Category: Cloud

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 11: Design and Implement Network Security Module Resources

Resources are links taken from MS Learns summary page for this module

• Azure best practices for network security
• Introduction to Azure DDoS Protection
• Azure DDoS Protection best practices
• Introduction to Azure Firewall
• Introduction to Azure Firewall Manager
• Introduction to Azure Web Application Firewall

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 9: Exercise – Secure Your Virtual Hub Using Azure Firewall Manager

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

• Task 1: Create two spoke virtual networks and subnets.
  • Search and choose Virtual Networks in Azure Portal
  • Select Create
    • Create New Resource group
      • Enter unique name and click OK
    • Enter Unique Instance Name
    • Choose Region from dropdown
    • Choose Next : IP Addresses >
    • Choose the hyperlink for default under subnet name
      • Enter a unique subnet name
      • Change Subnet address range to appropriate CIDR range
      • Click Save
    • Click Review + create
    • Once validated click Create
  • Repeat for second Virtual Network
• Task 2: Create the secured virtual hub.
  • Search and Click Firewall Manager in Azure Portal
  • Click Overview tab
  • Click View secured virtual hubs
  • Click Create new secured virtual hub
    • Select Resource Group from dropdown
    • Select Region from dropdown
    • Enter unique name for Secured virtual hub name
    • Enter appropriate CIDR for Hub address space
    • Enter Unique name for Virtual WAN Name
    • Click Next : Azure Firewall >
    • Click Next : Security Partner Provider >
    • Click Next : Review + create >
    • Once validation succeeds click Create
    • Search and return to Firewall Manager under Azure Portal
    • Choose Virtual Hubs in left panel
    • Choose Hub-01
    • Select Public IP configuration
    • Note Public IP Address for later
• Task 3: Connect the hub and spoke virtual networks.
  • Search for and choose Virtual WANs in Azure Portal
  • Choose Vwan-01
  • Select Virtual network connections in left panel
  • Choose Add connection
    • Enter unique Connection name
    • Choose hub from dropdown
    • Choose resource group from dropdown
    • Choose VNet from dropdown
    • Select Create
  • Repeat for Spoke 2
• Task 4: Deploy the servers.
  • Open PowerShell from Portal
  • Upload Template and Parameters files
  • Verify subscription
    • (az account show –output table)
  • Set subscription
    • (az account set –subscription “Name from output above”)
  • Set route group name variable
    • ($RGName = “fw-manager-rg”)
  • Deploy ARM template
    • (New-AzResourceGroupDeployment -ResourceGroupeName $RGName -TemplateFile filename.json -TemplateParameterFile filename.parameters.json)
  • Return to portal and navigate to Virtual Machines
    • Click first VM and note IP
    • Repeat for second VM
• Task 5: Create a firewall policy and secure your hub.
  • Search and Select Firewall Manager in portal
  • Click Azure Firewall Policies in left panel
  • Select Create Azure Firewall Policy
    • Choose Resource group from dropdown
    • Enter a unique name
    • Choose Region from dropdown
    • Toggle tier to Standard
    • Click Next : DNS Settings >
    • Click Next : TLS inspection >
    • Click Next : Rules >
    • Click Add a rule collections
      • Enter Unique Name
      • Select Application from Rule collection type dropdown.
      • Enter Priority (100)
      • Enter Name under Rules
      • Enter source (wildcard in this case *)
      • Enter http,https as protocol
      • Enter *.microsoft.com as destination
      • Click Add
    • Repeat for a DNAT rule collection type
      • Select TCP under protocol
      • Set Dest Port as 3389
      • Set Public Ip for DST
      • Enter Translated Address or FQDN
      • Enter DST port
      • Click Add
    • Repeat for Network rulle collection type
    • Click Review + Create
    • Once validated click Create
• Task 6: Associate the firewall policy.
  • In portal search and click Firewall Manager
  • Click Azure Firewall Policies
    • Check box next to Policy-01
    • Select Manage associations dropdown in menu bar
    • Select Associate hubs
      • Check box next to Hub-01
      • Select Add
    • Click Refresh
      • Should be listed now
• Task 7: Route traffic to your hub.
  • Select Virtual Hubs under deployments in left panel
  • Choose Hub-01
  • Under settings select Security configuration
    • Internet traffic select Azure Firewall from dropdown
    • Private traffic dropdown select Send via Azure Firewall
  • Click Save
  • Click OK in dialog
  • Ensure for both spokes Internet Traffic and Private Traffic list “Secured by Azure Fireall”
• Task 8: Test the application rule.
  • Launch Remote Desktop Connection
  • Enter IP in Computer Box
  • Click Connect
  • Click Connect again
  • Enter Creds
  • Click OK
  • In RDP open Internet Explorer
  • Browse to Microsoft Home Page
  • Okay in dialog
  • Browse to Google Home Page
  • Denied due to app rule
• Task 9: Test the network rule.
  • In RDP search and launch Remote Desktop Connection
  • Enter Private IP of workload VM
  • Click connect
  • Enter Creds
  • Clock OK
  • RDP Launches

