Tidy up - Unused Project and Nuget package reference using Visual Studio 2019

If you are a Developer/Architect using Visual Studio as IDE for your development activities, this blog post will be of your interest. During the Ignite 2021 conference, Microsoft released Visual Studio 2019 v16.9 and v16.10 Preview 1. As part of version 16.10 Preview 1, one of the cool features they introduced is to "Remove Unused References..." for any Projects and Nuget packages that are not in use. At the time of writing this blog post, we have Visual Studio Version 16.10.0 (official release) which includes this new feature.  As part of development, we generally get carried away and introduce new Nuget package references to your project and add new references to your Projects. By the end of development, you will not be 100% sure which are not being referenced and unused which means you will leave those unused project references in your application. Now you might be wondering what's the big deal in it since it doesn't harm. The advantage of removing unused project r
Post a Comment

Azure Container Registry Image Scanning With Azure Security Center

Just to recap in the previous blog post we looked into how to secure Azure Container Registry and in this post will see the offering from Azure Security Center. Azure Container Registry (ACR) is a manged, private container registry service in Azure to build, store, and manage container images and artifacts. ACR service based on the open-source Docker Registry 2.0. This post explains, what you get from Azure Security Center in the context of ACR.

Image scanning is important for any Docker registry. Vulnerability scanning for images stored in Azure Container Registry is now generally available in Azure Security Center (March 2020). This capability is powered by Qualys and seamlessly integrated into the Azure Security Center.

ACR image scanning requires Azure Security Center Standard tier. When you push an image to Container Registry, Security Center automatically scans it, then checks for known vulnerabilities in packages or dependencies defined in the file. Each scan takes approximately 10 min, you will be charged per image scanning operation. Scanned results are shown in Security Center and a security classification for each vulnerability detected, along with guidance on how to remediate issues and protect vulnerable attack surfaces. 

Enable ACR Image Scanning

Navigate to Azure Security Center where you can change the pricing tier using the Settings - Pricing Tier blade. Once you have chosen the Standard tier, you can enable the plan for the different resource types in which enable Container Registries for ACR scanning images. Now, all your ACR instances will scan Images and report vulnerabilities, security recommendations to ASC.


Azure Security Center provides dashboards, centralized location related to Security hygiene, Policy & Compliance, Threat protection. For ACR related issues navigate to Security Center - Resource Security Hygiene - Compute & apps, set the filter to Containers, and see all outcomes for services like ACR and AKS.

Recommendations from Azure Security Center

You can click the recommendation to see details about the issues reported.

Under security check findings it shows all the security issues found within images. Clicking on each issue will provide helpful information about the vulnerabilities/security recommendations and learn how to fix it.

Note: At this stage, Qualys’ scanner does not provide any Windows Container image scanning capabilities. 


Comments

Post a Comment

Popular posts from this blog

Tidy up - Unused Project and Nuget package reference using Visual Studio 2019

Image
If you are a Developer/Architect using Visual Studio as IDE for your development activities, this blog post will be of your interest. During the Ignite 2021 conference, Microsoft released Visual Studio 2019 v16.9 and v16.10 Preview 1. As part of version 16.10 Preview 1, one of the cool features they introduced is to "Remove Unused References..." for any Projects and Nuget packages that are not in use. At the time of writing this blog post, we have Visual Studio Version 16.10.0 (official release) which includes this new feature.  As part of development, we generally get carried away and introduce new Nuget package references to your project and add new references to your Projects. By the end of development, you will not be 100% sure which are not being referenced and unused which means you will leave those unused project references in your application. Now you might be wondering what's the big deal in it since it doesn't harm. The advantage of removing unused project r
Read more

Swagger UI for Azure Function v2 & v3 APIs

Image
In this blog post, we will see how to setup Swagger UI for Azure Function APIs in v2 and v3. Now you might be wondering why Swagger? Swagger is a language-agnostic specification for describing REST APIs, it also referred to as OpenAPI. Swagger UI offers a web-based UI that provides information about your REST APIs service. Prerequisites HTTP trigger Azure function provisioned or created in C# Azure DI enabled on Azure Function, for more details refer here  with relevant package version installed based on Azure Function version. Integrating Swagger UI into our Applications 1. Install the appropriate package based on the Azure Function version which you are dealing with from the below table. Unfortunately, it's not a single package for both versions due to Azure function v3 because v3 makes use of ASP.NET Core 3.1 which introduces a new serializer System.Text.Json (STJ) out-of-the-box.  Azure Function Version  Nuget package  v2               AzureFunctions.Extensions.Swashbuckle  v3
Read more

Authenticate Azure Functions - API Keys

Image
In this blog post, we will see one of the ways to secure your Azure Functions using API keys. Security plays a key role as part of SDLC (Software Development Life Cycle) doesn't matter whether it's exposed to the client/public or even if it's internal. There are multiple ways to secure your Azure Functions like API Keys, Certificate,  API Mgmt, App Service Authentication, etc. If you are new to the Cloud and Azure Functions but want to make a start with minimal effort and less setup of Infrastructure, then API Keys is the ideal choice. Azure Functions allows you to secure HTTP-triggered functions by API access key in the request. As part of creating new Azure Functions, we can select the Authorization Level enum value. If we set the Authorisation level to  Anonymous,  no security applied which means no authentication applied for the endpoint. Authorization Level - Function By setting the Authorisation level to Function each Azure Functions require a specific API key to Auth
Read more