Top 18 azure security fails and how to avoid them
0 likes228 views
The document discusses the top 18 security failures in Azure and provides guidance on avoiding them, highlighting issues like improper access controls and lack of monitoring. It emphasizes the importance of secure practices, such as using role-based access control and privileged identity management. Additionally, it offers resources and tools to enhance Azure security, including the Secure DevOps Kit for Azure.
Top 18 azure security fails and how to avoid them
- 1. @fincooper Top 18 Azure security fails and how to avoid them
- 2. @fincooper Karl Ots Managing Consultant karl.ots@zure.com • Cloud & cybersecurity expert • User group and conference organizer, podcast hosts • Patented inventor • Working on Azure since 2011 • Helped to secure 100+ Azure applications, from startups to Fortune 500 enterprises • linkedin.com/in/karlots
- 3. @fincooper What to expect in this session • Azure security landscape • Top Azure security fails I have wondered upon in my adventures • Why are they bad? • How to fix them? • Resources to help you secure your Azure environment, regardless of your current status
- 4. @fincooper Security controls in Azure Physical Security Network Host Application Admin Data Physical controls, video surveillance, access control Edge routers, firewalls, intrusion detection, vulnerability scanning Access control and monitoring, anti-malware, patch and configuration management Secure engineering (SDL), access control and monitoring, anti-malware Account management, training and awareness, screening Threat and vulnerability management, security monitoring and response, access control and monitoring, file/data integrity, encryption
- 5. @fincooper With great power comes great responsibility
- 6. @fincooper Role-Based Access Control Subscription Resource Groups Resources
- 7. @fincooper Privileged Identity Management • Requires Azure AD Premium P2 • For all users in the whole AAD Tenant • Identifies users with administrative privileges • Enables on-demand, just-in-time administrative access • Generates reports about administrator access history
- 8. @fincooper STRIDE • Azure removes some of the attack surface, as infrastructure and operations are handled by Microsoft. • We can use frameworks such as STRIDE to identify threats: • Good set of tools at https://www.microsoft.com/en-us/SDL/adopt/tools.aspx Threat Property Definition Spoofing Authentication Impersonating something or someone else. Tampering Integrity Modifying data or code. Repudiation Non-repudiation Claiming to have not performed an action. Information Disclosure Confidentiality Exposing information to someone not authorized to see it. Denial of Service Availability Deny or degrade service to users. Elevation of Privilege Authorization Gain capabilities without proper authorization.
- 9. @fincooper Top Azure security fails 1. Every user is an Owner • …In the Subscription scope 2. Service Principals have too wide privileges 3. Untrusted authorization provider being used (Microsoft Account, Gmail, unmanaged Azure AD…) 4. No monitoring 5. No alerting • Security Center • SQL Auditing • WAF • Azure Service Health 6. Storage access keys used directly 7. Credentials in code 8. No key rotation 9. Unprotected public endpoints (HTTP/RDP)
- 10. @fincooper Top Azure security fails 10. Too short Activity Log retention (if any) 11. Missing VM updates… 12. Enterprise Portal access control fails • Or Azure Sponsorship for Microsoft Startups / BizSpark 13. No Privileged Identity Management, Just-in-time Access or Just-Enough Access 14. No Advanced Threat Protection enabled 15. Azure DevOps access control fails 16. Data Access pane fails 17. Azure Governance fails 18. Network-level fails
- 11. @fincooper DEMO
- 12. @fincooper Secure DevOps kit for Azure (AzSK) • Set of tools for assessing the security posture of your Azure environment • Built by Microsoft Core Services Engineering • Used to secure 1000+ Azure subscriptions at Microsoft • Easy to get started with non-intrusive vulnerability scans, expands end-to- end tooling from developer machine to CI/CD to continuous assurance
- 13. @fincooper Materials • My slides: slideshare.net/karlots • Secure DevOps Kit for Azure: • azsk.azurewebsites.net • STRIDE Threat Modeling Lessons from Star War: • youtube.com/watch?v=Y3VQpg04vXo • Azure Security and Compliance Blueprint (not Azure Blueprint): • docs.microsoft.com/en-us/azure/security/blueprints/gdpr-paaswa-overview • Azure Virtual Datacenter: • docs.microsoft.com/en-us/azure/architecture/vdc/