulnerabilities

• Data compromises

PaaS Incident Response

Azure handles:

• Platform outages

• Runtime vulnerabilities

• Infrastructure issues

You handle:

• Application bugs

• Data security incidents

• Access control issues

SaaS Incident Response

Microsoft handles:

• Service outages

• Security patches

• Performance issues

You handle:

• User access reviews

• Data classification

• Policy violations

📋 Compliance and Governance Responsibilities

🏛️ Azure's Compliance Foundation

Azure provides the compliant infrastructure foundation, but you're responsible for using it in a compliant manner for your specific requirements.

🏢 Infrastructure Compliance

SOC 2, ISO 27001, FedRAMP, HIPAA-ready infrastructure

🔐 Security Controls

Built-in security features, encryption, audit logging

📊 Audit Reports

Regular compliance assessments and certifications

🎯 Your Compliance Responsibilities

📋 Requirements Assessment

Understand your specific compliance obligations (GDPR, HIPAA, SOX)

⚙️ Configuration Management

Configure Azure services to meet your compliance needs

📊 Data Governance

Data classification, retention policies, access controls

📝 Documentation & Audits

Maintain compliance documentation, respond to audits

💡 Key Insight:

Azure provides compliant infrastructure, but you must configure and use it compliantly. It's like having a certified kitchen - you still need to follow food safety procedures.

📊 Monitoring and Logging Responsibilities

🔵 Azure Monitors

🏢 Infrastructure Health

Server performance, network status, availability

⚙️ Platform Services

Service health, SLA compliance, capacity

🔐 Security Events

Infrastructure attacks, compliance violations

🟡 Shared Monitoring

🌐 Network Security

DDoS attacks, network intrusion attempts

🔒 Identity Events

Authentication failures, suspicious logins

📊 Performance Metrics

Resource utilization, response times

🟢 You Monitor

📱 Application Performance

Response times, error rates, user experience

💾 Data Access Patterns

Who accessed what data, when, and how

👥 User Behavior

Login patterns, privilege usage, anomalies

Compliance & Regulatory Frameworks

Understanding compliance frameworks is crucial for implementing Azure solutions in regulated industries. While Azure provides compliant infrastructure and services, organizations must configure and use them properly to meet their specific regulatory requirements.

🏛️ Azure's Compliance Foundation

🌐 Global Compliance Coverage

Azure maintains one of the most comprehensive compliance portfolios in the cloud industry, with over 90 compliance offerings across global, government, industry-specific, and regional standards.

📊 By the Numbers

90+

Compliance Offerings

50+

Countries/Regions

🌍 Global Standards

ISO 27001, SOC 1/2/3, CSA STAR

🏥 Industry-Specific

HIPAA, PCI DSS, FDA CFR Part 11

🏛️ Government

FedRAMP, DoD SRG, FISMA

🌍 Regional

GDPR, PIPEDA, Australia IRAP

🤝 Shared Compliance Responsibility

Compliance in the cloud follows the shared responsibility model. Azure provides compliant infrastructure and services, but customers must configure and use them according to their specific compliance requirements.

🔵 Microsoft's Compliance Role

• Maintains certified infrastructure and services
• Provides compliance documentation and audit reports
• Offers compliance-ready tools and features
• Undergoes regular third-party assessments
• Maintains security controls and monitoring

🟢 Customer's Compliance Role

• Understand specific regulatory requirements
• Configure Azure services for compliance
• Implement proper data governance
• Manage user access and permissions
• Monitor and audit your environment
• Maintain compliance documentation

GDPR - General Data Protection Regulation

European Union • Data Privacy & Protection

📋 What is GDPR?

The General Data Protection Regulation (GDPR) is a comprehensive data privacy law enacted by the European Union in 2018. It governs how organizations collect, process, store, and protect personal data of EU residents, regardless of where the organization is located.

