Professional Documents
Culture Documents
Full Ebook of Designing and Developing Secure Azure Solutions 1St Edition Michael Howard Simone Curzi Heinrich Gantenbein Online PDF All Chapter
Full Ebook of Designing and Developing Secure Azure Solutions 1St Edition Michael Howard Simone Curzi Heinrich Gantenbein Online PDF All Chapter
https://ebookmeta.com/product/designing-secure-systems-1st-
edition-michael-melone/
https://ebookmeta.com/product/building-microservices-
applications-on-microsoft-azure-designing-developing-deploying-
and-monitoring-1st-edition-harsh-chawla/
https://ebookmeta.com/product/developing-cloud-native-solutions-
with-microsoft-azure-and-net-build-highly-scalable-solutions-for-
the-enterprise-1st-edition-ashirwad-satapathi/
https://ebookmeta.com/product/explainable-ai-for-practitioners-
designing-and-implementing-explainable-ml-solutions-michael-munn/
Fundamentals of Pharmacognosy and Phytotherapy Michael
Heinrich
https://ebookmeta.com/product/fundamentals-of-pharmacognosy-and-
phytotherapy-michael-heinrich/
https://ebookmeta.com/product/azure-data-and-ai-architect-
handbook-adopt-a-structured-approach-to-designing-data-and-ai-
solutions-at-scale-1st-edition-anonymous/
https://ebookmeta.com/product/developing-solutions-for-microsoft-
azure-certification-companion-hands-on-preparation-and-practice-
for-exam-az-204-1st-edition-brian-l-gorman/
https://ebookmeta.com/product/design-and-deploy-a-secure-azure-
environment-mapping-the-nist-cybersecurity-framework-to-azure-
services-1st-edition-puthiyavan-udayakumar/
https://ebookmeta.com/product/security-requirements-engineering-
designing-secure-socio-technical-systems-dalpiaz/
Designing and Developing Secure
Azure Solutions
Michael Howard
Heinrich Gantenbein
Simone Curzi
Designing and Developing Secure Azure Solutions
ISBN-13: 978-0-13-790875-2
ISBN-10: 0-13-790875-X
Library of Congress Control Number: 2022947556
ScoutAutomatedPrintCode
Trademarks
Every effort has been made to make this book as complete and as
accurate as possible, but no warranty or fitness is implied. The
information provided is on an “as is” basis. The author, the publisher,
and Microsoft Corporation shall have neither liability nor
responsibility to any person or entity with respect to any loss or
damages arising from the information contained in this book or from
the use of the programs accompanying it.
Special Sales
CREDITS
Editor-in-Chief:
Brett Bartow
Executive Editor:
Loretta Yates
Sponsoring Editor:
Charvi Aora
Development Editor:
Kate Shoup
Managing Editor:
Sandra Schroeder
Tracey Croom
Copy Editor:
Kim Wimpsett
Indexer:
Ken Johnson
Proofreader:
Barbara Mack
Technical Editors:
Jonathan Davis, Mike Becker, Rick Alba, Altaz Valani, Hasan Yasar
Editorial Assistant:
Cindy Teeters
Cover Designer:
codeMantra
Art:
Cover illustration:
Valex/Shutterstock
Figure 10-37:
Gordon Lyon
Pearson’s Commitment to Diversity, Equity,
and Inclusion
—MICHAEL
With love to my wife Denyse, thanking her for the support she
provides.
—HEINRICH
With gratitude and love to my family, Silvia, Alice, and Viola, who
endure and support me tirelessly.
