Hot answers tagged

17

Given the current state of public cloud, I would argue that in many cases it is in fact more secure than on-premise storage. Granted I work for Microsoft, but my opinion both pre-dates my employment, and extends to competitors like Amazon and Google as well. Companies whose business models are built on data center operational expertise and excellence, are ...


7

Neither is necessarily more secure, but I will give you some opinions and perhaps facts. Host-extract can determine hostnames, which is also possible via virtual host enumeration. DirBuster, skipfish, and fuzzdb can rely on forced browsing, directory indexes, and predictable resource locations to find vulnerable directory structures and other issues. ...


7

There is at least one security benefit of sub-domains. If there is an XSS vulnerability on enroll.mydomain.net it can't be used to hijack a session on admin.mydomain.net. This is due to the Same-Origin Policy. It would also make it easier to move that application to a different server if need be. Isolation of failure is a good Defense in Depth approach. ...


6

It is a general best practice to use two separate key pairs (and hence certificates) for signature vs. encryption. I just refreshed myself on the reasons why: When a key is used for encryption, it's often wise to escrow it so that if it's lost, the encrypted content is not also lost. However, non-repudiation associated with a signature certificate isn't ...


6

Better or worse is relative to the usage of the protocol. SAML has it's place and SWT/JWT/et al have their place. The SAML spec is pretty much set in stone, whereas SWT/JWT are really in their infancy and keep changing. SAML has lots of knobs which makes it fairly complex and that's the enemy of good security, but everyone pretty much implements it the same ...


5

Many have pointed out key escrow as a reason for separating encryption and signature keys. Many have also mentioned that this shared use of keys is fine in this particular case. But nobody has mentioned the cryptographic problems in sharing keys for both signing and encryption If you look at official standards for cryptography, most of them specify that ...


4

In this particular scenario, this technique is fine. You use the same cryptographic key (in this case an X.509 cert) to encrypt-to-self. The sample you mention implements a session token (simply speaking a protected cookie), which is shared between multiple similar web services sitting behind a load balancer. So the 'signature' (in this particular ...


4

From security standpoint, there's not much difference between JWT and SAML token specs; it mostly boils down to supported signing and encryption algorithms (JWT is more limited in this regard; see http://tools.ietf.org/html/draft-jones-json-web-token-10#appendix-A). For this use case, in the end they both just provide claims (with all the necessary baggage, ...


4

You aren't missing anything technically, full disk encryption protects you from disk theft, improper disk disposal, or unauthorized access to the virtual container. The point I'd make to you is that if your data is valuable to your organization it's probably valuable to somebody else. You also have a duty of care to protect customer details any sensitive ...


4

First, for an analysis of TLS version and cipher suite selection, see my answer to Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment? The summary is: TLS_DHE_* and TLS_ECDHE_* support PFS, but AVOID DSS, RC4, and so on. The reason you're getting points off for not having FS with some browsers is the ...


3

Well, more accurately it says that untrusted relying parties pose a risk. If you accept token requests from any RP then an attacker could easily gather a fair bit of information about a user. That is the risk. If you only repond to requests from RP's that you know and trust then the liklihood that an attacker can gather the same information is less likely. ...


3

It is indeed mandatory to verify the certificate of the person you are talking to. However, it makes no sense for the server to verify it's own certificate. It would be like you verifying your home key still opens your door or if you did changed the locks. In normal operations, you should already know this. Checking the certificate of the server ...


3

There are a number of layers at which IDS/IPS can come into play when dealing with Azure IaaS. First, without doing anything at all, you already have IDS/IPS in place, because it's a standard piece of the Azure network security infrastructure. Every packet that enters their networks is going to be subject to inspection by the systems that are already in ...


3

Can someone look at this code and tell me if different certificates should be used in production code? First, any code that is use for a security function should be designed, design reviewed, implemented, code reviewed, and tested before puting in a production environment. Just because the code came from MSDN does not mean that it is secure. Even if you ...


2

Microsoft Azure uses a Remote Desktop Gateway kind of situation, so when you initiate a connection to your Azure Server your connection is via HTTPS until you hit the Microsoft Server farm. Once you int the network your connection is "proxied" via the Azure gateway server, this ensures that the only people who would be able to see any sensitive information ...


