Topsummit安全既服务案例分析–WindowsAzureAD身份云的架构和设计-微软李雨航

安全既服务案例分析–WindowsAzureAD身份云的架构和设计李雨航YaleLi微软全球首席安全架构师云安全联盟全球总战略顾问摘要1）传统IT安全软件的问题和不足

2）安全既服务的产生和要解决的问题3）WindowsAzureAD身份云的架构和设计4）开发人员使用场景5）打造身份云吸取的经验教训传统IT安全软件的问题和不足不适应多租户的云服务用户扩展性的局限无法跟上快速开发部署的步伐SecuritySoftwareExamples:Ad-AwareFreeAntivirus+Protectyourpersonalcomputeragainstvirusandspywareattacks.ComodoInternetSecurityProtectPCfromviruses,Trojans,worms,bufferoverflows,zero-dayattacks,spywareandhackers.ComodoFirewallGuardyourWindowsPCfrommalwareandInternetbasedattacks.SuperAntiSpywareFreeEditionDetectandremovespyware,malware,rootkits,trojans,hijackers,andothermaliciousthreats.ComodoAntivirusDetectanddestroymalwareandviruses.USBDiskSecurityProvideprotectionagainstanymaliciousprogramstryingtoattackviaUSBdrive.HitmanPro3(32-bit)Rescueyourcomputerfromvirusesandmalware.TrendMicroHijackThisScanyourRegistryandharddriveforspyware.MicrosoftSecurityEssentials(64-bit)ProtectyourcomputerwithMicrosoft'slatestsecuritysoftware.SuperAdBlockerBlockallformsofadvertising,includingpop-ups,Flashads,andbannerads.安全既服务的产生和要解决的问题

云计算的安全问题安全既服务带来的机会云安全联盟的十大SECaaS身份云要解决的问题描述云计算的安全问题

DataBreachesDataLossAccountHijackingInsecureAPIsDenialofServiceMaliciousInsidersAbuseofCloudServicesInsufficientDueDiligenceSharedTechnologyIssues安全既服务带来的机会

盾牌式战略思维：把注意力放在使用旧安全工具来保护云中数据和系统利剑式战略思维：为什么不能用云的力量创造出新一代安全工具这就是安全既服务（SecurityasaServiceorSECaaS)：Provisioningelastic,scalablesecuritysolutionsandservicestobothcloudbasedandtraditionalonpremisessystemsinpurecloudorhybridmodels.云安全联盟的十大SECaaS分类

IdentityandAccessManagement(IAM)–身份云DataLossPrevention(DLP)WebSecurityEmailSecuritySecurityAssessmentsIntrusionManagement,Detection,andPrevention(IDS/IDP)SecurityInformationandEventManagement(SIEM)EncryptionBusinessContinuityandDisasterRecovery(BCDR)NetworkSecurity身份云要解决的问题云用户账号身份生命周期的管理支持所以云应用的登录统一技术标准的线上线下身份认证手段组织机构的内外部共享所有员工和个人等减少企业卡，工作证，校园卡，组织机构代码证等的分别发放线上线下使用同一身份认证介质、资源管理和服务分享手段实名上网和统一数据跟踪、行为跟踪能力建立大数据和大数据溯源监控的能力使用的方便和简洁直接决定用户体验，新时代的特点WindowsAzureAD身份云的架构和设计WindowsAzureAD身份云设计原则WindowsAzureAD身份云工作原理WindowsAzureAD身份云联邦身份（Federation）WindowsAzureAD身份云一键登录(SingleSignOn)WindowsAzureAD身份云多因验证(PhoneFactor)WindowsAzureAD身份云设计原则

Theclouddesignpointdemandscapabilitiesthatarenotpartofcurrent-dayWindowsServerActiveDirectoryMaximizedevice&platformreachhttp/web/RESTbasedprotocolsMulti-tenancyCustomerownsdirectory,notMicrosoftOptimizeforavailability,consistentperformance,andscaleKeepitsimpleLeverageon-premisesinvestments,providecloudadditionsWindowsAzureAD身份云工作原理WindowsAzureAD身份云的架构和设计MSODSFederationsUsersPwdsTenantsSubscriptions,SKUsUsersandGroupsServiceprincipalsSyncTenantsIdentityProvidersServiceprincipalsADOn-premEnterpriseOrgIDACSAADCreate

Service

principalsADFSDirsyncusers,groupsIdentity

FederationMetadataNametoID

lookupAADDirectoryMgmtPortalGraphAPIPScmdsDirectorymanagementNativeClientAuthNlibLocateusers

Identity

providerRichclaims

intokenFederationsFederationsWindowsAzureAD身份云一键登录(SingleSignOn)

Singleidentityandsign-onforon-premisesandcloudservicesIdentitiesmasteredon-premises,singlepointofmanagementSecureTokenbasedauthenticationClientaccesscontrolbasedonIPaddresswithADFSandOffice365servicesStrongfactorauthenticationoptionsforadditionalsecurityWindowsAzureAD身份云

多因验证(PhoneFactor)

WhymultifactorYourdataandapplicationsareunderattackPasswordsareeasilycompromisedConsumerizationofIThasonlyincreasedthescopeofvulnerabilityStrengtheningregulatoryrequirementscallforstronglyauthenticatingaccessProvenAuthenticationPlatformPoweredbymarket-leadingPhoneFactorplatformTrustedbythousandsofenterprisecustomersacrossawiderangeofindustries,includinghealthcare,financialservices,manufacturing,andgovernmentAuthenticatingmillionsofloginsandtransactionseachmonthUserExperience(afterusername/passwordauthentication)MobileApp:

Theusertaps“Verify”intheapptoauthenticate.PhoneCall:Placesanautomatedvoicecalltotheuser.Theuseranswersthecallandpresses#inthephonekeypadtoauthenticate.TextMessage:Sendsatextpasscodetotheuser.Theusereitherrepliestothetextmessagewiththepasscodeorentersthepasscodeintothesign-ininterface.开发人员使用场景

AdeveloperofanestablishedcloudapplicationenablessignupofcustomerswhohaveAzureAD(开发企业自有身份云的云应用)Singlesignoninsteadofseparateusername/passwordforappQueryDirectoryGraphforuserinformation,provisioningAdeveloperofanewcloudapplicationusesAzureADasoff-the-shelfidentitysystemfortheirapp(开发基于身份云的云应用)UsesAzureADasthelocalaccountstoreEnablesignupofcustomersusingpopularwebIDsEnablesignupofcustomerswhohaveAzureADCheckout/en-us/manage/services/identity/(details)/en-us/library/hh974459.aspx(samples)GraphicAPI例子Request://Users('Ed@'){“d”: {"Manager":{"uri":"//Users('..')/Manager"},"MemberOf":{"uri":"//Users('..')/MemberOf"},"ObjectId":"90ef7131-9d01-4177-b5c6-fa2eb873ef19","ObjectReference":"User_90ef7131-