[00:00.000 --> 00:01.060]  Hello, guys.
[00:01.780 --> 00:02.660]  Thank you for coming.
[00:02.940 --> 00:04.400]  My name is Apostolos.
[00:04.740 --> 00:10.120]  I'm a security consultant penetration tester from MWR InfoSecurity based in London.
[00:10.520 --> 00:14.960]  So please excuse any British spelling in the presentation.
[00:16.160 --> 00:26.320]  So I hear from many consultants they have a problem when they try to scope or perform tests in the cloud environment.
[00:26.660 --> 00:28.220]  So Azure is one of them.
[00:28.220 --> 00:36.120]  So I decided to spend some time exploring the capabilities to do pen testing in the cloud systems.
[00:36.600 --> 00:47.320]  So I also developed a tool in this effort called Azureite, which makes enumeration and reconnaissance activities more easier.
[00:47.680 --> 00:50.960]  So let's start digging into the information.
[00:51.240 --> 00:54.600]  Let's start with some key directions we're going to see today.
[00:54.600 --> 01:01.220]  First of all, we'll try to get familiar ourselves with the main Azure components and some terminology.
[01:01.740 --> 01:06.420]  Then we'll explore the security controls and the pen testing capabilities.
[01:06.420 --> 01:09.900]  We'll highlight some key points.
[01:10.100 --> 01:13.620]  And finally, we'll see a demo for the Azureite.
[01:13.620 --> 01:13.640]  All right.
[01:15.580 --> 01:18.520]  Some quick hands, although I cannot really see with the lights.
[01:19.460 --> 01:22.560]  How many of you have used, like, Amazon AWS?
[01:23.940 --> 01:24.460]  O.K.
[01:24.660 --> 01:26.280]  I can see, like, four from here.
[01:27.320 --> 01:31.040]  So how many of you have used the Azure services?
[01:32.380 --> 01:32.900]  O.K.
[01:33.280 --> 01:34.000]  Probably the same.
[01:34.260 --> 01:34.800]  Are you?
[01:34.800 --> 01:34.800]  Thank you.
[01:35.200 --> 01:38.220]  And finally, just to cover all the audience.
[01:38.860 --> 01:43.320]  How many of you believe that the cloud is just something you hear in the Weather Channel?
[01:45.160 --> 01:47.120]  I have no one.
[01:47.180 --> 01:47.380]  O.K.
[01:47.540 --> 01:47.900]  That's good.
[01:48.400 --> 01:51.180]  So this is like a graph.
[01:51.320 --> 01:55.400]  It's from a survey performed from RightScale earlier this year.
[01:55.400 --> 02:04.080]  And it represents how many IT people will use the services, the public cloud services, in 2016.
[02:04.780 --> 02:09.100]  I believe it represents our distribution here.
[02:10.140 --> 02:17.240]  So starting with some cloud computing challenges that the organization faces.
[02:17.440 --> 02:18.600]  So about security.
[02:19.160 --> 02:26.820]  The organizations are concerned if there are the right security controls in place to make sure that the environment is properly secured.
[02:27.020 --> 02:28.440]  And also about compliance.
[02:29.640 --> 02:31.740]  Customers have handled payment data.
[02:31.960 --> 02:33.700]  They can't handle PII data.
[02:33.700 --> 02:36.980]  And they want to be compliant with the PCI standards, maybe.
[02:37.860 --> 02:49.480]  And then we have seen many incidents the last few years about agencies that get access to our traffic and get our data.
[02:49.620 --> 02:52.740]  So there are some trust and privacy concerns.
[02:52.740 --> 02:55.480]  And finally, like governance.
[02:56.640 --> 03:05.220]  Do we have the right controls in place to control and monitor our data and make sure that security is applied properly?
[03:07.160 --> 03:10.720]  So probably this is a diagram you're familiar with.
[03:11.440 --> 03:17.800]  In the white color, you can see the responsibilities for the tenants.
[03:17.800 --> 03:25.620]  And in green color, the mint color, you can see what the cloud provider manages and maintains.
[03:26.100 --> 03:27.800]  In this case, we have Azure.
[03:28.920 --> 03:36.820]  So in this example, for example, we have on-premises, the tenant has all the responsibility for maintenance and patching.
[03:36.820 --> 03:54.260]  And on the other hand, in the service model, like software as a service, you have Salesforce or Office 365, where the tenant says to the cloud provider, look, take all the responsibility.
[03:54.260 --> 03:55.980]  I just want to use the application.
[03:58.160 --> 04:03.920]  So just to get familiar with some terminology in the Azure environment, starting with a subscription.
[04:04.180 --> 04:06.340]  The subscription is our main container.
[04:07.020 --> 04:16.640]  First of all, the container that we have all our services, like virtual machines, databases, storage, and web applications, among others.
[04:16.640 --> 04:25.680]  And also, it's the container, the billing container, where the Azure services, the Azure charges for the usage.
[04:26.740 --> 04:30.860]  There are two main deployment models at the moment.
[04:31.040 --> 04:36.820]  The classic one, which is the oldest one, and it's based on cloud services.
[04:36.820 --> 04:47.260]  Cloud services, imagine like a group of your resources, like virtual networks, virtual machines.
[04:47.520 --> 04:52.460]  And the main problem with them is that you cannot manage the resources centralized.
[04:52.920 --> 04:54.580]  You only can manage them individually.
[04:55.220 --> 04:58.080]  So Microsoft and Azure is currently in transition.
[04:58.420 --> 05:04.120]  They're moving to the resource manager model, where you have more centralized management.
[05:04.120 --> 05:08.880]  You have some enhanced security controls.
[05:09.120 --> 05:12.200]  And yeah, overall is a better approach.
[05:12.240 --> 05:16.180]  And this is what Microsoft suggests for new deployments.
[05:16.720 --> 05:18.640]  Then you have the regions.
[05:18.880 --> 05:21.800]  So the cloud is a vague notion.