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 8: Secure Your Networks with Azure Firewall Manager

Azure FW Manager is a security management that provides central policy/route management for cloud-based sec perimeters.

Azure FW Manager simplifies centrally defining network and app level rules for filtering across multiple Azure FWs. Span different Azure regions and subscriptions in hub/spoke architectures for governance and protection

If managing multiple FWs it can be difficult to keep them in sync. Central IT needs a way to define base FW policies and enforce across multiple biz units. Also, DevOps want to create local derived FW policies implemented across orgs. Azure FW Manager can help solve these

• FW Manager can provide sec mgmt for 2 network arch types
  • Secured Virtual Hub
    • Given to any Azure Virtual WAN Hub associated with security and routing policies
    • Azure Virtual WAN Hub is MS managed resource to easily create hub/spoke archs
  • Hub Virtual Network
    • Given to any standard Azure VNet with associated security policies
    • Standard VNet is a resource created and managed yourself
    • Can peer spoke VNets that contain workload servers/services
    • Also manage FWs in standalone VNets that arenn’t peered to a spoke

• Azure FW Manager features
  • Key Features
    • Central Azure FW deployment and config
      • Centrally deploy/configure multiple FW instances even if they span regions and subscriptions
    • Hierarchical policies (global/local)
      • Use Azure FW Manager to centrally manage FW policies across multiple secure virtual hubs
      • Central IT teams can write global firewall policies to enforce org FW policy across teams
      • Local authored FW polocies allow DevOps self-service model
    • Integrated with third-party security-as-a-service for advanced security
      • In addition to Azure FW third party providers can integrate providing extra protection for VNet and branch Inet connections
      • Only available with secured virtual hub deployments
    • Centralized route management
      • Easily route traffic to secured hub for filtering/logging without need for User Defined Routes on spoke VNets
      • Available only with secured virtual hub deployments
    • Region availability
      • Use Azure FW Policies across regions
    • DDoS protection plan
      • Associate VNets with a DDoS protection plan within FW Manager
    • Manage Web App Firewall policies
      • Centrally create/associate WAF policies for app delivery platforms including Front Door and App Gateway

• Azure Firewall Manager Policies
  • FW policy is Azure resource that contains
    • NAT
    • Network rule collections
    • App rule collections
    • Threat Intelligence settings
  • Global resource that can be used over multiple FW instances in Secured Virtual Hubs and Hub VNets
  • New policies can be created from scratch or inherited
  • Inheritance allows DevOps to create local FW policies on top of org mandated base policy
  • Work across regions and subscriptions
  • Create FW Policy and associations using FW Manager
  • Can also create/manage policy using
    • REST API
    • Templates
    • Azure PowerShell
    • Azure CLI
  • Once created, can associate with FW in a Virtual. WAN Hub making it a Secured Virtual Hub
  • And/Or associate with FW in a standard VNet making it a Hub Virtual Network

• Deploying Azure FW Manager for Hub Virtual Networks
  • Recommended Process
    • Create FW Policy
      • Create new
      • Derived base policy and customize a local policy
      • Import rules from existing FW (Ensure to remove NAT rules from policies applied across multiple FWs)
    • Create hub & spoke architecture
      • Create Hub Virtual Network using FW Manager and peering spoke VNets to it
      • Or create VNet and add VNet connections/peering spoke VNet to peering
    • Select security providers and associate FW Policy
      • Currently, only Azure FW supported provider
      • Create a Hub VNet or convert existing VNet to Hub Virtual Network
      • Is possible to convert multiple VNets
    • Configured User Defined Route
      • For routing traffic to Hub VNet FW

