Questions tagged [azure]
The azure tag has no usage guidance.
96
questions
0
votes
0answers
37 views
How to prevent azure pipelines (yaml) from being used as an attack vector?
Let's say the following scenario exists:
A git repository exists on Azure DevOps Repos.
The repository uses yaml pipelines (azure-pipelines.yml).
The repository has branch policies to ensure that ...
0
votes
1answer
43 views
Is there a current best practice for authorizing an SPA to get/post to API
I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so.
It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
0
votes
0answers
3 views
Configuring Azure Console for _external_ authentication/SSO/IdP? [migrated]
I'm looking for pointers on how to configure Azure "IAM" to trust an external IdP/Authentication server.... but finding my way around the docs for Azure which is... not easy. Help would be more than ...
0
votes
0answers
29 views
Risk of having Azure Multi Site-To-Site VPN with different client
My company decided to build an ETL server on Azure and share by multiple client. My task is to research on possibility to set up multiple VPN tunnel from cloud to multiple client office network. I ...
0
votes
0answers
188 views
CORS issue with WebApp on Azure + AAD
I would like to get some experts' advice regarding the way I resolved the following issue:
Let's say my personal app is hosted as an Azure App Service on https://example.azurewebsites.net
The JS ...
2
votes
4answers
255 views
How do I configure Azure Web Apps so that the only access is via CloudFlare?
I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare.
I added Azure Security Center to my subscription.
At the moment one can access the ...
0
votes
0answers
52 views
Could using the azure storage account access_key_name to in databricks notebook be considered best practise?
Currently, we are using key_name mentioned in the below code to access the blob storage in azure from databricks notebooks. We aren't directly using the 512 bit access key value from the azure storage ...
0
votes
0answers
16 views
What is the security justification for blocking all outbound ports/protocols except HTTP over 80/443? [duplicate]
My companies IT blocks all outbound traffic except HTTP, preventing me from getting work done at the office (I often need to work on Azure SQL databases which require TCP over port 1433). I can get ...
2
votes
0answers
42 views
IPS solution for a medium sized web application
As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
44
votes
9answers
8k views
I have just 4 hours a month to security check a cloud based application - How to use my time?
I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month.
I essentially have half a workday to secure this application / keep it secure. What is an ...
0
votes
0answers
24 views
Encrypted Container for Azure WebApps
I am considering moving an application - which currently sits on a Bitlocker-encrypted Windows Server - to a Microsoft Azure WebApps Linux Container.
As far as I understand, encryption of the ...
0
votes
0answers
34 views
Azure AD - Guest user SSO to RDP
We have two Azure subscription, (1) of the parent company where all the users live in Azure AD (synchronised from on premises AD), and (2) that holds the 365 apps which are dedicated to our company.
...
0
votes
1answer
57 views
What protocol is NPS server using to send Secondary Auth to Azure MFA?
We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
0
votes
0answers
158 views
What is the best practice to run Openvas on Azure?
I have created a Kali VM on Azure to use for my pentesting engagement. I was able to access Openvas GM from my desktop, however I could not log in the GM even though I reset my GM password again and ...
0
votes
0answers
17 views
Server to server- local account or IdP?
For an organisation I work with, the policy for internally developed applications has been to use AD accounts for running services or service integrations (their AD is full of SA_AppName_purpose). ...
3
votes
1answer
187 views
Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?
Why can any application or user on your server type an insecure URL like these to get server information about that instance?
http://instance-data.us-east-1.compute.internal/latest/meta-data/
http://...
0
votes
0answers
29 views
Security and distro list naming convention in AAD
Most naming convention standards for Active Directory I have come across so far have security groups starting with an underscore to allow the equivalent distribution list to be user-friendly.
I am ...
0
votes
0answers
68 views
Is it safe to share an Azure SAS token with an untrusted client?
We need to host files in Azure Blob Store, and allow access to end users to their generated "statements"(pdf) for a short period of time.
We're considering achieving this by generating a short-lived ...
0
votes
0answers
20 views
Cloud IAM solutions- internal and external users
From the cloud IAM solutions, I am only familiar with Azure AD where there is a differentiation between Members and Guests. Members would be internal users (i.e. synchronised from Active Directory) ...
0
votes
0answers
107 views
Azure AD subdomains best practice
I'm setting up an Azure AD subscription for a small retailer with 3 branches and a headquarters (100s of users in each). The branches are self-sufficient and intend to manage their own users. Users ...
0
votes
0answers
26 views
Azure Security Policy for Azure Analysis Service
I have been working to build an Azure Security policy for Azure Analysis Services. First off, I cannot find one mention or sample code and I am unable to get any of my policies to work correctly. Is ...
1
vote
1answer
48 views
RDP to Azure VMs through public IP versus VPN
I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.
I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
1
vote
1answer
148 views
What are the benefits of using Nessus in addition to Azure Security Center?
Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management?
Or does it have any ...
2
votes
1answer
36 views
Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?
Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
0
votes
1answer
87 views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
0
votes
0answers
52 views
Securing Vue App in .NET MVC page
We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
0
votes
0answers
58 views
What is the best way to secure web API calls from worker apps running on Windows
I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
1
vote
0answers
17 views
What would happen to the connection when certificate expires? [duplicate]
We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure)
The expiry date of the certificate is 3 years from now.
Once the ...
0
votes
0answers
44 views
Azure AD — How to only allow MFA configuration from a trusted network?
Hopefully someone as an idea...
In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0answers
134 views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
2
votes
0answers
128 views
RFC 5280 compliant certificate with x509 extensions
First time posting here, be gentle.
Situation:
I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
3
votes
1answer
73 views
Azure publicly exposed resources
Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
42 views
What is the default cipher for SSL connections in Azure for MariaDB?
According to Microsoft's Documentation, Azure should be configured to use SSL for connections.
In regards to default settings, they state the following:
By default, the database service should be ...
0
votes
0answers
470 views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
4
votes
1answer
234 views
What is the security concerns of AzureAD?
We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
108 views
Is re-prompting a user for credentials an effective measure to prove a user's identify
I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
119 views
Permissions for Azure OMS Agent files
I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
0
votes
1answer
256 views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
1
vote
0answers
105 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
2answers
342 views
How are stateless firewalls useful in public cloud platforms?
I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
1
vote
1answer
205 views
Are Self-Encrypting Drives (SEDs) used in cloud environments?
I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS?
And if so, what additional protection do they offer beside from physical theft of the ...
2
votes
1answer
37 views
Block AzureRM PowerShell Module
Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
0answers
40 views
How to protect against rogue malicious applications in the Azure AD?
Consider the following hypothetical scenario:
I create the PhotoApp - native Android application that is used by users to manage their private photos.
I create the PhotoService - Web API that is ...
1
vote
1answer
87 views
How is AWS app identity verified?
So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
4
votes
5answers
1k views
Cloud provider for Penetration Testing
I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests.
The issue I am having is finding a cloud provider such as AWS, Azure etc. for this.
For AWS they ...
2
votes
0answers
144 views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
1answer
820 views
Detect and Scan Open Ports
I am trying to understand two questions -
I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
3
votes
1answer
6k views
Approach to (nmap?) port scan a subnet over VPN? (updated with figure)
I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server.
I want to do a port scan, indicated by the red arrow. The ...
1
vote
3answers
80 views
Protecting a private key on Azure
Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?
I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
0answers
61 views
What current methods are there to gain access to Azure?
I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance.
So far I haven't found much in the way ...
