I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, valid HTTPS certificate, etc. The web interface is publicly open to the web by design and I can't limit the access to it.

Since the product supports SAML SSO, I've also configured it to work with Azure AD as an identity provider for my organization, so I won't have to deal with managing additional passwords, 2FA and to avoid other security flaws.

What's the best way I can verify that the exposed web interface is as protected as it can be? Ideally I want to catch now as many problems and misconfigurations as I can, to minimize my risk of getting hacked for real.

  • IMO, this question needs improvement. It is effectively asking "how many different ways can I boil water?" I would recommend going back to the developer fo the product and asking "do you have any best practices in securing your product when it is configured for SAML SSO?" None of us here can answer as we know nothing other than you've protected your app with an identity provider connected to your Azure. It's far too general to assist.
    – Andrew K.
    Oct 13 '20 at 15:10

If you do not have an internal Cybersecurity resource, you can hire a Managed Security Service Provider (MSSP) or you can use free resources provided by the Cybersecurity & Infrastructure Security Agency (CISA) which will help report on potential vulnerabilities.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.