Questions tagged [azure]
A cloud computing platform offered by Microsoft.
112
questions
0
votes
0
answers
24
views
Which is more secure: Certificate or Secret inside our Azure Active Directory App, and why? [duplicate]
Inside our Azure Active Directory, we have 2 options to secure our calls to the Active Directory App:
Secret
Certificate
Which option is more secure and why? Inside our applications which will be ...
0
votes
0
answers
53
views
Is Self-Signed certificate sufficient for Production environments exposed to the Internet to secure our Azure Function
We have created an Azure Function which runs on a scheduled basis to update Sharepoint Online sites (each 10 minutes).
Now for this Azure Function to integrate with SharePoint, we have created an ...
1
vote
1
answer
68
views
Azure Shared Access Signature (SAS) token security
I'm learning Azure Storage and I am doing my best to make sure access from Internet is as safe as possible.
When I generate a connection string there is a SAS token embedded in the URL.
That token has ...
- 173
1
vote
1
answer
45
views
How SSO with OpenID and Azure AD works?
I try to understand how the integration we are using with OpenID works. I have read documents and different websites, but I feel that something escapes me related with SSO - I didn´t find so much ...
- 113
0
votes
1
answer
47
views
Secret security in containerised environment
I've been having a discussion with a developer about storing sensitive information in environment variables. Specifically within a containerised environment such as Azures Container apps.
Background ...
- 123
0
votes
0
answers
152
views
How do you automatically update analytic rule templates on Sentinel?
The Microsoft analytics rule templates get updates from time to time to include additional constraints within their KQL. Currently I'm manually updating each of the rule templates that have been ...
- 41
1
vote
1
answer
42
views
How do I remove malware with Defender for Cloud Apps?
I'm new to the role and my operational analyst left a few days before I started, I'm his manager, now it's just me. I'm familiar with the tooling but have never had to operate it myself.
I've had an ...
- 113
0
votes
0
answers
23
views
Threats for static webpage or read-only APIs
We have requirement for webpage (similar to this) that need to be available to anonymous public user. The webpage is static and contains spatial information that are updated by backend server. There ...
0
votes
0
answers
76
views
How can I request a certificate from an internal CA if my machine is Azure AD joined?
I'm using Ghostpak's Certify to discover vulnerable certificate templates on an internal certificate authority named certauth.megacorp.local. I've found a vulnerable template and was successfully able ...
1
vote
2
answers
473
views
OAuth2 - What is the advantage of using certificate over client secret credentials? (Azure)
When using OAuth2 in Azure, why Certificates are more secure than using Secrets?
The Secrets have expiration and are strong, and generated automatically.
The application needs to send a JWT containing ...
- 111
0
votes
0
answers
215
views
Change default classification label (Azure Information Protection) in Microsoft Office (Outlook, Word, Excel) by user
We have Azure Information Protection (AIP) configured for our organisation, we have 4 labels defined (public, internal, confidential, secret). The default label set for the organization is to "...
- 1
0
votes
0
answers
18
views
Is my perception of improved security by restricting access to an MS365 tenant/associated apps on per-device basis misguided? Why?
Receiving guidance from a contractor that restricting unknown devices (regardless of MFA, location, etc.) to an Azure tenant does not improve security in any meaningful way, and just creates a ...
- 93
1
vote
0
answers
90
views
Intercept API calls of powershell module
I am looking at a way to intercept the API call made by the AzureAD powershell module. Wireshark is not able to decrypt the TLS packets sent and I'd also like to work with the HTTP requests rather ...
- 11
0
votes
0
answers
187
views
Best way to encrypt client side data for SaaS inside the web
I am planning a SaaS-solution, where my clients store and save sensitive data on my servers.
Security is a big point as it makes a product more trustworthy, so my thought was that the data which I ...
0
votes
1
answer
687
views
What would be the best way to mitigate Azure Application Gateway WAF False Positive?
We have a Web API which uses the REST semantics and is protected using the Azure's Application Gateway using a Web Application Firewall. The Web App consuming this API can send in any type of data in ...
- 228
0
votes
0
answers
286
views
Azure WAF support for OData
I have noticed some of the OWASP rules from Azure WAF are rejecting OData default filtered such as $select, suspecting it to be SQL injection. How can you handle the nature of OData from Azure WAF?
1. ...
- 101
0
votes
1
answer
327
views
Does "validating" a JWT token from prove authentication with OpenId?
I have a static react app which users login via an Okta SPA app.
The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request.
...
- 143
0
votes
1
answer
195
views
How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?
I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory
Application is using the below details in-...
- 149
34
votes
4
answers
11k
views
Is serverless code immune to DDoS attacks?
In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
- 684
0
votes
1
answer
122
views
Storing client keys in cloud app
I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
1
vote
4
answers
141
views
Ingress client certificate authenticate requires CA certificate to be stored in secret?
