Azure Security Testing
According to a Statista report, 45% of respondents admit to running their most significant workloads on Azure1.
Azure offers over 200 products and cloud services across different categories, such as virtual machines, containers, databases, storage, and more, spanning over 60 regions and 300+ datacenters. Each service has its own settings, limitations, and caveats. This is why the most common security problems in Azure are closely related to the specific usage of these services. Some examples include:
- Storage Accounts with sensitive data publicly accessible to anonymous users,
- Overly permissive role assignments, leading to privilege escalation scenarios,
- Unencrypted data,
- Virtual machines unintentionally exposed to Internet-based attacks, providing an entry point to the private network,
- Improper secrets management (e.g., secrets stored in VMs user data),
- and more…
Connect with the Cloud Security Expert!
We are realists. We understand that the amount of knowledge you need to efficiently navigate the configuration complexities of some services can be overwhelming. This is why we are here to help you tame this beast and make your environment better and more secure.
Our approach to Azure security testing
Usually, we start the first day of testing by running automated tools and self-crafted scripts that allow us to capture the state of environment’s configuration. We then analyze the output and group the identified misconfigurations. Each finding is manually reviewed before we include it in the report.
We deeply analyze each finding, taking into account the context of the service’s use, the data it processes, and the risks it may pose to the organization. The test cases we build also include Azure CLI commands, allowing you to get the same information on your own without configuring additional tools. If we identify an opportunity to demonstrate to you a specific attack chain of combined misconfigurations – we will do so.
All of this is based on current Microsoft Azure security baselines and best practices, combined with the persistent desire to popularize the principle of least privileges and zero trust. As a result, you receive a report highlighting the biggest security issues that, under favorable conditions, can be exploited against you.
Azure security testing steps
In most of the cases, Azure configuration security assessments are carried out in the following steps:
- Getting Reader access to your Azure resources (the Reader role is sufficient).
- Capturing the current state of the environment using automated tools and simple scripts. 
- Defining priorities, assumptions, and dependencies. 
- Analyzing the results of automated or semi-automated scans. 
- Attempting to build attack chains from combined misconfigurations. 
- Looking for ways to escalate privileges in Azure (and Entra ID if desired).
- Aggregating test results and preparing the report. 
- Providing consultancy on eliminating identified vulnerabilities. 
- Verifying the proper vulnerabilities remediation. 
The result of the security tests is a detailed report. It consists of an executive summary, detailed description of all vulnerabilities, and proposed improvements.
DORA compliance
Azure Security Testing contributes to compliance with DORA principles. It aligns with DORA’s relevance to modern cloud-based DevOps environments. 
Get a quote for your project
Book a call or fill out our contact form to get a quote for a Azure Security Testing. Every organization is different – if necessary, we’ll get in touch with you to determine the specifics of your needs and the broader context of security testing.
