Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [azure]

The tag has no usage guidance.

28
votes
3answers
3k views

Pentesting against own web service hosted on 3rd party platform

I want to pentest websites and services programmed by our company, which is fine as long as we test it on our own infrastructure. What are the (legal) implications when pentesting our services once ...
15
votes
4answers
6k views

How do the STS token formats compare to each other SAML vs SWT vs JWT?

I'm configuring an Azure ACS STS and would like to know if there is any impact on security based on the following token formats or how they are used. The answers to this questions should apply to ...
14
votes
2answers
749 views

When do shared disks “leak” data to other VMs, and how is that mitigated?

Inspired by this answer, I would like to know what are some common threats and mitigation techniques used to prevent one VM from leaking data to another via the shared storage infrastructure. ...
11
votes
2answers
1k views

Is it safe to store SSN's in Azure Cloud?

I'm doing due diligence on a company. They are entirely cloud based and need to collect lots of personal information from users (including SSN). Is this something I should be majorly concerned with? ...
10
votes
1answer
375 views

What are the privacy differences with Azure trustee delegates in China, Germany, and other locations?

Azure has different privacy agreements set up with different datacenters as mentioned in this footnote Azure is now available in China through a unique partnership between Microsoft and 21Vianet, ...
8
votes
5answers
2k views

Should one sign and encrypt using the same key? The Azure Training Labs are taking this approach

I'm taking the Azure lab LoadBalancing with WCF and recognise what I have been told is bad from a security perspective, but am not sure if it applies here. Can someone look at this code and tell me ...
8
votes
1answer
693 views

Benefits of cloud based full disk encryption

Microsoft announced in May that it supported full disk encryption for VMs. They have recently merged a github branch into the Azure Powershell tools to enable this. The basic theory is that you ...
8
votes
2answers
1k views

What information is exposed by simply opening an RDP connection to the internet?

Microsoft, Rackspace and other hosted providers allows people to RDP into that server. Here are a few examples: Microsoft has something called "Azure Connect" it is very easy to expose a domain ...
6
votes
2answers
2k views

What is more secure: Many subdirectories, or many subdomains?

I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef: www.mydomain.net/enroll www.mydomain.net/admin www.mydomain.net/ ... or I can configure them as a ...
6
votes
1answer
3k views

Hardening SSL/TLS on Azure Cloud Service for A+ on Qualys SSL Labs?

We're using this powershell script as our Azure Cloud Service (PaaS) startup script and we're at an A- on the Qualys SSL Labs test Specifically we're losing points for the following reasons: Forward ...
6
votes
1answer
6k views

Intrusion prevention in windows azure?

When using the Windows Azure IAAS servers how does one setup IPS for all incoming traffic to these servers? How would a regular user who runs his whole environment within Azure make sure that he can ...
5
votes
1answer
609 views

Securely Storing Access Tokens for Azure Key Vault

I am using Azure's KEY vault to store encryption keys and handle encryption and decryption as we have a specification that requires encryption keys to be kept offsite, however this has left me with ...
4
votes
2answers
181 views

How much information about our Security & Penetration Testing should we share with customers?

We have a B2B Saas service which runs on Microsoft Azure. Microsoft publishes a lot of information about Azure security but occasionally customers ask us about the security testing and audits that ...
4
votes
2answers
803 views

Azure Key Vault vs Azure Environment Variables - Which is the right way?

I've read a lot on the new Azure Key Vault feature and it does have some valid use cases. However in the case of a simple web app I don't see the benefit of using environment variables which can be ...
4
votes
1answer
111 views

What is the security concerns of AzureAD?

We have lots of documents about Microsoft on-premise AD security problems and methodologies to find them and test them, but for AzureAD there is not much information about the possible problems and ...
4
votes
2answers
153 views

Can I prevent all employees from accessing customer data without being logged (especially IT)

I am hosting a web application and SQL server database on Azure and I would like to ensure that no individual at the company can access customer data without the access being logged. It seems that ...
4
votes
1answer
2k views

Azure AD B2C vs Auth0 [closed]

I am trying to work on security architecture for our SaaS application. The good finding was Azure AD B2C which is launched recently. And first comparison was with Auth0. Is this is correct comparison?...
4
votes
1answer
1k views

Invoke an antimalware scanner from code on azure Roles

We have a requirement to scan uploaded images via azure services. I found that Azure has a free out of the box solution http://azure.microsoft.com/en-us/support/legal/endpoint-protection/ However ...
3
votes
5answers
680 views

Cloud provider for Penetration Testing

I wish to set up a Kali Linux box on a cloud provider in order to perform same day penetration tests. The issue I am having is finding a cloud provider such as AWS, Azure etc. for this. For AWS they ...
3
votes
1answer
150 views

How does the use of Microsoft-branded Azure products affect my privacy policy?

I have an existing on premise infrastructure which I'm considering moving to Azure. On that platform, there are products that enhance my security, presumably by collecting metadata (IP, session, etc). ...
3
votes
0answers
687 views

Are enterprises Office 365 accounts overly exposed to brute force attacks?