—SIMONE
Contents at a glance
Acknowledgments
About the Authors
Foreword
Introduction
Part I Security principles
CHAPTER 1 Secure development lifecycle processes
CHAPTER 2 Secure design
CHAPTER 3 Security patterns
CHAPTER 4 Threat modeling
CHAPTER 5 Identity, authentication, and authorization
CHAPTER 6 Monitoring and auditing
CHAPTER 7 Governance
CHAPTER 8 Compliance and risk programs
Part II Secure implementation
CHAPTER 9 Secure coding
CHAPTER 10 Cryptography in Azure
CHAPTER 11 Confidential computing
CHAPTER 12 Container security
CHAPTER 13 Database security
CHAPTER 14 CI/CD security
CHAPTER 15 Network security
Appendix A: Core cryptographic techniques
Index
Contents
Acknowledgments
Foreword
About the Authors
Introduction
PART I SECURITY PRINCIPLES
Chapter 1 Secure development lifecycle processes
Developers are the number-one source of compromises
Introducing the Microsoft Security Development
Lifecycle
Quality ≠ security
Securing features vs. security features
SDL components
Security training
Defining your bug bar
Attack surface analysis
Threat modeling
Defining your toolchain
Avoiding banned functionality
Using static analysis tools
Using dynamic analysis tools
Security code review
Having an incident response plan
Performing penetration tests
SDL tasks by sprint
The human element
Summary
Chapter 2 Secure design
The cloud, DevOps, and security
IaaS vs. PaaS vs. SaaS, and the shared responsibility
Zero trust for developers
Thinking about secure design
Security design principles applied to Azure
Attack surface reduction
Complete mediation
Defense in depth
Economy of mechanisms
Fail-safe defaults
Fail safe and fail secure
Least common mechanism
Least privilege
Leveraging existing components
Open design
Psychological acceptability
Separation of duties
Single point of failure
Weakest link
Summary
Chapter 3 Security patterns
What is a pattern?
Our take on Azure security patterns
Authentication pattern
Use a centralized identity provider for
authentication
Authorization patterns
Adopt just-in-time administration
Assign roles to groups
Isolate from the internet
Isolate with an identity perimeter
Use role-based access control (RBAC)
Secrets management patterns
Use managed identities
Protect secrets with Azure Key Vault
Sensitive information management patterns
Create secure channels
Encrypt data client-side
Use bring your own key (BYOK)
Availability pattern
Design for denial of service
Summary
Chapter 4 Threat modeling
TL;DR
What is threat modeling?
The four main phases of threat modeling
STRIDE’s threat-classification approach
The trouble with threat modeling
Searching for a better threat modeling process
A better way to perform threat modeling: The five
factors
Threat-modeling tools
Assessing the five factors
CAIRIS
Microsoft Threat Modeling Tool
OWASP Threat Dragon
pytm
Threagile
Threats Manager Studio
How to threat model: A real-life example
Analyzing the solution: The first meeting
Analyzing the solution: The second meeting
Identifying specific threats and mitigations
Automatically identifying additional threats and
mitigations
Creating the roadmap
Using the dashboard
Pushing selected mitigations into the backlog
Summary
Chapter 5 Identity, authentication, and authorization
Identity, authentication, and authorization through a
security lens
Authentication vs. authorization vs. identity
Modern identity and access management
Identity: OpenID Connect and OAuth2 fundamentals
OpenID Connect and OAuth2
Application registration
Microsoft Authentication Library
OAuth2 roles
Flows
Client types
Tokens
Scopes, permissions, and consent
Anatomy of a JWT
Using OAuth2 in your Azure applications
Authentication
Something you know
Something you have
Something you are
Multifactor authentication
Who is authenticating whom?
Creating your own authentication solution
The role of single sign-on
Getting access without authenticating
Authenticating applications
Authorization
Azure AD roles and scopes
Azure control plane built-in RBAC roles
Azure data plane built-in RBAC roles
Managing role assignments
Custom role definitions
Denying assignments
Role assignment best practices
Azure AD Privileged Identity Management
Azure attribute-based access control
Summary
Chapter 6 Monitoring and auditing
Monitoring, auditing, logging, oh my!
Leveraging the Azure platform
Diagnostic settings
Log categories and category groups
Log Analytics
Kusto queries
Raising alerts
Protecting audit logs
Using policy to add logs
Taming costs
The need for intentional security monitoring and
auditing
The role of threat modeling
Custom events
Alerts from custom events on Azure Sentinel
Summary
Chapter 7 Governance
Governance and the developer
Azure Security Benchmark version 3
Network security
Identity management
Privileged access
Data protection
Asset management
Logging and threat detection
Incident response
Posture and vulnerability management
Endpoint security
Backup and recovery
DevOps security
Governance and strategy
Governance enforcement
Enforcement through processes
Governance documentation and security
education
Role-based access control
Automated enforcement during deployment
Microsoft Defender for Cloud
Secure Score
Reviewing compliance state for solution
Azure Policy
Azure Initiatives and compliance frameworks
Azure Policy effects
Enforcement (effects) levels and RBAC by
environment
Policy Assignments
Policy as code
Summary
Chapter 8 Compliance and risk programs
Something important to get out of way
What is compliance?