[05:22.000 --> 05:26.780]  So the data and the systems need to be located somewhere.
[05:27.100 --> 05:33.520]  So regions are the places, the locations, where the Microsoft data centers are.
[05:35.220 --> 05:37.680]  Templates is another feature for Azure.
[05:37.940 --> 05:41.500]  It's the way to automate your deployments.
[05:41.520 --> 05:46.500]  So you can script deployments, default configurations, and deploy them as you will.
[05:47.160 --> 05:48.380]  And finally, extensions.
[05:48.720 --> 05:58.340]  It's a feature that allows you to extend the functionality of your systems, like virtual machines with anti-malware devices, anti-malware services.
[06:00.480 --> 06:03.660]  Now, how can we manage the services in the Azure environment?
[06:04.020 --> 06:10.780]  So we have access controls for... access paths for all the users, like web access.
[06:11.040 --> 06:13.320]  You have two portals to manage the services.
[06:13.660 --> 06:18.240]  Then you have programmatic APIs, where you can develop your own applications.
[06:19.120 --> 06:27.440]  Command line tools for super-users, PowerShell, and the client tools for Linux and OSX users.
[06:28.080 --> 06:32.000]  And finally, traditional clients like RDP and SSH.
[06:34.460 --> 06:36.500]  This is the Azure portal.
[06:37.040 --> 06:40.590]  As we said earlier, this is like a web portal available on...
[06:41.530 --> 06:46.230]  You can access resource manager model deployments and classic model deployments.
[06:46.750 --> 06:50.450]  We will focus on the resource manager, as this is the latest one.
[06:50.650 --> 06:55.050]  And we will see some screenshots from this portal.
[06:56.370 --> 06:58.630]  Basically, don't access it through Internet Explorer.
[06:58.810 --> 06:59.490]  It's rather slow.
[06:59.710 --> 07:01.370]  Try Chrome or something else.
[07:05.520 --> 07:09.500]  Yeah, so now we've got an idea of what are the main terminology.
[07:09.500 --> 07:13.740]  Let's see how... what are the actual controls that we have in place.
[07:14.020 --> 07:19.540]  And we can highlight some points for the Azure functionality for pen testing.
[07:22.140 --> 07:27.480]  So, Azure gives you like various security controls that you can deploy from...
[07:27.480 --> 07:30.440]  for various layers of your... within your network.
[07:30.700 --> 07:34.100]  Starting from your perimeter, deep down to your deployment.
[07:34.360 --> 07:36.000]  To the individual endpoints.
[07:36.000 --> 07:40.660]  So, let's start with each point, each layer and see how we can protect it.
[07:40.880 --> 07:42.820]  Starting with the cloud access layer.
[07:43.800 --> 07:50.080]  Azure gives you like a transparent service protection against the denial of service attacks.
[07:50.380 --> 07:51.340]  Large scale attacks.
[07:52.220 --> 07:54.480]  The main approach they follow is...
[07:55.000 --> 07:59.120]  They move your systems from your services in different data centers.
[07:59.360 --> 08:01.020]  In order not to be affected.
[08:02.060 --> 08:07.960]  However, Microsoft states that you are responsible for the security of your own applications.
[08:10.500 --> 08:13.060]  And this... Microsoft is PCI compliant.
[08:13.060 --> 08:16.400]  So, if you make something wrong in your applications, it's your fault.
[08:17.780 --> 08:22.100]  So, also during a security assessment, you will not be able to see any...
[08:22.100 --> 08:25.020]  not configure this functionality.
[08:25.060 --> 08:28.880]  However, you have third-party solutions for denial of service.
[08:29.000 --> 08:32.540]  So, you can configure other mitigation controls like Synth cookies.
[08:34.580 --> 08:36.300]  Going further into the network.
[08:36.680 --> 08:40.180]  Virtual networks is the main building block for networking.
[08:40.180 --> 08:46.140]  And it's the main isolation block where you have...
[08:46.140 --> 08:49.020]  You can segregate the various components.
[08:49.260 --> 08:58.140]  So, for example, if you have services in one virtual network, they cannot access other virtual networks without direct connection.
[08:58.420 --> 08:59.400]  Explicit connection.
[09:00.560 --> 09:04.000]  They can contain subnets and gateway subnets.
[09:04.100 --> 09:08.120]  Gateway subnets is a special type of subnets that provide gateway services.
[09:08.780 --> 09:11.440]  You can perform normal pen testing activities.
[09:11.680 --> 09:13.340]  For example, discovering the subnets.
[09:13.480 --> 09:14.540]  You can do ARP scanning.
[09:15.060 --> 09:21.400]  However, you cannot ping other systems in the same virtual network.
[09:21.500 --> 09:24.320]  Although, you can access them properly with the clients.
[09:26.080 --> 09:28.100]  So, how can we access the...
[09:28.780 --> 09:30.820]  We said they are isolated.
[09:31.040 --> 09:32.640]  But how can we access the environments?
[09:32.640 --> 09:47.720]  So, if the client exposed services like SSH or RDP on the Internet, then, although this is like a bad practice, we need to raise it because if it's configured badly, then it can increase the attack surface.
[09:48.080 --> 09:50.700]  We can just use normal clients.
[09:50.920 --> 09:55.940]  Although, Azure by default, they use a self-signed certificate for RDP connections.
[09:56.740 --> 10:00.260]  So, make sure that this is configured properly.
[10:01.660 --> 10:06.640]  The safer way, the best approach is to use a VPN connection.
[10:06.840 --> 10:10.220]  It's a virtual private network to connect.
[10:10.380 --> 10:13.940]  So, let's see some more details about these configurations.
[10:14.920 --> 10:16.540]  Starting with the point to site.
[10:16.740 --> 10:21.300]  This is a normal configuration where you connect a client to the network.
[10:21.300 --> 10:24.600]  You need to have configured a gateway subnet.
