Security Features in Azure

As a cloud pentester, it’s important for you to understand one of the most popular cloud platforms out there—that is, Azure. You’ll probably be pentesting Azure networks and applications frequently.

In this chapter, we will first examine some of the most commonly used aspects of the Azure ecosystem along with the most popular Azure services, applications, and features, and why they’re used. After that, we’ll look into Azure Software-as-a-Service (SaaS), Infrastructure-as-a-Service (IaaS), and Platform-as-a-Service (PaaS) features. We will conclude the chapter by discussing Microsoft’s own Azure security tools and third-party security tools.

This chapter covers the following main topics:

• Introduction to Azure
• Frequently used Azure SaaS applications
• Azure IaaS applications
• Azure PaaS applications
• Azure security controls and tools

Let’s jump right in!

Introduction to Azure

At the beginning of the 2000s, Microsoft’s data center infrastructure was smaller than their current cloud platform competitors, Amazon and Google. But Microsoft’s pockets were comparatively deep. When it launched Xbox Live in 2002 (now known as the Xbox network), it had built immense backend infrastructure to support what was then the highest-capacity online gaming service ever. From that point on, Microsoft steadily expanded its own data center capacity as it got into the network services business (MSN doesn’t count) concurrently with its expansion into the video game console business.

From what I can tell, building Xbox Live/the Xbox network for the consumer market gave Microsoft the experience it needed to start providing network services for the enterprise market. Amazon launched AWS as “Amazon.com Web Services” in 2002, its initiative to provide cloud services to the enterprise. Microsoft probably thought, “I...

Frequently used Azure SaaS applications

I’ll summarize the most popular SaaS applications in Azure. It’s unlikely that you will be pentesting them because Microsoft has more responsibility for the security of its SaaS than for its PaaS and IaaS. Your company just inputs its own data into these applications or embeds them in its own applications. But it’s important as an Azure pentester to understand the many ways Azure is used so that you can contextualize how SaaS fits in with the rest of Azure and how the company you work for may be using Azure SaaS applications. Plus, the data your organization inputs into Azure’s SaaS applications is your organization’s security responsibility. For instance, if someone in your organization puts their sensitive bank account information into Microsoft Cost Management outside of the cryptography Microsoft has implemented, that’s your organization’s problem. If your organization has a PaaS or IaaS application...

Azure IaaS applications

Azure IaaS gives your organization just the very basics as far as software code is concerned. The vast majority of the code your organization deploys in IaaS belongs to your organization and is your organization’s responsibility as far as cybersecurity is concerned.

Here are some of the most commonly used IaaS applications in Azure.

Azure Virtual Machines

Azure Virtual Machines enables your organization to deploy VMs with Windows and Linux. You can deploy lots and lots of virtualized Windows and Linux servers to do anything and everything Linux and Windows servers do, from running huge enterprise applications to deploying web servers and other kinds of internet services.

Azure Kubernetes Service

Azure Kubernetes Service (AKS) supports Kubernetes containerization orchestration in Azure (https://azure.microsoft.com/en-ca/products/kubernetes-service/).

AKS is specially designed for Kubernetes clusters, so it is the best way to deploy Kubernetes...

Azure PaaS applications

Azure PaaS is in between SaaS and IaaS as far as the amount of control and autonomy of Azure customers (such as the business organization you work for) is concerned.

In PaaS, Azure provides a platform. Only Azure SaaS provides Azure’s own complete applications that customers deploy their data in, whereas Azure IaaS basically provides Azure’s server hardware and networking infrastructure with absolutely minimal Azure code. The vast majority of the code in an IaaS deployment belongs to the customer and is their responsibility.

Here are Azure PaaS services where customers run the applications they develop, but within platform systems that Microsoft develops.

Azure SQL Database

Azure SQL Database enables customers to build applications with SQL databases. SQL is one of the top vendor-neutral database development technologies. A wide variety of types of applications that need support from backend services use SQL, not just mobile apps or...

Azure security controls and tools

It’s possible to use Microsoft Azure to deploy cloud networks with excellent security. But cybersecurity is everyday work. As a cloud pentester, you’ll be deploying pentests, red team engagements, and vulnerability scans that will give the organization the vulnerability data it needs to continuously security harden its networks and applications. Defensive security specialists need to put your security recommendations into practice. They also need to actually use the variety of security tools that Microsoft provides for Azure.

Excellent cybersecurity is possible with Azure. But you’ve got to do the work and use the tools Microsoft gives you!

Security controls

Microsoft provides a number of applications to help your organization maintain the cybersecurity of its applications and services in Azure. They are also useful for pentesters to check, to look for security alerts and vulnerabilities that Microsoft’s own security...

Summary

Microsoft Azure offers a wide variety of SaaS, PaaS, and IaaS applications and services. Your organization will choose which Azure components you use according to your specific business needs.

Microsoft also provides a variety of security controls so that Azure instances can have effective cybersecurity. That includes protecting IAM through Active Directory, preventing exposed services, and protecting highly sensitive cryptographic keys and other kinds of authentication data and components.

Several third parties develop open source Azure pentesting and vulnerability scanning tools that you’ll use as a pentester. Using those tools is an effective way of finding vulnerabilities in Azure environments while avoiding activities that violate Microsoft’s pentesting policies.

In the next chapter, we’ll deploy our own Azure network and run some pentests in it.

Further reading

To learn more on the topics covered in this chapter, you can visit the following links:

• A listing of Microsoft Azure services: https://azure.microsoft.com/en-ca/products/
• Microsoft Azure’s definition of PaaS: https://azure.microsoft.com/en-ca/resources/cloud-computing-dictionary/what-is-paas
• Microsoft Azure’s definition of IaaS: https://azure.microsoft.com/en-ca/resources/cloud-computing-dictionary/what-is-azure/azure-iaas/
• Kyuu-Ji’s collection of Azure pentesting tools on GitHub: https://github.com/Kyuu-Ji/Awesome-Azure-Pentest