Hey, everyone, I'm Anupam Vij from Azure Core.
And today, we going to talk about
how you can protect your infrastructure in Azure
against DDoS attacks.
We're going to learn about the DDoS attack trends,
but then there are new features that we want to introduce
and hopefully you're going to enjoy.
So before we talk about how Azure DDoS Protection Standard
can help you mitigate the DDoS attacks
against your application,
let's review some of the 2021 DDoS attack trends
that we have seen.
With COVID situation in 2021, the first half,
we have seen that the frequency of the DDoS attacks
have increased by 25%.
It's not only the frequency of the DDoS attacks
that are increasing,
but it's also the volume of DDoS attacks
that continues to grow year over year.
Just this week, we released a blog post
that Azure mitigated 2.4 terabytes of DDoS attack,
which is the second largest DDoS attack ever known.
One of the reasons is also because it's extremely easy
to generate these attacks these days
through pay for hire services.
With the simplicity of generation of these DDoS attacks,
but the complexity involved
to mitigate these multi-vector attacks,
it's imperative that you are protecting your infrastructure
and critical applications in Azure
with the right protections in place.
Also knowing that 87% of the DDoS attacks are under an hour,
any resource with a public IP
that is receiving traffic from the internet
is susceptible to DDoS attacks.
It's not a question of if you will be attacked,
but it's rather a question of when you can be attacked.
With that, let's do a recap
of what Azure DDoS Protection Standard service is
and how it can help you protect your critical applications
against the DDoS attacks.
Azure DDoS Protection Standard
offers the cloud-scale DDoS protection for your workloads
and virtual networks in Azure.
It's integrated with Azure global networking,
which means that we leverage the scale of 62 Azure regions
and 50 terabytes of mitigation capacity
to mitigate the largest DDoS attacks known to the mankind.
It also ensures that we can mitigate multiple DDoS attacks
of significant volume all at the same time as well,
ensuring that your application's availability
and performance is not impacted.
The way we do that is through adaptive tuning.
The adaptive tuning ensures
that the DDoS protection policies that are being set
are specific to your application's workload
and the scale of your application.
And when, or if your application is under DDoS attack,
we will automatically start doing the mitigation.
And as we are doing the attack mitigation,
you will have full capability
to review the actions that we're taking
by analyzing the attack analytics,
as well as the telemetry.
We integrate the attack analytics and the telemetry
with Azure Security Center, as well as Azure Sentinel
if you use Azure Sentinel as a SIEM system in Azure.
We also allow you to integrate the attack analytics
and the telemetry
with your offline team systems like Splunk
with the idea that all the data is out there for you,
not only for compliance, not only for transparency,
but the data is actionable,
where you can do the correlation analysis
and ensure that other than a DDoS attack,
your environment is secure and no other malicious activity
is happening in your environment.
With DDoS Protection Standard,
we also offer DDoS Rapid Response.
Majority of the times when there is a DDoS attack
that happens on the application,
you don't have to reach out to us.
But we do understand that there are instances
where you may want to reach out to our team.
And that's where the DDoS Rapid Response helps.
If you engage the DDoS Rapid Response,
within less than 15 minutes or less,
our engineering team will work with you
to put custom mitigation policies in place as needed
to ensure again that your application's availability
and performance is not impacted
during the time of DDoS attack.
We also ensure that we offer you
or provide you with more detailed information
or forensic information towards the attack
such that you can use it for compliance
or auditing or reporting.
We offer 99.99% SLA guarantee
such that if your application is under a DDoS attack,
we guarantee that your application's availability
and performance won't be impacted.
But we also offer cost protection.
Cost protection ensures that during the time of DDoS attack,
if you incur the cost of scale-out of your resources,
then you get the 100% cost credit back.
The example of the scale-out resources is for instance,
if you have set your virtual machines to auto scale,
and the virtual machines scales from 10 VMs to 100 VMs,
you don't have to worry about paying the cost
of those 90 scale-out VMs.
The same is also applicable
whether you are deploying Azure Firewall,
you are deploying Application Gateway,
or even more importantly,
if you incur the cost of the bandwidth,
which is particularly more rampant,
if you undergo a DDoS attack,
which is an amplification attack,
in those instances,
your applications will start making
significant outbound connections
where you can incur a significant bandwidth challenge.
By using DDoS Protection Standard,
you will get the cost right back
for the duration of the DDoS attacks.
Adaptive tuning.
In DDoS protection, there are two components.
There is a detection, and then there are a mitigation.
Adaptive tuning applies to the detection component.
When you onboard to DDoS Protection Standard,
which is done by enabling it on a virtual network,
automatically in the backend,
we identify all the public IPS
that are inside the virtual network.
And from each public IP,
we define three DDoS detection policies.
One policy is for TCP SYN, the other is for TCP,
and the third policy is for UDP protocol.
