Azure security review and remediation

Views in this map

1. 1
   As builtThe September review found six weaknesses on the paths into customer data.
2. 2
   First 30 daysThe two criticals and the exposed database are fixed first, behind a private network.
3. 3
   RemediatedEvery finding has its control: the WAF, Key Vault and threat detection are in.

As built ‹ › 30 days ‹ › Remediated

Flows to play

• ▷
  Statement leakAn attacker goes after customers’ statement PDFs in blob storage.
• ▷
  Admin takeoverAn attacker phishes a cloud admin’s password and uses it.
• ▷
  Injection probeAn automated scanner probes the banking app for injection flaws.

The model behind it

53 records of 8 types. Every box on the map is one of them, so the filters and the record panel read the same data.

• Azure resources 26
• Findings 10
• Controls 7
• Actors 3
• Partners 3
• Client apps 2
• Threat actor 1
• Subscription 1

Filters

Severity and Control family: pick a value and everything else fades.