Questions tagged [azure]
The azure tag has no usage guidance.
2
votes
1answer
47 views
What is the security concerns of AzureAD?
We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
38 views
Is re-prompting a user for credentials an effective measure to prove a user's identify
I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
26 views
Permissions for Azure OMS Agent files
I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
0
votes
1answer
63 views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
1
vote
0answers
67 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
0
votes
2answers
816 views
How to convert my cert chain to PFX without a password
I am trying to enable an Azure Front Door instance on the front of my website using my EV cert (Extended Validation Certificate).
However, from Azure Front Door Cert Instructions,
Azure Front Door ...
2
votes
2answers
138 views
How are stateless firewalls useful in public cloud platforms?
I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
1
vote
1answer
104 views
Are Self-Encrypting Drives (SEDs) used in cloud environments?
I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS?
And if so, what additional protection do they offer beside from physical theft of the ...
1
vote
1answer
32 views
Block AzureRM PowerShell Module
Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
0
votes
0answers
33 views
How to protect against rogue malicious applications in the Azure AD?
Consider the following hypothetical scenario:
I create the PhotoApp - native Android application that is used by users to manage their private photos.
I create the PhotoService - Web API that is ...
1
vote
1answer
63 views
How is AWS app identity verified?
So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
3
votes
5answers
508 views
Cloud provider for Penetration Testing
I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests.
The issue I am having is finding a cloud provider such as AWS, Azure etc. for this.
For AWS they ...
2
votes
0answers
118 views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
0answers
211 views
oAuth vs. Basic Authentication to connect to Azure AD backed services via Daemon/Service Application
I'm creating app that will run as an automated service with no user interaction to process to connect to a mailbox and process emails (download attachments, move emails to a "processed" folder, etc.). ...
0
votes
1answer
490 views
Detect and Scan Open Ports
I am trying to understand two questions -
I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
2
votes
1answer
3k views
Approach to (nmap?) port scan a subnet over VPN? (updated with figure)
I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server.
I want to do a port scan, indicated by the red arrow. The ...
1
vote
3answers
68 views
Protecting a private key on Azure
Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?
I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
0answers
55 views
What current methods are there to gain access to Azure?
I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance.
So far I haven't found much in the way ...
1
vote
1answer
48 views
Azure VPN Gateway Client - Reported as Win32/Detplock
When following this official guide to setup an Azure VPN Gateway, the downloaded VPN client application is reported as Win32/Detplock by windows defender.
https://docs.microsoft.com/en-us/azure/vpn-...
5
votes
1answer
539 views
Securely Storing Access Tokens for Azure Key Vault
I am using Azure's KEY vault to store encryption keys and handle encryption and decryption as we have a specification that requires encryption keys to be kept offsite, however this has left me with ...
2
votes
1answer
82 views
Can I secure a server on which I'm deliberately allowing code execution?
Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface.
Obviously,...
2
votes
1answer
477 views
Strange attempts from Azure IP on our client data
I had to put this case here as Microsoft's answer won't make sense.
What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 104.42....
3
votes
0answers
632 views
Are enterprises Office 365 accounts overly exposed to brute force attacks?
Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”.
...
0
votes
0answers
160 views
OS Fingerprint prevention on Azure WebApps
Is there a way to prevent nmap os fingerprint on Azure Webapps? I used nmap and got report:
OS Detection Consolidation and Reporting
OS: Windows CPE: CPE: cpe:/o:microsoft:windows Found by NVT: 1.3....
0
votes
0answers
76 views
Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?
just in short. I was playing around a Azure AppService as I wanted to know how secure it is.
I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
0
votes
1answer
41 views
Limiting information disclosed by server
I host a web application on an Ubuntu 14.04 based VM hosted on Microsoft Azure infrastructure. The webserver is nginx. Recently, someone was trying to probe my server, and later correctly surmised ...
3
votes
1answer
150 views
How does the use of Microsoft-branded Azure products affect my privacy policy?
I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc).
...