[10:24.780 --> 10:27.500]  And then, you connect the remote client.
[10:27.500 --> 10:29.720]  And you can have multiple remote clients.
[10:29.720 --> 10:34.660]  And you connect it directly to your virtual network in order to access all the services.
[10:35.420 --> 10:39.500]  One point I would like to highlight here for scoping requirements.
[10:39.680 --> 10:43.600]  When, before you go to the assessment, ask for the VPN package.
[10:43.860 --> 10:53.260]  So, this is like the client you would like to have in order to configure your adapter in your interface, in your system, in order to connect.
[10:53.940 --> 10:57.720]  And also, ask for a client certificate from the tenant.
[10:57.900 --> 11:04.080]  This is like the certificate they will generate and will provide it to you for authentication.
[11:04.560 --> 11:08.620]  There are two different ways for classic model and resource manager model to get the package.
[11:09.380 --> 11:13.100]  So, just highlight it here for convenience.
[11:15.120 --> 11:19.920]  Site-to-site is another way to connect the virtual networks.
[11:19.920 --> 11:24.800]  So, you can have various types of connectivity you can face in an assessment.
[11:25.080 --> 11:41.720]  You can have either cloud only, where the virtual networks are located in the cloud, or you can have hybrid connectivity between on-premises systems, like the normal systems of the client, the corporate network, and connected to the cloud.
[11:42.040 --> 11:47.800]  In the first case, you need to configure VPN gateways in both virtual networks.
[11:48.500 --> 11:52.940]  And you can connect on it using like a point-to-site connection.
[11:53.180 --> 11:58.920]  If the connection is bidirectional between the two VPN gateways, then you can access all the systems.
[11:59.560 --> 12:10.060]  In the other case, where it's like on-premises to the cloud, you can be either on-site to the client, and the routing will be automatically, you can access the cloud.
[12:10.060 --> 12:22.920]  There is express route as well, as a third option for hybrid connections, where it's a dedicated channel, either through a cloud exchange provider, or through a fiber optic, using a network service provider.
[12:23.800 --> 12:25.860]  However, I haven't poked with it a lot.
[12:25.960 --> 12:27.400]  This is a good research project.
[12:29.860 --> 12:43.940]  When you configure a VNet to VNet connection, you can find out the pre-shared key that is used for authentication and encryption, and it's providing clear text in the Azure portal.
[12:44.020 --> 12:48.680]  So make sure that they actually enforce a strong password for it.
[12:51.450 --> 12:55.550]  We saw the security and the communication between the virtual networks.
[12:55.750 --> 12:57.930]  How can we secure the other services?
[12:58.170 --> 13:00.010]  Like, we're focusing on the web apps.
[13:00.210 --> 13:05.010]  This is like the platform-as-a-service version of web apps.
[13:05.010 --> 13:12.170]  You can have normal SSL configuration, SSL certificates, either IP-based or host name-based.
[13:13.230 --> 13:18.890]  Azure provides native support with extensions for Let's Encrypt certificate authority.
[13:19.070 --> 13:23.390]  So there's no excuse if the client don't want to use HTTPS.
[13:23.850 --> 13:30.230]  And there's another extension to just redirect the traffic from HTTPS to... from HTTP to HTTPS.
[13:32.890 --> 13:43.830]  Make sure that when you do application assessment, like a code review, you check the web config files, or based on the technology, you check the respective configuration file.
[13:47.390 --> 13:53.990]  Azure SQL Database and Azure SQL Server is another service provided as platform-as-a-service.
[13:55.270 --> 14:02.870]  It's a stripped-down version of the Microsoft SQL Server, so I believe in the backend it's like a normal SQL Server.
[14:03.630 --> 14:11.390]  What we need to point out here is you check the connection strings for the communication between the application and the SQL Server.
[14:12.250 --> 14:16.110]  Make sure that the two points we highlight here...
[14:16.110 --> 14:17.330]  Oh, the laser.
[14:17.530 --> 14:18.430]  Yeah, I can see it.
[14:18.810 --> 14:25.710]  So, Encrypt is always true, but you can actually encrypt the traffic, and Trust Server certificate is always false.
[14:25.710 --> 14:32.650]  So, in this case, you enforce the application to verify the server certificate just to avoid any man-in-the-middle attacks.
[14:36.800 --> 14:44.300]  So, we mentioned the configuration you have for transport security, but then how you can control the traffic.
[14:45.440 --> 14:48.580]  We said earlier about the VPN appliances.
[14:48.880 --> 14:52.140]  You can have third-party VPN appliances instead of the Azure VPN.
[14:52.140 --> 14:57.440]  These are configured as virtual machines where you deploy into your virtual networks.
[14:58.100 --> 15:04.160]  And apart from that, you can have web application firewalls for the web services and normal IDs, IPS.
[15:04.500 --> 15:06.840]  These are provided as third-party solutions.
[15:09.920 --> 15:10.600]  Firewalling.
[15:10.760 --> 15:15.920]  So, the main firewalling solution is like network security groups.
[15:16.160 --> 15:23.320]  Network security groups, the configuration is like the traditional IP tables or Windows firewall configuration.
[15:24.620 --> 15:29.300]  You can deploy them, you can apply them in subnets or in virtual machines.
[15:29.980 --> 15:42.640]  And make sure that the best approach is like to have the generic configuration in the subnet, and then restrict access to specific endpoints based on the business requirements.
[15:42.640 --> 15:48.280]  So, check that the actual client configures that has the appropriate configuration.
[15:49.000 --> 15:58.400]  You can retrieve the rules from the portal, the Azure portal, or from the partial commandlets or the other tools that are available.
[15:58.640 --> 16:02.420]  And we'll see later at the end another way to do it more efficiently.
[16:03.180 --> 16:11.380]  By default, when they are created, there are some default custom... default rules which allow traffic between the Azure services.
[16:11.380 --> 16:14.760]  However, these are assigned the lowest priority.