• Deploying Azure FW Manager for Secured Virtual Hubs
  • Recommended Process
    • Create hub/spoke architecture
      • Create Secured Virtual Hub using FW Manager and add VNet connections
      • Or create Virtual WAN Hub and add VNet connections
    • Select security providers
      • Create a Secured Virtual Hub
      • Or convert existing Virtual WAN Hub to Secure Virtual Hub
    • Create FW policy and associate it with hub
      • Only applicable if using Azure FW
      • Third-party security-as-a-service policies are configured via partners management
    • Configure route settings to route to Secured Virtual Hub
      • Route to secured hub for filtering/logging without User Defined Routes on spoke VNets using Secured Virtual Hub Route Setting page

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 7: Exercise – Deploy and Configure Azure Firewall Using the Azure Portal

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

• Task 1: Create a virtual network and subnets.
  • Search and Choose Virtual Networks in Azure Portal
  • Click Create
    • Choose a resource group from the dropdown or click create new (create new in this example)
    • Enter a unique name in the dialog box and click OK
    • Enter a unique name under Instance Details
    • Select a region from the dropdown
    • Click Next : IP Addresses >
    • Select (check box) and the link to the default subnet
      • In right panel enter a unique subnet name
      • Enter an appropriate Subnet address range
      • Click Save
    • Click Add subnet for later use
      • Repeat above settings as appropriate
      • Click Add
    • Click Review + create
    • Once Validation has passed click Create
• Task 2: Create a virtual machine.
  • Open PowerShell in cloudshell (Shell button next to portal search bar)
  • Upload Template and Parameters files
  • View and specify subscription
    • “az account show –output table”
    • “az account set –subscription “NAME from output above””
• Set resource group variable
  • “$RGName = Test-FW-RG”
• Return to Azure Portal to verify VM created
• Select new VM and note IP Address

• Task 3: Deploy the firewall and firewall policy.
  • Deploy template
    • “New-AzResourceGroupDeployment -ResourceGroupName $RGName -TemplateFile filename.json -TemplateParameterFile filename.parameters.json”
  • In Azure Portal Search and Click Firewalls
  • Select Create
    • Choose Resource group from dropdown
    • Enter Instance Name
    • Choose region from dropdown
    • Choose FW SKU (Standard in this example)
    • Choose Add New under Firewall Policy
      • Enter Unique Policy Name in dialog
      • Choose Region from dropdown
      • Select OK
    • Under Choose a virtual network toggle to Use existing
    • Choose VNet under dropdown
    • Choose Add new under Public IP address
      • Enter Unique Name in dialog
      • Click OK
    • Click Review + Create
    • Once validation passed click Create
    • When complete click Go to resource
    • On overview page copy Firewall private IP
    • In left panel click Public IP configuration under Settings
    • Note public IP address
• Task 4: Create a default route.
  • Search and click Route Tables in Azure Portal
  • Click Create
    • Choose Resource group from dropdown
    • Choose Region from dropdown
    • Enter unique name
    • Click Review + create
    • Once validation complete click Create
    • Once complete click Go to resource
    • Under settings select Subnets
    • Click Associate
      • Verify Virtual network and Subnet are as expected
      • Select OK
    • Under settings choose Routes
    • Click Add
      • Enter a unique route name
      • In Address prefix destination dropdown choose IP Address
      • Enter Destination IP addresses/CIDR ranges
      • In Next hop type dropdown choose Virtual Appliance
      • Enter Next Hop address
      • Select Add
• Task 5: Configure an application rule.
  • In Azure Portal navigate to FW policy created earlier
  • Click Application rules
  • Select Add a rule collection
    • Enter Unique name
    • Enter a priority (200 in this example)
    • Enter a name in the Name box
    • Enter Source IP (CIDR)
    • Enter Protocol (http,https)
    • Enter Destination (www.google.com)
    • Click Add
• Task 6: Configure a network rule.
  • Choose Network Rules under settings
  • Choose Add a rule collection
    • Enter a unique name for collection
    • Enter priority value (200)
    • Choose Rule Collection Group from dropdown
    • Enter unique name for rule under Name box
    • Enter Source (CIDR)
    • Choose Protocol from dropdown
    • Enter Destination Port(s)
    • Enter Destination
    • Click Add
• Task 7: Configure a Destination NAT (DNAT) rule.
  • Choose DNAT rules under settings
  • Select Add a rule collection
    • Enter unique name for rule collection
    • Enter priority value (200)
    • Choose Rule collection group from dropdown
    • Enter unique name for rule
    • Enter Source IP as wildcare (*)
    • Choose protocol from dropdown
    • Enter Destination Port
    • Enter Destination IP
    • Enter IP addr in Translated address or FQDN box
    • Enter Translated Port
    • Click Add
• Task 8: Change the primary and secondary DNS address for the server’s network interface.
  • Navigate to created VM earlier in Azure Portal
  • Click Networking under settings
  • Click the Network Interface for the VM
  • Click DNS servers under settings
    • Toggle to Custom
    • Add Primary and Secondary DNS Server
    • Click Save
  • Restart VM
    • Overview
    • Restart
    • Yes
• Task 9: Test the firewall.
  • Launch Remote Desktop Connection
  • Enter FW Public IP:3389
  • Connect
  • Connect
  • Enter Credentials for VM and click OK
  • Open Internet Explorer and Browse to Google
  • In dialog select OK
  • Browse to microsoft.com – blocked due to FW

