diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 442c03b1c..42681ba62 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -412,7 +412,7 @@ - [Az - Intune](pentesting-cloud/azure-security/az-services/intune.md) - [Az - File Shares](pentesting-cloud/azure-security/az-services/az-file-shares.md) - [Az - Function Apps](pentesting-cloud/azure-security/az-services/az-function-apps.md) - - [Az - Key Vault](pentesting-cloud/azure-security/az-services/keyvault.md) + - [Az - Key Vault](pentesting-cloud/azure-security/az-services/az-keyvault.md) - [Az - Logic Apps](pentesting-cloud/azure-security/az-services/az-logic-apps.md) - [Az - Management Groups, Subscriptions & Resource Groups](pentesting-cloud/azure-security/az-services/az-management-groups-subscriptions-and-resource-groups.md) - [Az - Queue Storage](pentesting-cloud/azure-security/az-services/az-queue-enum.md) diff --git a/src/images/sponsor_8ksec.png b/src/images/sponsor_8ksec.png new file mode 100644 index 000000000..1d751216b Binary files /dev/null and b/src/images/sponsor_8ksec.png differ diff --git a/src/images/sponsor_hackenproof.jpeg b/src/images/sponsor_hackenproof.jpeg new file mode 100644 index 000000000..a4c6bc6f4 Binary files /dev/null and b/src/images/sponsor_hackenproof.jpeg differ diff --git a/src/images/sponsor_intigriti.png b/src/images/sponsor_intigriti.png new file mode 100644 index 000000000..b7944f7d8 Binary files /dev/null and b/src/images/sponsor_intigriti.png differ diff --git a/src/images/sponsor_pentesttools.webp b/src/images/sponsor_pentesttools.webp new file mode 100644 index 000000000..1b5a0d663 Binary files /dev/null and b/src/images/sponsor_pentesttools.webp differ diff --git a/src/images/sponsor_rootedcon.png b/src/images/sponsor_rootedcon.png new file mode 100644 index 000000000..cf4e8a20a Binary files /dev/null and b/src/images/sponsor_rootedcon.png differ diff --git a/src/images/sponsor_stm.png b/src/images/sponsor_stm.png new file mode 100644 index 000000000..e45c021c8 Binary files /dev/null and b/src/images/sponsor_stm.png differ diff --git a/src/images/sponsor_trickest.jpeg b/src/images/sponsor_trickest.jpeg new file mode 100644 index 000000000..92331426b Binary files /dev/null and b/src/images/sponsor_trickest.jpeg differ diff --git a/src/pentesting-cloud/azure-security/az-services/keyvault.md b/src/pentesting-cloud/azure-security/az-services/az-keyvault.md similarity index 85% rename from src/pentesting-cloud/azure-security/az-services/keyvault.md rename to src/pentesting-cloud/azure-security/az-services/az-keyvault.md index e892174aa..a58149b22 100644 --- a/src/pentesting-cloud/azure-security/az-services/keyvault.md +++ b/src/pentesting-cloud/azure-security/az-services/az-keyvault.md @@ -4,13 +4,13 @@ ## Basic Information -**Azure Key Vault** ni huduma ya wingu inayotolewa na Microsoft Azure kwa ajili ya kuhifadhi na kusimamia taarifa nyeti kama **siri, funguo, vyeti, na nywila** kwa usalama. Inafanya kazi kama hazina ya kati, ikitoa ufikiaji salama na udhibiti wa kina kwa kutumia Azure Active Directory (Azure AD). Kutoka kwa mtazamo wa usalama, Key Vault inatoa **moduli ya usalama wa vifaa (HSM)** kwa funguo za cryptographic, inahakikisha siri zinahifadhiwa kwa usimbuaji wakati wa kupumzika na wakati wa kusafirishwa, na inatoa usimamizi thabiti wa ufikiaji kupitia **udhibiti wa ufikiaji kulingana na majukumu (RBAC)** na sera. Pia ina **kumbukumbu za ukaguzi**, uunganisho na Azure Monitor kwa ajili ya kufuatilia ufikiaji, na mzunguko wa funguo wa kiotomatiki ili kupunguza hatari kutokana na kufichuliwa kwa funguo kwa muda mrefu. +**Azure Key Vault** ni huduma ya wingu inayotolewa na Microsoft Azure kwa ajili ya kuhifadhi na kusimamia taarifa nyeti kama **siri, funguo, vyeti, na