Questions tagged [azure]
A cloud computing platform offered by Microsoft.
110
questions
0
votes
0answers
23 views
How dangerous is a leaked private key from outside the infrastructure in context of: "Azure Active Directory keyCredential property Disclosure?"
Microsoft published the Guidance for Azure Active Directory (AD) keyCredential property Information Disclosure in Application and Service Principal APIs which describes how to check if an Azure AD is ...
0
votes
0answers
31 views
New rule on verifying domain for azureAD app registration
ref:
https://docs.microsoft.com/en-us/azure/active-directory/develop/reference-breaking-changes#appid-uri-in-single-tenant-applications-will-require-use-of-default-scheme-or-verified-domains
We setup ...
0
votes
0answers
32 views
Is using SSL/TLS Termination insecure in Azure with Private Endpoints
Azure documentation mentions using SSL termination at app gateways to offload app services from some overhead. This sounds like a good idea, but then traffic will be unencrypted when travelling from ...
0
votes
0answers
55 views
Is it possible to prevent Kerbrute from unauthenticated user enumation Active Directory?
Currently looking for a way to prevent unauthenticated user enumeration on a Domain Controller. This is a security precaution I'd like to implement, next to the existing measures taken prevent ...
0
votes
0answers
36 views
What type of breach is occurring with Puppeteer.js on this Azure hosted webapp? (Snapshot provided)
When running the screenshot.js on https://try-puppeteer.appspot.com/, a web based Puppeteer.js I the image produced was of a gaming/gambling website, not my website at all!
My site was https://...
0
votes
1answer
61 views
Does "validating" a JWT token from prove authentication with OpenId?
I have a static react app which users login via an Okta SPA app.
The app receives a JWT, which it is stored in the browser, and passed to the backend API via Authentication header on every request.
...
0
votes
0answers
59 views
Using SMIME with Azure Information Protection and OME
As far as I know, SMIME encryption is more user-friendly than AIP, but there is the need to know the recipients public key (well, and even the need for them to have a public key).
I would like to ...
0
votes
0answers
27 views
MFA and developer access
How do we give access to some APIs with different levels of security?
I'm currently at a company where we have established a set of approved patterns of external exposure. In practice this means that ...
0
votes
0answers
47 views
Is there a way to bypass Azure AD when iframing a website?
I'm currently doing a dynamic security evaluation on a website using Azure AD for login. Initial scans show that the X-frame options header is not set. Obviously, this will be reported at the very ...
0
votes
0answers
49 views
Nitro Enclave / KMS Equivalent for Google and Azure
In AWS KMS I can set a key policy on a CMK so that it can only be used from within a Nitro Enclave that either has a particular signature or a particular image hash. Is there something similar to this ...
0
votes
1answer
83 views
How to mitigate risk of spoofing / Impersonating in OAuth Device flow ( device code flow ) in Azure AD?
I have developed C# application and hosted it as a windows service on a machine http://localhost:5000 . This application registered in `Azure Active Directory
Application is using the below details in-...
0
votes
0answers
113 views
Does azurevpnconfig (Azure) contain security-relevant information?
I created a new VPN gateway inside my Azure environment (OpenVPN SSL with AD authentication).
After that, I downloaded the profile/config file which contains azurevpnconfig.
With this file, the ...
0
votes
0answers
52 views
Azure Impossible Travel
So I am trying to hammer out the best process of handling impossible travel alerts and suspicious VPN activity.
In my current environment I dont have admin privileges to immediately disable user ...
34
votes
4answers
10k views
Is serverless code immune to DDoS attacks?
In classic hosting we have a virtual machine with limited resources allocated by hosting provider for running our web application. But with serverless code such as AWS Lambda or Azure Functions, our ...
0
votes
1answer
84 views
Storing client keys in cloud app
I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
0
votes
4answers
76 views
Ingress client certificate authenticate requires CA certificate to be stored in secret?
