Technological safeguards in Azure, such as Encrypted communications and operational processes, help keep your data secure. You also have the flexibility to implement additional encryption and manage your own keys.

• Data in transit :Azure uses industry-standard secure transport protocols such as SSL/TLS between user devices and Microsoft datacenters. You can enable encryption for traffic between your own virtual machines (VMs) and your users. With Azure Virtual Networks, you can use the industry-standard IPsec protocol to encrypt traffic between your corporate VPN gateway and Azure as well as between the VMs located on your Virtual Network. Refer SSL/TLS and IPsec if you are new to this.
•  Data at rest.Azure offers a number of encryption options, such as support for AES-256, giving you the flexibility to choose the data storage scenario that best meets your needs.

1. Cell-level encryptionto encrypt specific columns or even cells of data with different encryption keys.
2. If you need a Hardware Security Module or central management of your encryption key hierarchy, consider using Azure Key Vault with SQL Server in an Azure VM.

1. Very new capability in this space is called Always Encrypted (in preview) that makes encryption transparent to applications and allows clients to encrypt sensitive data inside client applications without sharing the encryption keys with SQL Database.

1. DDoS protection: DDoS protection is a layer of the Azure physical network that protects the Azure platform itself from large-scale Internet-based attacks. These attacks use multiple “bot” nodes in an attempt to overwhelm an Internet service. Azure has a robust DDoS protection mesh on all inbound Internet connectivity. This DDoS protection layer has no user configurable attributes and is not accessible to customer. This protects Azure as a platform from large-scale attacks, but will not directly protect individual customer application. Additional layers of resilience can be configured by the customer against a localized attack. For example, if customer A was attacked with a large-scale DDoS attack on a public endpoint, Azure blocks connections to that service. Customer A could fail over to another virtual network or service endpoint not involved with the attack to restore service. It should be noted that although customer A might be affected on that endpoint, no other services outside that endpoint would be affected. In addition, other customers and services would see no impact from that attack.
2. Service endpoints: Endpoints allow cloud services or resource groups to have public Internet IP addresses and ports exposed. The endpoint will use Network Address Translation (NAT) to route traffic to the internal address and port on the Azure virtual network. This is the primary path for external traffic to pass into the virtual network. The service endpoints are user configurable to determine which traffic is passed in, and how and where it's translated to on the virtual network.

• Traffic isolation: A virtual network is the traffic isolation boundary on the Azure platform. Virtual machines (VMs) in one virtual network cannot communicate directly to VMs in a different virtual network, even if both virtual networks are created by the same customer. This is a critical property that ensures customer VMs and communication remains private within a virtual network.
• Multitier topology: Virtual networks allow customers to define multitier topology by allocating subnets and designating separate address spaces for different elements or “tiers” of their workloads. These logical groupings and topologies enable customers to define different access policy based on the workload types, and also control traffic flows between the tiers.
• Cross-premises connectivity: Customers can establish cross-premises connectivity between a virtual network and multiple on-premises sites or other virtual networks in Azure. To do this, customers can use Azure VPN Gateways or third-party network virtual appliances. Azure supports site-to-site (S2S) VPNs using standard IPsec/IKE protocols and ExpressRoute private connectivity.
• NSG allows customers to create rules (ACLs) at the desired level of granularity: network interfaces, individual VMs, or virtual subnets. Customers can control access by permitting or denying communication between the workloads within a virtual network, from systems on customer’s networks via cross-premises connectivity, or direct Internet communication.
• UDR and IP Forwarding allow customers to define the communication paths between different tiers within a virtual network. Customers can deploy a firewall, IDS/IPS, and other virtual appliances, and route network traffic through these security appliances for security boundary policy enforcement, auditing, and inspection.
• Network virtual appliances in the Azure Marketplace: Security appliances such as firewalls, load balancers, and IDS/IPS are available in the Azure Marketplace and the VM Image Gallery. Customers can deploy these appliances into their virtual networks, and specifically, at their security boundaries (including the perimeter network subnets) to complete a multi-tiered secure network environment.

I am so excited to share this news with my fellow IT Implementers aka future Cloud implementers !!

In this transforming & confusing times, I often get question from experienced & relatively new professionals about "How do I plan my career in Cloud? Will me job be secure ?" etc. Your job is surely secure if you learn & un-learn in this changing times. Its no brainer that Cloud technology is transforming how you do your job. Keeping up with the necessary skills and trends is more important than ever. 