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 6: Design and Implement Azure Firewall

Azure. FW is managed, cloud based security service protecting VNet resources. Fully stateful FWaaS with build-in HA and unrestricted cloud scalability.

• Azure Firewall Features
  • Built-in HA
    • HA so no extra load balancers required or configuration needed
  • Unrestricted cloud scalability
    • Azure FW can scale out as much as needed. No need to budget for peak traffic
  • App FQDN filtering rules
    • Limit outbound HTTP/S or Azure SQL traffic to specific list of FQDNs including wildcard
    • Doesn’t require TLS term
  • Net traffic filtering rules
    • Centrally create allow/deny rules by
      • Source/Dest IP
      • Port
      • Protocol
    • Azure FW is fully stateful
    • Rules enforced and logged across multiple subscriptions and VNets
  • FQDN tags
    • Make it easy to allow well-known Azure service traffic through FW
    • Create an app rule and include Windows Update tag for example
  • Service tags
    • Represents group of IP address prefixes minimizing complexity for rule creation
    • Cannot create personal service tag or specify which IP addrs included in tag
    • MS manages prefixes by tag and auto updates as addrs change
  • Threat intelligence
    • Threat intelligence-based filtering (IDPS) possible to alert and deny traffic from/to known malicious IP/Domains
    • IP addrs/domains sources from MS Threat Intelligence feed
  • TLS inspection
    • FW can decrypt outbound traffic, process, reqncrypt and send to DST
  • Outbound SNAT support
    • All outbound VNet traffic Ips translate to Azure FW public IP (Source Network Address Translatioin (SNAT))
    • Identify and allow traffic originating from VNet to remote Inet DSTs
  • Inbound DNAT support
    • Inbound Inet traffic to FW public IP translated (Destination Network Addr Translation) filtered to. Private IP on VNet
  • Multiple public IP addrs
    • Associate multiple (up to 250) with FW for specific DNAT/SNAT scenarios
  • Azure Monitor Logging
    • All events integrated to Azure Monitor
    • Allows archival of logs to storage account
    • Stream events to Event Hubs
    • Send to Azure Monitor Logs
  • Forced tunneling
    • Configure Azure FW to route all Inet bound traffic to a next hop instead of direct to Inet
    • Example to send to on-prem FW or NVA to process
  • Web categories
    • Allow or deny user access to web site categories
    • Categories included in Azure FW Standard
    • Categories more fine-tuned in Premium Preview
    • Standard matches FQDN, in Prekmium match on entire URL for HTTP or HTTP/S
  • Certs
    • Azure FW is PCI, SOC, ISO, and ICSA Labs compliant

• Rule processing in Azure Firewall
  • In Azure FW, Possible to configure NAT rules, network rules, app rules. FW denies all traffic by default until manual rules configured to allow

• Rule processing with classic rules
  • Rule collections are processed according to type in priority order
    • Lower numbers to higher from 100 – 65000
  • A rule collection name is only letters, numbers, underscores, period and hyphens
  • Must being with a letter or number
  • Must end with letter,number,underscore
  • Max name – 80 chars
  • Increments of 100 for priority allowing additional rules in between later

• Rule processing with Firewall Policy
  • FW Policy, rules organized inside Rule Collections contained in Rule Collectioin Groups
  • Rule Collection types
    • DNAT
    • Network
    • Application
  • Define multiple types in single group
  • Can define zero+ rules in a collection
  • Rules in collection MUST be SAME type
  • FW Policy – rules processed on Rule Collection Group Priority
    • Number between 100 (highest) and 65000 (lowest)
    • Highest rule in group processed first
  • Application rules always processed after network rules which are always processed after DNAT rules

