Azure Sphere<\/a> has helped unlock opportunities for new insights and to deliver magical new experiences simply by providing a secured foundation for IoT.<\/p>\nOur customers are leading innovations across industries, and they are our strongest resource when it comes to security needs. One of the most significant blockers for customers is the risk assumed by connecting business-critical devices and equipment to the internet. Datacenters are a notable example. When you look at the datacenter\u2019s essential infrastructure, the most critical functions of maintaining the environment have been intentionally kept offline to protect and preserve them. While the servers and network of a datacenter function as this powerful hub of innovation that drives global computing, the mechanical, and electrical systems that they depend on are, out of necessity, air gapped.<\/p>\n
Mike Czamara, a General Manager at Microsoft, leads a team dedicated to the critical environment and availability of Azure Datacenters worldwide. \u201cWe approach datacenters with a necessarily conservative methodology. There’s the shell and there’s the critical space,\u201d<\/em> he says. Mike describes the shell as the building, the walls, the roof, the electrical system, the mechanical systems; everything that functions around the critical spaces or in service of them. The core is the servers and all the networking. The shell\u2019s multiple systems operate simultaneously, but not always symbiotically since they are not digitally connected. Connecting critical equipment is a substantial risk for a datacenter focused on reducing, if not eliminating downtime.<\/p>\nHowever, disruptions happen. Outages happen. Mike\u2019s team was finding that there were sometimes problems across building automation systems or power monitoring systems running code written by a third party. These issues sometimes lead to breakdowns. But, because the code at the heart of the issue was controlled by a third party, as Mike puts it, “Part of our destiny, and that of our customers, was out of our control.”<\/em> Having greater control over the datacenter environment promised better outcomes for customers. The need for more control over the datacenter environment was nested in a larger challenge: the datacenter ecosystem itself.<\/p>\nTaking the first step<\/h2>\n “We’re at the very beginning. We’re just walking up to the starting line. IoT was the first step,<\/em>” says Mike. Really, the first step was an email. Adolfo Ferreira, a Senior Principal Technical Program Manager on Mike\u2019s team, learned about Azure Sphere from the public announcement in April 2018. Adolfo immediately emailed Galen Hunt, the Managing Director of Azure Sphere. \u201cI wrote him, begging him to give me a development kit. I told him what I wanted to do with it, and he took a kit away from one of his developers to give to me.\u201d<\/em> As Mike puts it, \u201cFrom that point, it was game on.<\/em>\u201d<\/p>\n\u201cAzure Sphere really triggered this big opportunity for us,<\/em>\u201d says Adolfo. At the time he discovered Azure Sphere, Adolfo and his team were looking to develop secured data acquisition from the mechanical and electrical systems, which have always been \u201cread-only<\/em>\u201d systems. Azure Sphere gave them a way to securely connect these systems. The end-to-end solution includes secured hardware, the custom-built Azure Sphere OS, the cloud-based Azure Sphere Security Service, and ongoing servicing by Microsoft security experts for more than ten years. \u201cI understood what Azure Sphere was trying to do, I knew the security was the highest level in the industry. I knew nothing could come close to the level of security Azure Sphere could offer,\u201d<\/em> says Adolfo.<\/p>\nFor every Azure datacenter, security is the greatest priority, and the security requirements are spectacularly stringent. “Our data centers are not just running Microsoft\u2019s businesses, but other tens of thousands of other company\u2019s businesses within them. The Azure Sphere guardian module has layers and layers of security. The guardian module had no problem meeting our bar,”<\/em> says Mike.<\/p>\nWith Azure Sphere, the team started connecting mechanical and electrical systems\u2014air handling units, power distribution units\u2014to collect telemetry from the devices. In parallel, they started collecting data from servers and network devices. By using guardian modules powered by Azure Sphere, the team was able to confidently connect their most critical equipment when before the risk had been too great.<\/p>\n
The team is exploring multiple scenarios that Azure Sphere has made possible. Maintenance, for example, is probably the most substantial commitment required of a datacenter. The standard approach is to have a regular, planned maintenance schedule to prevent problems. Sometimes it’s necessary, but often it’s just scheduled and so it just happens even when there’s no apparent need. Mike estimates that by staying on top of this sort of “blind maintenance”<\/em> routine, only about 15 percent of maintenance will be reactive, meaning in response to an immediate need.<\/p>\nInformed by telemetry from connected systems, maintenance can become incisive, truly predictive, and can reduce reactive maintenance to as little as five percent. This can make a dramatic difference for organizations that forecast a budget one to five years out. Says Mike, “We are not spending money in hopes of preventing an outage. Our spend can become more targeted.”<\/em><\/p>\nUnlocking insights<\/h2>\n Mike envisions a future of diagnostics in the datacenter. He sees a cache of information in every piece of equipment, “When we unlock that, it’s data that can create a wealth of knowledge. When I can see that a specific component in a certain generator is acting funny, and I can see how it affects performance health, I can make a more informed choice of what to do.”<\/em> But he is thinking bigger than just generators or even just one datacenter. The knowledge gained from a single issue or incident in one datacenter can inform and improve performance for all the other datacenters located around the world.<\/p>\nBut Mike is still thinking bigger than that\u2014bigger than Microsoft. Having access to diverse sets of data, from partners and, maybe one day, from other organizations running equipment securely connected with Azure Sphere, can drive more informed decisions, and improve safety.<\/p>\n
