PingSafe Knowledge Base

Back to home

PingSafe Knowledge Base

Azure Knowledge Base

Azure Knowledge Base

We have written articles that explain security checks done by PingSafe on Azure and how engineering teams can fix the vulnerabilities.

Virtual Network Alerts Monitor

Container Registries

Azure Container Registries With Admin User

Azure Virtual Machines

No Recovery Services Vault

Premium Data SSD Disk Enabled

Automatic OS Upgrades Disabled

Scale Sets Health Monitoring Disabled

Guest Level Diagnostics Disabled

Unattached Disk Volumes

VM Undesired SKU Size

Accelerated Networking Disabled

Automatic Instance Repairs Disabled

VM Unapproved Extensions

VM Data Disk Encryption Disabled

VM Backups Disabled

VM Boot Diagnostic Disabled

Old VM Disk Snapshots

VM Auto Update Disabled

VM OS Disk Encryption Disabled

Virtual Machine Performance Diagnostics Disabled

VM Active Directory (AD) Authentication Disabled

Empty Scale Sets

Scale Sets Autoscale Notifications Disabled

Premium SSD Disk Enabled

Low VM Instant Restore Backup Retention Limit

Disk Volumes BYOK Encryption Disabled

VM Daily Backup Low Retention Period

VM Availability Set Disabled

See more

Network Security Group

Open Kibana

Open CIFS

Network Watcher Disabled

Open Oracle

Open SMTP

Open DNS

Open SMBoTCP

Excessive Security Groups

Open Hadoop HDFS NameNode Metadata Service

Open Salt

Restricted Ports Open To Public

Default Security Group Rules

Open NetBIOS

Open FTP

Open SQLServer

Open Telnet

Open VNC Client

Open MySQL

Open Docker

Open Hadoop HDFS NameNode WebUI

No Network Watcher

Open Oracle Auto Data Warehouse

Open VNC Server

Open SSH

Open All Ports

Open RDP

Open PostgreSQL

Open RPC

See more

PostgreSQL

Log Checkpoints Disabled

Log Duration Disabled

Enforce PostgreSQL SSL Connection Disabled

Storage Auto-Growth Disabled

Azure Active Directory Admin Disabled

Geo-Redundant Backups Disabled

Low Log Retention Period

Log Connections Disabled

Log Disconnections Disabled

Connection Throttling Disabled

See more

Azure Monitor

NSG Log Analytics Disabled

Log Profile No Retention Policy

No Log Profile

Log Profile Low Retention Time

Azure Monitor Storage Account Not configured

Key Vault No Diagnostic Settings

Azure Monitor No Diagnostic Settings

Key Vault Log Analytics Disabled

Log Profile Archive Data For Critical Activities

NSG No Diagnostic Settings

CDN Profile Log Analytics Disabled

Load Balancer No Diagnostic Settings

Azure Monitor Logs Disabled

Load Balancer Log Analytics Disabled

CDN No Diagnostic Settings

See more

Azure Security Center

Security Contacts Phone Disabled

Admin Security Alerts Disabled

High Severity Alerts Disabled

No Security Contact

Auto-Provisioning Disabled

Security Contacts Email Disabled

See more

SQL Databases

Low Point in Time Restore Backup Retention

SQL DB Multiple AZ Missing

DB Not Restorable

Database Auditing Disabled

SQL Servers

SQL Server Private Endpoints Not Configured

Azure Active Directory Admin Disabled

SQL Server Automatic Tuning Disabled

Audit Retention Policy Limit

SQL Server Allow Insecure TLS Version

Auto-Failover Groups Disabled

Audit Action Groups Disabled

Server Auditing Disabled

SQL Server Public Access

SQL Server Minimum TLS Version

TDE Protector Encryption Disabled

See more

Storage Accounts

Blobs Soft Deletion Disabled

Queue Service All Access ACL

Insecure Network Access Default Action

Storage Account Encryption Disabled

Storage Accounts Without HTTPS-Only

Trusted MS Access Disabled

Log Container Public Access

Log Storage Encryption Disabled

Blob Container Public Access

Blob Service Encryption Disabled

Blob Service Not Immutable

See more

Azure Key Vaults

Key Expiration Disabled

Key Vault Recovery Disabled

Secret Expiration Disabled

Load Balancers

Public Load Balancers

Load Balancers HTTPS Only Not Configured

Load Balancers Without Instances

Insecure Ports Open For Load Balancer

App Services

Web Apps Remote Debugging Enabled

Authentication Disabled

Web Apps Always On Disabled

Outdated Python Version

Outdate PHP Version

HTTPS Only Disabled

Outdated Java Version

Identity Disabled

Insecure TLS Version Supported

HTTP 2.0 Disabled

.NET Framework Version Not Latest

See more

Azure Active Directory

Custom Owner Roles

Activity Log

Security Solutions Logging

Policy Assignment Alerts Enabled

Network Security Group Rule Logging Disabled

Security Policy Alerts Disabled

Network Security Groups Logging Disabled

See more

Azure Policy

Resource Location Matches Resource Groups

No Policy Assignment

Missing Allowed Locations Policy

Kubernetes Services

Kubernetes Different Node Pool Version

Outdated Kubernetes Version

Kubernetes RBAC Disabled

Azure Resources

Management Lock Disabled

Resources Usage Limit Exceed

Azure Cosmos DB

Advanced Threat Protection Disabled

CosmosDB Public Access Enabled

CDN Profiles

CDN Profile HTTP Enabled

CDN Profile Endpoint Logging Disabled

MySQL Servers

MySQL SSL Connection Enforcement Disabled

Azure Virtual Network

Single Subnet

DDoS Standard Protection Disabled

Unknown Virtual Network Peering

Network Gateways In Use

Established Network Gateways Connections

Managed NAT Gateway Disabled

See more

Azure Network Watcher

NSG Flow Logs Retention Period

Azure Cache for Redis

Insecure TLS Version Supported

SSL Access Only Disabled