• Deploying and configuring Azure FW
  • Consideration Factors
    • FW centrally create,enforce,log app/network connectivity policies across subscriptions and VNets
    • FW uses static, public IP for VNet resources
    • FW fully integrated with. Azure Monitor for log/analytics
  • Steps for deployment
    • Create resource group
    • Create VNet and subnets
    • Create workload VM in subnet
    • Deploy FW and Policy to VNet
    • Create default outbound route
    • Configure app rule
    • Configure network rule
    • Configure DNAT rule
    • Test

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 5: Deploy Network Security Groups by Using the Azure Portal

NSG in Azure allows filtering network traffic to/from Azure resources in a VNet. NSG contains security rules to allow/deny inbound traffic to, or outbound from several types of resources. Each rule specifies source/destination, port, protocol.

• NSG Security Rules
  • NSG contains zero, or as many rules as you want, within subscription Limits
  • Each rule has a series of properties
    • Name
      • Must be unique within NSG
    • Priority
      • Number between 100-4096
      • Processed in order with lower number handled first
      • Once traffic matches rule processing stops
    • SRC or DST
      • Can be set to
        • Any
        • Individual IP
        • CIDR block
        • Service tag
        • App security group
    • Protocol
      • TCP
      • UDP
      • ICMP
      • ESP
      • AH
      • Any
    • Direction
      • Rx
      • Tx
    • Port Range
      • Individual Port
      • Range of Ports
    • Action
      • Allow
      • Deny
  • FW evaluates rules using source, source port, dest, dest port, protocol

• Default security rules
  • (Table below from MS Learn)
    • 
  • Deployment scenario examples based on diagram below (Diagram from MS Learn)
    •  
    • For inbound traffic Azure processes rules in NSG associated to subnet first (if exists), and then rules in NSG associated to interface (if exists)
      • VM1
        • Subnet1 associated with NSG1
        • Security rules are processed
        • VM1 is in Subnet1
        • Unless rule created that allows port 80 in, the DenyAllInbound default rule denies the traffic
          • In this case never evaluated by NSG2 as it’s associated to network interface
        • If NSG1 has rule allowing port 80, NSG2 then processes traffic
        • To allow port 80 to VM both NSG1 and NSG2 must have rule that llows port 80 from inet
      • VM2
        • NSG1 rule processed because VM2 in Subnet 1
        • Since VM2 has no NSG associated with interface all traffic received through NSG1 or denied all traffic by NSG1
        • Traffic either allowed or denied to all resources in same subnet when NSG is associated with subnet
      • VM3
        • No NSG associated with Subnet2 – traffic allowed into subnet and processed by NSG2 as it’s associated to interface attached to VM3
      • VM4
        • Traffic allowed to VM4 since NSG isn’t associated to Subnet3 or interface of virtual machine
        • All traffic allowed through a subnet & interface if they doesn’t have NSG associated
    • For outbound traffic Azure processes rules in NSG associated with interface first then subnet (if there is one in both cases)
      • VM1
        • Security rules in NSG2 processed Unless security rule denying port 80 out to internet, then the AllowInternetOutbound default rule allows traffic in both NSG1 and 2
        • If NSG2 has rule denying port 80 traffic is denied and NSG1 never evaluates
        • To deny port 80 from VM either/or both of NSGs must have rule denying 80 or internet
      • VM2
        • All traffic sent through interface to subnet since interface is attached to VM2 doesn’t have NSG associated
        • NSG1 rules are processed
      • VM3
        • If NSG2 has rule denying 80 traffic denied
        • If NSG2 has rule allowing port 80 allowed out to internet since NSG isn’t associated to Subnet2
      • VM4
        • All traffic allowed from because NSG isn’t associated to network interface on VM or Subnet3

• Application Security Groups
  • ASG enables configuration of network security as natural extension to apps structure
  • Allows grouping VMs and defining network security policy on these groups
  • Can reuse security policy at scale without manual maintenance of IP addresses
  • Platform handles complexity of IP addresses and multi rule sets
  • Create rules using service tags/ASG’s and avoid rules with individual Ips or ranges to minimize security rules needed

• Filter network traffic with an NSG using Azure Portal
  • Use NSG to filter Rx/Tx from VNet
  • NSG contain security rules filtering traffic by IP, port, protocol and are applied to resources in a subnet
  • Key stages to filter traffic with NSG
    • Create Resource Group
    • Create VNet
    • Create App Security Groups
    • Create Network Security Groups
    • Associate NSG with subnet
    • Create security rules
    • Associate NICs to an ASG
    • Test filters
  • More detailed steps see MS Learn site: Tutorial: Filter network traffic with a network security group using the Azure portal