HIPAA
HITRUST
GDPR
PCI DSS
FedRAMP
NIST SP 800-53
NIST Cybersecurity Framework
FIPS 140
SOC
ISO/IEC 27001
ISO/IEC 27034
Center for Internet Security Benchmarks
Azure Security Benchmark
OWASP
MITRE
Compliance synopsis
Using threat models to drive compliance artifacts
Summary
PART II SECURE IMPLEMENTATION
Chapter 9 Secure coding
Insecure code
Rule #1: All input is evil
Verify explicitly
Determine correctness
Reject known bad data
Encode data
Common vulnerabilities
A01: Broken access control
A02: Cryptographic failures
A03: Injection
A04: Insecure design
A05: Security misconfiguration
A06: Vulnerable and outdated components
A07: Identification and authentication failures
A08: Software and data integrity failures
A09: Security logging and monitoring failures
A10: Server-side request forgery (SSRF)
Comments about using C++
Don’t write glorified C
Use compiler and linker defenses
Use analysis tools
Security code review
Keeping developers honest with fuzz testing
Generating totally random data
Mutating existing data
Intelligently manipulating data knowing its
format
Fuzzing APIs
Summary
Chapter 10 Cryptography in Azure
A truth about security
Securing keys
Access control and Azure Key Vault
Use Key Vault Premium in production
Enable logging and auditing
Network isolation
Use Microsoft Defender for Key Vault
Back up your Key Vault assets
Managed HSM and Azure Key Vault
Secure keys with Key Vault summary
Cryptographic agility
How to achieve crypto agility
Implement crypto agility
The Microsoft Data Encryption SDK
Optional parameters
Managing SDK keys in Key Vault
Azure services and cryptography
Server-side encryption with platform-managed
keys
Server-side encryption with customer-managed
keys
Client-side encryption
Azure Storage cryptography
Azure VM cryptography
Azure SQL Database and Cosmos DB
cryptography
Key rotation
Azure Key Vault key rotation
Protecting data in transit
TLS and crypto agility
Ciphersuites
TLS in Azure PaaS
Setting ciphersuites
TLS in Azure IaaS
A common TLS mistake in .NET code
Testing TLS
Debugging TLS errors
Unsecure use of SSH
Summary
Chapter 11 Confidential computing
What is confidential computing?
Confidential computing processors
Intel Software Guard Extensions
AMD Secure Encrypted Virtualization-Secure
Nested Paging
Arm TrustZone
DCsv3-series VMs, SGX, Intel Total Memory
Encryption, and Intel Total Memory Encryption
Multi-Key
Attestation
Trusted launch for Azure VMs
Azure Services that use confidential computing
Summary
Chapter 12 Container security
What are containers?
You do not need containers for that!
How to proceed from here
Container-related services on Azure
Using containers on IaaS offerings
Comparing Azure container services
Problems with containers
Complexity
Immaturity
Fragmentation
Securing container services
Development and deployment
The container registry
The cluster
The nodes
The pods and containers
The application
Summary
Chapter 13 Database security
Why database security?
Which databases?
Thinking about database security
The SQL Server Family
SQL Server
Azure SQL Database
Azure SQL Managed Instance
Security in the SQL Server family
Control plane authentication
Control plane authorization
Control plane auditing
Control plane crypto on the wire
Control plane network isolation
Data plane authentication
Data plane authorization
Data plane auditing
Data plane crypto on the wire
Data plane network isolation
Cryptographic controls for data at rest
Miscellaneous
Cosmos DB security
Control plane authentication
Control plane authorization
Control plane auditing
Control plane network isolation
Data plane authentication
Data plane authorization
Data plane auditing
Data plane crypto on the wire
Data plane network isolation
Cryptographic controls for data at rest
Miscellaneous
Encryption of data in use: Always Encrypted
Always Encrypted
Always Encrypted with secure enclaves
Cosmos DB and Always Encrypted
SQL injection
Summary
Chapter 14 CI/CD security
What is CI/CD?