Microsoft is introducing  2 new free programs for IT Professionals who want to build and grow their career in the cloud-first world:

Microsoft IT Pro Cloud Essentials

A FREE annual subscription that includes free cloud services, education, and support.

• Cloud Services: Azure Credits; Enterprise Mobility Suite Trial; Office 365 Trial
• Education: Pluralsight 3 month subscription; Certification Exam Voucher
• Support: Priority support in the TechNet forums and a phone support incident.

Microsoft IT Pro Career Center

A FREE online resource to help you map your career path in cloud technologies, curriculum to learn the cloud roles, and industry career guidance to help you build the skills you need to stay relevant.

• Cloud Career Paths: discover what industry experts suggest for your cloud role
• Cloud Role Courses: follow a learning curriculum for your chosen cloud role
• Industry Career Trends: Hear from industry experts about the skills you need to succeed
  

I hope you'll make good use of these resources steer your career in a direction you desire.

Happy learning, un-learning & re-learning  :)

Till next time,

Pracheta

As a recap, what is Azure Site Recovery? 

Well, Azure Site Recovery can help you protect important applications by coordinating the replication and recovery of private clouds across sites, whether you’re protecting dozens – or hundreds of virtual machines. You can protect your applications to your own second site, a hoster’s site, or even use Azure as your disaster recovery site and avoid the expense and complexity of building and managing your own secondary location.

In this Part 1 blog, I'll cover the fundamental area of planning DR, identifying workloads based on criticality etc. 

So, if we take a step back to understand the philosophy to plan proper DR, its starts with identifying the critical nature of your application & data and then have a DR solution for it. Many argue that data back is the first step to recovery and that is right. ASR is holistic to give the most sophisticated solution with ease. While we'll get to that, lets dive a bit into DR tiers : 

The Seven Tiers of Disaster Recovery was originally defined by SHARE to help identify the various methods of recovering mission-critical computer systems as required to support business continuity. Although the original known published concept dates back to the 1990s, Business Continuity Planning (BCP) and Disaster Recovery specialists today continue to use the 7 Tiers to illustrate continuity capabilities and costs at a very high level.  The definitions for the various Tiers have been updated as technology has evolved in support of today's business requirements and their associated Recovery Time Objective (RTO) and Recovery Point Objective (RPO).

What does each tier denotes ?

Tier 0: No off-site data – Possibly no recovery

Businesses with a Tier 0 business continuity solution have no business continuity plan. There is no saved information, no documentation, no backup hardware, and no contingency plan. The time necessary to recover in this instance is unpredictable. In fact, it may not be possible to recover at all.

Tier 1: Data backup with no hot site

Businesses that use Tier 1 continuity solutions back up their data and send these backups to an off-site storage facility. The method of transporting these backups is often referred to as "PTAM" - the "Pick-up Truck Access Method." Depending on how often backups are created and shipped, these organizations must be prepared to accept several days to weeks of data loss, but their backups are secure off-site. However, this tier lacks the systems on which to restore data.

Tier 2: Data backup with a hot site

Businesses using Tier 2 business continuity solutions make regular backups on tape. This is combined with an off-site facility and infrastructure (known as a hot site) in which to restore systems from those tapes in the event of a disaster. This solution will still result in the need to recreate several hours or even days' worth of data, but the recovery time is more predictable.

Tier 3: Electronic vaulting

Tier 3 solutions build on the components of Tier 2. Additionally, some mission critical data is electronically vaulted. This electronically vaulted data is typically more current than that which is shipped via PTAM. As a result there is less data recreation or loss after a disaster occurs. The facilities for providing Electronic Remote Vaulting consists of high-speed communication circuits, some form of channel extension equipment and either physical or a virtual tape library and an automated tape library at the remote site. IBM's Peer-to-Peer VTS and Oracle StorageTek Virtual Storage Manager (VSM) Clustering are two examples of this type implementation.

Tier 4: Point-in-time copies

Tier 4 solutions are used by businesses that require both greater data currency and faster recovery than users of lower tiers. Rather than relying largely on shipping tape, as is common on the lower tiers, Tier 4 solutions begin to incorporate more disk based solutions. Several hours of data loss is still possible, but it is easier to make such point-in-time (PiT) copies with greater frequency than tape backups even when electronically vaulted.

Tier 5: Transaction integrity

Tier 5 solutions are used by businesses with a requirement for consistency of data between the production and recovery data centers. There is little to no data loss in such solutions; however, the presence of this functionality is entirely dependent on the application in use.

