Microsoft Azure Platform Certified "Secure" By Department of Defense

cagraham writes "Microsoft's cloud storage platform Azure received their first government certification yesterday, less than 24 hours before the official shutdown. The certification, which grants Azure 'Provisional Authority to Operate,' should make it easier for Microsoft to compete with rivals like IBM and Amazon Web Services for government contracts. The certification signifies that the Department of Defense, Homeland Security, and US General Services Administration have all deemed Azure safe from external hackers. Government cloud contracts are a lucrative market, as seen by Amazon's recent tussle with IBM over a $600M contract for a private CIA cloud."

Comments

Re:"Secure" meaning . . .

[Hoi Polloi]

The certification makes it easy for foreign entities to avoid it like the plague.

Reminds me of a conversation...

[ducomputergeek]

...when I worked in "Academic Computing" on the campus of the college I went to. What that really meant was I was one of five students allowed to touch the AS/400 we had. I remember my boss in a presentation where he boasted that AIX had never been hacked and I snorted. He looked at me puzzled and I said, "Is it available for export?" Answer was yes, "Well it has a backdoor that the NSA can use. Furthermore, how many of their premiere tech support staff, you know the people they send out in the field, work for IBM and draw a nice second paycheck from (insert 3 letter agency here)?" After that's how the CIA spied on the Soviet Embassy. They sent in a Xerox employee who also worked for the CIA to do maintenance on their Xerox machine...

Of course this was back at a time where very few outside of the military even knew the NSA existed or what they did. I was aware of them because I was following their Security Enhanced Linux developments at the time.

He didn't believe me. Recently got an email from him stating that it appears the arrogant 20 year old kid 13 years ago turned out to be largely correct about NSA capabilities....

It also didn't hurt that my father as an executive at one of the major defense contractors (hint they built fighter planes like the F-15 & F-18 & AV-8B). All my neighbors were engineers at the same company. I grew up in that world I remember asking what happened if we sold F-15's to country X and they used them against us: see Iran and the 1970's. The response I got was, "There's contingencies built into the systems", i.e. there was another reason the Israeli air force remained grounded during the first gulf war...

ok, so..

[roc97007]

...having worked for a company that did this type of stuff for the government, and seeing the process first hand, what I observe is that the certification is not necessary done by someone with a deep knowledge of security. It's done by a bored inspector with some training, checking off line items, sometimes for political reasons, sometimes for business reasons, or sometimes because the inspector wants to make his flight back to Virginia. So, great, it passed. Until it gets pwned. Then starts the long process of plugging an individual hole, getting pwned again, plugging another hole, getting pwned again. You know, the usual Microsoft patch cycle.