Integrity Failures on Azure

Detecting integrity failures in Azure requires both Azure-native tools and specialized scanning. Azure Security Center provides basic vulnerability scanning but lacks comprehensive API security testing.

middleBrick's Azure-specific detection identifies integrity failures through black-box scanning of Azure-hosted APIs. The scanner tests for Azure-specific vulnerabilities including:

• Azure Functions storage account manipulation
• API Management policy bypass
• App Service authentication token validation
• Cosmos DB access control violations
• Azure AD token manipulation

Using middleBrick's CLI for Azure API scanning:

# Scan Azure-hosted API
middlebrick scan https://yourapi.azurewebsites.net/api/endpoint

# Scan Azure Functions endpoint
middlebrick scan https://yourapp.azurewebsites.net/api/function?code=yourfunctionkey

# Scan API Management endpoint
middlebrick scan https://yourapim.azure-api.net/v1/resource

The scanner tests Azure-specific attack patterns including:

{
  "integrity_checks": [
    "azure_functions_storage_manipulation",
    "api_management_policy_bypass",
    "app_service_auth_bypass",
    "cosmos_db_access_control",
    "azure_ad_token_manipulation"
  ]
}

For Azure DevOps pipelines, integrate integrity failure detection into CI/CD:

# azure-pipelines.yml
- task: middleBrick@1
  inputs:
    scanUrl: '$(API_URL)'
    failOnSeverity: 'high'
    token: '$(MIDDLEBRICK_TOKEN)'
  condition: and(succeeded(), eq(variables['Build.Reason'], 'Manual'))

Azure Application Insights can help detect integrity failures in production by monitoring for unusual data patterns and access violations.

Remediating integrity failures in Azure requires leveraging Azure's native security features and implementing proper validation patterns.

For Azure Functions storage integrity:

// Secure Azure Function with storage validation
const { BlobServiceClient } = require('@azure/storage-blob');
const crypto = require('crypto');

module.exports = async function (context, req) {
    // Validate storage account configuration
    const storageConfig = validateStorageConfig(process.env.AzureWebJobsStorage);
    if (!storageConfig.valid) {
        throw new Error('Invalid storage configuration');
    }
    
    const blobServiceClient = BlobServiceClient.fromConnectionString(
        process.env.AzureWebJobsStorage
    );
    
    // Verify data integrity with checksums
    const containerClient = blobServiceClient.getContainerClient('data');
    const blobClient = containerClient.getBlobClient('sensitive-data.json');
    
    const downloadResponse = await blobClient.download();
    const data = await streamToJSON(downloadResponse);
    
    // Verify data integrity
    const expectedChecksum = data.checksum;
    const actualChecksum = crypto.createHash('sha256').update(JSON.stringify(data.payload)).digest('hex');
    
    if (expectedChecksum !== actualChecksum) {
        throw new Error('Data integrity check failed');
    }
    
    context.res = { body: data };
};

function validateStorageConfig(connectionString) {
    // Validate storage account name, endpoint, and other properties
    const config = parseConnectionString(connectionString);
    return {
        valid: config.accountName && config.endpoint && isValidAccount(config.accountName),
        account: config.accountName
    };
}

For API Management integrity protection:

<!-- Secure API Management policy with integrity checks -->
<inbound>
    <base />
    <validate-jwt header-name="Authorization" 
                  failed-validation-httpcode="401"
                  failed-validation-error-message="Unauthorized."
                  require-expiration-time="true"
                  require-signed-tokens="true"
                  clock-skew="300"
                  output-token-variable-name="parsedToken" />
    
    <!-- Verify backend service integrity -->
    <set-backend-service id="backend-service"
                         base-url="https://backend-api.azurewebsites.net"
                         fail-on-error-status-code="true" />
    
    <authentication-managed-identity resource="https://management.azure.com/" />
</inbound>

For Azure App Service authentication with proper integrity:

// Secure ASP.NET Core with proper authorization
[Authorize]
public async Task<ActionResult> GetUserData()
{
    var userId = User.FindFirst(ClaimTypes.NameIdentifier)?.Value;
    var userRole = User.FindFirst(ClaimTypes.Role)?.Value;
    
    // Verify user has access to this data
    if (!await _authorizationService.AuthorizeAsync(
        User, 
        userId, 
        "DataAccessPolicy")) {
        return Forbid();
    }
    
    // Additional integrity check - verify data ownership
    var userData = await _context.Users
        .Where(u => u.Id == userId && u.IsActive)
        .FirstOrDefaultAsync();
    
    if (userData == null) {
        return NotFound();
    }
    
    return Ok(userData);
}

For Azure Cosmos DB integrity with row-level security simulation:

// Secure Cosmos DB access with application-level integrity
public async Task<ActionResult> GetUserData(string userId)
{
    // Verify user can access this data
    var user = await _cosmosService.GetUserAsync(userId);
    
    if (user == null || user.OrganizationId != GetCurrentUserOrganizationId()) {
        return Forbid();
    }
    
    // Verify data integrity with ETag
    var options = new ItemRequestOptions {
        IfMatchEtag = user.ETag
    };
    
    var result = await _cosmosService.Container
        .ReadItemAsync<User>(userId, new PartitionKey(user.OrganizationId), options);
    
    return Ok(result);
}