CI/CD tools
Source control systems and supply chain attacks
Security tooling
Protecting your developers
Pull request approvals and PR hygiene
Separation of duties, least privilege overview
Secrets and service connections
Protecting the main branch in Azure DevOps and GitHub
Protecting the PROD deployment in Azure DevOps and
GitHub
Securing deployment agents
Securing Azure DevOps agents
Securing GitHub agents
Summary
Chapter 15 Network security
Azure networking primer
IPv4, IPv6 in Azure
IPv4 concepts
IPv4 addresses in Azure and CIDR
Routing and user-defined routes
Network security groups
Application security groups
Landing zones, hubs, and spokes
Hub and spoke and segmentation
Environment segregation, VNets, and allowed
communications
Ingress and egress controls
NVAs and gateways
Azure Firewall
Azure Firewall Premium SKU
Azure web application firewalls
API Management Gateway
Azure Application Proxy
PaaS and private networking
Private shared PaaS
Dedicated PaaS instances
Managed VNets
Agent-based network participation
Azure Kubernetes Service networking
Ingress controls
Egress controls with UDR
Private endpoints for Kubernetes API server
Cluster network policies
The dangling DNS problem
An example
Fixing dangling DNS
Summary
Appendix A: Core cryptographic techniques
Index
Acknowledgments
Finally, we’d like to thank Scott Guthrie for writing the foreword
and for leading the magnificent team that is Microsoft Azure.
Michael Howard
Austin, Texas
Heinrich Gantenbein
Simone Curzi
Perugia, Italy
About the Authors
Michael Howard
Heinrich Gantenbein
Heinrich Gantenbein is a Senior Principal Consultant on Cybersecurity
in Microsoft’s Industry Solutions Delivery. With 30+ years of
experience in software engineering and more than 30 years of
experience in consulting, he brings a wealth of practical know-how
to his role. Heinrich specializes in Azure security, threat modeling,
and DevSecOps.
Simone Curzi
Simone Curzi is a Principal Consultant from Microsoft’s Industry
Solutions Delivery. He has 20+ years of experience covering various
technical roles in Microsoft and has fully devoted himself to security
for more than 10 years. A renowned threat modeling and Microsoft
Security Development Lifecycle expert, Simone is a regular speaker
at international conferences such as Microsoft Ready, Microsoft
Spark, (ISC)2 Security Congress, Carnegie Mellon’s SEI DevOps
Days, and Security Compass Equilibrium. Simone is also author of an
open source threat modeling tool, Threats Manager Studio.
Foreword
Scott Guthrie
The question Yuri asked planted a seed. Over the next few
weeks, the three of us—Michael, Heinrich, and Simone—assembled a
plan to write this book. Between us, we have worked with hundreds
of customers to help them deploy business-critical solutions on Azure
with confidence. This book is the culmination of that real-world
experience.
The reason we wrote this book was not only to help you
understand how to design and develop secure solutions running on
Azure but to offer you pragmatic advice. The Venn diagram shown in
Figure I-1 reflects how we see this book.
FIGURE I-1 The Intersection of this book’s areas of coverage.
This book is not designed to be read from cover to cover. You can
do that, of course, but we have tried to make the chapters as
independent as possible so they can be read individually. With that
said, there are cross-references between chapters, and you might
sometimes need to read a section of a different chapter to get the
big picture.
The book also covers multiple ways to achieve a task, such as the
following:
Using the Azure Portal (although it’s not common to use the Azure
Portal in production systems because deploying in the real world
usually uses a pipeline to push resources)
Using the Azure command-line Interface (CLI)
Using PowerShell code
Using more complete code examples in different languages such
as C#, Python, JavaScript, and more
Tip
Just who is this book for? It’s for anyone deploying solutions on
Azure—whether they’re architects, developers, or testers—who
might not know a great deal about security but who want to make
sure their design and code are as secure as possible. We cover a lot
of ground in the book, but we also cover many complex topics in
depth.
System requirements
azure.microsoft.com/en-us/free
GitHub Repo
We’ve made every effort to ensure the accuracy of this book and its
companion content. You can access updates to this book—in the
form of a list of submitted errata and their related corrections—at:
MicrosoftPressStore.com/SecureAzureSolutions/errata
Stay in touch
Brahms’ style is very distinct. His pianoforte music calls for a special
technique, quite outside the ordinary. Nothing of the style of Chopin
or Liszt is evident, even in a work like the Paganini variations, which
is essentially virtuoso music. These peculiarities are already evident
in the first two sonatas, the works in which Schumann saw such
great promise. The sonatas are worth study, not only from the
historical point of view, but as unusual and beautiful music.
