Security Mental Model for Azure

We’ve been exploring Azure on the patterns & practices team for potential security guidance.   To get our heads around it, we’ve had to create a simple view for our team that we could quickly whiteboard or drill into.  We wanted a way to easily compare with our previous security guidance.  Here’s what we ended up with …

Today’s application security mental model …

Compare that to our evolving security mental model for Azure …

The key thing to note is that on Azure you have a managed infrastructure, but you still have to address application security issues, as you would in today’s on-premise scenario.  There are obviously more details to the story, but I’ll elaborate on those another day.  For now, the key is to simply notice how you can carry forward your application security skills to the cloud as a new deployment channel.