This should include guidance about all settings that have a security impact including documentation of: Threats – What the setting is designed to mitigate Countermeasures – How to configure the setting correctly to mitigate the threat Potential Impact –The operational impact of the setting configurations What tools are available to check the integrity of the system after deployment? What security considerations need to be taken into account by a developer calling the system’s APIs, if applicable? Is the product is designed to be exposed to Internet traffic without requiring a firewall? Identify what security logs are produced by the product, how they are protected against tampering, and how to access them. Require vendors to minimize and document attack surface changes resulting from installing software. This can be performed by using the Microsoft Attack Surface Analyzer tool. For more information, see: Require vendors to document which threats the product is and is not designed to protect itself and its data against. Typical items that cannot be protected against are identified in: Software digital signatures Require vendors to digitally sign all software binaries for all software products. For more information, see . Software development practices: Gather information about the vendor’s development practices Secure development education Do you educate all engineers about security development? How frequently? How much time per year for each engineer? What methodology is taught? Who teaches the classes? Development security and privacy processes What security development methods do you practice? The Microsoft Security Development Lifecycle? ISO 27034? Something else?
This should include guidance about all settings that have a security impact including documentation of: Threats – What the setting is designed to mitigate Countermeasures – How to configure the setting correctly to mitigate the threat Potential Impact –The operational impact of the setting configurations What tools are available to check the integrity of the system after deployment? What security considerations need to be taken into account by a developer calling the system’s APIs, if applicable? Is the product is designed to be exposed to Internet traffic without requiring a firewall? Identify what security logs are produced by the product, how they are protected against tampering, and how to access them. Require vendors to minimize and document attack surface changes resulting from installing software. This can be performed by using the Microsoft Attack Surface Analyzer tool. For more information, see: Require vendors to document which threats the product is and is not designed to protect itself and its data against. Typical items that cannot be protected against are identified in: Software digital signatures Require vendors to digitally sign all software binaries for all software products. For more information, see . Software development practices: Gather information about the vendor’s development practices Secure development education Do you educate all engineers about security development? How frequently? How much time per year for each engineer? What methodology is taught? Who teaches the classes? Development security and privacy processes What security development methods do you practice? The Microsoft Security Development Lifecycle? ISO 27034? Something else?
Hybrid%20Cloud%20-%20Azure%20Reference%20Architecture%20-%20Partner.docx