Questions tagged [azure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
21 views

Is it safe to share an Azure SAS token with an untrusted client?

We need to host files in Azure Blob Store, and allow access to end users to their generated "statements"(pdf) for a short period of time. We're considering achieving this by generating a short-lived ...
0
votes
0answers
17 views

Cloud IAM solutions- internal and external users

From the cloud IAM solutions, I am only familiar with Azure AD where there is a differentiation between Members and Guests. Members would be internal users (i.e. synchronised from Active Directory) ...
0
votes
0answers
33 views

Azure AD subdomains best practice

I'm setting up an Azure AD subscription for a small retailer with 3 branches and a headquarters (100s of users in each). The branches are self-sufficient and intend to manage their own users. Users ...
0
votes
0answers
22 views

Azure Security Policy for Azure Analysis Service

I have been working to build an Azure Security policy for Azure Analysis Services. First off, I cannot find one mention or sample code and I am unable to get any of my policies to work correctly. Is ...
1
vote
1answer
35 views

RDP to Azure VMs through public IP versus VPN

I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN. I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
1
vote
1answer
73 views

What are the benefits of using Nessus in addition to Azure Security Center?

Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management? Or does it have any ...
2
votes
1answer
29 views

Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?

Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
0
votes
1answer
73 views

Does Azure Key-Vault encrypt the values before storing?

We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
0
votes
0answers
29 views

Securing Vue App in .NET MVC page

We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
0
votes
0answers
57 views

What is the best way to secure web API calls from worker apps running on Windows

I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
1
vote
0answers
17 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
0
votes
0answers
33 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0answers
54 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
2
votes
0answers
41 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
1
vote
0answers
36 views

Azure publicly exposed resources

Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
38 views

What is the default cipher for SSL connections in Azure for MariaDB?

According to Microsoft's Documentation, Azure should be configured to use SSL for connections. In regards to default settings, they state the following: By default, the database service should be ...
0
votes
0answers
61 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
0
votes
0answers
236 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
39 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
4
votes
1answer
129 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
69 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
65 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
0
votes
1answer
152 views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...
1
vote
0answers
97 views

Building upon SOC 2 Compliance of hosting provider

We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
2answers
218 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
1
vote
1answer
155 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
1
vote
1answer
36 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
0answers
37 views

How to protect against rogue malicious applications in the Azure AD?

Consider the following hypothetical scenario: I create the PhotoApp - native Android application that is used by users to manage their private photos. I create the PhotoService - Web API that is ...
1
vote
1answer
72 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
4
votes
5answers
848 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
2
votes
0answers
132 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
1answer
670 views

Detect and Scan Open Ports

I am trying to understand two questions - I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
3
votes
1answer
4k views

Approach to (nmap?) port scan a subnet over VPN? (updated with figure)

I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server. I want to do a port scan, indicated by the red arrow. The ...
1
vote
3answers
75 views

Protecting a private key on Azure

Is there a way on Azure to protect a private key so only I have the key? No one else can get the key? I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
0answers
57 views

What current methods are there to gain access to Azure?

I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance. So far I haven't found much in the way ...
1
vote
1answer
53 views

Azure VPN Gateway Client - Reported as Win32/Detplock

When following this official guide to setup an Azure VPN Gateway, the downloaded VPN client application is reported as Win32/Detplock by windows defender. https://docs.microsoft.com/en-us/azure/vpn-...
5
votes
1answer
665 views

Securely Storing Access Tokens for Azure Key Vault

I am using Azure's KEY vault to store encryption keys and handle encryption and decryption as we have a specification that requires encryption keys to be kept offsite, however this has left me with ...
2
votes
1answer
82 views

Can I secure a server on which I'm deliberately allowing code execution?

Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface. Obviously,...
2
votes
2answers
883 views

Strange attempts from Azure IP on our client data

I had to put this case here as Microsoft's answer won't make sense. What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 104.42....
3
votes
0answers
715 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
0
votes
0answers
86 views

Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?

just in short. I was playing around a Azure AppService as I wanted to know how secure it is. I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
0
votes
1answer
41 views

Limiting information disclosed by server

I host a web application on an Ubuntu 14.04 based VM hosted on Microsoft Azure infrastructure. The webserver is nginx. Recently, someone was trying to probe my server, and later correctly surmised ...
3
votes
1answer
151 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
1
vote
0answers
45 views

Encrypt content on Azure without using KeyVault? [duplicate]

Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
4
votes
2answers
187 views

How much information about our Security & Penetration Testing should we share with customers?

We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
0
votes
2answers
474 views

Are there any PCI compliant firewalls that can be installed on Linux through normal means and not through an ISO? [closed]

We are trying to install a PCI compliant firewall on our Azure Vnet. The problem is, that ones like opnsense can only be installed through an iso, having to install it on a local VM and then having to ...
0
votes
2answers
344 views

Is traffic encrypted using IPSec intercepted in transit over public internet, hackable?

In the official Azure documentation describing Azure VPN Gateway, I read this about Site to Site VPN "Though traffic is encrypted using IPSec, it can be intercepted in transit since it traverses ...
10
votes
1answer
381 views

What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?

Azure has different privacy agreements set up with different datacenters as mentioned in this footnote Azure is now available in China through a unique partnership between Microsoft and 21Vianet, ...
28
votes
3answers
3k views

Pentesting against own web service hosted on 3rd party platform

I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
2
votes
2answers
115 views

Migrating IIS to Azure

So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...