azure security center Archives - Apostolidis Cloud Corner

Vulnerability Assessment for Azure VMs included in ASC

Pantelis Apostolidis — Tue, 11 Feb 2020 14:59:23 +0000

Vulnerability Assessment for Azure VMs included in ASC

Hackers and all kind of intruders takes advantage of weakness and mistakes of operating systems and application to get unauthorized access. Those weakness are caused due to lack of updates and patches, mistakes in design and implementation or just a human error. The prevention method of those weaknesses and mistakes is a Vulnerability Analysis that depends upon two processes. The Vulnerability Assessment and the Penetration Testing.

Microsoft Azure, in cooperation with Qualys, offers Vulnerability Assessment at no additional cost for Azure Security Center Standard Tier. The Vulnerability Assessment Azure VM extension reports its findings to Azure Security Center. We have analyzed more Azure Security Center features at previous posts:

ATTENTION! To take advance of the Qualys offering that is included at the Azure Security Center Standard Tier, without any additional cost, the extension must be installed from the Azure Security Center “Enable the built-in vulnerability assessment solution on virtual machines (powered by Qualys)” recommendation and not by the “Vulnerability assessment solution should be installed on your virtual machines” recommendation.

Don’t worry if you don’t see this recommendation at your subscription yet. This is because it is a preview recommendation and it is being rolled-out slowly across all regions.

How to enable the Vulnerability Assessment extension

Go to Azure Security Center, at the “Resource Security Hygiene” and select the “Computer & apps”.

Find the “Enable the built-in vulnerability assessment solution on virtual machines (powered by Qualys)” recommendation and click it.

At the recommendation page, under the “Affected resources” section, there are three tabs. The “Unhealthy resources”, the “Healthy resources” and the “Not applicable resources”. The “Unhealthy resources, are Virtual Machines that are eligible but we have not enabled the extension yet. The “Healthy resources” tab includes the Virtual Machines that already have the extension installed. The “Not applicable resources” tab includes the Virtual Machines that are not eligible for the extension. This category includes images from third party companies or they are not enabled for ASC Standard tier.

Select the Virtual Machines that you want to enable the extension and press “Remediate”

Once the extension is installed, it will need several minutes for the Virtual Machine will move to the “Healthy resources” tab and the Vulnerability Assessment scan will start. Note that if the Virtual Machine is stopped the remediation will fail. The Virtual Machine must be running for the extension to install.

To check the VM extension health, go to the VM and check the Extensions tab for “WindowsAgent.AzureSecurityCenter | Qualys.WindowsAgent.AzureSecurityCenter”

Viewing the Vulnerability Assessment results

After the extension is installed, the scan will start but it will need about 24 to 48 before you will be able to view the results. After the scan finishes, it will report he results at the Azure Security Center, under the “Remediate vulnerabilities found on your virtual machines (powered by Qualys)” recommendation.

Find more info at: https://docs.microsoft.com/en-us/azure/security-center/built-in-vulnerability-assessment

Pantelis Apostolidis

Pantelis Apostolidis is a Sr. Specialist, Azure at Microsoft and a former Microsoft Azure MVP. For the last 20 years, Pantelis has been involved to major cloud projects in Greece and abroad, helping companies to adopt and deploy cloud technologies, driving business value. He is entitled to a lot of Microsoft Expert Certifications, demonstrating his proven experience in delivering high quality solutions. He is an author, blogger and he is acting as a spokesperson for conferences, workshops and webinars. He is also an active member of several communities as a moderator in azureheads.gr and autoexec.gr. Follow him on Twitter @papostolidis.

www.cloudcorner.gr

The post Vulnerability Assessment for Azure VMs included in ASC appeared first on Apostolidis Cloud Corner.

ASC | Remediate security recommendations in 1 click

Pantelis Apostolidis — Fri, 27 Sep 2019 12:50:14 +0000

Azure Security Center

Remediate security recommendations in 1 click

Azure Security Center provides unified security management and advanced threat protection across hybrid cloud workloads. Using advanced analytics, it helps you detect potentially malicious activity across your hybrid cloud workloads, and recommends potential remediation steps, which you can then evaluate, and take the necessary action.