nywila** kwa usalama. Inafanya kazi kama hazina ya kati, ikitoa ufikiaji salama na udhibiti wa kina kwa kutumia Azure Active Directory (Azure AD). Kutoka kwa mtazamo wa usalama, Key Vault inatoa **moduli ya usalama wa vifaa (HSM)** kwa funguo za kificho, inahakikisha siri zinakuwa zimefichwa wakati wa kupumzika na wakati wa kusafirishwa, na inatoa usimamizi thabiti wa ufikiaji kupitia **udhibiti wa ufikiaji kulingana na majukumu (RBAC)** na sera. Pia ina **kumbukumbu za ukaguzi**, uunganisho na Azure Monitor kwa ajili ya kufuatilia ufikiaji, na mzunguko wa funguo wa kiotomatiki ili kupunguza hatari kutokana na kufichuliwa kwa funguo kwa muda mrefu. Tazama [Azure Key Vault REST API overview](https://learn.microsoft.com/en-us/azure/key-vault/general/about-keys-secrets-certificates) kwa maelezo kamili. -Kulingana na [**docs**](https://learn.microsoft.com/en-us/azure/key-vault/general/basic-concepts), Vaults zinasaidia kuhifadhi funguo za programu na funguo za HSM. Mifuko ya HSM iliyosimamiwa inasaidia tu funguo za HSM. +Kulingana na [**docs**](https://learn.microsoft.com/en-us/azure/key-vault/general/basic-concepts), Vaults zinasaidia kuhifadhi funguo za programu na funguo za HSM. Hifadhi za HSM zinazodhibitiwa zinasaidia tu funguo za HSM. -**Muundo wa URL** kwa **vaults** ni `https://{vault-name}.vault.azure.net/{object-type}/{object-name}/{object-version}` na kwa mifuko ya HSM iliyosimamiwa ni: `https://{hsm-name}.managedhsm.azure.net/{object-type}/{object-name}/{object-version}` +**Muundo wa URL** kwa **vaults** ni `https://{vault-name}.vault.azure.net/{object-type}/{object-name}/{object-version}` na kwa hifadhi za HSM zinazodhibitiwa ni: `https://{hsm-name}.managedhsm.azure.net/{object-type}/{object-name}/{object-version}` Ambapo: @@ -19,7 +19,7 @@ Ambapo: - `object-name` ni jina la kipekee la kitu ndani ya vault ya funguo - `object-version` inatengenezwa na mfumo na inaweza kutumika kwa hiari kuashiria **toleo la kipekee la kitu**. -Ili kupata ufikiaji wa siri zilizohifadhiwa katika vault, inawezekana kuchagua kati ya mifano 2 ya ruhusa wakati wa kuunda vault: +Ili kupata ufikiaji wa siri zilizohifadhiwa katika vault, inawezekana kuchagua kati ya mifano miwili ya ruhusa wakati wa kuunda vault: - **Sera ya ufikiaji wa vault** - **Azure RBAC** (ya kawaida na inashauriwa) @@ -48,15 +48,15 @@ Kwa ajili ya kuchambua na kusimamia mipangilio hii, unaweza kutumia **Azure CLI* ```bash az keyvault show --name name-vault --query networkAcls ``` -Amri ya awali itaonyesha mipangilio ya f**irewall ya `name-vault`**, ikiwa ni pamoja na anuwai za IP zilizowekwa na sera za trafiki zilizokataliwa. +Amri ya awali itaonyesha mipangilio ya f**irewall ya `name-vault`**, ikiwa ni pamoja na anuwai za IP zilizowekwa na sera za trafiki iliyokataliwa. Zaidi ya hayo, inawezekana kuunda **kiunganishi cha kibinafsi** kuruhusu muunganisho wa kibinafsi kwa vault. ### Ulinzi wa Kufuta -Wakati vault ya funguo inaundwa, idadi ya chini ya siku za kuruhusu kufutwa ni 7. Hii inamaanisha kwamba kila wakati unajaribu kufuta vault hiyo ya funguo itahitaji **angalau siku 7 kufutwa**. +Wakati vault ya funguo inaundwa, idadi ya chini ya siku zinazoruhusiwa kwa kufuta ni 7. Hii inamaanisha kwamba kila wakati unajaribu kufuta vault hiyo ya funguo itahitaji **angalau siku 7 kufutwa**. -Hata hivyo, inawezekana kuunda vault yenye **ulinzi wa kufuta usioamilishwa** ambayo inaruhusu vault ya funguo na vitu kufutwa wakati wa kipindi cha uhifadhi. Ingawa, mara ulinzi huu unapowekwa kwa vault hauwezi kuzuiliwa. +Hata hivyo, inawezekana kuunda vault yenye **ulinzi wa kufuta uliozimwa** ambayo inaruhusu vault ya funguo na vitu kufutwa wakati wa kipindi cha uhifadhi. Ingawa, mara ulinzi huu unapowekwa kwa vault hauwezi kuzimwa. ## Uhesabuji