🎯 Key GDPR Principles:

1. Lawfulness & Transparency

Legal basis for processing, clear privacy notices

2. Purpose Limitation

Data used only for specified purposes

3. Data Minimization

Collect only necessary data

4. Data Subject Rights

Access, rectification, erasure, portability

☁️ GDPR & Azure Services

🔵 Microsoft's GDPR Commitments

• GDPR-compliant Data Processing Agreement (DPA)
• EU Data Residency options in Azure regions
• Built-in privacy controls and encryption
• Data Subject Rights request tools
• Regular privacy impact assessments

🟢 Your GDPR Responsibilities

• Implement privacy by design in applications
• Configure data retention and deletion policies
• Ensure legal basis for data processing
• Respond to data subject requests within 30 days
• Report data breaches within 72 hours
• Conduct Data Protection Impact Assessments

🛠️ Azure GDPR Tools

• Azure Information Protection: Data classification
• Azure Policy: Compliance automation
• Azure Monitor: Audit logging
• Microsoft Compliance Manager: Assessment tools

💰 GDPR Penalties

Up to €20 million or 4% of annual global turnover (whichever is higher) for serious violations. Proper Azure configuration and governance helps avoid these penalties.

HIPAA - Health Insurance Portability and Accountability Act

United States • Healthcare Data Protection

🏥 What is HIPAA?

HIPAA is a US federal law enacted in 1996 that establishes national standards for protecting patient health information. It applies to covered entities (healthcare providers, health plans, healthcare clearinghouses) and their business associates who handle Protected Health Information (PHI).

🔐 HIPAA Security Requirements:

Administrative Safeguards

Policies, procedures, workforce training

Physical Safeguards

Facility access, device controls

Technical Safeguards

Access controls, encryption, audit logs

📊 PHI Protection

Protected Health Information includes any health information that can identify an individual: medical records, billing information, demographic data, and any health data linked to identity.

☁️ HIPAA & Azure Healthcare

✅ Azure HIPAA Features

• Business Associate Agreement (BAA) available
• HIPAA-eligible services clearly identified
• Encryption at rest and in transit
• Comprehensive audit logging
• Role-based access controls (RBAC)
• Azure Health Data Services for FHIR

🏥 Healthcare Implementation

• Use only HIPAA-eligible Azure services
• Implement minimum necessary access principle
• Configure automated audit logging
• Set up data retention and deletion policies
• Regular security risk assessments
• Staff training on HIPAA compliance

🛠️ Key Azure Services for HIPAA

• Azure Health Data Services: FHIR® API
• Azure SQL Database: Encrypted patient records
• Azure Key Vault: Encryption key management
• Azure Monitor: Audit and compliance logging
• Azure AD: Identity and access management

⚖️ HIPAA Violations

Penalties range from $100 to $50,000 per violation, with annual maximums up to $1.5 million. Criminal violations can result in fines up to $250,000 and 10 years in prison.

SOX - Sarbanes-Oxley Act

United States • Financial Reporting & Corporate Governance

💼 What is SOX?

The Sarbanes-Oxley Act of 2002 is a US federal law that establishes requirements for financial reporting transparency and corporate governance for publicly traded companies. It mandates strict controls over financial data and reporting processes to prevent corporate fraud.

📋 Key SOX Sections:

Section 302

CEO/CFO certification of financial reports

Section 404

Internal controls over financial reporting

Section 409

Real-time disclosure requirements

Section 802

Record retention requirements

🎯 SOX Objectives

• Ensure accuracy of financial reporting
• Establish internal controls and procedures
• Protect investors from corporate fraud
• Maintain audit trails and documentation

☁️ SOX Compliance in Azure

🔵 Azure SOX Support

• SOC 1 Type 2 attestation reports
• Comprehensive audit logging and monitoring
• Change management controls
• Data integrity and retention capabilities
• Role-based access controls
• Segregation of duties enforcement

📊 Financial Data Controls

• Implement segregation of duties in Azure RBAC
• Configure audit logging for all financial systems
• Set up change management workflows
• Establish data retention policies (7+ years)
• Monitor privileged access to financial data
• Regular access reviews and certifications

🛠️ Azure SOX Implementation

• Azure Monitor: Comprehensive audit trails
• Azure Policy: Automated compliance controls
• Azure DevOps: Change management workflows
• Azure Backup: Data retention and recovery
• Azure AD PIM: Privileged access management

⚖️ SOX Violations

Criminal penalties include fines up to $5 million and 20 years imprisonment for executives. Civil penalties can reach $150,000 for officers and directors.

SOC 2 - Service Organization Control 2

AICPA Standard • Service Provider Controls

🏢 What is SOC 2?