One of the key attributes in each of these policies is
at what point do we think there's a DDoS attack happening
on your application?
And the way we determine that is
through our proprietary machine learning algorithm,
which understands the scale of your application,
that is the number of virtual machines behind the public IP,
but also understands the traffic profile
that's incoming to the application.
So on a regular basis,
if your application receives 40,000 packets per second,
and then there's a seasonality associated with it,
our machine learning algorithm will learn that
and it will understand that.
And then based on that, we define those policy thresholds
to initiate DDoS mitigation.
This way, we ensure
that the mitigation is initiated automatically
when there's an anomaly in the traffic pattern,
as well as we think that the amount of traffic
that's incoming to your application
can cause your application to go down.
With attack analytics and Sentinel integration,
we ensure that you get access to near real-time information
about the actions that we're taking
as we are doing the attack mitigation
against your environment.
You get to understand what are the top sources
that are participating in the DDoS attack,
what are the top countries and the PS numbers
from where the attack is originating,
as well as the attack vectors that are in play.
We also highlight the IPs and the ports
that are being attacked in your environment
with the intent that all of this information is actionable,
that you can take action on,
as well as you can use it for compliance and security audit.
We are happy to announce that DDoS integration
with the Firewall Manager is available as public preview.
So if you're using Azure Firewall Manager,
you now have one place to go
from where you came onboard to DDoS Protection Standard
for your entire tenant.
All you need to do is navigate
to the virtual network subsection
of the Azure Firewall Manager.
And there you'll be able to view the virtual networks
that are protected with DDoS Protection Standard,
as well as the virtual networks that are not protected.
Using the single pane of glass,
now you have the capability to ensure
that both the firewall,
as well as the DDoS Protection Standard
compliance is reflected.
And then if you're not 100% compliant,
then using the same single pane of glass,
Azure Firewall Manager,
you can onboard your virtual network right there itself.
We are also happy to announce that inline DDoS protection
with Gateway LB integration is now available
through the Partner NVAs through our marketplace ecosystem.
Azure DDoS Protection Standard is always on
and protects against the Layer 3 and Layer 4 attacks,
but it's not inline.
Inline means that the traffic is always going
to the DDoS mitigation pipeline,
whereas the DDoS Protection Standard
takes anywhere from 30 to 60 seconds to detect an attack.
And when an attack is detected,
we put the traffic through the DDoS mitigation pipeline.
Now, why is inline DDoS mitigation important?
For the latency-sensitive applications
that cannot tolerate the 30 seconds of warm-up period
for the DDoS mitigation to click in,
it's imperative to always have
the traffic going through the DDoS mitigation pipeline.
And that is what now the partners in Azure
can offer through their NVA and the ecosystem.
Let me explain to you what this diagram is capturing here
and how you can ensure
that your latency-sensitive applications
can be further secure using this solution.
In this scenario,
we are taking an example of the game servers
because the gaming workloads are highly latency-sensitive.
And they're also susceptible to DDoS attacks.
Starting with bullet point one over here,
the traffic from the internet,
which we call as the unfiltered traffic,
comes to the Load Balancer IP
behind which the game servers are deployed.
The Load Balancer IP
on which the traffic on the internet is coming to
is the public IP of that Load Balancer.
Now, when the traffic comes to a Load Balancer IP,
it's automatically redirected to the private IP
of the Gateway Load Balancer.
Behind the Gateway Load Balancer is where the Partner NVAs
that can do the inline DDoS mitigation are connected to.
Now, once the traffic goes to the Gateway Load Balancer,
it will go through the Partner NVAs,
which will do the DDoS mitigation and inspection.
And then the clean traffic or the filtered traffic
would be sent back to the public IP
of the Load Balancer of the game servers.
This ensures that the NVAs
inspects all the supposed malicious traffic
and only pass the supposed clean traffic
back to the game servers,
again, thereby ensuring that the game servers
are not impacted due to lower volume, Layer 7,
or application layer DDoS attacks.
Now, the game server behind the public IP
of the Load Balancer is also susceptible
to Layer 3, Layer 4 DDoS attacks.
And that way, the recommendation is
to also enable DDoS Protection Standard
on the virtual network
of the game servers Load Balancer.
This way, you get Layer 3, Layer 7 comprehensive protection
against DDoS attacks.
This scenario is not only limited to game servers,
but will also cater towards other workloads
which are latency-sensitive, including the web workloads.
All right, so let's take a look
at DDoS Protection Standard in action.
I'll give you a demo on how to onboard
to the DDoS Protection Standard and some of the key features
that we also talked about today.
So in order to onboard to DDoS Protection Standard,
you need to create the DDoS protection plans.
So if you search for DDoS in the marketplace,
then the top service that shows up,
just click on the DDoS protection plans.
