Questions tagged [azure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
37 views

How to prevent azure pipelines (yaml) from being used as an attack vector?

Let's say the following scenario exists: A git repository exists on Azure DevOps Repos. The repository uses yaml pipelines (azure-pipelines.yml). The repository has branch policies to ensure that ...
0
votes
1answer
43 views

Is there a current best practice for authorizing an SPA to get/post to API

I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so. It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
0
votes
0answers
3 views

Configuring Azure Console for _external_ authentication/SSO/IdP? [migrated]

I'm looking for pointers on how to configure Azure "IAM" to trust an external IdP/Authentication server.... but finding my way around the docs for Azure which is... not easy. Help would be more than ...
0
votes
0answers
29 views

Risk of having Azure Multi Site-To-Site VPN with different client

My company decided to build an ETL server on Azure and share by multiple client. My task is to research on possibility to set up multiple VPN tunnel from cloud to multiple client office network. I ...
0
votes
0answers
188 views

CORS issue with WebApp on Azure + AAD

I would like to get some experts' advice regarding the way I resolved the following issue: Let's say my personal app is hosted as an Azure App Service on https://example.azurewebsites.net The JS ...
2
votes
4answers
255 views

How do I configure Azure Web Apps so that the only access is via CloudFlare?

I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare. I added Azure Security Center to my subscription. At the moment one can access the ...
0
votes
0answers
52 views

Could using the azure storage account access_key_name to in databricks notebook be considered best practise?

Currently, we are using key_name mentioned in the below code to access the blob storage in azure from databricks notebooks. We aren't directly using the 512 bit access key value from the azure storage ...
0
votes
0answers
16 views

What is the security justification for blocking all outbound ports/protocols except HTTP over 80/443? [duplicate]

My companies IT blocks all outbound traffic except HTTP, preventing me from getting work done at the office (I often need to work on Azure SQL databases which require TCP over port 1433). I can get ...
2
votes
0answers
42 views

IPS solution for a medium sized web application

As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
44
votes
9answers
8k views

I have just 4 hours a month to security check a cloud based application - How to use my time?

I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month. I essentially have half a workday to secure this application / keep it secure. What is an ...
0
votes
0answers
24 views

Encrypted Container for Azure WebApps

I am considering moving an application - which currently sits on a Bitlocker-encrypted Windows Server - to a Microsoft Azure WebApps Linux Container. As far as I understand, encryption of the ...
0
votes
0answers
34 views

Azure AD - Guest user SSO to RDP

We have two Azure subscription, (1) of the parent company where all the users live in Azure AD (synchronised from on premises AD), and (2) that holds the 365 apps which are dedicated to our company. ...
0
votes
1answer
57 views

What protocol is NPS server using to send Secondary Auth to Azure MFA?

We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
0
votes
0answers
158 views

What is the best practice to run Openvas on Azure?

I have created a Kali VM on Azure to use for my pentesting engagement. I was able to access Openvas GM from my desktop, however I could not log in the GM even though I reset my GM password again and ...
0
votes
0answers
17 views

Server to server- local account or IdP?

For an organisation I work with, the policy for internally developed applications has been to use AD accounts for running services or service integrations (their AD is full of SA_AppName_purpose). ...
3
votes
1answer
187 views

Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?

Why can any application or user on your server type an insecure URL like these to get server information about that instance? http://instance-data.us-east-1.compute.internal/latest/meta-data/ http://...
0
votes
0answers
29 views

Security and distro list naming convention in AAD

Most naming convention standards for Active Directory I have come across so far have security groups starting with an underscore to allow the equivalent distribution list to be user-friendly. I am ...
0
votes
0answers
68 views

Is it safe to share an Azure SAS token with an untrusted client?

