Hot answers tagged

43

In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection Systems are aware that it's an authorised scan. Both AWS and Azure have policies detailing the process and what's acceptable to test. The AWS one is here and the ...


18

Given the current state of public cloud, I would argue that in many cases it is in fact more secure than on-premise storage. Granted I work for Microsoft, but my opinion both pre-dates my employment, and extends to competitors like Amazon and Google as well. Companies whose business models are built on data center operational expertise and excellence, are ...


7

You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service completely. They may even be required to report you to law enforcement agencies.


6

Better or worse is relative to the usage of the protocol. SAML has it's place and SWT/JWT/et al have their place. The SAML spec is pretty much set in stone, whereas SWT/JWT are really in their infancy and keep changing. SAML has lots of knobs which makes it fairly complex and that's the enemy of good security, but everyone pretty much implements it the same ...


5

You aren't missing anything technically, full disk encryption protects you from disk theft, improper disk disposal, or unauthorized access to the virtual container. The point I'd make to you is that if your data is valuable to your organization it's probably valuable to somebody else. You also have a duty of care to protect customer details any sensitive ...


5

Many have pointed out key escrow as a reason for separating encryption and signature keys. Many have also mentioned that this shared use of keys is fine in this particular case. But nobody has mentioned the cryptographic problems in sharing keys for both signing and encryption If you look at official standards for cryptography, most of them specify that ...


5

This will vary according to your business and the transparency you have with your customers. Most of the companies perform tests on their application and share with the customers the standards they have been tested against, but not the "step-by-step" of the testing. For example, let's say you have a web application, you can mention to your customers that ...


4

In this particular scenario, this technique is fine. You use the same cryptographic key (in this case an X.509 cert) to encrypt-to-self. The sample you mention implements a session token (simply speaking a protected cookie), which is shared between multiple similar web services sitting behind a load balancer. So the 'signature' (in this particular scenario)...


4

There are a number of layers at which IDS/IPS can come into play when dealing with Azure IaaS. First, without doing anything at all, you already have IDS/IPS in place, because it's a standard piece of the Azure network security infrastructure. Every packet that enters their networks is going to be subject to inspection by the systems that are already in ...


4

First, for an analysis of TLS version and cipher suite selection, see my answer to Now that it is 2015, what SSL/TLS cipher suites should be used in a high security HTTPS environment? The summary is: TLS_DHE_* and TLS_ECDHE_* support PFS, but AVOID DSS, RC4, and so on. The reason you're getting points off for not having FS with some browsers is the TLS_RSA_*...


4

From security standpoint, there's not much difference between JWT and SAML token specs; it mostly boils down to supported signing and encryption algorithms (JWT is more limited in this regard; see http://tools.ietf.org/html/draft-jones-json-web-token-10#appendix-A). For this use case, in the end they both just provide claims (with all the necessary baggage, ...


3

It is indeed mandatory to verify the certificate of the person you are talking to. However, it makes no sense for the server to verify it's own certificate. It would be like you verifying your home key still opens your door or if you did changed the locks. In normal operations, you should already know this. Checking the certificate of the server server-...


3

However in the case of a simple web app I don't see the benefit of using environment variables which can be configured in the portal. I have not used Azure Key Vault, but it appears that the client application never actually sees the master key: When a SaaS application needs to perform cryptographic operations by using their customers’ keys, Key Vault ...


3

Well, more accurately it says that untrusted relying parties pose a risk. If you accept token requests from any RP then an attacker could easily gather a fair bit of information about a user. That is the risk. If you only repond to requests from RP's that you know and trust then the liklihood that an attacker can gather the same information is less likely. ...


3

Yes and no. If done right it will be, but what you are describing is simply an authentication cookie. I would suggest to not reinvent the wheel. The framework/programming language that you use probably already have a way to manage authentication cookie. I would go with that instead of creating it yourself.


3

Standard DNS tables and Azure are pretty flexible when it comes to helping you test this. I'd recommend the following: Register for a wildcard SSL certificate - this will let you apply the cert to subdomains as well. For help creating the cert check out http://www.andrewdenhertog.com/tips/creating-adding-ssl-certificates-azure/ If you want to test the cert, ...