[16:15.040 --> 16:15.800]  You cannot delete.
[16:15.980 --> 16:17.200]  You cannot customize them.
[16:18.020 --> 16:21.860]  Just leave them there and configure yours with the highest priorities.
[16:23.100 --> 16:25.240]  These rules allow ICMP traffic.
[16:25.500 --> 16:29.540]  However, your configuration can only configure TCP and UDP traffic.
[16:32.560 --> 16:36.020]  Another control for access for traffic...
[16:36.600 --> 16:39.880]  controlling the traffic is access control list.
[16:39.940 --> 16:41.560]  It's more limited functionality.
[16:41.560 --> 16:47.740]  You can only allow or deny access to a specific service in the VM.
[16:48.560 --> 16:56.720]  So, because the NSGs, the network security groups, allow for better configuration, it's suggested solution instead of this.
[16:59.400 --> 17:03.740]  We mentioned some third-party appliances.
[17:04.010 --> 17:11.640]  So, by default, the routing within the virtual networks and between the subnets is performed automatically with system routes.
[17:11.860 --> 17:23.940]  However, when you define your own virtual machines for security configuration, you need to have to deploy your own routes, to define your own routes.
[17:24.640 --> 17:25.970]  And this happens...
[17:25.970 --> 17:27.320]  This comes in play...
[17:27.320 --> 17:28.280]  This comes...
[17:28.280 --> 17:34.140]  Here comes in play the user-defined routing where you need to specify the next hop.
[17:35.520 --> 17:38.340]  So, when you do it, make sure that...
[17:38.340 --> 17:51.020]  Because the traffic is only allowed to be routed from one subnet to another subnet, make sure that the client actually deploy a proper configuration, and they don't just use the system, the default routes.
[17:55.110 --> 17:58.030]  Azure doesn't give us generic firewall configuration.
[17:58.030 --> 18:01.410]  We can focus on specific services.
[18:01.710 --> 18:06.690]  So, like in the SQL server and the database, we can have firewall rules.
[18:06.870 --> 18:09.930]  You can allow access only to specific IP addresses.
[18:10.470 --> 18:12.990]  And you can do it from the Azure firewall.
[18:13.230 --> 18:14.430]  You can retrieve the...
[18:14.430 --> 18:15.270]  From the Azure portal.
[18:15.490 --> 18:20.790]  You can retrieve the configuration from the portal or from the PowerShell commandlets.
[18:22.270 --> 18:34.410]  And one thing I would like to highlight here is that access to all the Azure resources is allowed by default to your services, to your servers, to SQL servers.
[18:34.670 --> 18:46.150]  So, make sure that this configuration is off because apart from your own Azure services, any malicious tenant can also access your servers.
[18:46.330 --> 18:50.150]  So, restrict access only to your authorized IP ranges.
[18:51.890 --> 18:57.610]  As a defensive depth, we can apply configuration, firewall configuration, to the database level.
[18:57.790 --> 19:05.830]  And this can only happen using the management studio, the SQL management studio, and SQL queries.
[19:05.870 --> 19:09.910]  So, you can configure this and also retrieve the configuration.
[19:13.630 --> 19:30.490]  Apart from restating, controlling the traffic in the Azure, there is some legitimate Azure traffic that we would like to allow in order that the services to communicate, retrieve the health, communicate, for example, for requests like DHCP or DNS.
[19:31.670 --> 19:40.910]  So, make sure that when you find something that doesn't seem right, first you double-check that it's not a legitimate IP before you flag it as malicious.
[19:43.800 --> 19:46.280]  We saw the encryption at Intrasit.
[19:47.160 --> 19:49.320]  So, what about the data at rest?
[19:49.400 --> 19:50.500]  How can we secure them?
[19:51.060 --> 19:56.960]  First of all, you can deploy traditional methods for encryption at the OS and disk level.
[19:57.100 --> 20:00.540]  This is the main difference between traditional configurations.
[20:00.820 --> 20:03.960]  You can have two separate configuration for encryption.
[20:03.960 --> 20:07.940]  You can deploy like BitLocker for Windows, DM Crypt for Linux.
[20:08.720 --> 20:12.640]  You can also have transparent data encryption for SQL Server.
[20:13.260 --> 20:18.140]  And for Azure Storage, this is another service, you can have Blob encryption.
[20:18.400 --> 20:21.200]  You can configure most of them through the Azure portal.
[20:22.300 --> 20:27.200]  A nice, neat feature of the Azure environment is the Azure Key Vault.
[20:27.440 --> 20:32.760]  This is a secure, hardened container which contains your cryptographic material.
[20:33.020 --> 20:35.940]  By cryptographic material, we mean keys and secrets.
[20:36.360 --> 20:42.980]  The keys can be like keys that are generated in the HSM or can be software-generated keys.
[20:43.620 --> 20:52.300]  However, even if they are software-generated keys, Azure protects you with another key that is then stored in the HSM.
[20:53.980 --> 20:59.560]  Secrets are shorter cryptographic material like SSL certificates or passwords.
[21:00.520 --> 21:08.260]  And, like, if we want to highlight something for privacy here, by default, Azure services or Azure employees, they don't have access to the Key Vault.
[21:08.860 --> 21:17.500]  However, Azure services might need to access the keys in order to decrypt the operating system while it boots.
[21:17.500 --> 21:21.780]  So, you can define specifically if you are allowed to access it.
[21:23.420 --> 21:32.040]  The Azure Key Vault is PCI compliant, according to the latest attestation of certification from PCI.
[21:33.020 --> 21:38.360]  And, yeah, let's see some more specific details about the Key Vault.
[21:38.360 --> 21:46.320]  One thing that we need to focus on during a review of the Azure configuration is the access policies.
[21:47.780 --> 21:54.060]  How we allow people, like users, and applications to access our Key Vault.
