Penetration Testing Services & CyberSecurity Solutions - SecureLayer7

What is MS Azure Security Assessment?

Lorem Ipsum is simply dummy text of the printing and typesetting industry. Lorem Ipsum has been the industry's standard dummy text ever since the 1500s But the integration of new technologies brings about new security vulnerabilities as well. By penetration testing your Azure cloud environment, you can identify and eliminate these security risks – including those unique to your private cloud.

Microsoft Azure, like any other hosting and cloud platform, provides tradeoffs between control of resources and ease of implementation. Additionally, cybersecurity responsibilities are shared between you, the cloud customer, and Microsoft, the cloud-service provider. General hardening practices still apply, but the scale and customizability of the Azure platform gives you some tools in your security toolbox that may not be available in an on-premises data center. This blog post will walk through some of the available tools and provide insight into some of the tradeoffs you’ll have to make when deciding how to best secure your Azure cloud resources.

Why MS Azure Security Assessment with SecureLayer7?

Azure comes with a number of security protections for experienced users. Microsoft also makes a point to adhere strictly to compliance and undergoes regular third-party audits. While this is a good place to start, it is each user’s responsibility to maintain their stability and security. The Azure services provide the structure to create virtual machines, networks, and applications, but it is the end-user that owns them. For this reason, it is essential that your Azure instances also receive regular security audits to protect your most sensitive assets.

What Can Be Pentested in Azure?

Many elements of cloud services can’t be tested. For instance, it’s strictly forbidden to perform DDoS attacks on the network, as it may result in unplanned downtime for many users. There are also several services that can (and should) receive a regular assessment. The following are a few examples of those that we will test:

Microsoft Azure
Microsoft Intune
Microsoft Dynamics 365
Microsoft Account
Office 365
Visual Studio Team Services

Azure Pentest Rules of Engagement

No pre-approval is needed to conduct penetration tests on Azure services, as of June 2017. While this helps save time during the pre-engagement process, there are still many factors to consider before testing your Azure network. It is important to note that certain assessment techniques are off-limits to protect other Azure users. Some are more obviously destructive, such as executing Denial of Service (DoS) attacks on the server.

Azure Pentest Reporting

Rhino Security Labs’ Azure penetration test reports are similar to network or web application pentest reports – available for download here. Our reports offer the technical depth to aid engineers in their remediation and strategic insight for leadership. A primary addition is that Azure reports cover unique vulnerabilities specific to the platform. Along with them, you will receive strategic recommendations and mitigations for your own Azure instances, and the cloud environment as a whole.

Database Security in Azure

On the network level, both database firewalls and server-level firewalls can be tuned to whitelist allowed-IP ranges to access authorized databases. Just as it sounds, database firewall rules grant access to specific databases. Server-level firewall rules, on the other hand, grant access to a server which may host multiple databases. Microsoft recommends that you use Database-level security firewall rules as opposed to the Server-level firewall rules, because it keeps your databases more portable and access

Encryption

Accomplish encryption of data in-transit by using the most up-to-date TLS or HTTPS implementation, this is nothing new. However, encrypting data at-rest on the Azure platform becomes a more interesting discussion as you will be faced with a number of decisions. Let’s assume that you’ve decided to store encryption keys in the Azure cloud, rather than on your own premises, as on-premises key management represents a whole other blog post. Next, you must decide whether you’d like Microsoft to manage your encryption keys for you or if