3

Can someone look at this code and tell me if different certificates should be used in production code? First, any code that is use for a security function should be designed, design reviewed, implemented, code reviewed, and tested before puting in a production environment. Just because the code came from MSDN does not mean that it is secure. Even if you ...


3

If the server is publicly accessible then you don't need to worry about VPN connection info. Security assessments are often performed on sites before they are exposed to the internet and the site is only accessible on a private network so they will ask for you to provide these details if that is the case. The DNS name that the application will have will ...


3

I have been sent an article by Azure Security Program Manager saying that Azure can be used for outgoing penetration testing with a few stipulations, mainly focused around ensuring that the outgoing tests don't affect other Azure users, e.g. outgoing DDoS slowing down the network. https://blogs.msdn.microsoft.com/azuresecurity/2016/08/29/pen-testing-from-...


3

Azure AD is SaaS so Microsoft is responsible for scanning and securing the infrastructure. It’s important to understand the division of responsibility between you and Microsoft. On-premises, you own the whole stack but as you move to the cloud some responsibilities transfer to Microsoft. The following responsibility matrix shows the areas of the stack in a ...


2

Microsoft Azure uses a Remote Desktop Gateway kind of situation, so when you initiate a connection to your Azure Server your connection is via HTTPS until you hit the Microsoft Server farm. Once you int the network your connection is "proxied" via the Azure gateway server, this ensures that the only people who would be able to see any sensitive information ...


2

I do not believe this is a very good thing. There are simple programs on the net which can attack, and exploit vulnerabilities is RDP. I suggest they look into secure VPN instead on directly opening their domain up onto the net. If you want the serious truth: Using TSgrinder, an attacker could try a brute-force attack using customized lists of username/...


2

The primary ramification is that the security of your private SSL/TLS key is ultimately out of your control. Technically, you could use a wildcard certificate, or a multiple domain certificate (Subject Alternative Name, or SAN, certificate). However; if you use a wildcard or SAN certificate, then the security of all of your servers is tied to the security ...


2

Cloud providers can provide single tenant hardware so your VMs are isolated from other customers and clients. A number of financial regulators are expecting this to be enabled for confidential / regulated data when stored in the cloud. For example, Amazon AWS has the concept of a 'dedicated instance' (link) If you select this option your EC2 instances will ...


2

If there's a way to access data without an audit log, secure the credentials required to access it that way and audit their access. Software such as Vault is geared toward this. Physical control of an MFA token such as storing it on a YubiKey and then putting that in a safe place with somebody who doesn't control the password would provide you with dual ...


2

To add to Xander's answer, there are a few things to consider: Company policy IaaS, PaaS, and SaaS multi-tenancy Key management Current internal security posture Company policy Some companies are okay with *aaS, some companies say a certain level of PII is okay to store off-prem without encryption, or require encryption for a certain level, and say above ...


2

Additional to the ISP consideration as per the answer of "Mike Lane", put in mind that also you are going to pentest over networks that are properties of a different entities that belong to the state in general; so you are not automatically granted permission for such kind of activity. If you could rent another share or VPS within the same infrastructure as ...


2

Interception of the traffic is 100% possible since the whole time the transfer is going via public internet isp etc,but retrieving sensible data out of it is highly unlikely, unless the attacker has cracked the Encapsulating Security Payload used to encapsulate the vpn traffic packets.


2

Please contact this guy If you need his name, register to https://censys.io/ and whois the ip. This person is the one in charge (for abuse) of the following ASN: MICROSOFT-CORP-MSN-AS-BLOCK AS8068 The ip you stated seems to be pretty well known for misbehaving. Try to figure out if microsoft is not playing by the rules or if its an attack attempt ...


2

Azure is fine with Pen Tests as long as their infrastructure is not unlawfully used to access or disrupt other systems on Azure (or without) which you cannot prove that you have the authorization to modify or access. Expect to provide a detailed specification of the kind of tests you wish to conduct including times when you wish to carry them out.


Only top voted, non community-wiki answers of a minimum length are eligible