The tag has no usage guidance.

learn more… | top users | synonyms

0
votes
0answers
11 views

Azure AD B2C vs Auth0

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison ...
-4
votes
0answers
41 views

How was azure apps website defaced? [on hold]

Recently we had 2 different html place holder websites that are hosted on azure apps had their index.html file replaced with some script kiddies hacker page and the old index file was renamed to ...
1
vote
0answers
22 views

Azure Networking VPN

Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources ...
2
votes
1answer
42 views

Azure Key Vault vs Azure Environment Variables - Which is the right way?

I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...
10
votes
2answers
845 views

Is it safe to store SSN's in Azure Cloud?

I'm doing due diligence on a company. They are entirely cloud based and need to collect lots of personal information from users (including SSN). Is this something I should be majorly concerned with? ...
2
votes
0answers
48 views

ISO27001 compliance and perceived Risks using Microsoft SQL Server Azure 2016 [closed]

Introduction My company is currently undergoing ISO27001 compliance. I originally thought that this is a purely technical issue, with the merits of different solutions being weighed up on purely ...
1
vote
0answers
42 views

How Do I Create a Production Client Authentication Certificate for Azure Key Vault?

I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here. The samples do a great job of explaining how to make a ...
3
votes
1answer
161 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
4
votes
2answers
129 views

Can I prevent all employees from accessing customer data without being logged (especially IT)

I am hosting a web application and SQL server database on Azure and I would like to ensure that no individual at the company can access customer data without the access being logged. It seems that ...
6
votes
1answer
124 views

Benefits of cloud based full disk encryption

Microsoft announced in May that it supported full disk encryption for VMs. They have recently merged a github branch into the Azure Powershell tools to enable this. The basic theory is that you ...
2
votes
0answers
83 views

Google.com serving *.portal.azure.com SSL certificate?

Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too. This disappeared ...
2
votes
1answer
97 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
0
votes
0answers
113 views

Is it possible to allow anonymous users to access part of an Azure website which uses Active Directory

I have a website hosted in Azure that uses Active Directory to prevent anyone from accessing it except for a few test users. Now I would like to expose a single page so that anyone can access it. I've ...
11
votes
2answers
355 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
4
votes
1answer
303 views

Invoke an antimalware scanner from code on azure Roles

We have a requirement to scan uploaded images via azure services. I found that Azure has a free out of the box solution http://azure.microsoft.com/en-us/support/legal/endpoint-protection/ However ...
6
votes
1answer
1k views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
1
vote
2answers
477 views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private ...
1
vote
1answer
337 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity ...
1
vote
1answer
124 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
4
votes
1answer
2k views

Intrusion prevention in windows azure?

When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can ...
1
vote
2answers
2k views

Best way to set up SSL certificates for consuming web service from Azure

I need to purchase and install the correct Verisgin SSL certificate(s) (X.509) on Azure. I have never done this before and would really appreciate some advice on how to go about it and what is ...
1
vote
1answer
598 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
2
votes
0answers
279 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
13
votes
4answers
5k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
7
votes
2answers
1k views

What information is exposed by simply opening an RDP connection to the internet?

Microsoft, Rackspace and other hosted providers allows people to RDP into that server. Here are a few examples: Microsoft has something called "Azure Connect" it is very easy to expose a domain ...
1
vote
1answer
376 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the ...
8
votes
5answers
2k views

Should one sign and encrypt using the same key? The Azure Training Labs are taking this approach

I'm taking the Azure lab LoadBalancing with WCF and recognise what I have been told is bad from a security perspective, but am not sure if it applies here. Can someone look at this code and tell me ...
5
votes
2answers
1k views

What is more secure: Many subdirectories, or many subdomains?

I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef: www.mydomain.net/enroll www.mydomain.net/admin www.mydomain.net/ ... or I can configure them as a ...