Security

Azure Advisor

Alan CurtisLeave a comment

Although Azure Advisor has been around for quite some time, it remains relatively unknown to many. Let’s take a closer look at this powerful tool.

What is Azure Advisor

Azure Advisor provides you with a one stop high level overview of your Azure environment. It provides actionable recommendations across critical dimensions, helping you optimize your resources.

Areas Covered:

  • Cost
    • Advisor analyzes your resource usage and suggests ways to reduce costs.
    • It identifies underutilized resources, recommends rightsizing, and highlights opportunities for reserved instances.
  • Security
    • Advisor focuses on security hardening.
    • It detects vulnerabilities and recommends actions related to network security groups, identity management, and data encryption.
  • Reliability
    • Ensuring high availability and fault tolerance is crucial.
    • Advisor suggests strategies to improve redundancy, load balancing, and disaster recovery.
  • Operational Excellence
    • Advisor ensures efficient resource management.
    • It provides best practices for tagging, automation, and monitoring.
  • Performance
    • It recommends ways to tune configurations, optimize queries, and scale resources.

Scoring and Recommendations

  • Microsoft gives each section a score.
  • Score and the recommendations are separate. You might have a perfect score in one section but still get some suggestions.
  • For example, recommendations under “Reliability” take into account things like security, saving money, and operational excellence.

When you click on the recommendations, you’ll be presented with the following:

  • Impact
    • This section outlines the severity or impact of the recommendation.
    • It helps you understand how critical the suggested action is for your environment.
    • Impact levels typically include:
    • High: Urgent actions needed to prevent major issues.
    • Medium: Important improvements that enhance efficiency.
    • Low: Minor adjustments with potential benefits.
  • Description
    • Here, you’ll find a detailed explanation of the recommendation.
    • Understand why the specific action is recommended and how it affects your resources.
    • The description often includes technical insights and best practices.
  • Potential Benefits
    • This section highlights the advantages of implementing the recommendation.
    • It answers the question: “What do I gain by following this advice?”
    • Benefits may include cost savings, improved performance, better security, or streamlined operations.
  • Impacted Resources
    • Advisor specifies the affected Azure resources related to the recommendation.
    • You’ll see a list of resources (e.g., virtual machines, databases, storage accounts) that benefit from the proposed action.
    • Understanding which resources are impacted helps you prioritize and plan your changes.

Summary

Azure Advisor is like a secret weapon—it’s your go-to spot for getting awesome tips and tricks to supercharge your Azure setup. Seriously, every Azure admin should bookmark this gem and keep it handy on their dashboard.

https://learn.microsoft.com/en-us/azure/advisor

https://learn.microsoft.com/en-us/azure/advisor/advisor-overview

Why it’s important to secure your Virtual Machines

Alan CurtisLeave a comment

Ever wondered what would happen if you accidentally created a VM with a Public IP without any additional security measures in place? Well, I thought I would give it a go over the weekend, and the results were rather interesting.

It’s worth noting that I am only looking at failed RDP requests. I am not counting any other scans or attempts to access the VM.

For the test, I used an isolated environment. I created a Windows 2019 Datacenter VM with a public IP address; I removed the NSG and allowed ICMP on the VM’s firewall. I wanted to make the VM as easy as possible to find. I ran the VM for about 30 hours in total.

During this time, I had a total of 11602 Failed Login Attempts.

I was interested to see what usernames the bad actors were attempting to use; as you can see below, Administrator and similar names are still the most popular.

Some of the less common usernames included:

\Recepcao\qaz889\skytek\w\P@ssword123!
\0022\jyp\mysql\emill\Auditor
\21\2z6pqi3\faturamento\Staff\PURCHASING
\camp\PRAXIS\test123\17\SUPPORT_388945a0

I exported the IP addresses and used the IP Geolocation lookup to see where the attempted access originated; as you can see, most of it is from the usual suspects.

Microsoft offers numbers security features to prevent this, which include:

I must admit this was a bit of fun, but on a serious note, make sure you have the necessary security in place. It’s a scary world we live in.