Hi everybody, my name is Daniel Gicklhorn.
I'm a Product Director for our Cloud CDN products
in Azure's Networking team.
And I'm really excited about today's talk.
This is a really frequent area of questions
that we get around how to build best practice architectures
in Azure for internet facing services.
And so I'm really excited to be able to cover this
with you today and to really dig
into some of these key areas and common misses
when customers are building websites on Azure.
So, first off,
I think we've all had a lot of difficult experiences
over the last 18 months as things have changed with COVID,
but that really has caused a fundamental shift,
not just in kind of our daily lives,
but really fundamentally in how web applications
are being built and how IT applications are changing
in the cloud.
Things like work from home and new scale needs
have made internet first services a mandate
for many companies.
And a lot of new security drivers are forcing applications
to think about new application architectures
as they're building cloud services
and as they're transforming applications
from on-prem to cloud.
Through that transformation comes a large set
of new challenges,
especially if you're going from something
that's not internet facing to an internet first application.
A couple of really key stats upfront.
96% of applications have at least one vulnerability in them.
And over the last 18 months,
we've seen exploits during COVID
and attacks growing more than 50%.
This comes as more applications become internet facing,
but also as the sort of risks
and the value of those applications increase.
And so with that change really increases the mandate
for applications to both have a story
that covers security and performance and the balance
between those two things.
Through this talk,
we'll cover a few different topics around how you do that,
but really fundamentally we'll talk
about how do you use
Microsoft's content delivery network solution
to protect your application while ensuring fast,
reliable delivery at a global scale
wherever you users are across the globe.
I've spent a lot of time speaking with developers
and application owners and really one area
that is fundamentally missing
from the way that many folks have thought
about building applications that they've thought
through the client tier
and they've thought through the application tier,
but they're really missing an intern layer,
which is an internet tier.
And that's really there to understand how do you connect
that application tier to your user tier
and how do you protect that application tier
against threats and other scale issues
that come from having an internet facing web surface.
Azure's application delivery product suite
is something we've built over the last two years
to really address this problem.
And how do you handle internet facing services?
It's a collection of products that enable security,
reliability, scale and performance in an integral way
with your application.
We enable this at a global scope and at a regional scope
for your applications.
And we deeply attach it to our security suite,
either within the global scope products like Azure CDN,
Azure Front Door,
but also regionally within things like Application Gateway.
Azure Front Door's a service we launched a few years ago
to really take this to the next level.
Azure Front Door is Microsoft's cloud native global content
application delivery service
and enables you to really easily encrypt user
to user communication and apply threat protection
to your applications and protect it
against a common set of threats.
We also provide the highest compliance certification
of any global public CDN today on the platform.
So it was really built for enterprise scale applications
and, really, applications that need
to think more horizontally about their security portfolio.
It provides dynamic application acceleration
to improve performance.
It provides a baseline set of capabilities
on our global network, that I'll talk about in a second,
around global content delivery.
We're releasing a new set of skews in preview
that better enable our customers
to enable more advanced security options
and to improve the developer experience
that allows you to enable more automation
and to combine dynamic and static experiences into one.
Azure Front Door is built
on Microsoft's huge top performing global network
and enables applications to leverage Microsoft's assets
to build high availability,
high performance experiences on our global network
that we've spent the last 20 years developing,
both for Microsoft's own products,
as well as for our customers.
Our network is constantly expanding.
In fact, it's recently expanded into new and deeper markets
in areas like Morocco and Angola,
and even some deeper markets in the United States
in areas like Jacksonville and Tampa.
It's a huge investment that continues to grow.
And it's an area where using services like Front Door
carry you forward with the expansion of that network
over time as well.
So now I'm going to talk about a core set of areas
around best practices
for building internet facing architectures.
Fundamentally with Front Door,
this breaks into three pillars.
One, how do you protect your application from threats
and how do you ensure that it has consistent scale
over time?
How do you accelerate your application
to improve the performance of the application
and ensure that it has consistent performance over time?
And finally, how do you automate common tasks with that
to ensure that you're not just building availability
into the protection and reliability of the service,
but you're building it into the reliability
of your CI/CD pipelines in your development
of your application, including this internet tier.
I'm going to break this down into two specific areas.
One, which is really how do you get the most you can quickly
from Azure Front Door service, which I call good,
which is basically how do you get started fast
without having to do a lot of work.
And how do you get sort of things
that are enabled by default or with limited configuration.
And then second cover some of the more advanced capabilities
that you get that add a lot of value to the product
that require a little bit more management and configuration.
To get started with your application,
the first thing you want to think about is protection.
And fundamentally, how do you protect your application
from these global attacks and from unknowns?