I want to enable client-certificate authentication in my AKS cluster and I have a basic question which I just don't seem to understand. As per the docs, ingress requires the CA certificate to be ...
0
votes
0answers
41 views
SQL Column encryption can be part of Data at Rest?
I have a SQL database and I have enabled the Always Encrypted feature. Can I claim that Data at Rest is fulfilled? or do I have to secure the backup files using certificates to claim that our database ...
1
vote
0answers
36 views
Should I consider migrating away from OAuth 2.0 Implicit Flow for an internal application relying on Azure AD?
I have recently migrated an internal application (API + SPA) security from Windows Authentication (done by IIS) to Azure A/D authentication using the implicit flow.
Now, every user must enter an e-...
2
votes
1answer
171 views
How to restrict access to API in Azure API Management to known applications?
We need to create an API in Azure API Management and allow only known, registered applications to call it. We can require authentication, which restricts access to only people in our AAD, but how can ...
0
votes
0answers
153 views
What are the benefits of using Azure RMS with DKE instead of BYOK/HYOK?
I'm trying to understand the Azure RMS solution. From my understanding, files are encrypted with a symmetric key, and that symmetric key + access policies are encrypted using the company key.
The ...
0
votes
2answers
376 views
Requesting an SSL certificate without a CSR, can it be done?
Please excuse me if this is a dumb or obvious question, I'm self taught and have not been able to find an exact answer to my question after much Googling and reading through StacEx!
I'm having issues ...
1
vote
1answer
111 views
Why if a server response contain both Public: TRACE and Allow: TRACE then responds with 405 NOT allowed?
SCENARIO:
I'm testing a web application. To test if TRACE is enabled I used both
nmap --script http-methods target.com
and
curl -k -i -X OPTIONS target.com
After running the former I get
443/tcp ...
0
votes
1answer
149 views
Azure Ad B2C Users access resources in other directory
I have two directories in Azure. The first one contains all the customers of our company, who are registered in Azure Ad B2C. These users must be separated from the other directory, which contains ...
1
vote
1answer
72 views
Verifying the security of SAML SSO
I run an instance of a log aggregation product in the cloud, installed on a VM. I've strictly configured it's networking settings, internal firewall, internal port redirection, strong admin password, ...
4
votes
1answer
1k views
Should I consider my Azure tenant ID as a secret?
As the title says: Should I consider my Azure tenant ID (GUID) as a secret? Are there any security implications when someone knows about this id?
22
votes
2answers
4k views
How critical is encryption-at-rest for public cloud hosted systems?
I work as a solutions architect for web-based systems on AWS. As part of this role, I often respond to Information Security questionnaires. Nearly all questionnaires request information about data ...
1
vote
1answer
201 views
Is it safe to expose port 22 on a database VM? [closed]
I have seen many answers to this question in different scenarios but I am still unsure of the actual answer.
I have a VM in the cloud (Azure), which will be hosting my production database. Is it safe ...
0
votes
1answer
753 views
Wrap key operation in Azure Key Vault - symmetric keys
Could anyone explain why the bolded part of the wrap key description?
Wraps a symmetric key using a specified key. The WRAP operation
supports encryption of a symmetric key using a key encryption key ...
0
votes
1answer
396 views
How often should we force users to re-authenticate when not on the network?
Our company has rolled out MFA to our users. We are a Microsoft shop, so we are using Azure AD to handle MFA and authentication to things like email, Teams, Sharepoint, etc. By default, we've disabled ...
1
vote
1answer
163 views
Security pattern for third party uploads to Azure blob container
Scenario:
Vendor 1 needs to upload data (.json, compressed .csv files, images and video) to an Azure blob storage container owned by Vendor 2
Vendor 1 is issued a limited duration SAS token each day ...
2
votes
1answer
174 views
How to prevent azure pipelines (yaml) from being used as an attack vector?
Let's say the following scenario exists:
A git repository exists on Azure DevOps Repos.
