Microsoft Azure Attestation: Now Generally Available

by Contributed | Feb 16, 2021 | Technology

This article is contributed. See the original author and article here.

Azure confidential computing offers a state-of-the-art hardware, software & services platform to protect sensitive customer data in-use while minimizing the Trusted Computing Base (TCB). Customers taking advantage of Azure confidential computing can further strengthen their security posture through use of Azure Attestation, a feature that allows them to verify the compliance of various workloads according to their security policies. If their environment becomes non-compliant with their security policies, the customer can prevent exposure of data.  

Azure Attestation offers a simple PaaS experience to enable customers solve the complicated problem of gaining trust and verifying the identity of an environment before they interact with it. The ability to gain this trust allows customers to develop applications and create business models that require uncompromising trust where they were previously unable to create them — in the cloud.  

What is Azure Attestation?

Azure Attestation is a unified solution that supports attestation of platforms backed by Trusted Platform Modules (TPMs) alongside the ability to attest to the state of Trusted Execution Environments (TEEs) such as Intel® Software Guard Extensions (SGX) enclaves

Azure Attestation receives evidence from an environment, validates it with Azure security standards and user-defined policies, and produces cryptographic proofs (called attestation tokens) for claims-based applications. These tokens enable relying parties to gain confidence in the trustworthiness of the environment, the integrity of the software binaries running inside it and make trust-based decisions to release sensitive data to it. The tokens generated by Azure Attestation can be consumed by services in scenarios such as enclave validation, secure key sharing, and confidential multi-party computation.

Why use Azure Attestation ?

Azure Attestation provides the following benefits:

• Offers a unified solution for attesting multiple TEEs or platforms backed by TPMs


• Allows the creation of custom attestation providers and configuration of policies to customize the generation of attestation tokens


• Provides the ability to securely communicate with the attested platform with the help of data embedded in an attestation token using industry-standard formatting


• A highly available service with Business Continuity and Disaster Recovery (BCDR) configured across regional pairs

How does Azure Attestation work?

The following actors are involved in an Azure Attestation workflow:

Client: The component which collects evidence from an environment and sends attestation requests to Azure Attestation.

Azure Attestation: The component which accepts evidence from the client, validates it with Azure security standards, evaluates it against the configured policy and returns the attestation token to the client.

Relying party: The component which relies on Azure Attestation for remotely attesting the state of an environment supported by the TPM/enclave.

Consider a multi-party data sharing use-case where an organization (relying party) wants to share data with its partners and achieve great insights by running inference models on the aggregated information. To protect data confidentiality while leveraging mutual benefits, data in-use can be encrypted and stored in TEEs like SGX enclaves. However, before giving access to the encrypted content, organizations would like to validate the trust worthiness of the enclave and then securely transfer secrets to the enclave. Azure Attestation enables the remote verification process.

Below is the workflow to perform SGX attestation using custom attestation providers:

2. User creates an provider using PowerShell/Portal/CLI.  Note that Regional shared attestation providers can be used to perform attestation when there is no requirement for custom policies


3. Attest URI is returned to the user


4. Attest URI is shared with the TEE client as a reference to Azure Attestation


5. The client collects enclave evidence and sends attestation request to Azure Attestation


6. The service validates the submitted information and evaluates it against a configured policy. If the verification succeeds, it issues an attestation token and returns it to the client


7. Client sends the attestation token back to the relying party

Getting started with Azure Attestation

1. To create an attestation provider via Azure portal, click the Create button on the Azure Attestation page in the Azure portal Marketplace menu.

2. Provide a name, location, subscription and resource group and proceed with the creation of your attestation provider.


3. If needed, upload policy signer certificates file to configure the attestation provider with signed policies. Learn more.

4. Once created, details of the provider can be seen in Overview page.

5. To view the default policy of your attestation provider, select Policy in the left-hand side Resource Menu.

6. To configure a custom policy to meet your requirements, click configure and provide policy information in text/JSON Web Token format and click Save.

7. Click the Refresh button to view the updated policy

Creation and management of attestation providers can also be performed using Command Line Interface (CLI) or Azure PowerShell.