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 4: Exercise – Configure DDoS Protection on a Virtual Network Using the Azure Portal

Tasks (taken from MS Learn: Items without “Task” in front of them are personal additions)

• Task 1: Create a DDoS Protection plan.
  • Search and click DDoS Protection Plans in Azure Portal
  • Click Create
    • Select or Create New Resource Group (create new in this example)
    • Enter unique name and click OK
    • Enter unique name under Instance Details
    • Choose Region from dropdown
    • Click Review + Create
    • Once Validated click Create
• Task 2: Enable DDoS Protection on a new virtual network.
  • Search and click Virtual Networks in Azure Portal
  • Click Create
    • Choose Resource Group from dropdown
    • Enter unique Name under Instance details
    • Choose Next : IP Addresses >
    • Choose Next : Security >
    • Toggle DDoS Network Protection to Enable
    • Choose DDoS Protection Plan created earlier from dropdown
    • Select Review + Create
    • Once validated select Create
• Task 3: Configure DDoS telemetry.
  • Search and click Public IP Addresses in Azure Portal
  • Click Create
    • Enter unique name
    • Enter DNS Name Label
    • Choose Resource Group from dropdown
    • Click Create
  • Search for DDoS protection plan created earlier
  • Choose Metrics under Monitoring
    • Set Scope to MyPublicIPAddress
    • Click Apply
    • Set Metrick from dropdown
      • Inbound packets dropped
• Task 4: Configure DDoS diagnostic logs.
  • Search and select my public IP address
  • Choose Diagnostic settings under Monitoring
    • Select Add diagnostic setting
      • Check all 3 boxes under Categories
      • Check AllMetrics box under metrics
      • Check send to Log Analytics workspace box
• Task 5: Configure DDoS alerts.
  • Search and navigate to Virtual Machines in Portal
  • Click Create > Azure Virtual Machine
    • Choose Resource Group from dropdown
    • Provide Virtual Machine Name
    • Choose Review + Create
    • Once Validated click Create
    • Click Download private key and create resource in Generate new key pair dialog
    • Click Go to resource
      • Click Networking under settings
      • Click link next to Network Interface
      • Select IP configurations under settings
      • Chose ipconfig1
        • Under Public IP address choose MyPublicIPAddress
        • Click Save
  • Navigate to DDoS protection plans in Azure Portal
    • Choose MyDDoSProtectionPlan as created earlier
      • Click Alerts under monitoring
        • Click Create > Alert Rule
        • Delete existing resource
        • Click Select Scope
        • Under Filter by resource choose search for and choose Public IP Addresses from the dropdown
        • Choose MyPublicIPAddress as created earlier
        • Click Done
      • Choose Next : Condition >
        • Choose Under DDoS attack or not
          • Select Maximum under Aggregation type dropdown
          • Select Greater than or equal too under Operator dropdown
          • Enter Threshold value (1 in this example)
          • Select Next: Actions >
          • Select Next : Details >
            • Enter Alert rule name
            • Choose Review + create
            • Click Create
• Task 6: Monitor a DDoS test attack.
  • Search Public IP Addresses in Azure Portal and on page click MyPublicIPAddress as created above
  • Copy the IP Address
  • Click Metrics under Monitoring section in left panel
    • In the Metric dropdown choose Under DDoS attack or not
    • Value changes from 0 to 1 if under attack

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 3: Deploy Azure DDoS Protection by Using the Azure Portal

• Distributed Denial of Service (DDoS)
  • DoS attack that has goal of preventing access to services/systems
  • Originates from one location
  • DDoS attack originates from multiple networks and systems
  • DDoS are largely available and security concern facing customers moving apps to the cloud
  • DDoS tries to drain API’s or app resources making it unavailable
  • DDoS can be targeted at endpoints that are publicly reachable via internet

• DDoS Implementation
  • Azure DDoS Protection, combining with app design best practices aids in defense again DDoS attacks.
  • Multiple service tiers available
    • Network Protection
      • Provides mitigation capabilities over DDoS infra Protection
      • Tuned specifically to AZ VNet resources
      • Simple to enable and requires no app modification
      • Policies applied to public IP associated with resources in VNet
      • Real-time telemetry through Azure Monitor views during attach, and historically
      • Rich mitigation analytics via diagnostic settings
      • App layer protection available via Azure App Gateway WAF
      • Protection for IPv4 and IPv6 public addrs
    • IP Protection
      • DDoS IP Protection is pay-per protected IP
      • Contains same core features as DDoS Network Protection
      • Value-added services such as
        • DDoS rapid response support
        • Cost Protection
        • Discounts on WAF
  • Protects resources in VNets
  • Protection includes:
    • VM Public IP Addresses
    • Load Balancers
    • App Gateways
  • When coupled with App. Gateway WAF can provide full L3-7 mitigation capabilities

