Cloud security shoot-out: AWS vs Azure

In survey after survey, IT managers nominate ‘security’ as one of the prime reasons they are tentative about embracing public cloud servers.

Two of the most common security concerns for users of public cloud storage include data confidentiality and data integrity.

Data confidentiality means that data stored in that cloud should not be disclosed to unauthorised persons or devices, while data integrity refers to the owner of the data being made aware of any unauthorised changes.

As public cloud services have matured, the major providers have attempted to address both of these issues with new features.

Microsoft Azure is addressing cloud security using virtual private storage based on Searchable Encryption. Amazon Web Services has also responded with its own tools.

Today we compare the architecture level security and the application level security of the two from a theoretical perspective. Both these cloud service providers include significant provisions for dealing with cloud security issues – but one offers a clear differentiator.

Security in the public cloud

Using a shared hosting server has always been a threat to business, whether it is using a database management system on the host or a file system provided by the operating system of the server.

In a public cloud, the infrastructure is owned and controlled by the cloud service provider. Thus, infrastructure and computational resources are shared by several organisations - each with their own data privacy and security concerns - and customer data falls outside direct customer control.

The Azure approach to cloud security

The Microsoft Azure Platform is the central component of Microsoft cloud computing services, providing mechanisms to increase and decrease the computing resources of applications and services.

Windows Azure Environment - the operating system of the Azure platform - provides all features for hosting services in the cloud and it is split into five sub-components: Compute, Storage, Fabric Controller, Content delivery network (CDN) and Connect.

These sub-components are related to our investigation of data security. Each component provides a service that aims to deal with some of the main security issues. In Table1, we list the features of each sub-component:

_{Table 1: The Azure approach to security.}

The Amazon approach to cloud security

In 2006, Amazon began to offer IT infrastructure services based on web services. The Amazon AWS cloud provides an infrastructure for deploying web-scale solutions and offers a variety of infrastructure services such as Amazon Simple Storage service (Amazon S3) and Amazon Elastic Compute Cloud (Amazon EC2). In Table 2, we list the security and availability elements of each of these services, with longer explanations included below.

_{Table 2: The Amazon approach to security.}

Comparing the security features: Microsoft Azure and Amazon AWS

In comparing Amazon AWS and Microsoft Azure from the point of view of security features, we focus on the two main security issues mentioned earlier: data confidentiality and data integrity. Below we present a condensed overview of the way both service providers attempt to address these needs.

_{Table 3: Security comparisons.}

Read on as we look at confidentiality and integrity in detail...