Customer success stories

We are excited to enable multiple scenarios that benefit from Azure Attestation. Some of them include:

SQL Always Encrypted with secure enclaves

“Microsoft Azure Attestation is a key component of a solution for confidential computing provided by Always Encrypted with secure enclaves in Azure SQL Database. Azure Attestation allows database users and applications to attest secure enclaves inside Azure SQL Database are trustworthy and therefore can be confidently used to process queries on sensitive data stored in customer databases.”

– Joachim Hammer, Principal Group PM Manager, Azure SQL

ISV partners

Microsoft also works with platform partners who specialize in creating scalable software running on top of Azure confidential computing environments. Partners like Fortanix, Anjuna and Scone  are already poised to use the services offered by Azure Attestation.

Future roadmap for Azure Attestation

Our long-term aspiration is to partner with people and organizations around the planet to help them achieve more, and more securely with Microsoft Azure Attestation. Azure Attestation will be the one Microsoft service that attests multiple platforms used by Azure customers such as Confidential Containers, Confidential VMs, IoT edge devices and more. We expect Azure Attestation to be the leading cloud service used by customers to establish unconditional trust in infrastructure and runtime across Azure, on-premises and at the edge. Azure Attestation will continue to strengthen customer data governance.

Learn more about Azure Attestation

Microsoft Defender for Endpoint Now Available for GCC customers

by Contributed | Feb 16, 2021 | Technology

This article is contributed. See the original author and article here.

Security is at an inflection point as digital attack surfaces increase and threat attack sophistication escalates. It continues to be one of the most challenging areas our customers navigate.  Our Government customers have additional obligations to data compliance and governance.   

Microsoft Defender for Endpoint is a holistic, cloud delivered endpoint security solution that includes risk-based vulnerability management and assessment, attack surface reduction, behavioral based and cloud-powered next generation protection, endpoint detection and response (EDR), automatic investigation and remediation, managed hunting services, rich APIs, and unified security management. 

We are excited to announce that Microsoft Defender for Endpoint is now available for customers in the Government Community Cloud (GCC).  Microsoft Defender for Endpoint in GCC supports the Federal Risk and Authorization Management Program (FedRAMP) accreditation at a High Impact level. FedRAMP artifacts are available for review by customers who are required to comply with FedRAMP. Federal agencies can review these artifacts in support of their review to issue an Authority to Operate (ATO). 

While Microsoft Defender for Endpoint is available for purchase, we will continue to add capabilities and features.  Learn more here: Microsoft Defender for Endpoint for US Government customers – Windows security | Microsoft Docs 

Word for web now supports embedding interactive apps – YouTube, Wakelet, Buncee, Genially and more!

by Contributed | Feb 16, 2021 | Technology

This article is contributed. See the original author and article here.

We’re glad to share that you can now embed web content in the form of video, forms, slides and more in your documents on Word for the Web.

Embed Web Content

Have you ever faced a situation where you want to add a YouTube or Vimeo video from some online source into your document to make it easy for others to understand content? Have you ever thought of having a Forms inside your word document or embedding a great EdTech app such as Wakelet, Buncee or Genially?

This new embed feature enables you to do all of this and in a much-simplified manner. You just need to paste a web URL from any of our supported providers into a document on Word Web and we will automatically embed web content in the document. This will help others to watch a video or fill a form by keeping within the document. Here is an example of embedding a YouTube video:

Supported sources

Word for the web currently supports embedding content from the following sites and services. The number of supported sources is growing; all current partners and new partners will be listed here.  Check back regularly for more updates

• Youtube


• Buncee


• Wakelet


• Genial.ly


• Wizer


• Microsoft Stream


• Microsoft Forms


• Microsoft Sway


• Flipgrid Shorts


• Vimeo


• SlideShare


• TED Talks

How it works

1. Open Word in the Web.


2. Create a file/Open any existing file.


3. Paste a URL from any of these sources – Youtube, Microsoft Stream, Vimeo, Microsoft Forms, SlideShare, TED Talks, Flipgrid Shorts, Microsoft Sway


4. On recognizing a supported hyperlink, we automatically embed the web content.
   Note- In case you want to display your content as a normal hyperlink you can choose to display it as hyperlink from the floatie menu shown below the embedded content just after inserting web content.


