Microsoft Azure Blog > Alan Ross en-US Sun, 31 May 2020 07:56:03 Z time-synchronization-for-financial-services-in-azure Security Time synchronization for financial services in Azure You know what they say: “Time is money.” For many workloads in the capital markets space, time accuracy is money. Mon, 01 Oct 2018 13:00:32 Z <p>You know the expression: &ldquo;Time is money.&rdquo; For many workloads in the capital markets space, time accuracy is money. Depending on the application and applicable regulation, financial transactions need to be traceable down to the second, millisecond, or even microsecond. Financial institutions themselves are under scrutiny to prove the validity and traceability of these transactions. At Microsoft, we want to ensure our customers are aware of time accuracy and synchronization best practices, and how you can mitigate the risk of negative impact due to time synchronization issues on Azure.</p> <p>Time accuracy for a computer clock generally refers to how close the computer clock is to Coordinated Universal Time (UTC), the current time standard. In turn, UTC is based on International Atomic Time (TAI), a measure of time that combines the output of some 400 atomic clocks worldwide that yield approximately 1 second of deviation from mean solar time at 0&deg; longitude. While the most precise time accuracy can be achieved by reading the time from these reference clocks themselves, it is impractical to have a GPS receiver attached to every machine in a datacenter. Instead, a network of time servers, downstream from these systems of record, are used to achieve scalability. Each computer checks its own time against these time servers and adjusts time if needed. This is time synchronization in a nutshell.</p> <p>Computer clocks are susceptible to time drift that is imperceptible to most users, but can have costly consequences. The technology clocks rely on are typically either inexpensive oscillator circuits or battery backed quartz crystals that can cause seconds of drift per day which, over time, can accumulate into significant discrepancies in time. This can be mitigated using a timekeeping program that checks with external sources periodically, corrects any drift that occurs within the computer clock, and synchronizes time globally. This must be implemented by systems that are optimized for sub-second accuracy. Certain FSI applications like high-frequency trading have a very low tolerance for time drift. Regulations like MiFID II in the E.U., the U.S. Securities and Exchange Commission&rsquo;s requirements, and FINRA Regulatory Notice 16-23 ensure oversight of this potential impact to their respective markets.</p> <p>Time sync is just one of the ways that Microsoft is working with customers to create more secure and compliant applications. We&rsquo;ll continue to update our security and compliance offerings, so stay tuned for more information. In the meantime, check out our <a href="" target="_blank">Azure Trust Center</a> to learn more about our security offerings. For detailed instructions on how Microsoft supports time synchronization on Azure, check out the How-To tutorials for <a href="" target="_blank">Windows</a> and <a href="" target="_blank">Linux</a>.</p> Alan Ross expanded-azure-blueprint-for-ffiec-compliant-workloads Data Warehouse Expanded Azure Blueprint for FFIEC compliant workloads We are pleased to announce general availability of the expanded Blueprint for Federal Financial Institution Examination Council (FFIEC) regulated workloads. With more financial services customers… Tue, 21 Aug 2018 11:00:12 Z <p>We are pleased to announce general availability of the expanded Blueprint for Federal Financial Institution Examination Council (FFIEC) regulated workloads. As more financial services customers moving to the Azure cloud platform, we wanted to expand the Blueprint to explain how to deploy four different reference architectures in a secure and compliant way. It also takes the guesswork out of figuring out what security controls Microsoft implements on your behalf when you build on Azure, and how to implement the customer-responsible security controls.</p> <p>We have built an end-to-end solution for moving compliant workloads to Azure, and reducing the time required to do so, leveraging Microsoft&rsquo;s experience in working with banks in the U.S. and around the globe. Why start from scratch when you don&rsquo;t have to? This Blueprint provides guidance for the deployment of PaaS Web Applications, IaaS Web Applications, Data Analytics, and Data Warehouse architecture in Azure suitable for the collection, storage, and retrieval of sensitive financial data regulated by the FFIEC.</p> <h3>The FFIEC Blueprint now consists of:<a href=""><img align="right" alt="workloads" border="0" height="368" src="" style="border: 0px currentcolor; border-image: none; float: right; display: inline; background-image: none;" title="workloads" width="640"></a></h3> <ul> <li>Four reference architectures, with supporting deployment guidance</li> <li>Threat models to understand the points of potential risk</li> <li>Security control implementation mappings which describes how the reference architecture supports each control</li> <li>Customer responsibility matrix which details the implementation of each objective is the responsibility of Microsoft, the customer, or both</li> </ul> <h3>For more information and to get started, check out the following:</h3> <ul> <li><a href="" target="_blank">FFIEC Blueprint overview</a></li> <li><a href="" target="_blank">PaaS Automation code repository</a></li> <li><a href="" target="_blank">Azure Blueprint overview</a></li> </ul> Alan Ross microsoft-azure-launches-tamper-proof-azure-immutable-blob-storage-for-financial-services