There are three sonatas, the first in C major, opus 1; the second in
F-sharp minor, opus 2; the third in F minor, opus 5. The Scherzo in
E-flat minor, opus 4, belongs to the same period. In the very first
Brahms reveals himself; by the bare statement of the first part of the
second theme; by the double thirds of the second part which conceal
the sixths of which he was so fond; by the strangely hollow effect of
the chromatic scale, not long before the end of the first section, with
the sustained A below and the thin spacing of the whole; by the wide
accompaniment figures at the end of the first movement. The
octaves and sixths at the beginning of the Scherzo, the hollowness
later on in the movement, the extraordinary distance between the
hands in the thirty-sixth and thirty-seventh measures of the second
part, these are characteristic of Brahms’ way of writing for the
pianoforte. The trio of this Scherzo, by the way, might alone have
accounted for Schumann’s enthusiasm. The broad sweep of its
melody, the intense harmonies, the magnificent climax, have the
unmistakable ring of great genius. At the end of it may be noted a
procedure Brahms often employed: the gradual cessation of the
movement of the music by changing the value of the notes, more
than by retard. The last movement is splendidly vigorous. The chief
theme may have been taken from the theme of the first movement. It
gallops on over mountain and hill, full of exultation and sheer
physical spirits. The coda is a very whirlwind. Brahms told Albert
Dietrich that he had the Scotch song ‘My Heart’s in the Highlands’ in
his head while he was writing this finale; and the spirit of the song is
there.
The second sonata is as a whole less interesting than the first. The
first theme is not particularly well suited to the sonata form; there is a
great deal of conventionality about the passages which follow it. Yet
the transitional passage is interesting, and the deep, bass phrases,
so isolated from their high counterpoint, are very typical. One theme
serves for andante and Scherzo. In the latter movement the trio is
especially beautiful. It might easily be mistaken for Schubert.
The third sonata shows a great advance over the first and second.
The passage beginning in the eighth measure of the first movement
is in a favorite rhythmical style of Brahms. The right hand is playing
in 3/4 time, the left hand seems to be rather in 2/4. This is because
the figure of which it consists proceeds independently of the
measure beat. So later on one finds groups of six notes in 3/4 time
arranged very frequently in figures of three notes. In fact, the mixture
of double and triple rhythm is a favorite device of Brahms throughout
all his work. Two of the Paganini Variations are distinctly studies in
this rhythmical complexity—the fifth in the first set, the seventh in the
second set, in both cases the complexity being made all the more
confusing by odd phrasing.
The Andante, especially the last part of it, and the Scherzo of the
third sonata are among the most beautiful of Brahms’ compositions.
What the sonatas chiefly lack is not ideas nor skill to handle them,
but success in many parts in the treatment of the instrument. The
scoring is often far too thin. No relaxation is offered by passages of
any sensuous charm. One follows with the mind an ingenious
contrapuntal working-out that sounds itself empty, or leads to hollow
spaces.
The Ballades, opus 10, for example, tread heavily on the keyboard.
The first B major section of the second, with its appoggiaturas, its
widely separated outer parts now in contrary motion, now moving
together, and the mysterious single long notes between them, is
marred by the low, thick registration of the whole. There is a similar
thickness in the second section of the last ballade; an opposite
thinness in the middle section of the little intermezzo. Yet it would be
hard to find more romantic music than these Ballades, anything more
grim and awful than the first, more legendary in character than the
second, more gloomily sad than the last. There is a touch of sun in
the first melody of the second. Elsewhere we are in a gray twilight.
There are three earlier sets of variations, opus 9, opus 21, Nos. 1
and 2, which are small beside the two later sets just discussed. As
far as pianoforte music is concerned, the variations on a theme of
Handel, and the subsequent variations on a theme of Paganini,
represent the culmination of Brahms’ conscious technical
development, the one in the direction of intellectual mastery, the
other in the direction of keyboard effects. Behind them lie the
sonatas, the scherzo, and the ballades, all in a measure inspired, yet
all likewise tentative. After them come numerous sets of short pieces
which constitute one of the most beautiful and one of the perfect
contributions to pianoforte music.