SOC 2 is an auditing standard developed by the American Institute of CPAs (AICPA) that evaluates the internal controls of service organizations relevant to security, availability, processing integrity, confidentiality, and privacy of customer data.

🔐 SOC 2 Trust Principles:

🛡️ Security (Required)

Protection against unauthorized access

⏰ Availability

System operational availability as committed

⚙️ Processing Integrity

Complete, valid, accurate, timely processing

🔒 Confidentiality

Designated confidential information protection

🔐 Privacy

Personal information collection, use, and disposal

📊 SOC 2 Types

• Type I: Controls design at a point in time
• Type II: Controls effectiveness over a period (6-12 months)

☁️ Azure SOC 2 Compliance

✅ Azure SOC 2 Achievements

• SOC 2 Type II reports for all Azure services
• Annual independent audits by qualified CPAs
• Covers all five trust service principles
• Global compliance across all Azure regions
• Continuous monitoring and improvement
• Customer access to detailed audit reports

🎯 Customer SOC 2 Preparation

• Leverage Azure's SOC 2 reports for your audits
• Implement complementary controls for your applications
• Document your control environment and procedures
• Monitor and log all system activities
• Establish incident response procedures
• Regular security assessments and testing

🛠️ Azure SOC 2 Tools

• Azure Security Center: Security posture management
• Azure Sentinel: Security monitoring and SIEM
• Azure Monitor: Comprehensive logging and alerting
• Azure Backup: Data protection and availability
• Service Health: Service availability monitoring

📈 Business Value

SOC 2 compliance demonstrates to customers and partners that your organization has robust security controls and can be trusted with sensitive data and critical operations.

ISO 27001 - Information Security Management

International Standard • Security Management Systems

🌍 What is ISO 27001?

ISO 27001 is an internationally recognized standard that specifies requirements for establishing, implementing, maintaining, and improving an Information Security Management System (ISMS). It provides a systematic approach to managing sensitive information and ensuring its confidentiality, integrity, and availability.

🔄 ISMS Process (Plan-Do-Check-Act):

📋 Plan

Establish ISMS policy, objectives, and procedures

⚙️ Do

Implement and operate ISMS controls and procedures

📊 Check

Monitor, review, and assess ISMS performance

🔄 Act

Maintain and improve ISMS based on results

🎯 ISO 27001 Key Components

• Risk assessment and treatment methodology
• 114 security controls across 14 domains
• Management commitment and governance
• Continuous improvement culture

☁️ ISO 27001 & Azure

🏆 Azure ISO 27001 Certification

• Global certification for Azure cloud services
• Annual surveillance audits by accredited bodies
• Comprehensive ISMS covering all Azure operations
• Statement of Applicability (SoA) available
• Risk-based approach to security management
• Continuous monitoring and improvement

🔐 14 Security Control Domains

• Information Security Policies

• Organization of Information Security

• Human Resource Security

• Asset Management

• Access Control

• Cryptography

• Physical Security

• Operations Security

• Communications Security

• System Development

• Supplier Relationships

• Incident Management

• Business Continuity

• Compliance

🛠️ Customer ISO 27001 Journey

• Leverage Azure's certified infrastructure
• Conduct your own risk assessment
• Implement complementary controls
• Document policies and procedures
• Train staff on security awareness
• Regular internal audits and reviews

🌟 Global Recognition

ISO 27001 is recognized worldwide and often required for government contracts, healthcare organizations, and businesses handling sensitive data.

PCI DSS - Payment Card Industry Data Security Standard

Global Standard • Payment Card Data Protection

💳 What is PCI DSS?

PCI DSS is a global information security standard designed to prevent credit card fraud by protecting cardholder data. It applies to all organizations that store, process, or transmit payment card information, regardless of size or transaction volume.