[21:54.060 --> 22:01.660]  Make sure that no excessive access is allowed and the configuration is according to the business requirements.
[22:02.480 --> 22:08.200]  You can also see... you can retrieve this configuration only through a partial commandlets.
[22:11.040 --> 22:15.300]  Apart from the Key Vault, the keys and the secrets have their own properties.
[22:16.140 --> 22:19.640]  You can retrieve it, again, through PowerShell.
[22:19.860 --> 22:23.100]  And there is, like, the key type, as we mentioned earlier.
[22:23.280 --> 22:27.900]  It can be either HSA, HSM, or software generated.
[22:28.260 --> 22:37.380]  Currently, they support only asymmetric RSA encryption with long enough keys, like 2048-bit long.
[22:41.060 --> 22:42.120]  Azure database.
[22:42.780 --> 22:44.000]  The SQL database.
[22:44.780 --> 22:49.740]  You can configure the transparent data encryption very easily from the Azure portal.
[22:49.920 --> 22:52.340]  And you can retrieve the configuration as well from there.
[22:52.520 --> 22:56.380]  But we are super users, so we need to get our hands dirty.
[22:56.580 --> 23:00.480]  So we can get it from the SQL Management Studio as well.
[23:00.700 --> 23:05.180]  You can configure the encryption and get the configuration from...
[23:05.180 --> 23:08.420]  You can get all the rows.
[23:08.420 --> 23:11.780]  So here you can see the algorithm has been used.
[23:13.600 --> 23:19.160]  These are not keys that are stored in the Azure Key Vault for the transparent data encryption, by the way.
[23:23.680 --> 23:31.440]  Some clients, some organizations, have requirements to mask their data for, like, PII or PAN data.
[23:32.540 --> 23:36.720]  Azure gives you this ability to specify, like, rules.
[23:37.140 --> 23:40.360]  So make sure you check these rules, so that they apply them properly.
[23:40.920 --> 23:47.680]  And also you can see which users have been excluded from this list, so they can view the data without masking.
[23:50.400 --> 24:04.260]  And going down to the endpoint protection, like the actual virtual machines, you can have services from third parties or from Microsoft, like anti-malware and anti-virus.
[24:06.140 --> 24:08.440]  This is the default configuration I highlight here.
[24:08.660 --> 24:15.380]  You probably don't be able to see it, but you can view, like, what is actually the default configuration.
[24:16.520 --> 24:29.400]  From my experience, I was not able to configure anti-malware service from Microsoft after the initial creation, although the third-party solutions, they have clients on the actual VMs.
[24:30.040 --> 24:35.800]  You can view it here in the portal, or you can use a partial commandless to retrieve the configuration.
[24:37.680 --> 24:39.800]  And what about backup security?
[24:41.080 --> 24:48.000]  In the basic, the full server of Microsoft SQL server, you can get...
[24:48.000 --> 24:52.780]  You can set up the encryption during the creation of the virtual machine.
[24:53.220 --> 24:55.800]  You can also set the data retention policy.
[24:56.980 --> 25:10.740]  And as we said, in the Azure SQL database, when you define the transparent data encryption, all the data from your data to the log files and to the backup files are also encrypted.
[25:11.440 --> 25:17.140]  However, when you export the database from the Azure portal, this is not encrypted.
[25:17.320 --> 25:22.160]  So make sure that the client stores it in a secure container or somewhere securely.
[25:25.350 --> 25:34.050]  We saw the various security controls throughout the layers in the network, starting from the perimeter down to the endpoints.
[25:34.290 --> 25:36.570]  What about the user access controls?
[25:37.110 --> 25:41.890]  In the classic model, you had the two main user administrator roles.
[25:42.170 --> 25:50.110]  One was for the service administrator, and the other ones, the co-administrators, which were able to administer their services.
[25:50.110 --> 26:00.950]  In the newest resource manager model, you have the role-based access control, where you have more granular configuration of the access policy.
[26:02.110 --> 26:05.830]  We will see some more details about it in a little bit.
[26:06.730 --> 26:12.110]  Azure Active Directory is a special version of Active Directory available in Azure.
[26:12.110 --> 26:20.550]  Azure, and again, you can configure groups and users as you could do in a normal Active Directory in a Windows domain on your premises.
[26:21.710 --> 26:29.830]  There is also capability for third-party single sign-on for authorization and authentication, like Facebook and Google.
[26:31.070 --> 26:41.510]  Last but not least, you have multi-factor authentication using text message or phone calls or message verification codes.
[26:42.450 --> 26:53.670]  Make sure that the client actually uses this for the Azure management portals and the Azure portal, so to ensure that your management interface is protected properly.
[26:56.490 --> 26:59.690]  There are some more details about the role-based access control.
[27:00.830 --> 27:03.510]  As we said, you can have fine-grade configuration.
[27:03.510 --> 27:05.750]  You have three main roles.
[27:06.050 --> 27:13.090]  Contributor, owner, contributor, and reader, which the owner has the full privileges.
[27:14.210 --> 27:19.690]  Contributor has full access to the services, but they cannot configure access controls.
[27:20.410 --> 27:23.350]  And reader has only read access.
[27:24.290 --> 27:29.150]  In the Azure, you have three layers that you can configure access.
[27:29.150 --> 27:32.770]  At the subscription, at the resource groups, and then at the resources.
[27:33.110 --> 27:35.990]  And it's one of them inherited from the previous level.
[27:37.290 --> 27:44.950]  So in the connection between... also you can have... you can configure specific access for your resources.
[27:45.190 --> 27:52.810]  Like a virtual machine can have its own contributor, and an SQL database can have another reader for it.
[27:52.810 --> 27:56.130]  Just to make sure that you have only the access privileges you need.
[27:57.310 --> 28:03.490]  So the linking between the classic model and the newest model of access control.
[28:03.790 --> 28:10.930]  The previous subscription administrators, the service administrator, and the co-administrators, now inherit the owner role.
