security - How can we protect data in VSTS from access via the API? -

-

context: have vsts account https://blahblahblah.visualtudio.com have configured block outside access using azure premium conditional access , specifying public ips of our work network. interactive access blocked clients outside internal network.

but not block personal access tokens (pats). nor see setting disable or block use of pats. pats can allow access of data in our vsts account via rest api. without mechanism azure ad premium conditional access (whitelist), in world access or modify our data merely stealing pat. seems huge security hole me. missing control vulnerability?

ideally, have whitelist in vsts instead of having rely on azure ad premium. vsts service block both interactive , api calls did not originate in our designated safe locations. not exist far know.

so, how can protect our data users out in world might access our account data via api path , stolen pat?

you can disable basic authentication , alternate credentials, disable few features on vsts (like ssh git , git access tools don't support oauth workflow).

enter image description here

personal access token cannot disabled way unfortunately. though have people limit scope tokens , have them create limited time tokens.

it's in future integration aad tighter , able check aad conditional access.

another important note: once user has logged on using aad, can take laptop/device them location. long aad authentication still valid, not blocked access other location. conditional access checked upon login , renewal of token in case of vsts far know.

right due diligence on side of users can prevent unauthorized access account. have them treat pat same way treat other important secret information. use short duration pat's, limit scope needed , store them securely, in password vault lastpass or keepass.

ps: in cloud world machines regularly new ip addresses assigned , ipv6 make harder single out groups of machines, pure ip restrictions not way keep data safe. ip 1 of things relatively spoofed or hidden.


Comments

Post a Comment

Popular posts from this blog

javascript - Slick Slider width recalculation -

-
i'm trying add slide in panel on slick container css. carousel works except new width not being calculated when space has been added. recalibrate once advance next slide i'd happen each time panel opened or closed. i've tried adding both margin , padding, neither makes difference. ideas? https://jsfiddle.net/mhigley/dpf7mlpl/ html: <button type="button" id="button"><i class="fa fa-arrow-right"></i></button> <aside> <h2>slide in panel</h2> <ol> <li>list item</li> <li>list item</li> <li>list item</li> <li>list item</li> <li>list item</li> </ol> </aside> <main role="main"> <div class="sections"> <section> <article> <h2>first slide</h2> <p>lorem ipsum d...
Read more

jsf - PrimeFaces Datatable - What is f:facet actually doing? -

-
looking through primefaces code in app noticed following line: <f:facet name="header">#{trainsearch.traincount} trains</f:facet> it looks overriding header, makes sense, can explain me in little more detail? what happening line of code? complete code listed below: <p:datatable id = "results" value = "#{trainsearch.trains}" var = "train" rendered="#{not empty trainsearch.trains}" styleclass = "train-search-table horizontal-border"> <f:facet name="header">#{trainsearch.traincount} trains</f:facet> <p:column headertext = "train id"> <p:panelgrid columns="1" styleclass = "train-id-grid" layout = "grid"> <h:outputtext styleclass = "train-id-label" value="#{train.traini}"/> <h:outputtex...
Read more

angular2 services - Angular 2 RC 4 Http post not firing -

-
i trying fire post request app , it's not working, tried multiple ways. don't see request being fired under network tab in chrome. not sure problem is, appreciated. import { injectable } '@angular/core'; import { http, headers } '@angular/http'; @injectable() export class userservice{ private _url="users"; constructor(private _http: http){ } checkifusernameexists(username){ return this._http.get(this._url+"/"+username) .map(response => response.json()) } createuser(user){ let headers = new headers(); headers.append('content-type', 'application/json') console.log(json.stringify(user)); return this._http.post(this._url, json.stringify(user),{headers: headers}) .map(response => response.json()) } } first need capture error , solve error: this._http.post(this._url, json.stringify(user),{headers: headers}) .subscribe( ...
Read more