🛡️ 12 PCI DSS Requirements:

1-2: Network Security (Firewalls, secure configurations)

3-4: Cardholder Data Protection (Encryption, transmission)

5-6: Vulnerability Management (Antivirus, secure development)

7-8: Access Controls (Restrict access, unique IDs)

9-10: Monitoring (Physical access, network monitoring)

11-12: Testing & Policies (Security testing, information security policy)

🎯 PCI Compliance Levels

• Level 1: 6M+ transactions/year - QSA assessment
• Level 2: 1-6M transactions/year - Self-assessment
• Level 3: 20K-1M e-commerce/year - Self-assessment
• Level 4: <20K transactions/year - Self-assessment

☁️ PCI DSS & Azure

✅ Azure PCI DSS Features

• PCI DSS Level 1 Service Provider validation
• Attestation of Compliance (AoC) available
• Secure payment processing environments
• Network segmentation and isolation
• Encryption at rest and in transit
• Comprehensive logging and monitoring

💳 Payment Application Security

• Use Azure Payment HSM for key management
• Implement tokenization for card data
• Deploy applications in PCI-compliant environments
• Regular vulnerability scanning and penetration testing
• Implement strong access controls and monitoring
• Maintain detailed audit trails

🛠️ Azure PCI-Relevant Services

• Azure Payment HSM: Hardware security modules
• Azure App Service: Secure payment app hosting
• Azure Key Vault: Encryption key management
• Azure Firewall: Network security controls
• Azure Monitor: Logging and alerting
• Azure Security Center: Vulnerability management

💰 PCI Non-Compliance Costs

Non-compliance can result in fines from $5,000 to $100,000 per month, plus potential liability for fraud losses and increased transaction fees.

FedRAMP - Federal Risk and Authorization Management Program

US Government • Cloud Security Authorization

🏛️ What is FedRAMP?

FedRAMP is a US government program that provides a standardized approach to security assessment, authorization, and continuous monitoring for cloud products and services used by federal agencies. It ensures cloud services meet federal security requirements.

🔒 FedRAMP Authorization Levels:

Low Impact (LI-SaaS)

Public information, minimal impact if compromised

Moderate Impact

Sensitive but unclassified information

High Impact

High-risk data, significant impact if compromised

📋 FedRAMP Benefits

• "Do once, use many" - reusable authorization
• Accelerated federal cloud adoption
• Standardized security requirements
• Continuous monitoring requirements
• Enhanced transparency and accountability

☁️ Azure FedRAMP Authorization

🏆 Azure Government Authorizations

• Azure Commercial: FedRAMP Moderate (ATO)
• Azure Government: FedRAMP High (P-ATO)
• Azure Government Secret: IL5 authorization
• Azure Government Top Secret: IL6 authorization
• Dedicated regions for government workloads
• US citizen-operated and managed

🔐 Security Controls Implementation

• 400+ NIST 800-53 security controls implemented
• Continuous monitoring and scanning
• Physical separation from commercial cloud
• Enhanced identity and access controls
• Comprehensive audit and compliance logging
• Incident response and forensics capabilities

🛠️ Government Agency Benefits

• Inherit Azure's FedRAMP authorization
• Reduced assessment time and costs
• Access to authorized cloud services marketplace
• Streamlined procurement processes
• Enhanced security and compliance posture
• Support for sensitive government workloads

🎯 Government Cloud Strategy

FedRAMP enables federal agencies to leverage cloud technologies while maintaining the security, privacy, and compliance required for government operations.

🌐 Additional Compliance Frameworks

FISMA

Federal Information Security Management Act

US federal law requiring information security programs for government agencies and contractors.

• Risk-based approach to security
• NIST cybersecurity framework
• Continuous monitoring

CSA STAR

Cloud Security Alliance Security, Trust & Assurance Registry

Free, publicly accessible registry of cloud provider security assessments.

• Self-assessment questionnaire
• Third-party attestation
• Continuous monitoring

NIST

National Institute of Standards and Technology

Cybersecurity framework providing guidelines for managing cybersecurity risks.

• Identify, Protect, Detect
• Respond, Recover
• Risk management focus

PIPEDA

Personal Information Protection and Electronic Documents Act

Canada's federal privacy law governing private sector personal information handling.

• Consent requirements
• Purpose limitation
• Individual access rights

Australia IRAP

Information Security Registered Assessors Program

Australian government assessment for cloud services security.

• PROTECTED level certification
• Australian government cloud
• Strict data sovereignty

ENS

Esquema Nacional de Seguridad (Spain)

Spanish national security framework for public administration information systems.

• High, Medium, Low security levels
• Risk management approach
• Continuous improvement

🎯 Compliance Implementation Strategy in Azure

📋 Step-by-Step Approach

1. Assess Requirements

• Identify applicable regulations and standards
• Understand specific compliance obligations
• Document business requirements and constraints
• Evaluate current security posture

2. Design Architecture

• Select appropriate Azure regions and services
• Design network segmentation and access controls
• Plan data classification and protection
• Incorporate compliance controls by design

3. Implement Controls

• Deploy Azure Policy for automated compliance
• Configure security controls and monitoring
• Implement data encryption and key management
• Set up audit logging and retention

4. Monitor & Maintain

• Continuous compliance monitoring
• Regular assessments and audits
• Incident response and remediation
• Documentation and reporting

🛠️ Azure Compliance Tools

Microsoft Compliance Manager

Risk assessment and compliance score tracking

Azure Policy

Automated governance and compliance enforcement

Azure Blueprints

Repeatable, compliant environment deployment

Azure Monitor

Comprehensive logging, monitoring, and alerting

Azure Security Center

Security posture management and recommendations

Azure Information Protection

Data classification and protection

🎯 Best Practice

Use Azure's native compliance tools and leverage Microsoft's compliance investments to reduce your compliance burden while maintaining strong security posture.

📚 Compliance Quick Reference

Framework	Industry/Region	Key Focus	Azure Support	Penalties
GDPR	EU/Privacy	Personal data protection	✅ Full compliance	€20M or 4% revenue
HIPAA	US/Healthcare	Health information	✅ BAA available	$1.5M annually
SOX	US/Financial	Financial reporting	✅ SOC 1 reports	$5M + 20 years
SOC 2	Global/Services	Service controls	✅ Type II reports	Business impact
ISO 27001	Global/Security	Security management	✅ Certified	Business/contract
PCI DSS	Global/Payments	Card data security	✅ Level 1 validated	$100K/month
FedRAMP	US/Government	Federal cloud security	✅ High authorization	Contract loss

💡 Key Takeaway

Azure provides the compliant foundation, but you must configure and use services correctly to meet your specific compliance requirements. Leverage Azure's compliance tools and documentation to simplify your compliance journey.

Real-World Scenarios

🏥 Scenario 1: HealthCare Inc. HIPAA Compliance

📋 The Challenge:

HealthCare Inc. wants to move their patient management system to Azure. They need to understand HIPAA compliance responsibilities and ensure patient data protection.

🏥 What Azure Provides:

HIPAA-eligible infrastructure: Certified data centers and services
Business Associate Agreement (BAA): Legal framework for HIPAA compliance
Built-in encryption: Data at rest and in transit protection
Audit logging: Comprehensive activity tracking

🎯 What HealthCare Inc. Must Do:

Configure access controls: Only authorized staff access patient data
Manage encryption keys: Control access to decryption capabilities
Train staff: HIPAA awareness and secure usage practices
Monitor access: Regular audit of who accessed patient records
Data retention: Implement proper retention and deletion policies

💡 The Outcome:

Azure provides HIPAA-ready infrastructure, but HealthCare Inc. must configure and use it properly. The shared responsibility ensures both technical and procedural compliance.

🏦 Scenario 2: SecureBank's Multi-Tier Application

📋 The Architecture:

SecureBank uses a hybrid approach: IaaS for their core banking system, PaaS for customer-facing web apps, and SaaS for employee collaboration. Each has different responsibility boundaries.

🏛️ Core Banking (IaaS)

Azure VMs running legacy COBOL applications

High customer responsibility

🌐 Web Banking (PaaS)

Azure App Service for online banking portal

Shared responsibility

📧 Employee Tools (SaaS)

Microsoft 365 for internal communication

Minimal customer responsibility

🎯 Responsibility Breakdown:

IaaS Banking System

✅ SecureBank manages:

• Windows Server security patches

• Database encryption and backup

• Network security groups

• Application-level firewalls

PaaS Web Portal

✅ SecureBank manages:

• Web application security

• Customer authentication

• API security and rate limiting

SaaS Employee Tools

✅ SecureBank manages:

• User account provisioning

• Email retention policies

• Data loss prevention rules

🚨 Scenario 3: Data Breach Incident Response

⚠️ The Incident:

TechCorp discovers unauthorized access to their Azure SQL Database containing customer information. An employee's credentials were compromised, leading to data access from an unusual location.