[28:10.930 --> 28:13.010]  So you can access and manage everything.
[28:16.640 --> 28:22.440]  Similar in the SQL databases, you can have fine-grade access configuration with various groups.
[28:24.300 --> 28:27.800]  And in the web apps, you have the single sign-on configuration.
[28:28.520 --> 28:33.660]  And isn't it something you would like to have, like Facebook or Google, to authenticate to your web apps?
[28:36.920 --> 28:44.760]  So scanning the services from an external point of view, you will see some ports you usually don't expect.
[28:45.980 --> 28:51.280]  But make sure that you don't flag again something that you will impact the Azure services.
[28:52.480 --> 28:58.640]  You can see here some proof of concept for the gateway, the SQL server, and the web applications.
[28:59.440 --> 29:09.100]  One interesting fact is that in the Azure web application, you can deploy your files or configuration using FTP.
[29:09.400 --> 29:12.020]  However, we cannot see any FTP ports open here.
[29:12.020 --> 29:18.280]  This port there looks like a FTP with 1221 TCP port.
[29:18.500 --> 29:21.620]  However, you can only access it through HTTP request.
[29:21.840 --> 29:25.140]  When you send a HTTP request, you get back an IP.
[29:25.360 --> 29:28.240]  And that IP address is the FTP server.
[29:28.840 --> 29:31.640]  Unfortunately, anonymous authentication is not enabled.
[29:34.480 --> 29:39.240]  What secure environment would be Azure if it doesn't have an auditing and monitoring capability?
[29:40.200 --> 29:43.220]  So you can collect data from your services.
[29:43.220 --> 29:45.240]  You can specify your own rules.
[29:45.480 --> 29:52.000]  You can specify alerts to retrieve the data and get notifications when something is wrong.
[29:52.000 --> 30:01.000]  And as we can see in some specific details for the Azure SQL server, there is auditing configuration through the Azure portal.
[30:01.240 --> 30:03.340]  You can also retrieve it through PowerShell.
[30:05.320 --> 30:08.400]  You can have like for failure and or success events.
[30:09.700 --> 30:18.460]  And one neat feature, again, I like some functionalities that's available in Azure.
[30:18.660 --> 30:19.720]  It's like thread detection.
[30:20.640 --> 30:24.640]  So you can configure in the same section in the settings panel.
[30:25.000 --> 30:28.500]  You can configure detection for SQL vulnerabilities.
[30:28.560 --> 30:31.400]  And this is something I would like to have in my configuration.
[30:33.380 --> 30:38.540]  One question I got from one of my colleagues is like, what happens if I have a Splunk server?
[30:39.320 --> 30:42.260]  How can I get access logs, audit logs?
[30:42.480 --> 30:52.180]  So Azure has an add-on for Splunk, so you can communicate directly with the services and retrieve all the data in your server directly.
[30:54.880 --> 30:56.660]  Also, monitoring capabilities.
[30:56.660 --> 30:59.000]  You can enable your own rules.
[30:59.160 --> 31:03.640]  And through the Azure portal, again, you have various metrics.
[31:03.640 --> 31:07.900]  You have various configurations about when to get notified.
[31:08.200 --> 31:12.640]  And you can specify a list of users to be notified.
[31:13.160 --> 31:21.280]  However, getting your notifications in your mail is a good approach.
[31:21.720 --> 31:28.620]  But Azure Security Center provides you more comprehensive details about your issues in your environment.
[31:29.320 --> 31:33.560]  This is a SOC provided for free in the Azure environment.
[31:33.560 --> 31:36.020]  It's available through the portal, the Azure portal.
[31:36.820 --> 31:42.200]  And gives you some details about prevention and detection issues you have.
[31:42.320 --> 31:44.400]  Like, how can you mitigate...
[31:44.400 --> 31:52.340]  How you can apply additional mitigation controls to deploy... to strengthen the security posture of your environment.
[31:52.340 --> 31:59.000]  And also, how you can detect any malicious activities or threats against your environment.
[32:00.000 --> 32:02.340]  So, in the prevention panel...
[32:03.220 --> 32:05.360]  This is available from the Azure portal again.
[32:05.680 --> 32:11.980]  You can see the health of your environments in the virtual machines, networking, and the other services.
[32:11.980 --> 32:15.920]  And then you can actually do...
[32:16.860 --> 32:20.860]  Take some mitigation activities against the issues.
[32:23.680 --> 32:28.500]  One feature provided in this environment is the security policies.
[32:28.700 --> 32:30.720]  You can configure specific rules...
[32:30.720 --> 32:38.220]  Policies according to the client's requirements in order to retrieve data from the various Azure services.
[32:38.220 --> 32:42.080]  Like, for example, for missing patches or baseline rules.
[32:42.520 --> 32:44.200]  And this happens regularly.
[32:44.820 --> 32:52.560]  And the Azure Security Center aggregates them and presents them as recommendations in the security center.
[32:52.780 --> 33:03.400]  So, when you start doing an assessment, make sure you start from the security center to get a better idea of what's the current health of the environment, the security status.
[33:05.220 --> 33:06.500]  Regarding detection...
[33:06.500 --> 33:08.280]  This is the main panel.
[33:08.520 --> 33:10.160]  It's similar to the prevention one.
[33:10.400 --> 33:15.200]  Before you start an assessment, make sure you take note of these numbers down here.
[33:15.360 --> 33:17.480]  What are the alerts you have?
[33:17.660 --> 33:19.200]  The client has already.
[33:19.460 --> 33:27.620]  So, in case you generate additional alerts to exclude them in the end.
[33:28.940 --> 33:32.620]  And some of the very, very nice features from these environments.
[33:32.620 --> 33:38.860]  You can get detailed and verbose information for any issues that happen.
[33:38.980 --> 33:41.760]  Like here, you have the RDP brute-force.
[33:41.880 --> 33:45.700]  So, you can get how many users were found successfully or not.