Updates Microsoft Azure launches tamper-proof Azure Immutable Blob Storage for financial services I’m pleased to announce Azure Immutable Blob Storage, which allows customers to store and retain data in a non-erasable and non-rewritable format. Thu, 05 Jul 2018 09:00:13 Z <p>I&rsquo;m pleased to announce that Azure <a href="">Immutable Blob Storage</a> is now in public preview &ndash; enabling financial institutions to store and retain data in a non-erasable and non-rewritable format &ndash; and at no additional cost. Azure Immutable Blob Storage meets the relevant storage requirements of three key financial industry regulations: the CFTC Rule 1.31(c)-(d), FINRA Rule 4511, and SEC Rule 17a-4. Financial services customers, representing one of the most heavily regulated industries in the world, are subject to complex requirements like the retention of financial transactions and related communication in a non-erasable and non-modifiable state. These strict requirements help to provide effective legal and forensic surveillance of market conduct.</p> <p>Software providers and partners can now rely on Azure as a one-stop shop cloud solution for records retention and immutable storage with sensitive workloads. Financial institutions can now easily build their own applications taking advantage of these features while remaining compliant. These Write Once Read Many (WORM) policies apply to all tiers of storage (hot, cool, and archive). This industry leading compliance storage offering is now available at no additional cost on top of the base pricing of Azure storage!</p> <p>To document compliance, Microsoft retained a leading independent assessment firm that specializes in records management and information governance, Cohasset Associates, to evaluate Azure Immutable Blob Storage and its compliance with requirements specific to the financial services industry. Cohasset validated that Azure Immutable Blob Storage, when used to retain time-based Blobs in a WORM state, meets the relevant storage requirements of CFTC Rule 1.31(c)-(d), FINRA Rule 4511, and SEC Rule 17a-4.&nbsp; Microsoft targeted this set of rules, as they represent the most prescriptive guidance globally for records retention for financial institutions. We are pleased to announce the release of Cohasset&rsquo;s assessment of our immutable storage feature set, <a href="">available today</a>.</p> <p>For customers seeking to decommission legacy SAN and other storage infrastructure, as well as take advantage of the economies of scale available in the cloud, Azure Immutable Blob Storage offers the perfect feature set:</p> <ul> <li>Data can be rendered immutable and cannot be modified or deleted by any user including those with account administrative privileges.</li> <li>Administrators can configure policies where data can be created and read, but not updated or deleted &ndash; otherwise known as WORM storage.</li> <li>The same Azure storage environment can be used for both standard and immutable storage. This means IT no longer needs to manage the complexity of a separate archive storage solution.</li> <li>Integration with archive, cool, and hot tiers of storage &ndash; allowing it to be used with data accessed frequently or infrequently. Discounts apply to storage accessed infrequently, either in cool standby or fully archived.</li> <li>Administrators can create <a href="">lifecycle management</a> policies to dictate rules for when data automatically moves between tiers. For example, data that has not been modified for two months moves to archive storage.</li> </ul> <p>This feature set is a result of Microsoft learning and partnering with a broad set of stakeholders across the financial services industry ecosystem. Azure is in a unique position to partner with banking and capital markets customers, given our global leadership in engaging with regulators, the industry leading audit rights we provide to customers, and our exclusive cloud <a href="">compliance program</a>. Microsoft also has a unique portfolio of financial services compliance offerings built into our products:</p> <ul> <li>The <a href="">Service Trust Portal</a> provides full unredacted <a href="">audit reports</a> for the Azure platform, including PCI DSS, SOC 1 Type 2, SOC 2 Type 2, and ISO 27001.&nbsp; It also includes <a href="">compliance guides</a> for implementing solutions on Azure subject to financial services regulations.</li> <li><a href="">Compliance Manager</a> provides a cross-cloud view of control state, organized by Microsoft managed controls and institution managed controls. It includes workflow, allowing a compliance officer to assign control implementation or testing processes to any user through Azure Active Directory. <a href="">These features</a> were built in collaboration with leading financial institutions and regulators.</li> <li><a href="">Azure Advisor</a> provides best practice guidance for the topics financial institutions care most about: resiliency, security, performance, and cost.</li> <li><a href="">Azure Security Center</a> provides deeper visibility into the security threats facing your environment and makes those insights actionable with a few clicks.</li> </ul> <p>This set of resources and features makes Azure the best destination for moving financial data into the cloud and helping ensure it meets the strict regulatory requirements imposed on the financial services industry. <a href="">Get started today</a>! For the full story of how Azure can help banks and insurers meet their regulatory responsibilities, visit <a href="">The Microsoft Trust Center</a>. Lastly, see our <a href="">case studies</a> for how customers are using Azure.</p> Alan Ross