1
vote
0answers
43 views
Encrypt content on Azure without using KeyVault? [duplicate]
Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
4
votes
2answers
171 views
How much information about our Security & Penetration Testing should we share with customers?
We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
0
votes
2answers
390 views
Are there any PCI compliant firewalls that can be installed on Linux through normal means and not through an ISO? [closed]
We are trying to install a PCI compliant firewall on our Azure Vnet. The problem is, that ones like opnsense can only be installed through an iso, having to install it on a local VM and then having to ...
0
votes
2answers
325 views
Is traffic encrypted using IPSec intercepted in transit over public internet, hackable?
In the official Azure documentation describing Azure VPN Gateway, I read this about Site to Site VPN
"Though traffic is encrypted using IPSec, it can be intercepted in
transit since it traverses ...
10
votes
1answer
363 views
What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?
Azure has different privacy agreements set up with different datacenters as mentioned in this footnote
Azure is now available in China through a unique partnership between Microsoft and 21Vianet, ...
28
votes
3answers
3k views
Pentesting against own web service hosted on 3rd party platform
I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
2
votes
2answers
108 views
Migrating IIS to Azure
So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
0
votes
1answer
84 views
How should I detect and respond to bad actors who perform SQL injections?
SQL Azure has a logic component called Threat Detection. I assume it looks for SQL Injection, but also evidence of dangerous commands like sp_exec.
I would like to expand that scope, and also ...
2
votes
2answers
621 views
Why does an external pentester testing my Azure website ask for IP, Gateway, DNS and VPN credentials?
I have an Azure website and a client who wants to use my site but needs to perform ethical hacking on it in order to decide if it's secure enough for them.
They've asked me this to send them this:
...
0
votes
1answer
273 views
Feeding Azure portal logs into a SIEM solution
Currently working on a cloud transformation project where all infrastructure is being placed into Azure.
We currently use a SIEM solution to monitor and assess events across the environment. The ...
0
votes
1answer
249 views
Microsoft IP Blocked by my fail2ban
Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse.
My ...
0
votes
1answer
399 views
Robots trying to login to Azure VM when SSH port is closed in manager
I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
4
votes
1answer
2k views
Azure AD B2C vs Auth0 [closed]
I am trying to work on security architecture for our SaaS application.
The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0.
Is this is correct comparison?...
1
vote
2answers
125 views
Azure Networking VPN
Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources ...
4
votes
2answers
685 views
Azure Key Vault vs Azure Environment Variables - Which is the right way?
I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...
11
votes
2answers
1k views
Is it safe to store SSN's in Azure Cloud?
I'm doing due diligence on a company. They are entirely cloud based and need to collect lots of personal information from users (including SSN). Is this something I should be majorly concerned with? ...
2
votes
0answers
354 views
ISO27001 compliance and perceived Risks using Microsoft SQL Server Azure 2016 [closed]
Introduction
My company is currently undergoing ISO27001 compliance. I originally thought that this is a purely technical issue, with the merits of different solutions being weighed up on purely ...
1
vote
0answers
198 views
How Do I Create a Production Client Authentication Certificate for Azure Key Vault?
I am learning about Azure Key Vault, and one of the scenarios it supports is certificate authentication, which you can read about here.
The samples do a great job of explaining how to make a self-...
3
votes
1answer
574 views
Is It OK If a Server Does Not Verify a Certificate?
I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV).
To start with, please see this article:
In particular, I am interested in this statement:
When ...
4
votes
2answers
152 views
Can I prevent all employees from accessing customer data without being logged (especially IT)
I am hosting a web application and SQL server database on Azure and I would like to ensure that no individual at the company can access customer data without the access being logged. It seems that ...
8
votes
1answer
663 views
Benefits of cloud based full disk encryption
Microsoft announced in May that it supported full disk encryption for VMs. They have recently merged a github branch into the Azure Powershell tools to enable this.
The basic theory is that you ...
2
votes
0answers
101 views
Google.com serving *.portal.azure.com SSL certificate?
Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too.
This disappeared ...
2
votes
1answer
267 views
What reasons are there to not just send the API key as an HTTP header over HTTPS?
I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