2

I do not believe this is a very good thing. There are simple programs on the net which can attack, and exploit vulnerabilities is RDP. I suggest they look into secure VPN instead on directly opening their domain up onto the net. If you want the serious truth: Using TSgrinder, an attacker could try a brute-force attack using customized lists of ...


2

Standard DNS tables and Azure are pretty flexible when it comes to helping you test this. I'd recommend the following: Register for a wildcard SSL certificate - this will let you apply the cert to subdomains as well. For help creating the cert check out http://www.andrewdenhertog.com/tips/creating-adding-ssl-certificates-azure/ If you want to test the ...


2

Yes and no. If done right it will be, but what you are describing is simply an authentication cookie. I would suggest to not reinvent the wheel. The framework/programming language that you use probably already have a way to manage authentication cookie. I would go with that instead of creating it yourself.


2

I think it's going to be extremely difficult, if not impossible to do this. Think about ALL the places where customer data exists, or can be accessed from: Production SQL servers. Development SQL servers. Backup servers. Production webservers. Development webservers. You probably are already auditing production webservers. But what about development ...


2

If there's a way to access data without an audit log, secure the credentials required to access it that way and audit their access. Software such as Vault is geared toward this. Physical control of an MFA token such as storing it on a YubiKey and then putting that in a safe place with somebody who doesn't control the password would provide you with dual ...


2

The primary ramification is that the security of your private SSL/TLS key is ultimately out of your control. Technically, you could use a wildcard certificate, or a multiple domain certificate (Subject Alternative Name, or SAN, certificate). However; if you use a wildcard or SAN certificate, then the security of all of your servers is tied to the security ...


2

To add to Xander's answer, there are a few things to consider: Company policy IaaS, PaaS, and SaaS multi-tenancy Key management Current internal security posture Company policy Some companies are okay with *aaS, some companies say a certain level of PII is okay to store off-prem without encryption, or require encryption for a certain level, and say ...


1

If you want your server to encrypt/sign outgoing traffic, then it needs its own private key. This is normal. What I think you are asking is about the security of having this certificate on a server that is ultimately out of your control. You will simply have to limit the exposure of this certificate and have processes in place to handle the event where you ...


1

It's perfectly fine to send api keys as a header in the HTTPS request, since first SSL/TLS negotiation happens, and then the packet with the header is sent. The first packet to negotiate the SSL doesn't contain headers other than browser specific generic ones. This is secure and safe. AD however does have some power behind it, and in an all windows ...


1

It also depends on your storage system. For example, if you have de-duplication, guest VMs may be able to establish whether known blocks of data are already stored, for example: (1) create a VM and store 10,000 reference files; (2) create another VM and store 30,000 files sampled without replacement from (A) the 10,000 reference files on VM 1, (B) 10,000 ...


1

You are going to be fighting somewhat of an uphill battle to implement this the way you want to. For whatever reason, local anti-virus systems typically do not give an API for such interactions. I will give a few options: 1) Scan your files on a storage server after they have been uploaded. Then, check back later to see if the AV has zapped them. pros: ...


1

Securing by IP is a great first step. It severely limits your attack surface. But, as you point out, the source IP in PAAS deployments has limited trust value. Adding a (reverse) proxy server between the outside world & the inside (local) server will also make things more difficult for an attacker. In business settings, having a reverse proxy separate ...


1

At the end of the day I don't think really matters, since it's a preference of format. SAML 2.0 is set in stone but is very large and verbose (as XML tends to be). But in my personal preference these days with my own projects. I say try out JWT tokens, which is a token in JSON format. If your client applications span across different platforms, it might be ...


1

I found a good article that should help you, http://www.windowsazure.com/en-us/documentation/articles/cloud-services-configure-ssl-certificate/ In their example they show a Wildcard cert, because of the (*) in the domain name *.contoso.com or www.contoso.com If you want a good deal on a Verisign wildcard SSLGURU(DOT)US is a good site that has it for a ...


1

HRD is done through two different mechanisms, which are used in either passive or active contexts. The passive method will determine the realm based on the username after they've lost focus of the username field. A lookup is done of the username and determines what tenant the username is tied to. If the tenant requires federated auth the site will redirect ...



Only top voted, non community-wiki answers of a minimum length are eligible