Questions tagged [azure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
20 views

Securing Vue App in .NET MVC page

We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
0
votes
0answers
55 views

What is the best way to secure web API calls from worker apps running on Windows

I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
1
vote
0answers
16 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
0
votes
0answers
29 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0answers
33 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
2
votes
0answers
31 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
1
vote
0answers
33 views

Azure publicly exposed resources

Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
32 views

What is the default cipher for SSL connections in Azure for MariaDB?

According to Microsoft's Documentation, Azure should be configured to use SSL for connections. In regards to default settings, they state the following: By default, the database service should be ...
0
votes
0answers
51 views

Usage of a self-signed certificate between Akamai and Azure

First of all, some background of what is proposed: The client's browser initialises request The request is resolved by public DNS (CNAME) to Akamai Edge The request is processed by Akamai accordingly ...
0
votes
0answers
175 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
0
votes
0answers
34 views

Is Azure Key Vault more secure than the machine certificate store?

I'm trying to secure the communication between two on-premise legacy applications (one .NET and one Java) using client certificates. One application is exposed externally so I don't want to rely on ...
4
votes
1answer
117 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
56 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
49 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
0
votes
1answer
128 views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...
1
vote
0answers
88 views

Building upon SOC 2 Compliance of hosting provider

We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
2answers
185 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
1
vote
1answer
128 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
1
vote
1answer
34 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
0answers
37 views

How to protect against rogue malicious applications in the Azure AD?

Consider the following hypothetical scenario: I create the PhotoApp - native Android application that is used by users to manage their private photos. I create the PhotoService - Web API that is ...
1
vote
1answer
71 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
3
votes
5answers
742 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
2
votes
0answers
126 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
1answer
614 views

Detect and Scan Open Ports

I am trying to understand two questions - I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
2
votes
1answer
3k views

Approach to (nmap?) port scan a subnet over VPN? (updated with figure)

I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server. I want to do a port scan, indicated by the red arrow. The ...
1
vote
3answers
74 views

Protecting a private key on Azure

Is there a way on Azure to protect a private key so only I have the key? No one else can get the key? I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
0answers
55 views

What current methods are there to gain access to Azure?

I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance. So far I haven't found much in the way ...
1
vote
1answer
53 views

Azure VPN Gateway Client - Reported as Win32/Detplock

When following this official guide to setup an Azure VPN Gateway, the downloaded VPN client application is reported as Win32/Detplock by windows defender. https://docs.microsoft.com/en-us/azure/vpn-...
5
votes
1answer
622 views

Securely Storing Access Tokens for Azure Key Vault

I am using Azure's KEY vault to store encryption keys and handle encryption and decryption as we have a specification that requires encryption keys to be kept offsite, however this has left me with ...
2
votes
1answer
82 views

Can I secure a server on which I'm deliberately allowing code execution?

Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface. Obviously,...
2
votes
2answers
757 views

Strange attempts from Azure IP on our client data

I had to put this case here as Microsoft's answer won't make sense. What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 104.42....
3
votes
0answers
696 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
0
votes
0answers
83 views

Azure AppService - Configuration vulnerability - Would you also consider this as a vulnerability?

just in short. I was playing around a Azure AppService as I wanted to know how secure it is. I have discovered it is possible (using the regularly deployed application) to write to complete d:\home ...
0
votes
1answer
41 views

Limiting information disclosed by server

I host a web application on an Ubuntu 14.04 based VM hosted on Microsoft Azure infrastructure. The webserver is nginx. Recently, someone was trying to probe my server, and later correctly surmised ...
3
votes
1answer
150 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
1
vote
0answers
43 views

Encrypt content on Azure without using KeyVault? [duplicate]

Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
4
votes
2answers
182 views

How much information about our Security & Penetration Testing should we share with customers?

We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
0
votes
2answers
460 views

Are there any PCI compliant firewalls that can be installed on Linux through normal means and not through an ISO? [closed]

We are trying to install a PCI compliant firewall on our Azure Vnet. The problem is, that ones like opnsense can only be installed through an iso, having to install it on a local VM and then having to ...
0
votes
2answers
343 views

Is traffic encrypted using IPSec intercepted in transit over public internet, hackable?

In the official Azure documentation describing Azure VPN Gateway, I read this about Site to Site VPN "Though traffic is encrypted using IPSec, it can be intercepted in transit since it traverses ...
10
votes
1answer
379 views

What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?

Azure has different privacy agreements set up with different datacenters as mentioned in this footnote Azure is now available in China through a unique partnership between Microsoft and 21Vianet, ...
28
votes
3answers
3k views

Pentesting against own web service hosted on 3rd party platform

I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
2
votes
2answers
112 views

Migrating IIS to Azure

So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
0
votes
1answer
86 views

How should I detect and respond to bad actors who perform SQL injections?

SQL Azure has a logic component called Threat Detection. I assume it looks for SQL Injection, but also evidence of dangerous commands like sp_exec. I would like to expand that scope, and also ...
2
votes
2answers
653 views

Why does an external pentester testing my Azure website ask for IP, Gateway, DNS and VPN credentials?

I have an Azure website and a client who wants to use my site but needs to perform ethical hacking on it in order to decide if it's secure enough for them. They've asked me this to send them this: ...
0
votes
1answer
278 views

Feeding Azure portal logs into a SIEM solution

Currently working on a cloud transformation project where all infrastructure is being placed into Azure. We currently use a SIEM solution to monitor and assess events across the environment. The ...
0
votes
1answer
256 views

Microsoft IP Blocked by my fail2ban

Yesterday at 3AM our Fail2ban blocked an IP, not tremendously uncommon, however it appears to relate back to a Microsoft address. This could perhaps be an Azure server being used for the abuse. My ...
0
votes
1answer
425 views

Robots trying to login to Azure VM when SSH port is closed in manager

I have many robots trying to do SSH login in a Azure VM. In the resource manager SSH is disabled but attacker IPs are public, as you can see below, where I copy a log for auth.log (I have an Ubuntu ...
4
votes
1answer
2k views

Azure AD B2C vs Auth0 [closed]

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison?...
1
vote
2answers
157 views

Azure Networking VPN

Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources ...
4
votes
2answers
844 views

Azure Key Vault vs Azure Environment Variables - Which is the right way?

I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...