{"id":44385,"date":"2021-12-09T00:00:00","date_gmt":"2021-12-09T00:00:00","guid":{"rendered":"urn:uuid:74a654c9-e36c-21e5-7131-dd6386a4e706"},"modified":"2021-12-09T00:00:00","modified_gmt":"2021-12-09T00:00:00","slug":"top-10-azure-cloud-configuration-mistakes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/top-10-azure-cloud-configuration-mistakes\/","title":{"rendered":"Top 10 Azure Cloud Configuration Mistakes"},"content":{"rendered":"

<\/p>\n

<\/div>\n

Top misconfigured rules for Azure services<\/span><\/p>\n

Let\u2019s look at three top misconfigured services for Azure and the Conformity rule for that service with the highest misconfiguration rate.<\/p>\n

Service: Azure Activity Log<\/a>
Rule(s): “Create alert for \u2018delete PostgreSQL database\u2019 events”<\/a> and \u201ccreate alert for \u2018create\/update PostgreSQL database\u2019 events\u201d<\/a><\/p>\n

The top misconfigured rules for Azure Activity Log are related to PostgreSQL, a fully managed database-as-a-service platform. “Create alert for \u2018delete PostgreSQL database\u2019 events”<\/a> and \u201ccreate alert for \u2018create\/update PostgreSQL database\u2019 events<\/a>\u201d both have a high misconfiguration rate of 99.10%.<\/p>\n

When improperly configured, PostgreSQL databases can be abused for cryptocurrency mining, as the PGMiner botnet operation discovered in 2020. It\u2019s essential for users to regularly check the Azure Activity Log, as it provides data that pertains to configuration changes. Accurately collecting and analyzing Azure Activity Log data can enable users to keep an eye out for potentially malicious activity across their systems.<\/p>\n

Service: Azure Virtual Machines<\/a> (VM)
Rule(s): “Install approved extensions only\u201d<\/a> and \u201cenable automatic OS upgrades\u201d<\/a><\/p>\n

With a misconfiguration rate of 100%, “install approved extensions only\u201d<\/a> and \u201cenable automatic OS upgrades\u201d are (unsurprisingly) the top misconfigured rules for Azure VM<\/a>. When vulnerable extensions are used in Azure environments, it can lead to elevation of privilege and remote execution attacks. Recently, malicious actors abused the Azure OMIGOD vulnerabilities<\/a> in the Open Management Infrastructure (OMI) framework used by several Azure VM management extensions. Microsoft has since issued extension updates<\/a> for these vulnerable extensions.<\/p>\n

How can organizations prevent misconfigurations in the cloud?<\/span><\/p>\n

For organizations looking to prioritize digital transformation, all roads lead to cloud adoption. And while CSPs generally do a good job at securing the infrastructure of the cloud services they offer, users must understand it\u2019s their responsible to correctly configure the services.<\/p>\n

Here are some security recommendations for keeping misconfigurations and threats at bay:<\/p>\n