Hacker News new | ask | show | jobs
by nickburns 812 days ago 

  I've done an objective comparison of cloud provider security capabilities and Azure's is the worst by a large margin [ . . . ]
could you say a little more about this—if only to list some security-related functionality that's default or comes with 'base ' licensing in other public clouds, but that Microsoft offers only as add-on? probably a fair list considering the sheer number of tier and add-on SKUs. but anything specific that's particularly egregious?
2 comments
jiggawatts 811 days ago
As a random example, they charge customers to store audit logs. That would be “fine”, except that they charge something like 7x what AWS does for the equivalent service. The AWS pricing is already what I would call “too high”, which makes Azure’s log analytics pricing highway robbery. It can cost more than the VMs it is auditing!

Another fun problem is that their audit logs only log the identity of the person that triggered the event about 50% of the time. In many cases they mask or drop this field, which is the most important piece of data in such a log!

So for example a developer in our org pressed a button in an Application Insights troubleshooting wizard when his app ran out of memory. This “helpfully” doubled the size of an already huge server pool that had a reservation in it. We ended up paying $15K extra that month and never figured out who did it because the logged identity was some internal service account!

link
javcasas 811 days ago
Oh, you paid 15k more? I'd say that's a feature.
link
jiggawatts 811 days ago
Me? No. The government did… with your taxes.
link
_8j50 811 days ago
Can't share details but we basically listed mitre tactics and what out of box detection/prevention/logging each CSP provides.
link
nickburns 811 days ago
anything nonspecific enough to share re: results? how'd/s Azure fare relative?
link
_8j50 809 days ago
Basically, they had products for most categories bur unlike other CSPs they were paid and optional and the payment model makes it hard to predict cost. Applying those features across a large number of subscriptions is also not a trivial task. You can compare ASC alerts vs SCC (gcp) yourself and see.
link