The repository uses yaml pipelines (azure-pipelines.yml).
The repository has branch policies to ensure that ...
0
votes
1answer
80 views
Is there a current best practice for authorizing an SPA to get/post to API
I have an API and an SPA. The SPA is all anonymous but I want to ensure the caller of the API is authorized to do so.
It seems that all of the OAuth best practices, e.g. PKCE, depend on a user ...
2
votes
4answers
1k views
How do I configure Azure Web Apps so that the only access is via CloudFlare?
I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare.
I added Azure Security Center to my subscription.
At the moment one can access the ...
2
votes
0answers
54 views
IPS solution for a medium sized web application
As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment....
44
votes
9answers
8k views
I have just 4 hours a month to security check a cloud based application - How to use my time?
I've been tasked with looking after an application deployed to azure. I have been allocated 4 hours a month.
I essentially have half a workday to secure this application / keep it secure. What is an ...
0
votes
1answer
98 views
What protocol is NPS server using to send Secondary Auth to Azure MFA?
We are using PAP to pass data between our on-prem VMware and on-prem NPS server. But our on-prem NPS Server passes data to Azure MFA in the cloud. I want to ensure a stronger protocol than PAP is ...
3
votes
1answer
247 views
Why isn't cloud (AWS, Azure, GCP) metadata served over HTTPS?
Why can any application or user on your server type an insecure URL like these to get server information about that instance?
http://instance-data.us-east-1.compute.internal/latest/meta-data/
http://...
0
votes
0answers
58 views
Security and distro list naming convention in AAD
Most naming convention standards for Active Directory I have come across so far have security groups starting with an underscore to allow the equivalent distribution list to be user-friendly.
I am ...
1
vote
1answer
85 views
RDP to Azure VMs through public IP versus VPN
I have two options for remoting into our Azure VMs: RDP to public IP or RDP through VPN.
I'm certain using a VPN is 'more' secure. But my question is: Is it still reasonably secure to have a hole in ...
1
vote
1answer
355 views
What are the benefits of using Nessus in addition to Azure Security Center?
Are there any benefits to using vulnerability scanners such as Nessus Pro or Tenable.io, if we are already using Azure Security Center for vulnerability and update management?
Or does it have any ...
4
votes
1answer
110 views
Does FedRAMP apply to the cloud hosting environment, the software being hosted, or both?
Our company is limited to using products that maintain FedRAMP compliance, and we are looking to implement a new data collection tool. We are interested in a product that utilizes Microsoft Azure, ...
0
votes
1answer
106 views
Does Azure Key-Vault encrypt the values before storing?
We are using key-vault for storing the secrets, will it give any added advantage if we encrypt the values before storing it in key-vault?
0
votes
0answers
89 views
Azure AD -- How to only allow MFA configuration from a trusted network?
Hopefully someone as an idea...
In Azure AD, how can we allow MFA setup by a user but only allow that configuration to occur on a trusted network? We have trusted networks defined but everything we ...
1
vote
0answers
335 views
Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?
I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
2
votes
0answers
288 views
RFC 5280 compliant certificate with x509 extensions
First time posting here, be gentle.
Situation:
I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
3
votes
1answer
106 views
Azure publicly exposed resources
Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
70 views
What is the default cipher for SSL connections in Azure for MariaDB?
According to Microsoft's Documentation, Azure should be configured to use SSL for connections.
In regards to default settings, they state the following:
By default, the database service should be ...
0
votes
0answers
958 views
Azure AD Application Proxy Security Concerns + Azure Application Gateway (WAF) Better?
I am still new to security and still learning the basics so was interested in getting some feedback on two Azure services.
Edit: We are a school and the application's host 4000+ parent and student ...
4
votes
1answer
316 views
What is the security concerns of AzureAD?
We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
2
votes
1answer
171 views
Is re-prompting a user for credentials an effective measure to prove a user's identify
I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
