services / Azure / Application security group

An Application Security Group (ASG) is a logical grouping of network interfaces (by application role) that can be referenced as the source/destination of NSG rules, instead of explicit IP ranges, to scope firewall rules to a set of VMs.

An ASG is a perimeter/segmentation control referenced by NSG rules; membership in one determines which firewall rules apply to a given interface, so misuse indirectly controls network access the same way an NSG does. Rated consistent with the other network-segmentation resources documented alongside it.

Microsoft.​Network/​applicationSecurityGroups/​write

Creating or updating an ASG definition is a prerequisite for controlling which interfaces inherit the firewall rules written against that group; combined with join rights on member interfaces/rules, it lets an attacker reshape which traffic reaches a given application tier.

Risks

1. Network movement (BOOST)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links