• Types of DDoS Attacks
  • Can mitigate the following types of attacks
    • Volumetric attacks
      • Flood network layer with large amounts of what looks like legit traffic
      • Include UDP floods, amplification flood, and other spoofed-packet floods
    • Protocol Attacks
      • Attack renders target inaccessible exploiting L3 and L4 weaknesses
      • Includes SYN flood, reflection, and other protocol attacks
    • Resource (App) layer attacks
      • Target web application packets to disrupt transmission between hosts
      • Includes HTTP protocol violations, SQL injection, cross-site scripting, and other L7 attacks

• Azure DDoS protection features
  • Examples include
    • Native platform integration
      • Native integration into Azure and configured via portal
    • Turnkey protection
      • Simplified config protecting all resource right away
    • Always-on traffic monitoring
      • App traffic patterns monitored 24/7
    • Adaptive tuning
      • Profiling and adjusting to service traffic
    • Attack analytics
      • Detailed reports every 5 mins during attack
      • Complete summary after attack ends
    • Attack Metricks and alerts
      • Summary metrics from each attack through. Azure Monitor
      • Alerts configured at start/stop of attack, and duration of attack
      • Uses built-in attack metrics
    • Multi-layered protection
      • When deployed with WAF, DDoS Protection protected network and app layer

• More details about some of the above DDoS Protection Features

• Always-on traffic monitoring
  • Monitors actual traffic utilization
  • Constantly compares against defined thresholds
  • When threshold exceeded, mitigation initiated automatically
  • When back below threshold, mitigation stopped
  • During mitigation, traffic towards protected resource redirected and checks performed
    • Ensure packets conform to inet specs and aren’t malformed
    • Interact with client to determine if traffic potentially spoofed (e.g. SYN Auth or SYN Cookie or dropping packet to force re-transmit)
    • Rate-limit packets if no other enforcement can be performed
  • DDoS protection drops attack traffic and forwards remaining traffic
  • Within a few minutes – notified using Azure Monitor metrics
  • Configuring logging on DDOS Protection telemetry logs for future analysis
  • Metric data is retained for 30 days.

• Adaptive real-time tuning
  • DDoS Protection service aids to protect customers and prevent impacts to others

• Attack metrics, alerts, logs
  • DDoS Protection exposes rich telemetry using Azure Monitor
  • Configure alerts for any metric DDoS Protection uses
  • Integrate logging with Splunk (Azure Event Hubs, Azure Monitor Logs, and Azure Storage for advanced analysis using Azure Monitor Diagnostics
  • Steps
    • In Portal
      • Monitor > Metrics
        • Select Resource group
        • Select resource type of Public IP Address
        • Select the Azure Public IP Address
      • DDoS metrics visible in the Available metrics pane
  • DDoS Protection applies 3 autotuned mitigation policies for each public IP of protected resource in VNet DDoS is enabled
    • SYN
    • TCP
    • UDP
  • View policy thresholds
    • Inbound [SYN/TCP/UDP] packets to trigger mitigation metrics
  • Policy thresholds autoconf via machine learning-based network traffic profiling
  • DDoS mitigation occurs for IP under attack only when threshold exceeded
  • If pub IP under attack, value for Under DDoS attack or not metric changes to 1 while mitigation being performed

• Multi-layered Protection
  • Specific resource attacks at app layer – recommended a WAF be configured
  • WAF inspected inbound web traffic to block SQL Injection, Cross Site Scripting, DDoS, and other L3 attacks
  • Azure provides WAF as feature of App Gateway for centralized protection of web apps
  • Other WAF offerings from partners in Azure Marketplace
  • Even web app FW are susceptible to volumetric and state exhaustion
    • Enable DDoS protection on WAF VNet to aid in protection of these

• Deploying DDoS Protection Plan
  • Key stages of deploying DDoS Protection:
    • Create Resource Group
    • Create DDoS Protection Plan
    • Enable DDoS Protection on new/existing VNet or IP addr
    • Configure DDoS telemetry
    • Configure DDoS diagnostic logs
    • Configure DDoS alerts
    • Run a test DDoS attack to verify results

