Microsoft began offering on Monday guidance intended to help developers make secure applications for the company's Windows Azure cloud platform.
Guidance is being offered in the form of a technical paper accessible on Microsoft's site that's entitled, "Security Practices for Developing Windows Azure Applications." It is intended for developers, designers, architects and testers and is based on the company's Security Development Lifecycle practices.
[ In February, InfoWorld reported that Microsoft offered atemplate for applying Securty Development Lifecycle concepts to agile software development. ]
"Issues related to the security of the cloud are becoming increasingly important for businesses and consumers. As a result, it's important that people delivering products to the cloud understand that they must build applications with security in mind from the start," a Microsoft representative said.
The paper focuses on practices for secure design, development, and deployment, including service layer/application security considerations and protections provided by Azure and underlying network infrastructure. Sample design patterns for hardened/reduced-privilege services are covered as well.
Among the topics featured are identity management and access control, data security, Active Directory Federation Services 2.0, and Windows Azure Platform Access Control service. Developers, the paper states, must consider potential threats to Azure applications.
"Computing solutions that use Windows Azure are very compelling to companies wishing to trim capital expenditure," the report concludes. "However, security remains an important consideration. Software architects and developers must understand the threats to software developed for 'the cloud' and use appropriate secure design and implementation practices to counter threats in the cloud environment."
The progression from client-server to Web to cloud applications has changed the boundary of applications and these shifts make understanding threats to Azure-based software "all the more important," the paper said.
First announced in October 2008, Azure became generally available earlier this year.