Inside a Microsoft datacenter
Dec 11th, 2024 by Jesper Kråkhede
I often get the question: How secure is the cloud, really? Where is my data, and who can touch it? So let me take you on a tour, as far as public information allows, of how a Microsoft datacenter is protected. This post is long. It has to be.
Start with the scale. Azure runs on more than 400 datacenter facilities in more than 70 regions. A region is a group of datacenters, and inside most regions there are availability zones, physically separate locations with their own power, cooling and network. If one building goes down, your service can continue in another.
The physical security works in layers, like an onion.
Before you even arrive, you need an approved request with a valid business reason. Access is granted on a need to access basis, only to the specific area you need, and only for a limited time. Then it expires.
The perimeter. Tall fences of steel and concrete around the whole site, cameras that are monitored around the clock, guard patrols and bollards that stop vehicles.
The building entrance is staffed by trained and background checked security officers.
Inside the building, you need two factor authentication with biometrics to move further, and you only get into the parts you are approved for.
On the datacenter floor, there is a full body metal detector, both on the way in and on the way out. Only approved devices may enter, so nothing gets in or out without Microsoft knowing. Cameras watch the front and the back of every server rack.
Visitors are escorted at all times and have no access rights of their own. Their badges are collected and wiped after the visit.
And when a disk reaches the end of its life, it is wiped according to NIST 800-88. If it can´t be wiped, it is destroyed: shredded, pulverised, disintegrated or incinerated, and the destruction is recorded.
There is one more separation that is easy to miss. The people who run the building can´t log on to Azure systems. And the engineers who run Azure don´t walk around in the datacenters. Physical and logical access are kept apart, so no single person has both.
Then the logical layers. Azure´s production network is separated from Microsoft´s corporate network. Engineers who operate the platform do it from secure admin workstations, with just in time access that has to be requested and approved, and is removed automatically when the time is up. Standing access is avoided. For customer data, there is Customer Lockbox, where the customer approves any access by Microsoft engineers.
Data is encrypted at rest and in transit by default, and traffic between datacenters is encrypted. Customers can manage their own keys in hardware security modules. With confidential computing, data can even be protected while it is being processed.
The hardware itself has a root of trust. Microsoft has developed its own security chip, Cerberus, which verifies the firmware of the servers so that tampering can be detected.
Everything is monitored continuously, both for availability and for security, by teams around the clock. And the whole thing is audited by independent auditors against standards such as ISO 27001, SOC 1 and SOC 2 and many national ones.
Is it perfect? No. Nothing is, and Microsoft has had its share of incidents and criticism this year. But compare it with your own server room, and be honest.
The cloud is someone else´s computer. Just make sure it is a better protected one.