We need to host files in Azure Blob Store, and allow access to end users to their generated "statements"(pdf) for a short period of time. We're considering achieving this by generating a short-lived ...
0
votes
0answers
20 views

Cloud IAM solutions- internal and external users

From the cloud IAM solutions, I am only familiar with Azure AD where there is a differentiation between Members and Guests. Members would be internal users (i.e. synchronised from Active Directory) ...
0
votes
0answers
107 views

Azure AD subdomains best practice

I'm setting up an Azure AD subscription for a small retailer with 3 branches and a headquarters (100s of users in each). The branches are self-sufficient and intend to manage their own users. Users ...
0
votes
0answers
26 views

Azure Security Policy for Azure Analysis Service

I have been working to build an Azure Security policy for Azure Analysis Services. First off, I cannot find one mention or sample code and I am unable to get any of my policies to work correctly. Is ...
1
vote
1answer
48 views

RDP to Azure VMs through public IP versus VPN

I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN. I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
1
vote
1answer
148 views

What are the benefits of using Nessus in addition to Azure Security Center?

Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management? Or does it have any ...
2
votes
1answer
36 views

Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?

Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
0
votes
1answer
87 views

Does Azure Key-Vault encrypt the values before storing?

We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
0
votes
0answers
52 views

Securing Vue App in .NET MVC page

We have a .NET MVC app which requires authentication in order to see any pages within the site. Users are directed to Azure Active Directory to authenticate and the flow returns them to the MVC app ...
0
votes
0answers
58 views

What is the best way to secure web API calls from worker apps running on Windows

I have a particular problem on how to securely call web APIfrom machines that do automated data collection on documents. The computers that run code are Windows machines and the server is a Kubernetes ...
1
vote
0answers
17 views

What would happen to the connection when certificate expires? [duplicate]

We are using X509 certificate to connect between on-premise devices to the cloud services (Device provisioning service from Azure) The expiry date of the certificate is 3 years from now. Once the ...
0
votes
0answers
44 views

Azure AD — How to only allow MFA configuration from a trusted network?

Hopefully someone as an idea... In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0answers
134 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
2
votes
0answers
128 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
3
votes
1answer
73 views

Azure publicly exposed resources

Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
42 views

What is the default cipher for SSL connections in Azure for MariaDB?

According to Microsoft's Documentation, Azure should be configured to use SSL for connections. In regards to default settings, they state the following: By default, the database service should be ...
0
votes
0answers
470 views

Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?

I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services. Edit: We are a school and the application's host 4000+ parent and student ...
4
votes
1answer
234 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
108 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
1
vote
1answer
119 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
0
votes
1answer
256 views

How do I protect the Azure Client ID and Client Secret in HashiCorp Vaults with AKV Auto-Unseal?

Say I set up a HashiCorp Vault, on dedicated hardware, with an AKV seal stanza like the following: seal "azurekeyvault" { tenant_id = "46646709-b63e-4747-be42-516edeaf1e14" client_id = "...
1
vote
0answers
105 views

Building upon SOC 2 Compliance of hosting provider

We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
2
votes
2answers
342 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
1
vote
1answer
205 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...
2
votes
1answer
37 views

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
1
vote
0answers
40 views

How to protect against rogue malicious applications in the Azure AD?

Consider the following hypothetical scenario: I create the PhotoApp - native Android application that is used by users to manage their private photos. I create the PhotoService - Web API that is ...
1
vote
1answer
87 views

How is AWS app identity verified?

So I get the notion of roles and service-linked roles and policies in AWS. However, all of that works only if the principal/identity (and I know there's a difference between the two, but using either ...
4
votes
5answers
1k views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
2
votes
0answers
144 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
0
votes
1answer
820 views

Detect and Scan Open Ports

I am trying to understand two questions - I run Qualys/Nessus scans on periodic basis in our Azure/AWS environment and always run into issues while detecting for Open ports, A basic nmap scan would ...
3
votes
1answer
6k views

Approach to (nmap?) port scan a subnet over VPN? (updated with figure)

I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server. I want to do a port scan, indicated by the red arrow. The ...
1
vote
3answers
80 views

Protecting a private key on Azure

Is there a way on Azure to protect a private key so only I have the key? No one else can get the key? I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
0answers
61 views

What current methods are there to gain access to Azure?

I'm currently working with our development teams and trying to build a threat model for the Azure environment and how attackers may gain access to our instance. So far I haven't found much in the way ...