5. You can the play the video right from the document using the website’s controls for play, pause, volume, etc.

Availability

This feature is available in Word for the Web for 100% of the users.

Feedback 

Let us know whether we’re getting it right by answering the feedback prompts in the experience. To send additional feedback, you can submit them by clicking Help > Feedback.     

Thanks,
Gaurav Goel
Microsoft Word Product Manager

Instructure Announces Immersive Reader is Available Free to Canvas Users

by Contributed | Feb 16, 2021 | Technology

This article is contributed. See the original author and article here.

Last week, Instructure announced that the Microsoft Immersive Reader is now freely available to all Canvas users to make content more inclusive and accessible. Canvas by Instructure is the learning platform that helps great education happen.  Open, intuitive, and born in the cloud, Canvas streamlines all the digital tools and content that teachers and students love, for a simpler and more connected learning experience.  Since we launched Immersive Reader as a Cognitive Service all to all partners last summer, a top request from educators and schools has been to integrate with Canvas.

By integrating the Immersive Reader, Canvas makes their Pages content available for learners of all abilities and can help with access content and reading.  Based on early feedback, we hope to enable Immersive Reader in even more places in the future.  All of the capabilities built-in to the Immersive Reader will now be able to Canvas customers. The Immersive Reader has been in beta testing for Canvas users over the past year, and starting last week, is now at general availability, and free for institutions to enable.

“Last year Instructure became the first [LMS] provider to offer Immersive Reader for students,” said Mitch Benson, Instructure’s chief product officer, in a statement. “Our beta users love this tool because it demonstrably increases reading and writing comprehension, and is seamlessly woven inside the Canvas experience at no additional cost to schools. This is just one piece of the broader collaboration between Microsoft and Instructure that we’re excited to move forward in 2021.”

Educators are already excited about the new capabilities in Canvas.  Monica Padilla, a 6^th grade science teacher from Highlands Middle School, says  “I love the ease and simplicity of immersive reader and how it helps me serve my students.   Canvas is so easy to use and add assignments too.  Immersive reader will make equal access to content available to all of my students.”

This integration is now freely available to all Canvas users worldwide.  Make sure your institution or school has first enabled this via the IT Admin instructions.  Once your school enables the Immersive Reader, any educator can flip it on – instructions are here.

Microsoft is thrilled to have Canvas integrate the Immersive Reader to make text and reading accessible to all! 

Mike Tholfsen

Principal Product Manager, Microsoft Education

@mtholfsen

Reaching for the Stars with Renee Wynn [M365 Meetup for Government]

by Contributed | Feb 16, 2021 | Technology

This article is contributed. See the original author and article here.

How do you digitally transform an organization whose end-users are rocket scientists and whose mission is literally out of this world?! Renee P. Wynn recently retired as the CIO of NASA after a distinguished 30-year career in federal service. In this session, she shares her perspective on leadership, mission-aligned IT, digital transformation, and effective cyber-security. Many people can say that their organization has successfully deployed Microsoft 365, but Ms. Wynn led it being deployed into orbit! This is a rare opportunity to learn and ask questions from a National Academy of Public Administration Fellow and award-winning leader.

Speaker:
Renee P. Wynn, NASA CIO (retired)
https://www.linkedin.com/in/renee-wynn-8935a24/

Renee P. Wynn recently retired as the NASA Chief Information Officer after 30-years of federal service. She started her consulting business, RP Wynn Consulting, LLC, to continue to serve the federal government in a new capacity. As the NASA CIO, Ms. Wynn collaborated with the complex NASA mission programs to improve NASA’s global cybersecurity posture including supply chain risk management and transform IT management. Ms. Wynn oversaw an IT Portfolio of more than $2B and provided global IT services to more than 65,000 customers, including operations in Russia to support launches to the International Space Station.