Notes from MS Learn AZ-700 Module 6: Design and implement network security – Unit 2: Get Network Security Recommendations with Microsoft Defender for Cloud

Network security is various tech, devices, processes and provides rules and configs to protect the CIA of networks/data. Every org though have some sort of network security

• Network Security
  • Covers controls to secure and protect Azure.
  • Including securing VNets
  • Private connections
  • Prevent/mitigate external attacks
  • Secure DNS
  • Full description on MS Learn site Security Control V3: Network Security on Microsoft Learn

• NS-1: Establish network segmentation boundaries
  • Security Principle to ensure that VNet deployment aligns with segmentation strategy
  • Any workload that incurs high risk should be isolated in VNets

• NS-2: Secure cloud services with network controls
  • Security Principle to secure cloud services establishing private access point to resource(s)
  • Should also disable/restrict public access if you can

• NS-3: Deploy firewall at edge of enterprise network
  • Security Principle to perform advanced filtering on net traffic to/from external networks
  • Can also use firewalls between internal segments
  • If needed, custom routes for subnet used to override system route
  • This forces net traffic to go through network appliance for security

• NS-4: Deploy IDS/IPS
  • Security Principle to inspect network and payload to/from workloads
  • Ensure IDS/IPS always tuned for high-quality alerts

• NS-5: Deploy DDOS Protection
  • Security Principle to protect network/apps from attacks

• NS-6: Deploy web app firewall
  • Security Principle to deploy WAF and configure rules to protect web apps/API’s from app specific attacks

• NS-7: Simplify net security config
  • Security Principle to use tools to simplify, centralize, enhance network security management

• NS-8: Detect & Disable insecure services/protocols
  • Security Principle to protect from insecure services/protocols at OS/App/Software package
  • Deploy controls if disabling isn’t possible

• NS-9: Connect on-prem or cloud privately
  • Security Principle to use private connection between networks

• NS-10: Ensure DNS security
  • Security Principle to ensure DNS security config against known risks

• Using Microsoft Defender for Cloud for Regulatory Compliance
  • Defender for Cloud aids in streamlining meeting regulatory compliance requirements using the “Regulatory Compliance Dashboard”
  • This shows status of all assessments within environment you have chosen standards and regulations for
  • As you act and reduce risk posture improves

• Regulatory Compliance Dashboard
  • Shows overview of status with set of supported compliance regulations
  • View overall score, number of pass/fail assessments within each standard

• Compliance Controls
  • Contains
    • Subscriptions the standard is applied on
    • List of all controls for said standard
    • View details of passing/failing assessment associated with control
    • Number of affected resources
    • Severity of the alert
  • Some are grayed out as they don’t have Any MS Defender for Cloud assessments associated
  • Check their requirement and assess them
  • Some controls may be process-related not technical

• Exploring details of compliance with a specific standard
  • To generate PDF report with a summary of status choose Download Report
  • Provides high-level summary of compliance status for standard based on MS Defender for Cloud assessment data
  • Organized according to controls of said standard
  • Can be share with stakeholders and aid in providing evidence to internal/external auditors

• Alerts in MS Defender for Cloud
  • Automatically collects/analyzes/integrates log data from Azure resources
  • List of prioritized security alerts shown along with. Info needed to investigate and remediation steps

• Manage security alerts
  • Defender for Cloud overview page shows Security Alerts tile at top and a link in the left panel
  • Security alerts page shows active alerts
  • Sort by Severity, Title, Affected Resource, Activity Start Time
  • MITRE. ATTACK tactics and status
  • To filter select any of the relevant filters

• Respond to security alerts
  • From Security alerts list click an alert
  • Another panel opens with description of alert and affected resources
  • View full details to display more info
  • Left pane shows high-level info regarding alert
    • Title
    • Severity
    • Status
    • Activity time
    • Description
    • Affected Resource
  • Right Pane includes
    • Alert details tab with more details
      • IP address
      • Files
      • Processes
      • Etc
    • Take Action Tab with Actions like
      • Mitigate the threat
        • Provides manual remediation steps
      • Prevent Future Attacks
        • Provides sec recommendations to aid in reducing attack server, increase security posture
      • Trigger Automated Response
        • Provides option to trigger logic app as response
      • Suppress similar alerts
        • Provides option to suppress further alerts with similar characteristics