I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
- 113
1
vote
0
answers
101
views
Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?
I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow.
Now, every user must enter an e-...
- 2,183
2
votes
1
answer
581
views
How to restrict access to API in Azure API Management to known applications?
We need to create an API in Azure API Management and allow only known, registered applications to call it. We can require authentication, which restricts access to only people in our AAD, but how can ...
- 121
0
votes
2
answers
1k
views
Requesting an SSL certificate without a CSR, can it be done?
Please excuse me if this is a dumb or obvious question, I'm self taught and have not been able to find an exact answer to my question after much Googling and reading through StacEx!
I'm having issues ...
- 103
1
vote
1
answer
254
views
Why if a server response contain both Public: TRACE and Allow: TRACE then responds with 405 NOT allowed?
SCENARIO:
I'm testing a web application. To test if TRACE is enabled I used both
nmap --script http-methods target.com
and
curl -k -i -X OPTIONS target.com
After running the former I get
443/tcp ...
- 557
0
votes
1
answer
306
views
Azure Ad B2C Users access resources in other directory
I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
1
vote
2
answers
203
views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
- 237
7
votes
1
answer
5k
views
Should I consider my Azure tenant ID as a secret?
As the title says: Should I consider my Azure tenant ID (GUID) as a secret? Are there any security implications when someone knows about this id?
- 305
23
votes
2
answers
4k
views
How critical is encryption-at-rest for public cloud hosted systems?
I work as a solutions architect for web-based systems on AWS. As part of this role, I often respond to Information Security questionnaires. Nearly all questionnaires request information about data ...
- 355
2
votes
1
answer
571
views
Is it safe to expose port 22 on a database VM? [closed]
I have seen many answers to this question in different scenarios but I am still unsure of the actual answer.
I have a VM in the cloud (Azure), which will be hosting my production database. Is it safe ...
- 123
1
vote
1
answer
2k
views
Wrap key operation in Azure Key Vault - symmetric keys
Could anyone explain why the bolded part of the wrap key description?
Wraps a symmetric key using a specified key. The WRAP operation
supports encryption of a symmetric key using a key encryption key ...
- 113
1
vote
2
answers
804
views
How often should we force users to re-authenticate when not on the network?
Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
- 19
1
vote
1
answer
298
views
Security pattern for third party uploads to Azure blob container
Scenario:
Vendor 1 needs to upload data (.json, compressed .csv files, images and video) to an Azure blob storage container owned by Vendor 2
Vendor 1 is issued a limited duration SAS token each day ...
- 113
2
votes
1
answer
305
views
How to prevent azure pipelines (yaml) from being used as an attack vector?
Let's say the following scenario exists:
A git repository exists on Azure DevOps Repos.
The repository uses yaml pipelines (azure-pipelines.yml).
The repository has branch policies to ensure that ...
- 121
0
votes
1
answer
145
views
Is there a current best practice for authorizing an SPA to get/post to API
I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so.
It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
- 103
3
votes
4
answers
2k
views
How do I configure Azure Web Apps so that the only access is via CloudFlare?
I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare.
I added Azure Security Center to my subscription.
At the moment one can access the ...
- 281
2
votes
0
answers
84
views
IPS solution for a medium sized web application
As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
- 1,442
44
votes
9
answers
9k
views
I have just 4 hours a month to security check a cloud based application - How to use my time?
I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month.
I essentially have half a workday to secure this application / keep it secure. What is an ...
- 1,005
0
votes
1
answer
149
views
What protocol is NPS server using to send Secondary Auth to Azure MFA?
We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
- 21
3
votes
1
answer
310
views
Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?
Why can any application or user on your server type an insecure URL like these to get server information about that instance?
http://instance-data.us-east-1.compute.internal/latest/meta-data/
http://...
- 995
0
votes
0
answers
96
views
Security and distro list naming convention in AAD
Most naming convention standards for Active Directory I have come across so far have security groups starting with an underscore to allow the equivalent distribution list to be user-friendly.
I am ...
- 73
1
vote
1
answer
125
views
RDP to Azure VMs through public IP versus VPN
I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.
I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
- 181
1
vote
1
answer
474
views
What are the benefits of using Nessus in addition to Azure Security Center?
Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management?
Or does it have any ...
- 31
4
votes
1
answer
181
views
Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?
Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
- 43
0
votes
1
answer
140
views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
- 143
0
votes
0
answers
169
views
Azure AD -- How to only allow MFA configuration from a trusted network?
Hopefully someone as an idea...
In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0
answers
464
views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
- 11
2
votes
0
answers
404
views
RFC 5280 compliant certificate with x509 extensions
First time posting here, be gentle.
Situation:
I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
3
votes
1
answer
319
views
Azure publicly exposed resources
Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
- 53
0
votes
0
answers
1k
views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
- 1