Smarter and safer<\/h2>\n Mike’s team has been pioneering new safety measures enabled by Azure Sphere. Anytime a person must go into a datacenter to work on a piece of equipment, it is a point of risk. “There’s a problem of human error when a person goes into the wrong panel. They might turn off the wrong panel, which disrupts our customers.”<\/em> In addition to the risk of uptime, there is also a serious risk to personal safety. Datacenters use a ton of power. A single datacenter uses between thirty-two and forty megawatts of power, roughly equivalent to six thousand homes. Panels have power sensors that will trip a warning siren when necessary, but a person’s instinctive reaction is to immediately shut the panel to turn off the alarm, potentially leaving problems unresolved. The team had to think about the problem, safety risk, and human behavior.<\/p>\nThe team paired a klaxon siren with an Andon light and using a board built with Azure Sphere connected to the power sensor and datacenter control system. This setup made it possible to send the step-by-step of a work order, called a digital method of procedure (DMOP), directly to the panel requiring work. When a DMOP is released, the Andon light for the specific panel will change color to identify it as the panel requiring work. As the person goes through the DMOP for the work order, step by step, the light will reflect their progress. If the person misses a step, the light will signal the mistake and the klaxon will sound. Says Mike, “It’s exactly like bowling with bumpers.<\/em>”<\/p>\nThe team went a step further and integrated their electrical power monitoring system and their incident monitoring system. If a person working in the datacenter opens the wrong panel, a security alert is automatically sent, and a ticket is cut to a manager. “We immediately know when something has gone off-script if someone has put themselves or the datacenter in jeopardy. We can stop all work and figure out what’s going on,”<\/em> says Mike.<\/p>\nAzure Sphere made it possible to securely coordinate multiple systems to create a new safety process. The connected panels do more than just help ensure correct and safe execution of processes, they also capture data when things go wrong so that the team can learn from incidents and resolve problems. “We’re creating systems that will keep us within the lines of safety and security and that help us adjust and refine those lines,”<\/em> says Mike.<\/p>\nImpressive too is that Adolfo\u2019s team developed the first of these safer electrical panels in only two months. \u201cThe Azure Sphere SDK made it possible for us to move fast and develop a complete solution from scratch, that was fully integrated with Azure Cloud Services<\/em>,\u201d he says. \u201cWith Azure Sphere, we can quickly turn any idea into a proof of concept.\u201d<\/em><\/p>\nStrategic advantages<\/h2>\n Adolfo\u2019s team is focused on developing systems to increase reliability, security, and safety, and to optimize the building and systems that make up the \u201cshell<\/em>\u201d of the datacenters. The total Azure Sphere offering, particularly the ongoing servicing by Microsoft security experts for more than ten years, has amplified the team\u2019s ability to deliver business value. The cloud-based Azure Sphere Security Service automatically delivers OS and security updates to every device, so Adolfo and his team never have to worry about patching. \u201cThat\u2019s all taken care of by Azure Sphere,\u201d<\/em> he says. And when the team needs to push new firmware to devices, Adolfo says it\u2019s incredibly straightforward to do that at scale. Plus, Azure Sphere attestation guarantees the right firmware version is running on all their devices. \u201cThe services and support that Azure Sphere just provides have taken away the burden on my team<\/em>,\u201d he says.<\/p>\nHandling all that work at scale, especially security, would have required building out a dedicated team. \u201cHaving a whole team just for upkeep doesn\u2019t actually add business value. Instead, we can spend our time on how to implement technology to improve availability, to reduce costs, to increase visibility into operations\u2014that\u2019s really how we add value. It\u2019s a huge advantage. We have the opportunity to set the new standard in the datacenter industry, using Azure Sphere,<\/em>\u201d says Adolfo.<\/p>\nThe business case for creativity<\/h2>\n Mike sees the true value of Azure Sphere in how it enables innovation on a much larger scale of influence: “This tiny little thing is enabling us to evolve\u2014not iterate anymore\u2014evolve our space, our industry. It’s going to make our datacenters much more predictable, more usable, so that our customers reap the benefits and rewards of everything we’re doing.”<\/em><\/p>\nMike started out by giving one engineer, Adolfo, total freedom to innovate with that first Azure Sphere development kit. Now Adolfo leads a team of ten whose only job is to create, to invent, to explore. “Because we were seeing such gains with one, two, then three people driving innovation, I was able to make a legitimate business case to bring on more people,”<\/em> says Mike.<\/p>\nOne of the reasons why Mike can confidently turn his team loose, without rails (“you can’t really have rails if you want to innovate,”<\/em> he says), is because Azure Sphere offers a secured platform. The team’s grounding principles are safety, security, uptime, and cost. It must be safe. It must be secure. It cannot impact the customer. And it has to be affordable. Says Mike, “Azure Sphere delivers it all. It gives us this great foundation to work through wild ideas and opportunities.<\/em>”<\/p>\nGet started with Azure Sphere today<\/a>\u00a0to build and test innovative, secured solutions for your organization, even while you\u2019re working remotely.<\/p>\n","protected":false},"excerpt":{"rendered":"Azure Sphere first entered the IoT Security market in 2018 with a clear mission\u2014to empower every organization on the planet to connect and create secure and trustworthy IoT devices. Security is the foundation for durable innovation and business resilience. Every industry investing in IoT must consider the vulnerabilities of the cyberthreat landscape. For our customers, […]<\/p>\n","protected":false},"author":98,"featured_media":92240,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[3676],"products":[3690,3699],"threat-intelligence":[],"tags":[3742],"coauthors":[2301,2458],"class_list":["post-92238","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-best-practices","topic-iot-security","products-microsoft-defender","products-microsoft-defender-for-iot","tag-azure"],"yoast_head":"\n
IoT security: how Microsoft protects Azure Datacenters | Microsoft Security Blog<\/title>\n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n\t \n\t \n\t \n