AZURE PENETRATION TESTING
Whether you are utilising classic Azure portal or Azure Resource Manager (ARM), Azure penetration testing for applications or cloud infrastructure helps you to assess and remediate the identified risks. Scope of an Azure pentest is limited by your Azure subscriptions and the your primary security concerns.
Get In Touch
Why is Azure Penetration Testing important?
Cloud computing model is solving bigger challenges than anyone can imagine in terms of flexibility, downtimes and saving substantial costs. Microsoft Azure has come across a great way in a few years, offering you to run Linux based applications in Azure environment.
As is the on-premises model of deploying secure configurations, Microsoft Azure offers multiple security services that are useful to businesses. Azure services are good for cloud users, but it is customer’s responsibility to maintain their environment. Additionally, scale and flexibility to customise services offered by Microsoft adds another dimension from security perspective.
We help you maximise your security investments by offering independent third-party azure cloud security assessments.
Your trusted Azure penetration testing provider
Common Azure security vulnerabilities and misconfigurations
Microsoft Azure’s rise is down to offering flexibility over resource management and easy deployment model. The Azure penetration testing checklist below is not the most extensive because we follow a tailored approach when performing penetration testing assessments:
- Azure misconfiguration issues
- Azure Identity and Access Management (IAM) issues related to multi-factor authentication, insecure Azure AD hardening policies
- Access permissions for Azure blob, Queue, Table, Files related to data leakage
- Microsoft Azure storage encryption
- Azure NSG (Network Security Groups) issues related to ingress/egress traffic and routing security
- Azure AD security access controls
- Auditing and Monitoring
- Privilege Access Management
- Azure Identity Protection and Network Watcher issues
- Azure database control access (Database access and Application access)
What is and isn't allowed under Azure pen test scope?
An Azure penetration test differs from traditional security tests. All cloud providers have a clear policy of what is permitted when it comes to penetration testing customer environments. Microsoft red team and pen test rules of engagement are detailed here. Microsoft products that are named under ‘Microsoft Cloud’ (Azure environment) definition permitted for penetration tests include the following:
- Active Directory / Azure AD tenant configuration
- Dynamics 365
- Office 365
- Azure DevOps
- Microsoft Intune
- Microsoft Account
- Azure resources and Azure cloud services
A general rule for the shared responsibility model for the use of azure cloud services is:
Cloud provider is responsible for security of the cloud
Tenant or organisation client is responsible for security in the cloud
Any attacks launched during penetration tests meant to target the core infrastructure (related to DNS, Denial of Service, Protocols/Ports or request floods) is explicitly out of scope, as lined in the Microsoft pen test rules of engagement.
Azure Pentesting services
Whether it’s for infrastructure as a service (IaaS), a platform as a service (PaaS) or software as a service (SaaS), we provide Azure pentest services ranging from Office 365 security, black box and white box penetration testing to security audits for specific assets. Based on the customer requirement, security reviews of Microsoft Defender configuration (formerly Azure Security Centre and Azure Defender) are also undertaken in the Microsoft Azure platform.
The following are the most common security service offerings in addition to red team, azure application pentesting and API security testing.
Azure Penetration Testing
Azure Penetration testing refers to identifying and exploiting security vulnerabilities and misconfigurations to simulate real-world cyber attacks. This exercise is helpful to identify, assess and remediate the high impact risks to your cloud environment. Pentesting Azure applications is covered in our web application offering.
Office 365 Security Audit
Cyphere Office 365 Security Audit includes a thorough review of your current setup against Office 365 security risks and ensure that your setup follows controls around Device Management, Account Policies, Application Permissions, Security Controls around authentication, exchange online, auditing & storage.
Azure Security Review
It is your responsibility to secure assets hosted in the cloud. This includes security center review, assessing Azure services and secure configuration baselines, policies and procedures against Azure resources, Azure active directory and Azure cloud Virtual Machines serving your staff and users internally in the cloud.
- Assurance that Azure infrastructure can withstand cloud-based attacks
- Validation of internal and third party integrations
- Comply with regulatory requirements
- Ensure strong Azure cloud authentication, authorisation and encryption in place
- Ensure sufficient logging and monitoring controls
- Validation of cloud defense controls and strategy
Microsoft Azure provides cloud resources, securing it is your responsibility.
Azure Pentest Methodology
Our security testing approach involves benchmark based assessments as well as standard pentest methodology extended to include Microsoft cloud specific security concerns. We support industry-leading testing standards and methodologies unless the scope is a red team:
- OWASP
- Mitre Att&ck Framework
- Penetration Testing Execution Standard (PTES)
- NIST SP 800-115
Azure Active Directory Security
Whether in cloud or on-prem, active directory is the heart of Microsoft directory services offerings. Many businesses are already cloud-based, with some preferring a hybrid approach and remaining choosing to slow down with cloud adoption.
Understand in detail the differences between different services and concepts behind Azure AD and on-prem AD.
