Questions tagged [azure]
The azure tag has no usage guidance.
81
questions
0
votes
0answers
21 views
Is it safe to share an Azure SAS token with an untrusted client?
We need to host files in Azure Blob Store, and allow access to end users to their generated "statements"(pdf) for a short period of time.
We're considering achieving this by generating a short-lived ...
0
votes
0answers
17 views
Cloud IAM solutions- internal and external users
From the cloud IAM solutions, I am only familiar with Azure AD where there is a differentiation between Members and Guests. Members would be internal users (i.e. synchronised from Active Directory) ...
0
votes
0answers
33 views
Azure AD subdomains best practice
I'm setting up an Azure AD subscription for a small retailer with 3 branches and a headquarters (100s of users in each). The branches are self-sufficient and intend to manage their own users. Users ...
0
votes
0answers
22 views
Azure Security Policy for Azure Analysis Service
I have been working to build an Azure Security policy for Azure Analysis Services. First off, I cannot find one mention or sample code and I am unable to get any of my policies to work correctly. Is ...
1
vote
1answer
35 views
RDP to Azure VMs through public IP versus VPN
I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.
I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
1
vote
1answer
73 views
What are the benefits of using Nessus in addition to Azure Security Center?
Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management?
Or does it have any ...
2
votes
1answer
29 views
Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?
Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
0
votes
1answer
73 views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
0
votes
0answers
29 views
Securing Vue App in .NET MVC page
We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
0
votes
0answers
57 views
What is the best way to secure web API calls from worker apps running on Windows
I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
1
vote
0answers
17 views
What would happen to the connection when certificate expires? [duplicate]
We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure)
The expiry date of the certificate is 3 years from now.
Once the ...
0
votes
0answers
33 views
Azure AD — How to only allow MFA configuration from a trusted network?
Hopefully someone as an idea...
In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0answers
54 views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
2
votes
0answers
41 views
RFC 5280 compliant certificate with x509 extensions
First time posting here, be gentle.
Situation:
I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
1
vote
0answers
36 views
Azure publicly exposed resources
Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
38 views
What is the default cipher for SSL connections in Azure for MariaDB?
According to Microsoft's Documentation, Azure should be configured to use SSL for connections.
In regards to default settings, they state the following:
By default, the database service should be ...
0
votes
0answers
61 views
Usage of a self-signed certificate between Akamai and Azure
First of all, some background of what is proposed:
The client's browser initialises request
The request is resolved by public DNS (CNAME) to Akamai Edge
The request is processed by Akamai accordingly
...
0
votes
0answers
236 views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
39 views
Is Azure Key Vault more secure than the machine certificate store?
I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
4
votes
1answer
129 views
What is the security concerns of AzureAD?
We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
69 views
Is re-prompting a user for credentials an effective measure to prove a user's identify
I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
65 views
Permissions for Azure OMS Agent files
I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
0
votes
1answer
152 views
How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?
Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following:
seal "azurekeyvault" {
tenant_id = "46646709-b63e-4747-be42-516edeaf1e14"
client_id = "...
1
vote
0answers
97 views
Building upon SOC 2 Compliance of hosting provider
We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
2answers
218 views
How are stateless firewalls useful in public cloud platforms?
I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
1
vote
1answer
155 views
Are Self-Encrypting Drives (SEDs) used in cloud environments?
I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS?
And if so, what additional protection do they offer beside from physical theft of the ...
1
vote
1answer
36 views
Block AzureRM PowerShell Module
Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
0answers
37 views
How to protect against rogue malicious applications in the Azure AD?
Consider the following hypothetical scenario:
I create the PhotoApp - native Android application that is used by users to manage their private photos.
I create the PhotoService - Web API that is ...
1
vote
1answer
72 views
How is AWS app identity verified?
So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
4
votes
5answers
848 views
Cloud provider for Penetration Testing
I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests.
The issue I am having is finding a cloud provider such as AWS, Azure etc. for this.
For AWS they ...
2
votes
0answers
132 views
Web application making a call to a REST API when already authenticated
I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
1answer
670 views
Detect and Scan Open Ports
I am trying to understand two questions -
I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
3
votes
1answer
4k views
Approach to (nmap?) port scan a subnet over VPN? (updated with figure)
I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server.
I want to do a port scan, indicated by the red arrow. The ...
1
vote
3answers
75 views
Protecting a private key on Azure
Is there a way on Azure to protect a private key so only I have the key? No one else can get the key?
I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
0answers
57 views
What current methods are there to gain access to Azure?
I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance.
So far I haven't found much in the way ...
1
vote
1answer
53 views
Azure VPN Gateway Client - Reported as Win32/Detplock
When following this official guide to setup an Azure VPN Gateway, the downloaded VPN client application is reported as Win32/Detplock by windows defender.
https://docs.microsoft.com/en-us/azure/vpn-...
5
votes
1answer
665 views
Securely Storing Access Tokens for Azure Key Vault
I am using Azure's KEY vault to store encryption keys and handle encryption and decryption as we have a specification that requires encryption keys to be kept offsite, however this has left me with ...
2
votes
1answer
82 views
Can I secure a server on which I'm deliberately allowing code execution?
Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface.
Obviously,...
2
votes
2answers
883 views
Strange attempts from Azure IP on our client data
I had to put this case here as Microsoft's answer won't make sense.
What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 104.42....
3
votes
0answers
715 views
Are enterprises Office 365 accounts overly exposed to brute force attacks?
Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”.
...
0
votes
0answers
86 views
Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?
just in short. I was playing around a Azure AppService as I wanted to know how secure it is.
I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
0
votes
1answer
41 views
Limiting information disclosed by server
I host a web application on an Ubuntu 14.04 based VM hosted on Microsoft Azure infrastructure. The webserver is nginx. Recently, someone was trying to probe my server, and later correctly surmised ...
3
votes
1answer
151 views
How does the use of Microsoft-branded Azure products affect my privacy policy?
I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc).
...
1
vote
0answers
45 views
Encrypt content on Azure without using KeyVault? [duplicate]
Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
4
votes
2answers
187 views
How much information about our Security & Penetration Testing should we share with customers?
We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
0
votes
2answers
474 views
Are there any PCI compliant firewalls that can be installed on Linux through normal means and not through an ISO? [closed]
We are trying to install a PCI compliant firewall on our Azure Vnet. The problem is, that ones like opnsense can only be installed through an iso, having to install it on a local VM and then having to ...
0
votes
2answers
344 views
Is traffic encrypted using IPSec intercepted in transit over public internet, hackable?
In the official Azure documentation describing Azure VPN Gateway, I read this about Site to Site VPN
"Though traffic is encrypted using IPSec, it can be intercepted in
transit since it traverses ...
10
votes
1answer
381 views
What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?
Azure has different privacy agreements set up with different datacenters as mentioned in this footnote
Azure is now available in China through a unique partnership between Microsoft and 21Vianet, ...
28
votes
3answers
3k views
Pentesting against own web service hosted on 3rd party platform
I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
2
votes
2answers
115 views
Migrating IIS to Azure
So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
