Questions tagged [azure]
The azure tag has no usage guidance.
73
questions
0
votes
0answers
20 views
Securing Vue App in .NET MVC page
We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
0
votes
0answers
55 views
What is the best way to secure web API calls from worker apps running on Windows
I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
1
vote
0answers
16 views
What would happen to the connection when certificate expires? [duplicate]
We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure)
The expiry date of the certificate is 3 years from now.
Once the ...
0
votes
0answers
29 views
Azure AD — How to only allow MFA configuration from a trusted network?
Hopefully someone as an idea...
In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0answers
33 views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
2
votes
0answers
31 views
RFC 5280 compliant certificate with x509 extensions
First time posting here, be gentle.
Situation:
I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
1
vote
0answers
33 views
Azure publicly exposed resources
Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
32 views
What is the default cipher for SSL connections in Azure for MariaDB?
According to Microsoft's Documentation, Azure should be configured to use SSL for connections.
In regards to default settings, they state the following:
By default, the database service should be ...
0
votes
0answers
51 views
Usage of a self-signed certificate between Akamai and Azure
First of all, some background of what is proposed:
The client's browser initialises request
The request is resolved by public DNS (CNAME) to Akamai Edge
The request is processed by Akamai accordingly
...
0
votes
0answers
175 views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
34 views
Is Azure Key Vault more secure than the machine certificate store?
I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
4
votes
1answer
117 views
What is the security concerns of AzureAD?
We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
56 views
Is re-prompting a user for credentials an effective measure to prove a user's identify
I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
49 views
Permissions for Azure OMS Agent files
I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
0
votes
1answer
128 views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
1
vote
0answers
88 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
2answers
185 views
How are stateless firewalls useful in public cloud platforms?
I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
1
vote
1answer
128 views
Are Self-Encrypting Drives (SEDs) used in cloud environments?
I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS?
And if so, what additional protection do they offer beside from physical theft of the ...
1
vote
1answer
34 views
Block AzureRM PowerShell Module
Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
0answers
37 views
How to protect against rogue malicious applications in the Azure AD?
Consider the following hypothetical scenario:
I create the PhotoApp - native Android application that is used by users to manage their private photos.
I create the PhotoService - Web API that is ...
1
vote
1answer
71 views
How is AWS app identity verified?
So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
3
votes
5answers
742 views
Cloud provider for Penetration Testing
I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests.
The issue I am having is finding a cloud provider such as AWS, Azure etc. for this.
For AWS they ...
2
votes
0answers
126 views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
1answer
614 views
Detect and Scan Open Ports
I am trying to understand two questions -
I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
2
votes
1answer
3k views
Approach to (nmap?) port scan a subnet over VPN? (updated with figure)
I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server.
I want to do a port scan, indicated by the red arrow. The ...
1
vote
3answers
74 views
Protecting a private key on Azure
Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?
I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
0answers
55 views
What current methods are there to gain access to Azure?
I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance.
So far I haven't found much in the way ...
1
vote
1answer
53 views
Azure VPN Gateway Client - Reported as Win32/Detplock
When following this official guide to setup an Azure VPN Gateway, the downloaded VPN client application is reported as Win32/Detplock by windows defender.
https://docs.microsoft.com/en-us/azure/vpn-...
5
votes
1answer
622 views
Securely Storing Access Tokens for Azure Key Vault
I am using Azure's KEY vault to store encryption keys and handle encryption and decryption as we have a specification that requires encryption keys to be kept offsite, however this has left me with ...
2
votes
1answer
82 views
Can I secure a server on which I'm deliberately allowing code execution?
Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface.
Obviously,...
2
votes
2answers
757 views
Strange attempts from Azure IP on our client data
I had to put this case here as Microsoft's answer won't make sense.
What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 104.42....
3
votes
0answers
696 views
Are enterprises Office 365 accounts overly exposed to brute force attacks?
Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”.
...
0
votes
0answers
83 views
Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?
just in short. I was playing around a Azure AppService as I wanted to know how secure it is.
I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
0
votes
1answer
41 views
Limiting information disclosed by server
I host a web application on an Ubuntu 14.04 based VM hosted on Microsoft Azure infrastructure. The webserver is nginx. Recently, someone was trying to probe my server, and later correctly surmised ...
3
votes
1answer
150 views
How does the use of Microsoft-branded Azure products affect my privacy policy?
I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc).
...
1
vote
0answers
43 views
Encrypt content on Azure without using KeyVault? [duplicate]
Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
4
votes
2answers
182 views
How much information about our Security & Penetration Testing should we share with customers?
We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
0
votes
2answers
460 views
Are there any PCI compliant firewalls that can be installed on Linux through normal means and not through an ISO? [closed]
We are trying to install a PCI compliant firewall on our Azure Vnet. The problem is, that ones like opnsense can only be installed through an iso, having to install it on a local VM and then having to ...
0
votes
2answers
343 views
Is traffic encrypted using IPSec intercepted in transit over public internet, hackable?
In the official Azure documentation describing Azure VPN Gateway, I read this about Site to Site VPN
"Though traffic is encrypted using IPSec, it can be intercepted in
transit since it traverses ...
10
votes
1answer
379 views
What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?
Azure has different privacy agreements set up with different datacenters as mentioned in this footnote
Azure is now available in China through a unique partnership between Microsoft and 21Vianet, ...
28
votes
3answers
3k views
Pentesting against own web service hosted on 3rd party platform
I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
2
votes
2answers
112 views
Migrating IIS to Azure
So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
0
votes
1answer
86 views
How should I detect and respond to bad actors who perform SQL injections?
SQL Azure has a logic component called Threat Detection. I assume it looks for SQL Injection, but also evidence of dangerous commands like sp_exec.
I would like to expand that scope, and also ...
2
votes
2answers
653 views
Why does an external pentester testing my Azure website ask for IP, Gateway, DNS and VPN credentials?
I have an Azure website and a client who wants to use my site but needs to perform ethical hacking on it in order to decide if it's secure enough for them.
They've asked me this to send them this:
...
0
votes
1answer
278 views
Feeding Azure portal logs into a SIEM solution
Currently working on a cloud transformation project where all infrastructure is being placed into Azure.
We currently use a SIEM solution to monitor and assess events across the environment. The ...
0
votes
1answer
256 views
Microsoft IP Blocked by my fail2ban
Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse.
My ...
0
votes
1answer
425 views
Robots trying to login to Azure VM when SSH port is closed in manager
I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
4
votes
1answer
2k views
Azure AD B2C vs Auth0 [closed]
I am trying to work on security architecture for our SaaS application.
The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0.
Is this is correct comparison?...
1
vote
2answers
157 views
Azure Networking VPN
Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources ...
4
votes
2answers
844 views
Azure Key Vault vs Azure Environment Variables - Which is the right way?
I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...