These sets are opus 76, Nos. 1 and 2; the two Rhapsodies, opus 79,
and the last works for the instrument, opus 117, opus 118, and opus
119. There are few pieces among them which are unworthy of the
highest genius matched with consummate mastery of the science of
music. The two earlier collections, opus 76 and 79, differ from the
later in something the same way that Beethoven’s opus 57 differs
from his opus 110. They are impassioned, fully scored, dramatic, and
warm. The two Capriccios, Nos. 1 and 5 in opus 76, are
distinguished from his other pieces by a fiery agitation. The keys of
F-sharp minor and C-sharp minor on the pianoforte lend themselves
to intense and restless expression. In the former of these two pieces
more is suggested than fully revealed.
The two ‘Rhapsodies,’ opus 79, are among the best known of
Brahms’ pianoforte works. Both are involved and difficult; but the
form and the ideas are broad and consequently more easily grasped
than in the shorter pieces. Moreover, they are frankly vigorous and
passionate; and the B major section of the former, with its bell-like
effects, and the broad middle section of the latter, like the gallop of a
regiment across the steppes, are relatively conventional.
All are unusual music, all masterpieces. There is the utmost skill, as
in the canonic figures in the first intermezzo of opus 117, in the
middle section of opus 118, No. 2, and all through opus 118, No. 4.
There is a legendary quality in both opus 117, No. 1, and opus 117,
No. 3. In the latter the A major section is extraordinarily beautiful and
without a parallel in music. The last set is perhaps as a whole the
most remarkable. There are three intermezzos and one rhapsody. In
many measures of the first intermezzo the harmonies seem to unfold
from a single note, to be shed downward like light from a star. The
music drifts to a melody full of human yearning, rises again in
floating harmonies, drifts slowly downward, too heavy with sadness.
In the second and third the mood is happier, cool in the second,
smiling in the third. The final rhapsody is without a trace of
sentiment, healthy, sane, and enormously vigorous. Something
stands in the way of its effectiveness, however. It is coldly
triumphant. If there is any phase in human feeling which is wholly
strange to music, it is the sense of perfect physical condition,
entailing an unruffled mind and the flawless working of the muscles,
without excess, with only the enthusiasm of physical well-being, and
this entirely equable. The rhapsody in E-flat, opus 119, No. 4, is thus
normal.
The features of Brahms’ style are clearly marked. There are the wide
spacing of accompaniment figures demanding a large hand and the
free movement of the arm, the complicated rhythms, the frequent
use of octaves with the sixth included, the generally deliberate
treatment of material, the employment of low and high registers at
once with little or nothing between, the lack of passage work to
relieve the usual sombre coloring. The enthusiast will have little
difficulty in imitating him. Yet it is doubtful if Brahms will have a
successor in pianoforte music. What makes his work tolerable is the
greatness of his ideas, and this greatness makes them sublime. His
procedures in the employment of another will be cold and dull. It is
safer to imitate the virtuoso style of Liszt, for that has an intrinsic
charm.
There are two concertos, one in D minor, opus 15, and one in B-flat
major, opus 83. Brahms performed the first himself in Leipzig and
was actually hissed from the stage. Yet it is a very great work, one of
the few great concertos written for the pianoforte. A certain gloomy
seriousness in the character of the themes stands in the way of its
popular acceptance, and there are passages, notably in the middle
movement, the ungainliness of which not even the most impassioned
fancy or the deepest seriousness can disguise. The second concerto
is longer and more brilliant. This, too, must be ranked with the earlier
one, as one of the few great concertos, but chiefly by reason of the
noble quality of the ideas, the mastery of art and form. Brahms’
treatment of the piano is nowhere conventionally pianistic. This
second concerto is more than exceedingly difficult; but those
qualities in the instrument which add a variety of color and light to
the ensemble are for the most part not revealed in it. There is
consequently a monotony that in so long a work is likely to prove
tedious. A few figures and a few effects are peculiar to the
pianoforte. These should rightfully be brought into prominence in a
concerto. Mozart, Beethoven, and Schumann were able to do this,
not in the least subtracting from the genuine value of their work, but
rather adding to it. Brahms was less able to combine beauty and
conventionality. Yet such a passage as the return to the first theme in
the first movement of the second concerto shows a great
appreciation of color; and there is a grandeur and dignity in both
concertos, a wealth of romance in the first and of vitality in the
second, as well, in the presence of which criticism may well be silent.
[34] Part of the quotation is given in our ‘Narrative History,’ II, pp. 308f.