[33:46.540 --> 33:53.660]  And also, I tried running ACAR in one virtual machine with Microsoft anti-malware installed.
[33:53.660 --> 33:57.160]  And the service was...
[33:57.160 --> 34:05.200]  The security center retrieved the details and presented here what's the actual file, what are the actions that was taken.
[34:08.970 --> 34:11.370]  So, we have seen the main security controls.
[34:11.790 --> 34:13.510]  And it's a lot of work to do.
[34:13.710 --> 34:19.190]  Like, when you want to review an environment, you are a pen tester, you want to go inside, you have no idea about Azure.
[34:19.490 --> 34:23.910]  And you want to get an idea about the whole subscription, how things look like.
[34:24.110 --> 34:26.150]  So, here comes in play Azureite.
[34:26.870 --> 34:28.950]  So, in Azureite, you have...
[34:28.950 --> 34:31.850]  And also, you can see here, this is the only word spelled with Z.
[34:32.650 --> 34:32.950]  Yeah.
[34:33.630 --> 34:35.190]  It's a favor for you.
[34:36.410 --> 34:41.270]  So, starting with the main component, this is like the Azureite Explorer.
[34:44.490 --> 34:47.690]  So, this is basically a tool written in...
[34:47.690 --> 34:49.990]  using the Azure PowerShell commandlets.
[34:49.990 --> 34:55.710]  And it can retrieve the configuration from all the systems we have seen so far.
[34:55.890 --> 35:04.590]  Starting like with virtual machines, your virtual network configuration, your subnets, your key vaults, web applications.
[35:05.050 --> 35:09.790]  So, all the information we have seen so far, you can retrieve them in a structure format.
[35:11.370 --> 35:29.950]  Because, for me, it was like very slow going through all the systems one by one and trying to retrieve the configuration and see what is the various IPs, what are the connections between the systems, and what is the configuration, for example, for the encryption configuration for a virtual machine.
[35:30.370 --> 35:33.730]  So, I was trying to find a better way to do it.
[35:33.850 --> 35:43.830]  So, an auditor or a penetration tester that wants to have a better idea of the environment, they can do it like passively, and retrieve the data off-site.
[35:44.270 --> 35:46.290]  So, you just need the details.
[35:46.550 --> 35:50.230]  You just need credentials for the subscription.
[35:50.510 --> 35:55.050]  So, the client can provide you like with your credentials.
[35:55.810 --> 36:02.170]  For a user, either with one of the main three roles, owner, contributor, or reader.
[36:02.170 --> 36:05.570]  I believe they will be really reluctant to give you owner.
[36:08.470 --> 36:16.890]  So, as soon as this executed, one of my main problems was like I was thinking, how do I need to present the data to the users?
[36:17.690 --> 36:20.290]  Shall I do like a table format?
[36:20.530 --> 36:24.770]  Shall I do like an HTML page with the data?
[36:25.270 --> 36:32.230]  So, I decided to do something more structured and leave the pen testers to handle the data as they want.
[36:32.510 --> 36:38.090]  So, the output from this tool, the Azure Light Explorer, is JSON files.
[36:40.710 --> 36:42.750]  It contains all the JSON objects.
[36:42.950 --> 36:45.670]  So, in the end, you can get some statistics for the environment.
[36:46.250 --> 36:48.650]  So, in this case, we can see JSON objects.
[36:48.810 --> 36:50.670]  We can get some details for the environments.
[36:51.890 --> 36:52.810]  Can you see it?
[36:53.870 --> 36:54.350]  Okay.
[36:54.610 --> 36:57.870]  So, you can get some configuration for the network security groups.
[36:57.870 --> 37:00.050]  What are the ports that are allowed?
[37:00.230 --> 37:02.530]  If it's inbound, outbound traffic.
[37:03.690 --> 37:06.450]  And then, like for the virtual machine encryption.
[37:06.770 --> 37:12.170]  If it's data for the operating system or the disk.
[37:12.350 --> 37:14.710]  If it's enabled or not.
[37:15.210 --> 37:16.750]  And you get all this information.
[37:16.750 --> 37:26.890]  So, you can scroll down through all of them and get some more details, verbose details about the system without having to go through all of them on the Azure portal.
[37:26.890 --> 37:28.090]  You can just do it offline.
[37:28.630 --> 37:30.470]  In this case, you have the key vault.
[37:30.690 --> 37:33.330]  You can get the access policies, as we mentioned earlier.
[37:33.610 --> 37:40.490]  You can have the properties of the secrets and the keys later on.
[37:42.870 --> 37:51.270]  So, as soon as I got this output from the Azure environment, I thought that I have to do something else.
[37:51.430 --> 37:53.430]  Like, okay, you can get the JSON object.
[37:53.870 --> 38:00.070]  But what is something else I can do to present it more comprehensive and get some idea about the environment?
[38:00.350 --> 38:02.350]  This is good, but it's just text files.
[38:02.610 --> 38:04.630]  I'm tired of text files.
[38:04.990 --> 38:06.770]  So, here comes the visualizer.
[38:07.450 --> 38:08.750]  Azure right visualizer.
[38:08.750 --> 38:12.730]  So, in this case, I get the JSON object.
[38:12.890 --> 38:14.690]  I convert it to another JSON object.
[38:15.030 --> 38:21.790]  However, this JSON object shows me the connections between the various systems in the subnet.
[38:21.970 --> 38:38.910]  So, when I import it, create a HTML file, you can get an output in the graph format, and you can get information about the various associations between the systems in the tree structure, from the virtual network to the subnet, down to the VMs.
[38:39.450 --> 38:44.550]  You can get details about the weak ACLs, the network security groups.
[38:46.170 --> 38:49.590]  So, for example, in this case, we have a subnet with a weak ACL.
[38:49.870 --> 38:58.810]  You can see here the names of the ACLs, and you can go back in your JSON output and actually review the configuration.