How do you make sure that you're ensuring brand reliability
and consistency with your application
and how your users experience it,
even when you're under attack.
I'm going to go through a set of
different capabilities here,
both in the good or sort of easy, out-of-the-box level,
as well as how to enhance that with sort of a better tier
of more advanced capabilities.
So first is you really have to think about
how do you secure your traffic coming into your website.
Front Door allows you to get a free SSL certificate
that you can very quickly deploy
and scale your application to a secure footprint.
It's something that's really simple to deploy.
And it's the easiest way in Azure to upgrade your services
to SSL and do that at a global scale.
We also let you configure your application
and force traffic to be encrypted.
So you don't just have traffic coming in
that might also be unencrypted,
but Front Door makes it really easy with its rules platform,
to be able to add a redirect that forces traffic coming
into your website to upgrade to SSL or to upgrade to HTPs
and ensure that no connections come in unsecured.
We also let you add WAF.
And WAF is really fundamental to how do you think
about unknown and known threats for your application?
We provide a robust web application firewall platform
that lets you configure a combination of managed rules
and bot rules to ensure that you're protecting
against defaults for security in your application.
What that means is really fundamentally ensuring
that you have control over the known knowns
that may be attacking your application
and leveraging Microsoft's experience in this space
with our global threat protection
to ensure that you have the best of breed
when it comes to those set of rules and defaults
that you can protect your application with.
In addition,
and this is something that's really commonly missed
when configuring web application firewall
is when you're building a global service
and you're adding something like a tier to your application,
you have to think about not just the positive scenarios,
like how does it work if the user is not blocked,
but you have to think through scenarios,
like what is the user experience someone gets
when they're blocked from WAF?
And so one of the really common areas
that's missed is really configuring the WAF
on Front Door to be able to give a user experience
in the block case.
And that can either signal mobile devices
or things like that that need to react
if they get blocked by a WAF,
but also any users that come in
that could be potentially misclassified or otherwise.
And so that's something that's really fundamental to add
when you're adding WAF to your service is configuring
that error message.
And Front Door makes it really easy to do that
and to make it simple to configure.
And finally in the default category
is enabling access logging.
And I can't recommend this enough
is being able to really understand
the behavior your users are experiencing
and to build custom dashboards and custom playbooks
for how you understand your users, not just today,
but over time.
Front Door makes it easy to enable logging
with a couple of clicks and you can send it to the myriad
of different services in Azure
that lets you consume, process, manage those logs
and use them to understand the behavior for your users.
This is particularly useful
because Front Door is a global service.
And so you can then see the traffic coming
into your application from wherever it comes
across the globe, regardless of the application end point
that it's landing or the origin or the backend
that it's landing on in Azure.
Taking protection to the next level,
there's a couple of really key scenarios to think through.
The first is once you've got the basics and you're protected
against sort of basic WAF risks is extending that
to add things like rate limiting to your application
with Front Door,
which lets you manage user expectations
and even manage the expectations that you have yourselves
about how much traffic you'd expect from a single user.
That's really helpful to protect applications
from bots and other high-scale threats,
including in many cases, developers themselves
who might be adding test tools for an app to an application.
And then next,
and this is something new with our Front Door service,
is enabling private link.
And that's really to prevent your backends
from becoming internet facing
and to ensure that they are protected
and they don't have any public IP.
This is really fundamentally a huge value change
in Front Door as we go to the new preview capabilities
in Front Door Premium,
which is enabling private link
so that you can secure access to the origin.
As I mentioned, there's no public IP.
And allows you to really extend your zero trust story
that you're building for your application out
to the CDN or out to Front Door as well,
and treat all of that in a single perimeter.
It's something that we're really happy
and is really one of the highest demand items
that we're rolling out right now.
And it's something that for enterprise services
is something you should fundamentally think about.
Next is acceleration.
And this really comes down to managing the performance
of your application.
And there's a lot that you get from Front Door
by default by using the platform
that you don't get just by having a public IP on Azure
or on a different cloud.
The first is that instead of having a regional IP,
you get a global IP, and that IP is managed by Front Door,
both in terms of how does it govern traffic
in and out of our network,
but how does it also manage internet reliability
in front of Front Door from issues.
We have an active set of tools within our arsenal
that we use to be able to quickly detect
and automatically route around internet issues
that you get when you onboard to the Front Door platform.
The second is Front Door
is inherently a global load balancer.
And so when you use this as a global load balancer,
there's a capability to be able to route traffic
based on regressions in latency of your application.
And it's not something that you can do
with the Azure Traffic Manager
or other DNS based load balancers.
