The content is a compilation of blog posts by Teri Radichel on Azure Security, including topics such as Azure Security Assessments, Cloud Security Presentations, Azure Confidential VMs, Homomorphic Encryption with Microsoft SEAL, and more.
Abstract
The content is a collection of blog posts written by Teri Radichel on various topics related to Azure Security. The posts cover a range of topics, including Azure Security Assessments, Cloud Security Presentations, Azure Confidential VMs, Homomorphic Encryption with Microsoft SEAL, and more. The posts are written in a conversational tone and provide insights into various aspects of Azure Security. The author also shares their experiences with Azure Support and provides recommendations for improvements.
Opinions
The author prefers to use AWS most of the time when doing security assessments and penetration testing.
The author has found issues with Azure Support, including sending things in email outside the support portal, not looking at screenshots uploaded by the author, constantly replying on tickets after the author requested to close them, and going around in circles for weeks before admitting that something was a bug.
The author believes that Azure Support issues could be a security problem.
The author has found workarounds for issues with Azure, such as when they could not create a VM.
The author has found interesting behavior when testing new Azure features, such as the one that is supposed to disallow users from creating new tenants.
The author has documented their experience with Azure Support for about an 8 week period and hopes that some of the issues they found have been fixed.
This is a compilation of my posts on Azure Security. Although I teach Azure Security classes, I prefer to use AWS most of the time when I’m doing security assessments and penetration testing. I have a lot more posts on AWS Security for that reason. But right now I’m teaching an Azure class so expect a few more Azure posts for a minute. Also, most of the concepts I write about on AWS Security can be translated to Azure Security. Maybe someday I’ll get around to writing about that translation.
This post explains how Azure features such as MFA and Conditional Access might have prevented the Solar Winds Breach that basically took over Azure accounts. It also explains how understand who can grant application permissions in an Azure account is very important.
This is a presentation given about Azure to Auditors to explain what to look for on an Azure Audit or security assessment. New tools exist now in Azure that did not exist at the time of this presentation.
What is Cloud
To understand what cloud is, we can take a look at the evolution of technology that lead to “cloud.”
Tanja Janca (SheHacksPurple) and I gave this presentation at Microsoft Build, OWASP AppSec day in Melbourne, Australia, on her podcast, and the presentation went to DefCon but I opted out of that one.
Cloud Security Presentations
Many of my general cloud security presentations are applicable to Azure.
Related to the issues with Azure support, at one point I could not create a VM. Any VM. I contacted Azure support but I already told you how that went. Hopefully this is resolved now as people all over the world seemed to be having this problem at the time. This is a security problem because if you have an application with a vulnerability and need to deploy a VM and can’t — you have a denial of service issue. I did find a workaround described in this post.
In this post I reviewed a new Azure feature that is supposed to disallow users from creating new tenants. I found some interesting behavior when testing it.
This is probably too boring to read in full but I documented my experience with Azure support for about an 8 week period. It was frustrating, but I hope by documenting it some of this got fixed. The biggest problems are:
#1. Azure Support sends things in email outside the support portal so they can’t be properly tracked.
#2. Azure support wasn’t looking at screenshots I uploaded.
#3. Constantly replies on tickets after I request to close them and couldn’t close them myself.
#4. Went around in circles for something that didn’t work for weeks before they finally admitted it was a bug. I also found and reported other bugs.
There’s more but those were the most egregious problems. I really hope this helped and some of these things got fixed because I have had these problems since Day 1 using Azure and it’s why I generally don’t pay for support. I end up resolving most of my problems on my own. If you can’t get the support you need when you need it, this could be a security problem. I presume larger companies that spend a lot more than I do get better support. :-)
Most of the posts I’ve written for other cloud environments in terms of attack vectors, architectures, and security controls are applicable in Azure. You would just implement them with Azure-specific constructs.
About Teri Radichel:
~~~~~~~~~~~~~~~~~~~~
⭐️ Author: Cybersecurity Books
⭐️ Presentations: Presentations by Teri Radichel
⭐️ Recognition: SANS Award, AWS Security Hero, IANS Faculty
⭐️ Certifications: SANS ~ GSE 240
⭐️ Education: BA Business, Master of Software Engineering, Master of Infosec
⭐️ Company: Penetration Tests, Assessments, Phone Consulting ~ 2nd Sight Lab
Need Help With Cybersecurity, Cloud, or Application Security?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
🔒 Request a penetration test or security assessment
🔒 Schedule a consulting call
🔒 Cybersecurity Speaker for Presentation
Follow for more stories like this:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
❤️ Sign Up my Medium Email List
❤️ Twitter: @teriradichel
❤️ LinkedIn: https://www.linkedin.com/in/teriradichel
❤️ Mastodon: @teriradichel@infosec.exchange
❤️ Facebook: 2nd Sight Lab
❤️ YouTube: @2ndsightlab