[39:01.250 --> 39:03.590]  This is not a traditional network diagram.
[39:03.770 --> 39:06.850]  It shows the connections between your services.
[39:07.090 --> 39:10.570]  So, for example, here you can see if the virtual machine is encrypted.
[39:11.670 --> 39:18.890]  So, you can get a better understanding straight away at one glance, like, without having to scroll through all the files.
[39:19.070 --> 39:20.870]  You get the connections between the systems.
[39:20.870 --> 39:22.630]  You can interact with the graph.
[39:24.450 --> 39:29.330]  And this is about the VNet gateway, the configuration, the public IP address.
[39:29.550 --> 39:33.350]  You get information about the IP configuration of the networks.
[39:34.990 --> 39:38.230]  And also, as we said, it's not a traditional environment.
[39:38.270 --> 39:44.450]  You get information about the SQL servers, how they are connected, what SQL databases they have.
[39:45.630 --> 39:46.630]  You can get...
[39:46.630 --> 39:56.830]  If it's, like, for example, encrypted, and for the Azure SQL server, you can see what IP addresses are allowed to connect, what remote clients.
[40:01.280 --> 40:04.280]  So, one last feature is, like, the web applications.
[40:04.420 --> 40:16.560]  So, the limitation of, like, these tools, like Explorer and Azureite, is, like, they are based on the PowerShell commandlets, and it's only the functionality supported by Microsoft.
[40:16.980 --> 40:23.340]  There is some additional functionality, and we'll try to amend it in the near future.
[40:27.000 --> 40:27.600]  So...
[40:28.840 --> 40:29.640]  Thank you.
[40:33.190 --> 40:34.090]  Thank you, guys.
[40:34.390 --> 40:35.770]  So, some conclusions.
[40:36.090 --> 40:37.830]  We have just scratched the surface.
[40:38.110 --> 40:40.250]  There is a lot more to cover.
[40:40.750 --> 40:45.170]  However, each one of these components can be one presentation and so on.
[40:46.930 --> 41:02.230]  It requires some familiarization with the services, and, however, I believe that the Azure provides you the right controls to deploy, like, defensive depth approaches, or do your job, like, create tools and interact with the services.
[41:02.730 --> 41:10.050]  And finally, although I thought it's not the most mature, maybe Amazon is a little better, they are doing gradually a better job.
[41:10.170 --> 41:15.290]  So, in the near future, it will be the cloud service of the choice.
[41:17.090 --> 41:20.670]  Check out this space, the labs.mwrenfosecurity.com.
[41:20.790 --> 41:33.150]  I'll publish, like, a document with extensive details, with screenshots, and more specific details about, like, how to assess the environment, and, like, the tool will be available soon.
[41:34.390 --> 41:35.810]  Thank you very much for your time.
[41:36.010 --> 41:36.870]  Any questions?
[41:45.110 --> 42:01.870]  Does your visualizer give me any ability to demonstrate to someone, maybe, that least privilege is being enforced, or some kind of separation of duties, or, you know, this guy can't see that, that's masked, these people in this group are not there?
[42:02.030 --> 42:03.650]  Do you approach any of that stuff?
[42:04.730 --> 42:08.410]  No, at the moment, I only approach the configuration of the systems.
[42:08.890 --> 42:14.830]  However, you can get some information about the systems, but it can be, like, a separate component.
[42:15.430 --> 42:17.730]  It cannot be associated with the virtual machines.
[42:18.090 --> 42:20.390]  Right, but you were talking through...
[42:20.390 --> 42:27.390]  I'm deliberately mentioning some of the features that you said were part of the security controls that you got from Azure.
[42:27.390 --> 42:27.890]  Yeah.
[42:28.310 --> 42:29.590]  So that's what I was getting at.
[42:29.670 --> 42:33.210]  Can you visualize some of those other Azure features?
[42:33.750 --> 42:50.790]  Yeah, you can probably can, because most of them you can retrieve through either the APIs or the partial, so you can retrieve the user access control rules, and you might not be able to have it in the same graph with the systems, but you might have another graph with the user access controls, yeah.
[42:51.610 --> 42:52.610]  It's really cool.
[42:53.110 --> 42:54.210]  Thank you, thank you very much.
[42:56.790 --> 42:57.930]  Yeah, I just have a...
[42:58.650 --> 42:59.890]  Yeah, of course.
[43:00.170 --> 43:01.490]  I just have a quick question for you.
[43:01.670 --> 43:01.870]  Yeah.
[43:02.050 --> 43:08.530]  How much have you seen in terms of, like, speed up of completion of engagements from creating your own tools?
[43:08.730 --> 43:10.270]  Like, has it been a force multiplier?
[43:10.270 --> 43:12.290]  Have you been able to cut down a manpower?
[43:13.050 --> 43:13.950]  Things like that.
[43:14.790 --> 43:24.830]  So in the Azure environment, I haven't done any more advanced security, like, testing, like using Empire or any.
[43:24.950 --> 43:31.770]  But it's like a common, it's a traditional environment, so you most probably can apply attacks.
[43:31.950 --> 43:47.010]  I'm not sure about Empire, so what I would like to do next is focus more on the Windows domain, the Azure subscription, the Azure Active Directory, and how you combine it with the on-premises Active Directory.
[43:47.010 --> 43:51.450]  For example, in red teaming assessment, what can I do?
[43:51.750 --> 43:53.350]  What information can I retrieve?
[43:53.630 --> 43:56.830]  Are the normal PowerShell tools effective?
[43:57.250 --> 44:00.190]  So, yeah, this is definitely something to look in the future.
[44:00.370 --> 44:00.730]  Yeah, of course.
[44:00.870 --> 44:02.790]  And, of course, feel free to do it.
[44:06.030 --> 44:06.470]  Cool.
[44:07.610 --> 44:08.750]  Thank you again, guys.
[44:08.750 --> 44:17.280]  Thank you, guys.