Azure云平臺的隱私與環(huán)境治理方案

1、Azure云平臺的隱私與環(huán)境治理方案技術創(chuàng)新，變革未來Agenda云端治理的意義 & 持續(xù)云端治理的過程Azure云端治理的框架云端治理之安全&身份管理云端治理之部署加速云端治理之資源一致性云端治理之花費管理云端治理的意義 & 持續(xù)云端治理的過程治理的定義Governance is all of the processes of governing, whether undertaken by a government, market or network, whether over a family, tribe, formal or informal organization or ter

2、ritory and whether through the laws, norms, power or language of an organized society.It relates to the processes of interaction and decision-making among the actors involved in a collective problem that lead to the creation, reinforcement, or reproduction of social norms and institutions.In lay ter

3、ms, it could be described as the political processes that exist in between formal institutions./wiki/Governance云端治理需求優(yōu)秀的人才恰當?shù)馁Y源合理的配置持續(xù)化治理1.規(guī)劃執(zhí)行改進規(guī)劃執(zhí)行改進Azure云端治理的框架Azure 資源組織框架Azure ScaffoldCore/Core NetworkAzure 資源管理框架CRUDAzure Resource Manager (ARM)Query規(guī)范化控制 ：通過規(guī)則引擎實施監(jiān)測& 審核環(huán)境中資源的規(guī)范性資源可見性: 清晰的查看海量的

4、云端資源1. 環(huán)境標準化：通過統(tǒng)一的 部署&更新云端資源PolicyRole-basedARM TemplatesManagement GroupsSubscriptionsAccessDefinitions規(guī)則引擎 Azure PolicySecurityAzure Security Center Guest Config baselines Key Vault certificate NSG rulesAKS & AKS Engine RBAC role assignmentRegulatory ComplianceNIST SP 800-53 R4 ISO 27001:2013 CISP

5、CI v3.2.1:2018FedRAMP Moderate Canada Federal PBMM SWIFT CSP-CSCF v2020UK Official and UK NHS IRS 1075TagsResource standardizationCostRequire specified tag Add or replace a tag Inherit a tag from the RG Append a tagAllowed/ not allowed RP Allowed locations Naming convention Back up VMsAllowed images

6、 for AKSAllowed VM SKUs Allowed Storage SKUs云端治理之安全&身份管理安全是云端管理的第一要務Microsoft Antimalware for AzureAzure Log AnalyticsAzure Security CenterVNET, VPN, NSGApplication Gateway (WAF), Azure FirewallDDoS Protection StandardExpressRouteEncryption (Disks, Storage, SQL)Azure Key VaultConfidential ComputingA

7、zure Active DirectoryMulti-Factor AuthenticationRole Based Access ControlAzure Active Directory(Identity Protection)+ Partner SolutionsData protectionNetwork securityThreat protectionIdentity & accessmanagementSecurity management網絡架構的設計On Premises Network(s)Public IPPublic IP/en-us/azure/architectur

8、e/reference-architectures/hybrid-networking/shared-services數(shù)據保護KEY MANAGEMENT INTERFACESSQL SERVER (VM), AZURE SQL DATABASE & AZURE SQL DATA WAREHOUSEAZURE DISK ENCRYPTION - PARTNER VOLUME ENCRYPTION - VIRTUAL MACHINES WINDOWS & LINUXAPPLICATION LEVEL ENCRYPTIONAZURE STORAGE SERVICE ENCRYPTION (Blob

9、s,STOCKAGE AZURETDE (TRANSPARENT DATA ENCRYPTION) - CLE (CELL LEVEL ENCRYPTION) - SQL SERVER ENCRYPTED BACKUPSALWAYS ENCRYPTEDSQL ServerAzure SQL DatabaseAZURE COSMOS DBAZURE BACKUP SERVICE - AZURE BACKUP SERVICEAZURE DATA LAKEAZURE DATA LAKEAZURE HDINSIGHTAZURE KEY VAULTAUTHENTICATION TO KEY VAULT合

10、理的身份管理是云端所必須Resource Role PermissionsSegment Model Variations云端治理之部署加速Azure BlueprintsARM TemplatesPolicy DefinitionsRole-based access controlsCustom Scripts*Coming in June 2019BlueprintCloud Engineer+ISO 27001FedRAMPNISTCloud ArchitectResource GroupsAzure DevOps/en-us/azure/devops/index?view=azure-

11、devops云端治理之資源一致性資源一致性的三個方面/en-us/azure/architecture/cloud-adoption/governance/resource-consistency/采取合適的架構設計 確保應用的穩(wěn)定Azure BackupAvailability Sets, Zones and Region PairsAzure Site RecoveryAzure中的高可用選擇VM SLA99.9%VM SLA99.95%VM SLA99.99%Regions54Disaster recoverySingle VMProtection with Premium Storag

12、eAvailability setsProtection against failures within datacentersAvailability zonesProtection from entire datacenter failuresSite Recovery &Region pairsProtection from disaster with Data Residency complianceAZs available across US, Europe and Asia more regions coming soonIndustry-onlyHigh availability SLAAzure 監(jiān)控中心平臺健康中心 Azure Service Health云端資源的可見性 Azure Resource Graph云端資源可優(yōu)化性 Azure Advisor針對云端資源提供持續(xù)的優(yōu)化建 議，例如