One of the main features of Azure Security Center is that offers prioritized and actionable security recommendations so you can remediate security vulnerabilities before they can be exploited by attackers. To simplify remediation of security issues now allows you to remediate a recommendation on multiple resources with a single click.

Quick access to 1-click fix
The 1-click fix label is shown next to the recommendations that offer this faster remediation tool.
Logging for transparency
All remediation actions are logged in the activity log.

How to use 1-click remediation

Look for the “1-click Fix !” Label at the recommendations!

Once you click the “1-click Fix !” Label, the recommendation information page will pen. Select the affected resources and click Remediate

A final window will open that will inform you about the action that will be performed and what will affect. Check the information and if you agree click the final “Remediation” button

Current 1-click remediation availability

Remediation is available for the following recommendations in preview:

Web Apps, Function Apps, and API Apps should only be accessible over HTTPS
Remote debugging should be turned off for Function Apps, Web Apps, and API Apps
CORS should not allow every resource to access your Function Apps, Web Apps, or API Apps
Secure transfer to storage accounts should be enabled
Transparent data encryption for Azure SQL Database should be enabled
Monitoring agent should be installed on your virtual machines
Diagnostic logs in Azure Key Vault and Azure Service Bus should be enabled
Diagnostic logs in Service Bus should be enabled
Vulnerability assessment should be enabled on your SQL servers
Advanced data security should be enabled on your SQL servers
Vulnerability assessment should be enabled on your SQL managed instances
Advanced data security should be enabled on your SQL managed instances

Single click remediation is part of Azure Security Center’s free tier.

Sources:

Azure Security Center single click remediation

Azure Security Center—1-click remediation for security recommendations is now available

Pantelis Apostolidis

www.cloudcorner.gr

The post ASC | Remediate security recommendations in 1 click appeared first on Apostolidis Cloud Corner.

Azure Storage Advanced Thread Protection

Pantelis Apostolidis — Wed, 10 Oct 2018 15:19:54 +0000

Azure Storage Advanced Thread Protection

Azure Storage Advanced Threat Protection is a new security feature, currently in Preview. It monitors the Azure Blob Storage accounts. It detects anomalies and uncommon access to the Storage Account and notifies the admins through email.

All the Azure Storage Advanced Threat Protection monitoring and logs are integrated to the Azure Security Center, including the well known ASC recommendations.

It’s so easy to enable, just go to the Azure Portal, navigate to your storage account’s Advanced Threat Protection setting and switch it ON!

After that you can view the alerts at the Security Center, under Threat Protection’s Security Alerts.

Pantelis Apostolidis

www.cloudcorner.gr

The post Azure Storage Advanced Thread Protection appeared first on Apostolidis Cloud Corner.

Bulletproof manage your Azure VMs

Pantelis Apostolidis — Sun, 03 Dec 2017 21:35:58 +0000

Bulletproof manage your Azure VMs

Continuing the Azure Security Center posts, today we will see a new feature of the Security Center, called Just in Time VM Access.

As best security practice, all the management ports of a Virtual Machine should be closed using Network Security Groups. Only the ports required for any published services should be opened, if any.

However there are many occasions that we are requested to open a management port for administration or a service port for some tests for short time. This action has two major problems, first it requires a lot of administration time, because the administrator must go to the Azure Portal and add a rule at the VM’s NSG. The second problem is that many time the port is forgotten open and this is a major vulnerability since the majority of the Brute Force attacks are performed to the management ports, 22 and 3389.

Here comes the Azure Security Center, with the Just in Time VM Access feature. With this feature we can use the RBAC of the azure Portal and allow specific users to Request a predefined port to be opened for a short time frame.

JIT Configuration

Lets see how we configure the JIT. First we need to go to the Azure Security Center. Scroll down to the ADVANCED CLOUD DEFENSE and click the “Just in time VM Access”. Since it is at a Preview you need to press the “Try Just in time VM access”

After we enable JIT, the window displays tree tabs, the Configured, the Recommended and the No recommendation. The Configured tab displays the Virtual Machines that we have already enabled JIT. The recommended are VMs that have NSGs and are recommended to be enabled for JIT. The No recommendation are Classic VMs or VMs that don’t have attached NSG.