CHAPTER VII
CHOPIN
Chopin’s music and its relative value in musical value; racial and
personal characteristics; influences and preferences; Chopin’s
playing—His instinct for form; the form of his sonatas and
concertos; the Polonaise-Fantaisie; the preludes—Chopin as a
harmonist; Chopin’s style analyzed: accompaniment figures, inner
melodies, polyphonic suggestions, passages, melodies and
ornaments—His works in general: salon music; waltzes;
nocturnes; mazurkas; polonaises; conclusion.
I
No music for the pianoforte is more widely known than that of
Chopin. None has been more generally accepted. None has been
exposed so mercilessly to the mauling of sentimentality and
ignorance; nor has any other suffered to such an extent the ignominy
of an affable patronage. Yet it has not faded nor shown signs of
decay. Rather year by year the question rises clearer: is any music
more irreproachably beautiful? Less and less timidly, thoughtful men
and women now demand that Chopin be recognized truly as equal of
the greatest, even of Bach, of Mozart, of Beethoven. There are no
fixed standards by which to measure the greatness of music. We
adore the sacredness of forms and names. At the best we have a
sort of tenacity of faith, supported by a wholly personal enthusiasm.
To many this demand on behalf of Chopin will appear to be based on
an enthusiasm that is not justifiable; but by what shall enthusiasm be
justified? It is an emotion, something more powerful in music than
reason. One must grant that no pianoforte music has shown a
greater force than Chopin’s to rouse the emotions of the general
world. That it moves the callow heart to sighs or that the ignorant will
fawn upon it is no proof of weakness in it. Your ignoramus will dote
on Beethoven almost as much. Chopin’s music has depth upon
depth of beauty into which the student and the artist may penetrate.
It can never be fully comprehended and then thrown aside. To study
it year after year is to come ever upon new wonders.
It is urged against Chopin that he wrote only for the pianoforte. But
this cannot have any weight in estimating the value of his music. It is
generally acknowledged that the pianoforte is of all instruments the
most difficult to write for. Chopin was absolute master of these
difficulties, just as Wagner was master of the orchestra. He was
therefore in a position to give perfect expression to his ideas, as far
as color of sound is concerned. Mr. Edgar Stillman Kelley in his
recent book on Chopin[35] brings forward the interesting point that at
the time Chopin was composing—roughly between 1830 and 1845—
the orchestra would have been quite inadequate to the expression of
his ideas; both because of the imperfections of many of the
instruments and because of the lack of virtuoso skill among the
players. For Chopin’s music is above all things intricate. There is a
ceaseless interweaving of countless strands of harmony, a subtle
chromaticism of which the brass instruments would have been
incapable, and elaborate figures and passages which violinists would
not have been able to play. The pianoforte on the other hand was
relatively perfect. To it Chopin turned, as to a medium that would not
restrict his expression. And so accurately and minutely did he shape
his music in accordance with the instrument, that the many attempts
by clever and skillful men to arrange it for the orchestra have almost
entirely failed.
But neither the Italian opera nor the music of Hummel and Field was
the favorite music of Chopin. The two composers whose works he
accepted unqualifiedly were Sebastian Bach and Mozart. Here he
found a rich emotion and a flawless beauty of style. Here there was
no distortion, no struggle of ideas, no harshness. Here was for him
perfection of form and, what is perhaps rarest in any art, a just
proportion between form and content, an unblemished union of all
the elements which make music not only great but wholly beautiful.
Chopin spent the years of his boyhood and youth in Warsaw. In the
summer of 1829 he spent some weeks in Vienna, and played there
twice in public. In the list of those who were present at these
concerts—which, by the way, were wholly successful—one reads the
names of men and women who had known Beethoven and
Schubert, even friends of Mozart. He went again to Vienna in the fall
of 1830 and remained there, more or less idling, until uncertain
political conditions and an outbreak of cholera drove him in July,
1831, to seek Paris. Here he arrived about the end of September,
and here with few exceptions he lived the rest of his life.
II
It is evident that in many respects Chopin’s innovations sprang from
instinct. They are not the conscious putting to test of a theory of
reform, as are, in a small way, the Carnaval of Schumann, and in a
more grandiose one, the B minor sonata of Liszt. As regards form,
for example, he was in many cases not in the least dependent upon
past or contemporary standards. Such pieces as the Ballades and
the Barcarolle are without precedent. But they are the spontaneous
growth of his genius; not the product of an experimental intelligence.
The intellectually formal element which Berlioz, Schumann, and Liszt
made bold with, Chopin quite ignored.