Securing Application Insights

Question

Hi,

We have an instance of Application insights which is ingesting data from client side (react) applications. Is it advised to add any security appliance in front of application insights like Application Gateway with WAF or Front Door with WAF or any firewall. If yes, what kind of security is required.

Please not that IP whitelisting is not an option as data is coming from client applications (in browser).

Thanks

Answer

Hi RajivBansal-2486,

Thanks for the detailed response back

Below are some of the in-built securities in Application Insights.

1.Application Insights now supports Microsoft Entra authentication. By using Microsoft Entra ID, you can ensure that only authenticated telemetry is ingested in your Application Insights resources.

Refer: https://zcusa.951200.xyz/en-us/azure/azure-monitor/app/azure-ad-authentication?tabs=net

2.Managing personal data in Azure Monitor Logs and Application Insights

Refer: https://zcusa.951200.xyz/en-us/azure/azure-monitor/logs/personal-data-mgmt

3.Control network traffic Consider private connectivity for accessing Azure services. Private connectivity effectively isolates your traffic from the public internet. Data flows for private networking include both data ingestion and query operations, each targeting distinct endpoints. These endpoints can be managed independently. This approach allows you to configure private ingestion while maintaining public query access, or vice versa. By doing so, you can apply defense-in-depth principles by creating localized network controls at all available network boundaries.

Refer: https://zcusa.951200.xyz/en-us/azure/well-architected/service-guides/application-insights

1.Is security using OWASP rules as provided by Web Application Firewall required?

A) We require WAF to be enabled The WAF uses OWASP rules to protect your Container Apps not your application insights. These rules include protection against attacks such as SQL injection, cross-site scripting attacks, and session hijacks.

Refer: https://zcusa.951200.xyz/en-us/azure/web-application-firewall/ag/ag-overview

2.Is security from malicious IPs or BOTs required?

A) Microsoft's default security measures include blocking malicious IPs, applying OWASP security rules, and defending against bot attacks

Refer: https://zcusa.951200.xyz/en-us/azure/bot-service/bot-service-resources-faq-security?view=azure-bot-service-4.0#can-i-block-all-traffic-to-my-bot-except-traffic-from-the-bot-framework-service

let us know if you have any further queries. I’m happy to assist you further. User's image

Please do not forget to "Accept the answer” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Securing Application Insights

1 answer

Your answer