To enable JIT for a VM, go to the Recommended tab, select one or more VMs and press “Enable JIT on x VMs”

At the “JIT VM access configuration” the Security Center proposes rule with the default management ports. We can add other ports that we need and also remove any of them that are unnecessary.

At each rule we can configure the Port, the Protocol, the Source IP and the Maximum request time.

If we leave the “Allowed source IPs” to “Per request” then we allow the requester to decide. One very interesting setting here is that when a user requests access it has the option to allow only the Public IP that he is using at that time automatically.

With the last option, the “Max request time” we narrow down the maximum time that we will allow a port to be opened.

After we configure all the parameters we click Save and the VM moves to the Configured tab. At any time we can change the configuration by selecting the VM, press the three dots at the end of the line (…) and click Edit.

The Propertied button opens the VM’s blade, the Activity log shows all the users that requested access and the Remove of course disabled the JIT.

Behind the scene

What really happens to the VM? if you browse to the NSG that is attached to the VM you will see that all the port rules configured at the JIT are added as NSG Rules with lower priority than all the other rules. All other rules automatically changed priority to higher.

Lets see how we request access and what happens in the background. To request access go to the Security Center / JIT , select the VM and press “Request Access”

At the “Request access” blade switch on the desired port, select “My IP” or “IP Range” and the Timerange, all according to the JIT configuration of the VM. Finally press “Open Ports”

At the above example I select “My IP” so if you go to the VM’s NSG you will see that the 3389 port rule changed to “Allow” and for Source has my current Public IP. Also it moved at first priority.

After the expiration of the time rage the port will change to “Deny” and move back to its prior priority.

Pantelis Apostolidis

www.cloudcorner.gr

The post Bulletproof manage your Azure VMs appeared first on Apostolidis Cloud Corner.

Use Azure Security Center to protect your workloads

Pantelis Apostolidis — Mon, 20 Nov 2017 19:18:47 +0000

Use Azure Security Center to protect your workloads

At this series of posts we will make a walk along the Azure Security Center, to see some common usage scenarios. Like how we can use it to protect from a Virtual Machine to a whole Data Center.

To make it easier to understand we will start with a typical Azure IaaS scenario. A Virtual Machine with IIS role to act as Web Server. The steps to create the VM is out this post’s scope. I will simply describe the process. First we create a Windows Server 2016 Virtual Machine. Second we log in and add the Web Server (IIS) role. Third we open the port 80 at the VM’s Network Security Group (NSG) and voila we can browse at the Azure DNS name of the VM and see the IIS default landing page.

At this point the security of the Web Server is relying on the Network Security Rule, a layer 3 firewall that allows access to the port 80 and of course the Windows Firewall that does exactly the same.

Lets browse to the Azure Security Center from the Azure Portal. There we see an overview of security settings for the whole subscription.

First, click the “Compute”. I will skip the overview and go directly to the “VMs and computers” tab. There we see the name of the VM and the five points of interest. Our VM is not monitored, it doesn’t have endpoint protection and it reports some vulnerabilities.

Recommendation: Enable data collection for subscriptions

To start resolving the issues click the VM to go to the Recommendations blade. The first recommendation says to enable data collection for the subscription. Of course this is the Log Analytics, OMS (Operations Management Suite) integration. This will enable the subscription resources to report to log analytics.

Press the “Enable data collection for subscription”. The Data Collection blade will open. There we can enable or disable the automatic provision of the monitoring agent. This is the Microsoft Monitoring Agent that connects a Virtual Machine to Log Analytics and also we can use it for connecting to SCOM.

The second option is to chose a workspace. IF you have already created an OMS workspace you can choose it. If not let it create a new one automatically. Finally press save.

Returning to the previous blade you will see that the “Turn on data collection” recommendation, is now in Resolved state.

Although this recommendation is resolved instantly, the Microsoft Monitoring Agent is not yet installed. Go back to the Compute / Data collection installation status to see the agent installation status.

Stay tuned for the next Azure Security Center post to resolve more recommendations.

Pantelis Apostolidis

www.cloudcorner.gr

The post Use Azure Security Center to protect your workloads appeared first on Apostolidis Cloud Corner.