[MUSIC PLAYING]
ARMAN RYE: Hi there.
My name is Arman Rye, and I'm a Networking Specialist
at Google Cloud.
In recent years, there have been record-breaking numbers
of DDoS--
Distributed Denial of Service-- attacks
against organizations and networks of many sizes,
costing companies major financial losses,
drops in production, and security threats.
As adversaries continue to expand their capabilities
and frequency of attacks, any organization
hosting a web service via the public internet
is susceptible to attack.
While it isn't realistic to prevent all attacks,
it's essential to mitigate the impact when it happens.
Cloud Armor is Google Cloud's DDoS-defense service and web
application firewall solution.
One of the features available as part of Cloud Armor
is adaptive protection.
Adaptive protection helps you protect your Google Cloud
applications, websites, and services against Layer 7
DDoS attacks such as HTTP floods and other high-frequency Layer
7 application-level malicious activity.
Adaptive protection is a part of Cloud Armor, which
is a broader network-security service that
provides defenses against DDoS and application attacks.
Adaptive protection builds machine-learning models
to identify and block web attacks on your infrastructure.
It does this by first learning what your normal traffic
pattern looks like for each internet-facing website
or service, which might take an hour to a couple of days
in order to give it enough time to train the model.
This includes several dozen features and characteristics
of incoming requests, for example,
the source of the traffic or elements
of the HTTP request coming in.
Once it's done learning the baseline traffic
patterns of a web service, it will then
shift to actively monitoring for Layer 7 DDoS attacks.
And it continues to learn over time,
so as the traffic patterns of good requests change,
it adjusts its models automatically.
If it detects an anomalous deviation
from your normal traffic pattern,
it will alert you on this anomalous activity.
It then generates a signature describing
the potential attack, and generates a custom Google Cloud
Armor web application firewall rule to block the signature.
Now I'll show you how it works.
I've set up a simple managed instance group sitting
in us-east1.
It's a backend service sitting behind a global HTTPS load
balancer.
I've also configured a Cloud Armor security
policy with adaptive protection turned on.
Using a script, I've simulated our good,
normal traffic with a 20-request-per-second range,
and left it on for one hour.
This traffic was used for adaptive protection
to profile our normal traffic pattern.
After an hour, I will simulate malicious user traffic
to trigger adaptive protection's detection in real time.
Here we are in the Google Cloud UI on the Cloud Armor page.
This is where you manage all of your Cloud Armor security
policies.
Listed are multiple security policies
that I have in this project.
Clicking in on gcp-demo-policy, you
can see a handful of example rules are listed.
The default action is Allow, which
means that if no rules are triggered,
traffic will get sent to an instance group sitting
in us-east1.
In addition to the handful of rules,
adaptive protection is enabled for this Cloud Armor policy.
Selecting the Targets tab, you can
see that this policy is applied to the unmanaged-web-backend
backend service.
This is the backend service of the load
balancer, where the instance groups are
located for the demo.
Under the Adaptive Protection tab,
you can see that there has been a steady flow of traffic
to my backend instances for the last one hour,
at about 22 requests per second.
This traffic is hitting the unmanaged web backend,
which is what I applied my Cloud Armor security policy to.
This security policy has adaptive protection enabled,
so this traffic has now been profiled by adaptive protection
to indicate a normal traffic pattern.
In order to simulate abnormal traffic behavior,
I created a script to send around 2,000 HTTPS requests
per second to the public IP address of my L7 global load
balancer that is frontending my us-east1 managed instance
group on Google Cloud.
After several minutes have passed from my script running,
I'll head back to the Adaptive Protection tab.
Here you can see a spike in the number of allowed requests
from around 22 requests per second
to over 2,000 requests per second.
You can see under Potential Attacks
that Cloud Armor has flagged this simulated traffic
as a potential attack.
Drilling into the most recent alert, the signature
and recommended rule tells us the confidence level of 97%
that it is an attack.
Looking into the details, you can
see the RemoteHost IP is listed as part of the attack
signature, and there is a recommended rule
to update my gcp-demo-policy security policy to protect
against this attack.
Right from here, I can apply the rule
in preview mode or blocking mode.
Preview mode lets you preview the effects of a rule
without enforcing it, while blocking mode enforces the rule
and starts blocking traffic right away.
The attack confidence and recommended rule
will dictate whether you should deploy in a preview
or blocking mode, and varies from application
to application.
I'm going to select preview mode
Now I will head back to my existing Cloud Armor policy.
Here you can see a new rule with priority 59
has been created in a preview mode
within minutes of the attack being kicked off.
When a DDoS attack happens, it's a race against the clock
to minimize any damage.
Cloud Armor's adaptive protection drastically
reduces the time that incident responders
have to spend performing analysis and proposing
mitigations to block the ongoing attack.
You get actionable insights right away
via machine-learning-powered analysis,
pattern detection, and recommended mitigations.
Adaptive protection is part of the Cloud Armor Managed
Protection Plus subscription.
The subscription also includes a number of other security
features like Named IP Lists, DDoS Response Support,
and DDoS Bill Protection.
You can subscribe to Cloud Armor Managed Protection
Plus in the Google Cloud Console,
and check out the links below for more information on Cloud
Armor and how to get started.
[MUSIC PLAYING]