安全既服務案例分析–WindowsAzureAD身份云的架構和設計李雨航YaleLi微軟全球首席安全架構師云安全聯盟全球總戰略顧問摘要1）傳統IT安全軟件的問題和不足

2）安全既服務的產生和要解決的問題3）WindowsAzureAD身份云的架構和設計4）開發人員使用場景5）打造身份云吸取的經驗教訓傳統IT安全軟件的問題和不足不適應多租戶的云服務用戶擴展性的局限無法跟上快速開發部署的步伐SecuritySoftwareExamples:Ad-AwareFreeAntivirus+Protectyourpersonalcomputeragainstvirusandspywareattacks.ComodoInternetSecurityProtectPCfromviruses,Trojans,worms,bufferoverflows,zero-dayattacks,spywareandhackers.ComodoFirewallGuardyourWindowsPCfrommalwareandInternetbasedattacks.SuperAntiSpywareFreeEditionDetectandremovespyware,malware,rootkits,trojans,hijackers,andothermaliciousthreats.ComodoAntivirusDetectanddestroymalwareandviruses.USBDiskSecurityProvideprotectionagainstanymaliciousprogramstryingtoattackviaUSBdrive.HitmanPro3(32-bit)Rescueyourcomputerfromvirusesandmalware.TrendMicroHijackThisScanyourRegistryandharddriveforspyware.MicrosoftSecurityEssentials(64-bit)ProtectyourcomputerwithMicrosoft'slatestsecuritysoftware.SuperAdBlockerBlockallformsofadvertising,includingpop-ups,Flashads,andbannerads.安全既服務的產生和要解決的問題

云計算的安全問題安全既服務帶來的機會云安全聯盟的十大SECaaS身份云要解決的問題描述云計算的安全問題

DataBreachesDataLossAccountHijackingInsecureAPIsDenialofServiceMaliciousInsidersAbuseofCloudServicesInsufficientDueDiligenceSharedTechnologyIssues安全既服務帶來的機會

盾牌式戰略思維：把注意力放在使用舊安全工具來保護云中數據和系統利劍式戰略思維：為什么不能用云的力量創造出新一代安全工具這就是安全既服務（SecurityasaServiceorSECaaS)：Provisioningelastic,scalablesecuritysolutionsandservicestobothcloudbasedandtraditionalonpremisessystemsinpurecloudorhybridmodels.云安全聯盟的十大SECaaS分類

IdentityandAccessManagement(IAM)–身份云DataLossPrevention(DLP)WebSecurityEmailSecuritySecurityAssessmentsIntrusionManagement,Detection,andPrevention(IDS/IDP)SecurityInformationandEventManagement(SIEM)EncryptionBusinessContinuityandDisasterRecovery(BCDR)NetworkSecurity身份云要解決的問題云用戶賬號身份生命周期的管理支持所以云應用的登錄統一技術標準的線上線下身份認證手段組織機構的內外部共享所有員工和個人等減少企業卡，工作證，校園卡，組織機構代碼證等的分別發放線上線下使用同一身份認證介質、資源管理和服務分享手段實名上網和統一數據跟蹤、行為跟蹤能力建立大數據和大數據溯源監控的能力使用的方便和簡潔直接決定用戶體驗，新時代的特點WindowsAzureAD身份云的架構和設計WindowsAzureAD身份云設計原則WindowsAzureAD身份云工作原理WindowsAzureAD身份云聯邦身份（Federation）WindowsAzureAD身份云一鍵登錄(SingleSignOn)WindowsAzureAD身份云多因驗證(PhoneFactor)WindowsAzureAD身份云設計原則

Theclouddesignpointdemandscapabilitiesthatarenotpartofcurrent-dayWindowsServerActiveDirectoryMaximizedevice&platformreachhttp/web/RESTbasedprotocolsMulti-tenancyCustomerownsdirectory,notMicrosoftOptimizeforavailability,consistentperformance,andscaleKeepitsimpleLeverageon-premisesinvestments,providecloudadditionsWindowsAzureAD身份云工作原理WindowsAzureAD身份云的架構和設計MSODSFederationsUsersPwdsTenantsSubscriptions,SKUsUsersandGroupsServiceprincipalsSyncTenantsIdentityProvidersServiceprincipalsADOn-premEnterpriseOrgIDACSAADCreate

Service

principalsADFSDirsyncusers,groupsIdentity

FederationMetadataNametoID

lookupAADDirectoryMgmtPortalGraphAPIPScmdsDirectorymanagementNativeClientAuthNlibLocateusers

Identity

providerRichclaims

intokenFederationsFederationsWindowsAzureAD身份云一鍵登錄(SingleSignOn)

Singleidentityandsign-onforon-premisesandcloudservicesIdentitiesmasteredon-premises,singlepointofmanagementSecureTokenbasedauthenticationClientaccesscontrolbasedonIPaddresswithADFSandOffice365servicesStrongfactorauthenticationoptionsforadditionalsecurityWindowsAzureAD身份云

多因驗證(PhoneFactor)

WhymultifactorYourdataandapplicationsareunderattackPasswordsareeasilycompromisedConsumerizationofIThasonlyincreasedthescopeofvulnerabilityStrengtheningregulatoryrequirementscallforstronglyauthenticatingaccessProvenAuthenticationPlatformPoweredbymarket-leadingPhoneFactorplatformTrustedbythousandsofenterprisecustomersacrossawiderangeofindustries,includinghealthcare,financialservices,manufacturing,andgovernmentAuthenticatingmillionsofloginsandtransactionseachmonthUserExperience(afterusername/passwordauthentication)MobileApp:

Theusertaps“Verify”intheapptoauthenticate.PhoneCall:Placesanautomatedvoicecalltotheuser.Theuseranswersthecallandpresses#inthephonekeypadtoauthenticate.TextMessage:Sendsatextpasscodetotheuser.Theusereitherrepliestothetextmessagewiththepasscodeorentersthepasscodeintothesign-ininterface.開發人員使用場景

AdeveloperofanestablishedcloudapplicationenablessignupofcustomerswhohaveAzureAD(開發企業自有身份云的云應用)Singlesignoninsteadofseparateusername/passwordforappQueryDirectoryGraphforuserinformation,provisioningAdeveloperofanewcloudapplicationusesAzureADasoff-the-shelfidentitysystemfortheirapp(開發基于身份云的云應用)UsesAzureADasthelocalaccountstoreEnablesignupofcustomersusingpopularwebIDsEnablesignupofcustomerswhohaveAzureADCheckout/en-us/manage/services/identity/(details)/en-us/library/hh974459.aspx(samples)GraphicAPI例子Request://Users('Ed@'){“d”: {"Manager":{"uri":"http://Users('..')/Manager"},"MemberOf":{"uri":"http://Users('..')/MemberOf"},"ObjectId":"90ef7131-9d01-4177-b5c6-fa2eb873ef19","ObjectReference":"User_90ef7131-