Tier 6: Zero or near-zero data loss

Tier 6 business continuity solutions maintain the highest levels of data currency. They are used by businesses with little or no tolerance for data loss and who need to restore data to applications rapidly. These solutions have no dependence on the applications or applications staffs to provide data consistency. Tier 6 solutions often require some form of Disk mirroring. There are various synchronous and asynchronous solutions available from the mainframe storage vendors. Each solution is somewhat different, offering different capabilities and providing different Recovery Point and Recovery Time objectives. Often some form of automated tape solution is also required. However, this can vary somewhat depending on the amount and type of data residing on tape.

Tier 7: Highly automated, business integrated solution

Tier 7 solutions include all the major components being used for a Tier 6 solution with the additional integration of automation. This allows a Tier 7 solution to ensure consistency of data above that which is granted by Tier 6 solutions. Additionally, recovery of the applications is automated, allowing for restoration of systems and applications much faster and more reliably than would be possible through manual business continuity procedures.

So where does Azure Site Recovery come in?

Tier 7,  This means that Azure Site Recovery can offer the lowest levels of recovery time, and the highest value for customers, and when combined with the other components within the Microsoft solutions, helps customers to protect all of their mission critical applications and data.

Where are the workloads hosted ?

Typically likely be one of two scenarios –

1.) Most likely scenario - you use multiple products for backup, replication and DR – perhaps even different products for differing infrastructure.

2.) You have an integrated solution for physical and virtual – but it doesn’t support cloud or offer DRaaS. If you have multiple products – ASR offers simplification with one solution – with the capabilities to support their cloud needs. ASR reduce that problem set by having BC/DR be one less solution on the list to learn and manage.

Once your applications are identified & you know which set can be just fine on a good back-up solution & which one require a robust DR, we take the next step. Azure Site recovery is a service so you don't have to install anything, however there are few components to support the data & application replication to secondary site that requires few VMs. Here are the set

1. Vault in Azure, create this under "recovery services" 
2. Process Server: Used for caching, compression, and encryption   { This will stay on-prem }
3. Config Server: Used for centralized management                 { VM in Azure }
4. Master Target: Used as a repository and for retention          { VM in Azure }

Mobility Service runs on each VMs that you wish to protect as it captures all data writes from memory

I'll explain with a common scenario -- Build robust DR solution for VMware on-prem primary site & build its DR on Azure. 

I'm here with a very interesting new topic to present my views on. While, Disaster Recovery isn't a new topic for professionals & I'm sure many of you might have been involved in building or managing DR setup.

As times have changed & Cloud is inevitable, there are amazing things happening in the space of offering DR as a service, aka DRaaS.

Before I write any further, lets understand very briefly why should any one care form a technology point of view ( cost is a separate discussion & DRaaS turns out to be cost effective too ) -

• Without the hassle of maintaining another site for DR you can achieve DR for your critical Applications & Services.
• Completely automate the orderly recovery of services in the event of a site outage at the primary datacenter with Site Recovery. Bring over applications in an orchestrated way to help restore service quickly, even for complex multi-tier workloads. 
• Choice to select Cloud as the secondary site or just use it to orchestrate DR logic in case of catastrophe on-prem set-up ( this could be a Hyper-V based or VMWare based )
  

Azure Site Recovery is one such service to start with. ASR as its commonly called as is a managed Azure service that allows you to build your DR strategy your way while taking away the complexities. It has engines, components that will run in the background to do the magic. ( More on ASR's internals in next post )

Let me illustrate the 2 basic scenarios with the help of diagrams :

If you choose to make Azure your secondary site,then there are 4 scenarios that are most commonly used -

• Protect VMware virtual machines: You can protect on-premises VMware virtual machines by replicating them to Azure or to a secondary datacenter. 
• Protect Hyper-V VMs: You can protect on-premises Hyper-V virtual machines by replicating them to the cloud (Azure) or to a secondary datacenter.
• Protect physical servers: You can protect physical machines running Windows or Linux by replicating them to Azure or to a secondary datacenter.
• Migrate VMs: You can use Site Recovery to migrate Azure IaaS VMs between regions, or to migrate AWS Windows instances to Azure IaaS VMs.

Hope this crisp blog has given to an introduction to DRaaS and ASR.

More in next post. Have a good week !

You may think, why now ?