And we provide the ability to quickly route
around issues at the origin,
not just if there's some sort of reliability drop,
but also in the case of some sort of performance degradation
that you might see.
If you have a multi-region setup
and one region regresses in terms of performance,
we can fail traffic over to another endpoint
because we're doing a level of active probing.
And then finally by default is really enabled caching
and Front Door does this intelligently
where we don't enable caching by default
because we assume that you're building
a set of, sort of, hybrid or sort of dynamic
plus static applications together.
It's something that you configure very granularly by route
and be able to enable when you need it,
but that can very quickly allow you to move content out
from your origin to the application edge
and for us to be able to serve it for you globally
from the edge of our network.
Taking that a step further,
there's a couple of key areas that you can take.
One is enabling compression on the fly,
especially for mobile device experiences.
And this is really critical to be able to compress content
as it goes over small wireless networks, wireless uplinks,
and things like that.
It's very easy to turn on,
but something you have to consider
based on the number of devices that you have.
And then second is tuning your load balancing settings.
By default, we pick some sets of defaults
that are good for many applications
that in about 30 seconds fail over
when there's some sort of degradation in your application.
You can tune that to be quicker
based on how your application responds to health probes
and how we manage your traffic
through some settings in Front Door.
And so that's the next area to really click into,
to really tighten up the performance acceleration
that Front Door provides.
Finally, really getting into how do you automate
your application using Front Door
and how do you use it to automate your operational scenarios
for delivering your service?
The first is really common is really how do you ensure
that you have SSL certificate rotation
if you're using a front door managed certificate,
like I mentioned before.
We'll rotate that for you.
You don't have to think about how to rotate your certificate
or keep it fresh on the site.
The second, and this is really of the first step
and it's very easy to set up alerts in Azure
using Azure alerting and log analytics
and other different capabilities,
but really setting up alerts to check if your origin
is responding with bad responses, like 400 of 500 spike,
or if the health probes that we're sending detect
that there's been some sort of failure in your origin.
The fundamental availability will be managed by Front Door
because it'll fail away from origins
that are exhibiting those type of failures,
but it's also something that will give you much quicker
access to go repair a situation,
even if Front Door's keeping your users up
while your origin is having issues.
And then finally Front Door,
because it's integrated with the rest of the Azure ecosystem
and the Azure automation capabilities,
it allows you to write PowerShell scripts
or other automated scripting to be able
to manage your Front Door instances automatically.
And what that means when you're thinking
about developing applications with Front Door
is really the ability
to automate common developer activities
or things that you work through with your CI/CD pipeline.
If you are building applications
that take a dependency on sort of a deployment phase
and things like that,
you can automate the changes to Front Door
through that process.
You can use it also to automate more major changes
to your website,
like adding new microservices to your website
because Front Door lets you configure route-based rules
and things like that.
And finally, in the automation category,
sort of the next steps,
there are really to take this to the next level
is really integrating Front Door
with the rest of our ecosystem.
One is using Azure Sentinel to create playbooks
and accelerate your response to attacks
is a huge rich amount of data that you can access
from Azure Sentinel that will let you really build
that operational practice around how do you respond
to a web application threats and issues on a regular basis.
And then last, which is something we'll cover
in some subsequent videos as well is adding a backup origin
to your website so that you really have
a disaster experience.
If you, for example, accidentally delete something major
on your website and you experience a global failure,
having a disaster experience,
so your users don't see a down site,
but see sort of a backup experience
is really critical there.
And it happens more than I think we'd all like
to think it does.
Finally, in this space,
we've added a set of more advanced analytics
with the new premium and standard versions of Front Door
that are, as I mentioned,
are in preview that really expand your access
to real-time data and expand your operational experience
when you're trying to understand the traffic and behavior
of your services coming in.
We give you a view into sort of the global source
of your traffic and give you a new map graphic,
as well as a set of telemetry that give you deep insights
into the behavior of your traffic,
both in terms of just the traffic arriving,
as well as the security of your service.
So through this talk,
I've covered a set of really key best practices
and go-do's for using Front Door
to add this delivery tier to your application.
In particular, we dug into a set of really easy,
kind of, good, out-of-the-box capabilities
that you can really quickly get from Front Door
to be able to enhance your application experience quickly.
And a set of more advanced or better capabilities
that let you extend that value further.
Every web application in Azure should have a delivery tier,
and I'm really looking forward to seeing more applications
and more of the conversations that I'm having
with customers really talk about how do they enhance
this delivery tier further in the near future.
If you want to learn more about Azure Front Door,
you can go to azure.com/frontdoor,
and that will link you to all of our documentation
and other services.
And really happy to talk to you today, thank you.