20 common security vulnerabilities and misconfiguration in Azure

1. 20 common security
vulnerabilities and
misconfiguration in Azure
By
Eng Soon Cheah
Microsoft MVP
@CheahEngSoon

2. Who am I ?
• Microsoft MVP – Microsoft Azure
• Senior IT Developer in Big 4
• Microsoft Certified in Azure Security Engineer Associate

3. Microsoft Azure TOP 20 vulnerabilities
1. A storage account accessible from the Internet
2. Storage accounts that allow insecure transfers
3. Lack of multi-factor authentication for privileged users
4. Lack of multi-factor authentication for joining devices
5. The free basic version of Azure Security Center lacks many necessary
security features
6. Azure virtual network with basic DDoS protection
7. Unencrypted operating system and data disks
8. Missing email notifications in the Security Center
9. Missing log alerts in Azure Monitor
10. Azure NSG inbound rule is configured as ANY

4. Continue…
11. Configure the public IP address as Basic SKU
12. Use dynamic IP addresses for public-facing services
13. Blob storage with anonymous read access
14. The number of guest users in Azure AD is too large
15. Insecure guest user settings in Azure AD
16. Unlimited access to Azure AD management portal
17. Azure Identity Protection feature is disabled by default
18. Azure Network Watcher is disabled by default
19. HTTPS is not mandatory for all web application traffic
20. Monitoring strategy in Azure Security Center

5. 1. Storage account accessible from the
Internet

6. 2. Insecure transfer of storage accounts

7. 3. Lack of multi-factor authentication for
privileged users

8. 4. Lack of multi-factor authentication for newly
added devices

9. 5. Free version of Azure Security Center

10. 6. Basic DDoS protection for virtual networks

11. 7. Unencrypted operating system and data disk

12. 8. Missing email notifications in Security
Center

13. 9. Log alerts are missing in Azure Monitor

14. 10. Azure NSG inbound rule is configured as
ANY

15. 11. The public IP address is configured as Basic
SKU

16. 12. Dynamic IP address for public-facing
services

17. 13. Blob storage with anonymous read access

18. 14. High number of guest users in Azure AD

19. 15. Insecure guest user settings in Azure AD

20. 16. Unrestricted access to Azure AD management
portal

21. 17. Azure Identity Protection feature is
disabled

22. 18. Azure Network Watcher is disabled

23. 19. HTTPS is not enforced for all web
application traffic

24. 20. Monitoring strategy in Azure Security
Center

26. References
• My YouTube Channel
https://www.youtube.com/c/mvponduty
• Images Credit: aqniu-wx