Microsoft on Dec. 7 announced Azure Government Top Secret, a new cloud for Top Secret classified data, and outlined new features of Azure Government and the expansion of Azure Government Secret as part of its annual Government Leaders Summit.

In a Microsoft Azure blog, Tom Keane, corporate vice president of Azure global, said Azure Government Top Secret, which has been undergoing federal accreditation, is designed to provide the same capabilities as the commercial version of Azure, Azure Government and Azure Government Secret, “enabling a continuum of compute from mission cloud to tactical edge.”

New features of Azure Government Secret, which is authorized by both Department of Defense impact level 6 and intelligence community directive 503, address needs of application developers and security analysts. The new Azure Kubernetes Service and Azure Container Instances will allow developers to better deploy and manage containerized applications. With Azure Sentinel and Azure Security Center analysts can collect, analyze, and act on telemetry data from their Azure and on-premises environments to deliver unified security and proactive threat management.

For the Azure Government cloud, Availability Zones give users redundancy and logical isolation of data center services, assuring that critical customer services and workloads are available anywhere 24/7. Additionally Windows Virtual Desktop in Azure Government recently became available, accredited at the high level by the Federal Risk and Authorization Management Program.

To address needs of users working on the tactical edge, Microsoft announced rugged hardware to that supports low-latency data processing, making it easier for agencies to deploy artificial intelligence and machine learning to the network edge or access satellite data in disconnected environments. The Azure Modular Data Center — available at impact levels 5 and 6 – was announced in October, but now has a high availability power module and a network high availability module that provides network resiliency through multiple satellite communication partners in different orbits.

The ruggedized versions of Azure Stack Hub, Azure Stack Edge Pro R and the portable Azure Stack Edge Mini R are now generally available for customers in Azure Government and Azure Government Secret.

Microsoft made these government cloud announcements as part of its annual Government Leaders Summit.

With the $10 billion Department of Defense JEDI cloud contract still in court, Microsoft launched a new cloud on Monday to serve government agencies with highly sensitive and classified data: the Azure Government Top Secret cloud.

Tom Keane, corporate vice president for Microsoft Azure Global, said Microsoft has completed the buildout of new Azure Government Top Secret regions targeting the government’s most sensitive and classified workloads. The news comes as Microsoft and Amazon Web Services are tied up in a court battle regarding the U.S. Defense Department’s (DOD) estimated $10 billion Joint Enterprise Defense Infrastructure (JEDI) cloud contract.

The contract has been awarded to Microsoft on two occasions. In September, the DOD reaffirmed that Microsoft won the JEDI contract.

However, this month, the DOD said the JEDI contract requires commercial parity, which Microsoft said on Monday it is providing with Azure Government Top Secret.

“We are working with the US Government on accreditation,” said Keane in a blog post on Monday. “As part of our ongoing commitment to commercial parity driven by government mission requirements, Azure Government Top Secret regions are designed to provide the same capabilities as Azure (commercial), Azure Government, and Azure Government Secret, enabling a continuum of compute from mission cloud to tactical edge.”

Keane said the broad range of services offered in Azure Government Top Secret regions will meet the demand for greater agility in the classified space, including the need to gain deeper insights from data sourced from any location as well as the need to enable the rapid expansion of remote work.

“Mission owners will benefit from greater choice in modernizing legacy systems, with a secure cloud platform that works on open standards and open frameworks with tools that work across a wide range of skill levels, from business analysts to developers to data scientists,” said Keane.

The contentious and ongoing litigation process surrounding the JEDI contract has been raging on for well over a year.

In late 2019, the DOD awarded the JEDI cloud contract to Microsoft, but AWS filed a suit challenging the award. AWS has argued that President Donald Trump’s political interference in the contact stemming from his antipathy toward Amazon founder and CEO Jeff Bezos has corrupted the selection process.

The military initiated its 120-day review period in March after a federal judge identified at least one shortcoming in the vendor evaluation process that delivered the lucrative JEDI contract to Microsoft over its rival. That process has been delayed.

In May, Microsoft urged Amazon to “stand down on its litigation” opposing the JEDI contract, arguing the ongoing legal and administrative challenges were keeping the best tools out of the hands of U.S. warfighters.

Contentious legal battles — first between Oracle and AWS even before the JEDI contract was awarded, followed by AWS and Microsoft — have drastically delayed the U.S. military’s ambitious and expensive plan to modernize IT resources across all branches of the armed forces.

Microsoft’s implementation of products and services for the JEDI contract still have to wait for an injunction imposed by a federal court in February to be lifted

A new experiment by a Polish security researcher offers a fresh perspective on the well understood but still all too common problem of developers accidentally publishing secrets to code repositories.

Andrzej Dyjak recently ran an experiment to see how long it took before a secret committed to a public repository (such as API or cryptographic keys) was exploited.

An AWS key generated using the Thinkst Canary digital tripwire service was first compromised after 11 minutes when posted to GitHub, before getting repeatedly attacked thereafter.

A similar dummy secret went 62 minutes before suffering its first and only compromise on GitLab.

Dyjak used GitGuardian, a Git secrets scanning technology, during his experiment.

In the case of GitHub, Dyjak received an alert within seven minutes, and therefore before the first compromise, of possible secret leakage.

Time to pwnage
The time it takes for accidentally committed secrets on public repositories to being compromised has been the subject of previous, more extensive studies by North Carolina State University (PDF), IBM Research (PDF), and a GitHub honeypot exercise put together by security researcher Bob Diachenko.

Dyjak said that although people have focused on the honeypot part of his experiment, he was more interested in a comparison between the secret detection features of GitHub and GitLab.

“GitHub won – they caught the secret, alerted me, informed the provider, and on top of all that they also alerted me about vulnerable dependencies

“GitLab lost – it does offer similar SAST [static application security testing] features but they require setup of Auto DevOps which is a bottleneck.”

The Daily Swig approached both GitHub and GitLab for comment on this story, which we’ll update as and when more information comes to hand.

Dyjak deliberately leaked two secret API keys, attached to AWS and Slack, respectively.

“While AWS was compromised in both cases (GH and GL),” Dyjak reports, “Slack was not compromised in neither.”

This finding provides anecdotal evidence that adversaries are actively and selectively hunting for leaked AWS secrets rather than any inadvertently exposed tokens or credentials within code repositories.