🔍 Investigation Findings:

Weak password policy: Employee used simple, reused password
No MFA enabled: Single factor authentication was insufficient
Excessive permissions: Employee had more access than needed
Delayed detection: No real-time monitoring alerts configured

🎯 Responsibility Analysis:

✅ What Azure Did Right

• Protected infrastructure from attack
• Provided audit logs of all access
• Offered MFA and monitoring tools
• Ensured data encryption at rest

❌ Where TechCorp Failed

• Did not enforce strong password policy
• Failed to enable MFA for all users
• Granted excessive database permissions
• No monitoring alerts configured

🛠️ Remediation Actions

• Immediate: Reset all passwords, enable MFA
• Short-term: Review and reduce permissions
• Long-term: Implement monitoring and alerts
• Ongoing: Security awareness training

💡 Key Learning:

Azure provided all the security tools needed, but TechCorp failed to configure and use them properly. The breach was preventable with proper implementation of available security features.

Best Practices for Shared Responsibility

📖 Understand Your Boundaries

• Study the shared responsibility matrix for each service
• Document your responsibilities clearly
• Train your team on security boundaries
• Regular responsibility reviews and updates

📋 Document Everything

• Create security responsibility matrices
• Maintain configuration documentation
• Record all security decisions and rationale
• Keep incident response procedures updated

🤖 Automate Your Responsibilities

• Use Azure Policy for compliance automation
• Implement automated security scanning
• Set up automated backup and recovery
• Use Azure Security Center recommendations

📊 Continuous Monitoring

• Implement comprehensive logging
• Set up real-time security alerts
• Regular security assessments
• Monitor compliance continuously

🎓 Ongoing Education

• Regular security awareness training
• Stay updated on Azure security features
• Practice incident response procedures
• Learn from security incidents and near-misses

🧪 Regular Testing

• Conduct security penetration testing
• Test backup and recovery procedures
• Validate incident response plans
• Perform disaster recovery drills

📚 Quick Reference: Always Remember

Never Azure's Responsibility

• Your data and content
• User account management
• Client device security
• Application-level access control

Always Azure's Responsibility

• Physical infrastructure security
• Network infrastructure
• Hypervisor security
• Service availability (per SLA)

Varies by Service Model

• Operating system security
• Network controls
• Application security
• Identity and access management

Session Summary

🎯 Key Takeaways from Session 5

🤝 Shared Responsibility Fundamentals:

Core Principle: Security responsibilities are divided between you and Azure
Azure's role: "Security OF the cloud" - infrastructure and platform
Your role: "Security IN the cloud" - data, identity, applications
Service models: Responsibilities shift as you move IaaS → PaaS → SaaS

🔒 Always Your Responsibility:

Information and data: Classification, protection, governance
Identity and access: User management, authentication, permissions
Client devices: Endpoint security, device management
Configuration: Proper setup of security controls and policies

🏢 Always Azure's Responsibility:

Physical infrastructure: Data centers, servers, networking hardware
Physical security: Building access, guards, surveillance
Network infrastructure: Internet backbone, global connectivity
Hypervisor: Virtualization security, tenant isolation

⚖️ Service Model Differences:

IaaS: You manage OS, apps, data - most responsibility
PaaS: Shared management - Azure handles OS, you handle apps
SaaS: Microsoft manages most - you handle data and users
Trend: More managed service = less customer responsibility

🚀 Ready for Next Steps?

Perfect! You now understand the fundamental principle that governs all cloud security: the Shared Responsibility Model. This knowledge is crucial for implementing secure cloud solutions and avoiding common security gaps.

Test Your Knowledge - Quiz 5 Continue to Session 6: Deployment Models

AZ-900 Exam Tips

🎯 Remember for Exam:

• Physical security = always Azure's responsibility
• Data and identity = always customer's responsibility
• Operating system responsibility varies by service model
• More managed service = less customer responsibility
• Shared responsibility ≠ shared accountability

💡 Common Exam Questions:

• Who manages OS patches in IaaS vs PaaS?
• What's always the customer's responsibility?
• How do responsibilities change across service models?
• Who handles physical security of data centers?
• Identity management responsibilities in each model