0

A colleague just asked me how secure is TFS Online?

His question is deeper than the MSDN security documentation.

What he really wants to know is, if there was some rogue Microsoft employee, is TFS Online secure enough that the data is safe?

In other words, is his code safe from Microsoft?

Improve this question
6
  • 1
    Your data is not encrypted. That should be enough.
    – Ramhound
    Sep 30, 2013 at 21:06
  • tinfoil hats make it safe enough. Ramhound has a point tho.
    – Lorenzo Von Matterhorn
    Sep 30, 2013 at 21:06
  • Lol, He's already wearing the tinfoil. So we're good. I cant quite tell if @Ramhound is being sarcastic tho, so I miss that point.
    – crthompson
    Sep 30, 2013 at 21:08
  • 3
    I an not saying your information isn't protected in other ways but your information is not encrypted thus anyone with access could access your files. My advice don't use it for a billion dollar software idea.
    – Ramhound
    Sep 30, 2013 at 21:08
  • 3
    Of course "an MS employee" has access to his data -- it's their service. If he's that paranoid, don't use it. :)
    – Ƭᴇcʜιᴇ007
    Sep 30, 2013 at 21:12

1 Answer 1

Reset to default
1

Microsoft recently published a TFS Online Security Whitepaper that talks about the different security controls Microsoft uses. They describe, in my opinion, reasonable protections given the state of the market today.

[I]s his code safe from Microsoft?

The paper mentions the following controls to protect from Microsoft employees:

  1. Encryption of data at rest via SQL Server TDE (Transparent Data Encryption).
  2. Encryption of data in transit via HTTPS.

If employees must get access during "a live site incident or other approved maintenance activity, which is logged and monitored", access is restricted to those that need access and have passed background checks.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .