Tweet
Tweet

Slide 1

Slide 1 text

No content

Slide 2

Slide 2 text

DIY Azure Security Assessment Tanya Janca Cloud Advocate @SheHacksPurple Teri Radichel CEO 2nd Sight Lab @TeriRadichel

Slide 3

Slide 3 text

@SheHacksPurple @TeriRadichel Do It Yourself, Security Assessment @SheHacksPurple @TeriRadichel

Slide 4

Slide 4 text

@SheHacksPurple @TeriRadichel This is me. I’m Tanya Janca. AKA: @SheHacksPurple WoSEC

Slide 5

Slide 5 text

@SheHacksPurple @TeriRadichel ~ 25 years in tech professionally Spammed + hacked => security focus Taught myself to program, age 12. Cloud security ~ AWS Hero, SANS Landed in networking + telecom Helped Capital One move to cloud Moved to programming Master of Infosec Engineering, GSE Master of Software Engineering 2nd Sight Lab ~ Cloud Security Web + E-commerce Business Training, Assessments, Pentesting Teri Radichel

Slide 6

Slide 6 text

@SheHacksPurple @TeriRadichel

Slide 7

Slide 7 text

@SheHacksPurple @TeriRadichel

Slide 8

Slide 8 text

Why Do It Yourself?

Slide 9

Slide 9 text

No content

Slide 10

Slide 10 text

@SheHacksPurple @TeriRadichel Out of Scope (for this talk) Rick Rolling X

Slide 11

Slide 11 text

@SheHacksPurple @TeriRadichel Let’s do this.

Slide 12

Slide 12 text

@SheHacksPurple @TeriRadichel

Slide 13

Slide 13 text

@SheHacksPurple @TeriRadichel External Azure

Slide 14

Slide 14 text

@SheHacksPurple @TeriRadichel

Slide 15

Slide 15 text

@SheHacksPurple @TeriRadichel https://aka.ms/TurnOnMFA

Slide 16

Slide 16 text

@SheHacksPurple @TeriRadichel https://aka.ms/AzureADandYou

Slide 17

Slide 17 text

@SheHacksPurple @TeriRadichel

Slide 18

Slide 18 text

@SheHacksPurple @TeriRadichel

Slide 19

Slide 19 text

@SheHacksPurple @TeriRadichel

Slide 20

Slide 20 text

@SheHacksPurple @TeriRadichel

Slide 21

Slide 21 text

@SheHacksPurple @TeriRadichel

Slide 22

Slide 22 text

@SheHacksPurple @TeriRadichel

Slide 23

Slide 23 text

@SheHacksPurple @TeriRadichel

Slide 24

Slide 24 text

@SheHacksPurple @TeriRadichel

Slide 25

Slide 25 text

https://aka.ms/ASC-and-me

Slide 26

Slide 26 text

No content

Slide 27

Slide 27 text

@SheHacksPurple @TeriRadichel https://aka.ms/subscription-coverage

Slide 28

Slide 28 text

@SheHacksPurple @TeriRadichel https://aka.ms/custom-policy

Slide 29

Slide 29 text

@SheHacksPurple @TeriRadichel TRUST

Slide 30

Slide 30 text

@SheHacksPurple @TeriRadichel

Slide 31

Slide 31 text

@SheHacksPurple @TeriRadichel

Slide 32

Slide 32 text

@SheHacksPurple @TeriRadichel

Slide 33

Slide 33 text

@SheHacksPurple @TeriRadichel

Slide 34

Slide 34 text

@SheHacksPurple @TeriRadichel

Slide 35

Slide 35 text

@SheHacksPurple @TeriRadichel

Slide 36

Slide 36 text

@SheHacksPurple @TeriRadichel

Slide 37

Slide 37 text

@SheHacksPurple @TeriRadichel

Slide 38

Slide 38 text

@SheHacksPurple @TeriRadichel

Slide 39

Slide 39 text

@SheHacksPurple @TeriRadichel

Slide 40

Slide 40 text

@SheHacksPurple @TeriRadichel https://aka.ms/cloud-native-policy

Slide 41

Slide 41 text

@SheHacksPurple @TeriRadichel https://aka.ms/JustInTime

Slide 42

Slide 42 text

@SheHacksPurple @TeriRadichel https://aka.ms/JustInTime

Slide 43

Slide 43 text

@SheHacksPurple @TeriRadichel https://aka.ms/JustInTime

Slide 44

Slide 44 text

@SheHacksPurple @TeriRadichel https://aka.ms/Azure-PIM “PIM essentially helps you manage the who, what, when, where, and why for resources that you care about. ”

Slide 45

Slide 45 text

@SheHacksPurple @TeriRadichel (Application Whitelisting for servers) https://aka.ms/Adaptive-Controls

Slide 46

Slide 46 text

@SheHacksPurple @TeriRadichel https://aka.ms/storage-threats

Slide 47

Slide 47 text

@SheHacksPurple @TeriRadichel

Slide 48

Slide 48 text

@SheHacksPurple @TeriRadichel https://aka.ms/storage-threats @SheHacksPurple @TeriRadichel https://aka.ms/storage-threats

Slide 49

Slide 49 text

@SheHacksPurple @TeriRadichel

Slide 50

Slide 50 text

@SheHacksPurple @TeriRadichel

Slide 51

Slide 51 text

@SheHacksPurple @TeriRadichel

Slide 52

Slide 52 text

@SheHacksPurple @TeriRadichel

Slide 53

Slide 53 text

@SheHacksPurple @TeriRadichel https://aka.ms/Sentinel-by-Azure

Slide 54

Slide 54 text

@SheHacksPurple @TeriRadichel https://aka.ms/Data-Security

Slide 55

Slide 55 text

@SheHacksPurple @TeriRadichel @SheHacksPurple @TeriRadichel https://aka.ms/DB-VA

Slide 56

Slide 56 text

@SheHacksPurple @TeriRadichel

Slide 57

Slide 57 text

@SheHacksPurple @TeriRadichel

Slide 58

Slide 58 text

@SheHacksPurple @TeriRadichel

Slide 59

Slide 59 text

@SheHacksPurple @TeriRadichel • Set scope; only test what is in scope • Verify account structure, Identity and Access Control, follow best practices • Set Azure Policies, according to your org’s needs • Turn on Azure Security Center, for all subscriptions • Use Cloud Native Security features: Threat Detection and Adaptive Application Controls, File Integrity Monitoring, Just in Time (JIT) & PIM • Follow Networking best practices; NSGs, Routes, Access to compute and storage, Network Watcher, Azure Firewall, Express Route and Bastion Host • Always be on top of your alerts and logs for Azure WAF and Sentinel • VA everything, especially your SQL databases • Encryption, for your disks and data (in transit and at rest) • Monitor all that can be monitored • Follow the Azure Security Center Recommendations • THEN call a PenTester. :)

Slide 60

Slide 60 text

@SheHacksPurple @TeriRadichel WE CAN Do It Ourselves. @SheHacksPurple @TeriRadichel

Slide 61

Slide 61 text

@SheHacksPurple @TeriRadichel Articles & Videos • https://medium.com/microsoftazure/pentesting-azure-thoughts-before-reading- matts-book-4609d14fb61d • https://medium.com/microsoftazure/pentesting-azure-the-report-3bf32fc3d12e • https://youtu.be/NHt9KKP3mPg • https://www.cisecurity.org/cis-benchmarks/ • https://www.cisecurity.org/blog/cis-microsoft-azure-foundations-benchmark-v1-0- 0-now-available/ Resources

Slide 62

Slide 62 text

@SheHacksPurple @TeriRadichel (Follow us?) Tanya Janca Twitter: @SheHacksPurple medium.com/@SheHacksPurple https://dev.to/SheHacksPurple YouTube.com/SheHacksPurple Teri Radichel Twitter: @TeriRadichel medium.com/cloud-security https://2ndsightlab.com slideshare.net/TeriRadichel THANK YOU