Query on restrictions or constraints around use of malware in own resources

Mease, Darren Thomas 86 Reputation points
2020-09-29T17:13:21.95+00:00

Hi,

Apologies if I have missed something, however if I created a virtual machine that was not permitted any outbound access (also - access would be by client to site VPN), are we permitted to run malware on our own hosts?

The main reason I am asking is that at present we have physical air-gapped labs for this, and would like to migrate to Azure for this purpose.

I am aware of the penetration testing rules of engagement [1], however it is not directly related to what I am trying to achieve. As well as reverse-engineering malware, we are also interested in the testing efficacy of certain countermeasures.

Any thoughts or guidance here appreciated,

[1] https://www.microsoft.com/en-us/msrc/pentest-rules-of-engagement?rtc=1

Azure Virtual Machines
Azure Virtual Machines
An Azure service that is used to provision Windows and Linux virtual machines.
7,810 questions
0 comments
Accepted answer
  1. whoward-msft 2,766 Reputation points
    2020-09-29T21:14:08.847+00:00

    Hi @Mease, Darren Thomas ,

    Thanks for the question. You are able to setup a sandbox environment on an Azure Virtual Machine whereas you are responsible for the infrastructure. I would caution you against deploying Malware on a SaaS or PaaS offering (like a Web App) as the platform handles the security so deploying anything with malware would be quickly removed or resolved.

    A benefit of using Azure VMs as your sandbox would be that if you need to delete the VM or the environment you can easily do that and deploy a fresh one. The ability to isolate VMs from one another or allow them to communicate would also be good for testing how things spread but with the ability to limit traffic to a single Vnet you could actually contain any tests.

    For more on this idea please see this thread here.

    ----------

    Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

    1 person found this answer helpful.
    0 comments

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Mease, Darren Thomas 86 Reputation points
    2020-09-30T07:08:10.59+00:00

    Hi @WinstonHoward-MSFT,

    Thank you for the swift and extremely helpful response!

    Understood on the SaaS and PaaS - I can confirm I will be sticking to the Azure VMs.

    0 comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.