Well, commoditization of Cloud has a lot to do with it. As the market has grown so has the price war between the vendors - ultimately leading to more cloud for your money. Alongside this is the growth and widespread commercial recognition of various Continuous Delivery tooling tools and providers (Puppet, Chef and the like) which means you can purchase a secure, maintainable and reliable cloud solution and have the tooling to deploy to it relatively easily - compared to the situation 4 or 5 years ago. All established businesses need to do now is work out how to run their 15 yr old legacy codebase on a distributed, flexible, multi-site platform. Definitely, not an easy challenge but one that could be overcome with some insight into DevOps practices and approaches.

So, what exactly is DevOps ?

As per Wikipedia - DevOps ( Taken as initials from Development & Operations ) is a software development method that stresses communication, collaboration, integration, automation, and measurement of cooperation between software developers and other information-technology (IT) professionals. Other say that, DevOps is more than a technology or a tool set. It’s a mindset that requires cultural evolution.  It is people, process and the right tools to make your application lifecycle faster and more predictable.

Well, English apart, there are specific goals of a DevOps approach & they span the entire delivery pipeline -

1. Improved deployment frequency
2. Resulted faster time to market
3. Lower failure rate of new releases
4. Shortened lead time between fixes, and faster mean time to recovery in the event of a new release crashing or otherwise disabling the current system.
5. Simple processes become increasingly programmable and dynamic
6. Ultimately optimizing resources to not do repeatable jobs & very often, automation supports this objective. 

In a nutshell - ALM & Agile methodology for s/w dev,  Rapid provisioning, Rapid app deployment , Monitoring & Automation !

While all the above are much desired by all the organizations on this planet. Still, why this has been so difficult to achieve. In my understanding, there were two reason -

• Not enough incentive to collaborate & work in the siloed environments of the past ( and present for many )
• Bringing people together - A dev guys is rather better off coding with headset on than talking to an IT guy & same holds true for IT guy, who has 100 things to keep running & maintaining SLAs. Who has time to get together ? :P

As Cloud has bridged many barriers, made platforms, containers & so much available to plug it all in & run the show a bit smoothly. It has also made time for both Dev & IT guys to focus on taking their solutions to next level, the time is just apt to cross skill a bit & be more relevant in these transforming times !!

Stay tuned for my musings on DevOps journey !

Here are the decks from three themes we have covered in last few months -

1. Azure for Infrastructure Professionals
2. Enterprise Mobility
3. Modernize your datacenter with WS 2012

It took me longer to upload them, profusely apologize for it.

You can access them at - http://1drv.ms/1GIERRu

Let me know if you have any questions.

Stay tuned for more to come :)

Firstly, what is mobility strategy?

Is it the ability to let users have access to any applications from anywhere? Is it managing devices that connects to corporate environment? Is it about keeping security to the core? Is it about giving seamless self-service experience to end users? Is it mobile application management too?

Indeed, it’s all of the above and could be much more. Strategies are very context sensitive to enterprises so what might be a great mobility strategy for one, might not fill the gap in other enterprise.

Disruptive innovation is the need of the hour & navigating through with a clear strategy would be a key differentiators in Enterprises. One way of looking at the Mobility strategy could be –

1. How & what IT will manage the user owned devices?

2. In the hurry to manage, enterprises must not overlook privacy. Drawing clear lines between personal & corporate is essential to take into consideration.

3. Categories data & application access in terms High impact, medium impact, low impact brackets so that corporate remote access strategy could be defined well.

4. Define reasonable security checkpoints (like multi-factor authentication, application gateways  etc ) to ensure vulnerable/ hacking connection could never get into corporate environment

5. Chose a management solution that could cater to variety of devices, from various phones to phablets to tablets.

    

Apart from a technical strategy, one other aspect requires equal attention i.e Process modifications when needed. More often than not, enterprises bring new technologies but without modifying the existing processes. This one is really important for the new “mobility” scenarios. While it’s important to not deviate from core policies, at the same time it’s important to relook at processes & policies that might had been put up years ago.

Last but not the least, enabling people within an Enterprise to understand the importance of data security. Make tools & techniques available to users & educate them to take right decisions when dealing with corporate data.

While a lots have been happening in the world & I've been working on some very interesting projects, blogging sorts of took a back seat :(

I'm going be  much much more regular going forwards ! Promise :)

So Hello again & stay tuned !!

Hope to see you at the 1st ever Windows Azure Conference that we are organizing this month.

If you haven't registered yet, please do :)

REGISTER AT - http://www.windowsazureconference.in/default.aspx

Flexible track is for the IT Professionals out there. Enclosing the eDM

eDM - WAC.docx