And then create a DDoS protection plan.
And what you will see is
it's asking for subscription information.
And that's really the key
because once you link it to the subscription,
you cannot move the plan to another subscription.
But just because you have linked the DDoS protection plan
to a subscription, it means,
it still means that you can use the same plan
for all other subscriptions in the same tenant.
So the plan is linked to a subscription,
but it applies for all the subscriptions in a given tenant.
So select the subscription,
provide it a resource group,
give it a name,
and then hit Review and Create.
So I already have the DDoS plan created in the subscription.
Now, once you have created the plan,
what you need to do is you need to navigate
to the virtual network
and navigate to the DDoS protection subnet.
By default, it's set to disable.
All you need to do to onboard
to DDoS Protection Standard is click on Enable,
link it to the plan that you have created and hit Save.
When you do that, automatically in the backend,
we will identify all the public IPs
that are associated in that virtual network.
And then for each public IP,
we going to to define DDoS mitigation policies.
So let's take a look at some of the DDoS mitigation policies
that we defined and how it looks through Azure Monitor.
So I'm going back here.
And I will go back to the Azure Monitor.
And we are going to take a look at the DDoS policies
that we have defined for one of the public IPS.
So here in the scope,
I'm going to select public IP as the scope.
And remember, even though DDoS Protection Standard
is enabled on a virtual network,
the protection applies on the public IP.
So let me find out the public IP here
and I'll just select this public IP.
Now, under the metrics,
you'll see a bunch of metrics out here,
and these are all related to DDoS Protection Standard.
Most of the metrics will not be populated,
unless we are doing the mitigation,
but the policy threshold metrics will be populated.
So, as I mentioned, for each public IP,
we defined three policy settings,
SYN packets to trigger your DDoS mitigation,
TCP packets to trigger DDoS mitigation, and UDP packets.
So if we take a look at the SYN packets,
we'll see that the policy threshold
that we have defined here is 100,000 packets per second
based on the amount of traffic this IP is receiving,
as well as the number of virtual machines behind this IP.
Likewise, if we take a look
at the TCP packet switching your DDoS mitigation,
we'll find that it's set at 2 million packets.
Now, what it means is that once the traffic volume
goes above 2 million packets per second,
is when we will detect as an anomaly,
and we will initiate DDoS mitigation.
Now, when we initiate DDoS mitigation,
the other metrics will start getting populated
in Azure Monitor,
where you can see the number of packets
that are incoming to the incoming to the IP,
the number of packets that we are dropping
because we deem those as malicious,
as well as the number of packets that we are following.
So this is Azure Monitor.
The other interesting thing to note is to onboard,
if you are onboarded to the diagnostic settings
for the DDoS logs,
then you would be able to also see the attack analytics
associated with DDoS logs.
So here, let me open the other browser here.
And so I have created the Log Analytic workspace,
where I have configured that anytime
there is a DDoS attack that happens,
then the mitigation logs should be pumped to this workspace.
And this is where you will see the summary
of the traffic overview,
which again means like, what traffic are we dropping,
what traffic are we forwarding,
what resources goes under DDoS attack
that we are mitigating,
as well as deep information
with respect to the attack vectors,
and the countries and the origins
from where the attack is originating.
Now, the other thing I'd like to highlight is
the Firewall Manager integration that we have done.
The first page shows you how many virtual networks
in your environment.
If your filter is set to the subscription,
then it's showing you how many virtual networks
in a given subscription are protected
versus virtual networks that are not protected.
But again, as the DDoS plan works for a subscription
in a given tenant,
so does the Firewall Manager.
So if you remove the subscription filter over here,
you will get to see the number of virtual networks
that are protected with DDoS Protection Standard
across multiple subscriptions in the same tenant.
If you navigate through the virtual networks here,
then you would be able to see how many VNET are protected
with DDoS Protection Standard,
and then the virtual networks that are not protected
with DDoS Protection Standard.
So here, what you can see are the virtual networks
where you have configured DDoS protection plan,
and you are protect it with DDoS Protection Standard.
Now, for the virtual networks
which are not linked to a DDoS protection plan,
it means that it's not getting the standard protection.
In order to onboard those virtual networks
to the DDoS Protection Standard,
all you need to do is to click here on the virtual network
and then select Manage Security,
select Manage DDoS Protection,
enable and link it to the plan that you have created
in your environment and hit Save.
With Firewall Manager, now you have one place
where you can configure not only your firewall settings,
but as well as DDoS Protection Standards settings
for your entire tenant.
Thanks a lot, everyone, for attending the session.
Hope this session was informational.
The key takeaway is that public IPs receiving traffic
over the internet are susceptible to DDoS attacks.
Do make sure that your infrastructure is protected
against DDoS attacks
and your applications are highly available.
Do review the links in this deck.
And thanks a lot again.