IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [azure]

A cloud computing platform offered by Microsoft.

116 questions
3
votes
0 answers

ISO27001 compliance and perceived Risks using Microsoft SQL Server Azure 2016

Introduction My company is currently undergoing ISO27001 compliance. I originally thought that this is a purely technical issue, with the merits of different solutions being weighed up on purely technical grounds. However I am coming to understand…
gordon613
  • 271
  • 2
  • 7
2
votes
2 answers

Best way to set up SSL certificates for consuming web service from Azure

I need to purchase and install the correct Verisgin SSL certificate(s) (X.509) on Azure. I have never done this before and would really appreciate some advice on how to go about it and what is considered best practice for production and testing…
davy
  • 129
  • 3
2
votes
1 answer

How does the authentication flow with Azure Active Directory differ from Azure ACS?

I understand that Azure ACS acted as a STS that had the ability to redirect users to a given STS (OpenID, LiveID, Facebook) or authenticate using a local user/password account. In a passive situation ACS would use redirects and either respond with a…
makerofthings7
  • 50,090
  • 54
  • 250
  • 536
2
votes
0 answers

Implementing ACS with REST + many Identity Providers - Problems - Azure

I am trying to integrate ACS to use in my application's authentication system. Currently I have a Javascript client and a WCF so I had to use a REST architecture. I am quite puzzled on how to do this but here we go : On my log-in page I managed to…
Bryan Arbelo - MaG3Stican
  • 121
  • 3
2
votes
1 answer

How to restrict access to API in Azure API Management to known applications?

We need to create an API in Azure API Management and allow only known, registered applications to call it. We can require authentication, which restricts access to only people in our AAD, but how can we ensure that only certain applications can…
TimTheEnchanter
  • 121
  • 1
2
votes
1 answer

How to prevent azure pipelines (yaml) from being used as an attack vector?

Let's say the following scenario exists: A git repository exists on Azure DevOps Repos. The repository uses yaml pipelines (azure-pipelines.yml). The repository has branch policies to ensure that changes go through pull requests. The build pipeline…
myermian
  • 121
  • 1
2
votes
4 answers

How do I configure Azure Web Apps so that the only access is via CloudFlare?

I have a Web Apps (Linux) application on Azure, and I added a custom domain which I have protected with CloudFlare. I added Azure Security Center to my subscription. At the moment one can access the application either directly via…
gordon613
  • 271
  • 2
  • 7
2
votes
0 answers

IPS solution for a medium sized web application

As part of application security compliance we are supposed to implement an IPS on our application. The application is basically an educational web portal where students can enrol for course assessment. The assessment will be done in the backend by…
Anonymous Platypus
  • 1,392
  • 3
  • 18
  • 33
2
votes
0 answers

RFC 5280 compliant certificate with x509 extensions

First time posting here, be gentle. Situation: I have a requirement, to link our printer/scanner to our Azure AD (so that it can lookup users etc.). I have enabled Azure AD Domain Services with LDAP enabled, and this works. I have tested the LDAP…
Asser Fahrenholz
  • 21
  • 1
2
votes
1 answer

Is re-prompting a user for credentials an effective measure to prove a user's identify

I'm upgrading the authentication of an application from self hosted forms authentication to OpenID Connect through Azure Active Directory B2C (AAD B2C) and have found a few pages which re-prompt the user for a password before a transaction is…
Kye
  • 153
  • 4
2
votes
2 answers

How are stateless firewalls useful in public cloud platforms?

I'm trying to understand the value of stateless firewalls in public cloud platforms like Network Access Control Lists (NACL) in Amazon Web Services (AWS). I think I know a few ways I can use them, but I'm not sure about the actual value in terms of…
eternaltyro
  • 817
  • 7
  • 16
2
votes
1 answer

Are Self-Encrypting Drives (SEDs) used in cloud environments?

I was wondering if SEDs are used in cloud environments, for example in data centers of CSPs like Azure or AWS? And if so, what additional protection do they offer beside from physical theft of the drive?
Thomaszzz
  • 21
  • 2
2
votes
1 answer

Block AzureRM PowerShell Module

Is there a way to block AzureRM PowerShell module commands from being executed by certain Azure AD users somewhere in Azure group policy? Or is there a way to do this with PowerShell tools?
C.J. May
  • 23
  • 4
2
votes
0 answers

Web application making a call to a REST API when already authenticated

I'm new to ASP.NET Core and OpenID connect/AzureAD, so I'm looking for some validation (or otherwise) of my approach. Extensive reading/googling over the last couple of weeks while I've been learning this hasn’t turned up an exact answer (although a…
Paul Nearney
  • 121
  • 2
2
votes
1 answer

Can I secure a server on which I'm deliberately allowing code execution?

Context: AI competition. Users upload a dll with a class implementing a provided interface, then the competition runner instantiates that class and invokes various methods on the interface. Obviously, this means that I'm intentionally allowing…
Brondahl
  • 159
  • 5
1 2
3
4 5 6 7 8