Earlier this year the Scottish parliament was attacked by what described as a “Brute Force” cyber-attack. It was said that the attack targeted “MSPs and staff with parliamentary email addresses”. ...
3
votes
0answers
389 views

ISO27001 compliance and perceived Risks using Microsoft SQL Server Azure 2016 [closed]

Introduction My company is currently undergoing ISO27001 compliance. I originally thought that this is a purely technical issue, with the merits of different solutions being weighed up on purely ...
2
votes
2answers
2k views

Best way to set up SSL certificates for consuming web service from Azure

I need to purchase and install the correct Verisgin SSL certificate(s) (X.509) on Azure. I have never done this before and would really appreciate some advice on how to go about it and what is ...
2
votes
2answers
643 views

Why does an external pentester testing my Azure website ask for IP, Gateway, DNS and VPN credentials?

I have an Azure website and a client who wants to use my site but needs to perform ethical hacking on it in order to decide if it's secure enough for them. They've asked me this to send them this: ...
2
votes
1answer
611 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
2
votes
2answers
175 views

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but ...
2
votes
1answer
82 views

Can I secure a server on which I'm deliberately allowing code execution?

Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface. Obviously,...
2
votes
2answers
702 views

Strange attempts from Azure IP on our client data

I had to put this case here as Microsoft's answer won't make sense. What's been happening is that since early July this year, we've had this IP belonged to Microsoft's Azure infrastructure, 104.42....
2
votes
1answer
272 views

What reasons are there to not just send the API key as an HTTP header over HTTPS?

I've been recently struggling to use Microsoft's Azure platform (which has been an unfathomable pain in the ass). One early thing I noted was how the authentication was unexpectedly more difficult ...
2
votes
1answer
938 views

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ...
2
votes
0answers
21 views

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP ...
2
votes
1answer
55 views

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the ...
2
votes
0answers
123 views

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning ...
2
votes
1answer
3k views

Approach to (nmap?) port scan a subnet over VPN? (updated with figure)

I am inside an enterprise network, and connecting a P2P VPN to an Azure VPN gateway. With that VPN connection up I can RDP to a jump server. I want to do a port scan, indicated by the red arrow. The ...
2
votes
2answers
111 views

Migrating IIS to Azure

So basically, right now we have a fully public facing Web server inside the local network and is a member of the domain. We're going to be migrating this to azure. I have recommended that the server ...
2
votes
0answers
101 views

Google.com serving *.portal.azure.com SSL certificate?

Just ran across this in my own browser (Chrome, Mac OS) where going to google.com would serve a *.portal.azure.com certificate. It seemed to be signed all the way to the root too. This disappeared ...
2
votes
0answers
339 views

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do ...
1
vote
2answers
1k views

Uploading pfx certificate to Azure

In order to use SSL with a custom domain in Azure Websites you must upload a pfx file with your certificate and private key to Azure. What are the ramifications of trusting Azure with the private key,...
1
vote
1answer
601 views

Securing an OAuth / OpenID Connect identity in a cookie for easy login

I have a website that uses Azure Active Directory or Google+ for logging in. I go through an OAuth2 login flow, and the users email along with their tokens are returned to me by their identity service....
1
vote
1answer
641 views

What risk can untrusted WS-Federation metadata pose?

I'm adding support for SAML/ADFS/Azure ACS and read that untrusted metadata poses a risk. Considering that ADFS does background refreshes of the metadata, as do some RPs, can someone explain the risk,...
1
vote
3answers
70 views

Protecting a private key on Azure

Is there a way on Azure to protect a private key so only I have the key? No one else can get the key? I understand that this might be impossible as the code we have on Azure needs the key to validate ...
1
vote
1answer
52 views

Azure VPN Gateway Client - Reported as Win32/Detplock

When following this official guide to setup an Azure VPN Gateway, the downloaded VPN client application is reported as Win32/Detplock by windows defender. https://docs.microsoft.com/en-us/azure/vpn-...
1
vote
2answers
149 views

Azure Networking VPN

Company is exploring the option of connecting Azure VNET to the on premise network using either Site-to-Site or ExpressRoute. There are concerns regarding potential vulnerability of internal resources ...
1
vote
1answer
144 views

Secure Azure to Data Centre Web Service Calls via Trusted IP?

Background The company I work for have a system with some data. This system's hosted in our private data centre. This system provides some ReST web services. We're looking to create a website, hosted ...
1
vote
0answers
25 views

Is there a way to configure Azure AD SSO to ignore SP forceAuthn parameter?

I am trying to workaround an annoying cloud based SP initiated sign-on parameter, forceAuthn, the SP includes this in their assertion and is set to true. They do this to ensure compliance with some of ...
1
vote
0answers
31 views

Azure publicly exposed resources

Azure's resources are generally made publicly accessible when launched (from a network point-of-view). e.g. An Azure SQL database will be given a public DNS name and the port will be accessible from ...
1
vote
0answers
30 views

What is the default cipher for SSL connections in Azure for MariaDB?

According to Microsoft's Documentation, Azure should be configured to use SSL for connections. In regards to default settings, they state the following: By default, the database service should be ...
1
vote
1answer
41 views

Permissions for Azure OMS Agent files

I have two files that the Azure OMS agent reads/writes from that are world writable files. Our vulnerability scanner (rapid 7) is picking these up as vulnerabilities. It's also poor practice in ...
1
vote
0answers
85 views

Building upon SOC 2 Compliance of hosting provider

We are looking at becoming SOC 2 compliant and I was curious if it is possible to leverage the compliance of a hosting provider as part of our attestation? More specifically, our product is fully ...
1
vote
1answer
125 views

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the ...