Hey, friends, when is it worth it to purchase DDoS protection?
When is it not?
What security services do you actually need to secure the cloud?
How easy is it to enable security features in the cloud?
Tanya Janca is here to show me how to secure my Azure resources today
on Azure Friday
Hey friends.
I'm Scott Hanselman, and it's Azure Friday. I'm here with Tanya.
We're going to talk all about securing Azure. How are you?
I'm good.
How are you, Scott?
I'm very well.
I'm happy to be chatting with you today.
I was literally just sitting with Rob before the show.
We were looking at my existing Azure resources some of them
I'd forgotten about, and I was just like, Oh, my goodness, is that a security risk?
I didn't even know that VM was still there.
Yeah, maybe I'll learn something today.
So awesome.
So you want to want to talk about securing your systems or what?
Cloud.
There's a lot of different holes in my security.
I could be equipped.
Someone could be RDP into my VM.
You know, I definitely need help.
One of the things I was hoping we could talk about was DDoS protection.
I don't know if you realize, but years ago I was actually the
CISO - the Chief Information Security Officer to run the election in Canada
for the whole country.
And we use DDoS protection because you want everything to go
right on the big day, right?
If you're waiting four years for something,
you want to make sure everything goes right.
And so one of the cool services that Azure offers
is protection against distributed denial of service attacks.
And we hear about them sometimes happening often against the gaming industry.
And so what a distributed denial of service attack is, is where
instead of just one system throwing tons of traffic at you,
it's actually many, many systems, often systems that are either bots
or that we're taking over that people are unaware of.
Quite often it's smart devices like a smart toaster or a fridge. And any way
They all point themselves at the same resource, trying to use up
all of it
so that no one else can access it. And if you
have an online store or something, that means no one can buy anything.
Or if perhaps you're trying to show everyone where they have to go to vote
on the big day, if that's down, that could interrupt an election.
And so you want to make sure that all your services are up.
All right. That makes sense.
People kind of caused trouble.
People trying to disrupt whatever is going on.
It could be Black Friday, it could be the elections, it could be anything.
And they just swarm and overwhelm your system.
And then it's hard to tell who's valid and who's not valid traffic. Yes.
And you definitely don't
want to put DDoS protection on every single site that you have.
It doesn't make sense.
It it's more like something that is a special system.
Or, for instance, you know, that there's threat intelligence
coming in that you might be in deep trouble
or you're a super famous cybersecurity reporter who people like to punish,
who I won't name, but he has received a whole bunch of DDoS attacks.
And so if you know your target
for some reason, it's definitely something your business wants to look into.
Want me to show it to you?
Let's see it - share your screen.
Cool.
OK, so you can see here that I actually don't have any DDoS
protection on right now.
That's because I made this demo this morning
so that I could show it to you.
It's actually pretty easy.
You just kind of click on it and then you tell it where you want to go.
And, Oh, I made a resource group called Azure Friday. Hmm.
And then you name it, I'm probably going to name it my DDoS protection.
That's spelled out rightly.
You figure out where you want to put it.
And so my resource group is in West US.
It makes the most sense that I would put my DDoS protection there,
and then it's going to ask for more stuff.
So you can add tags tags or if you're usually a bigger organization
and if you're using DDoS protection, there's a good chance
that you're using tags to name things.
So that basically
you can categorize your resources, but I'm not going to and that's OK.
And then it's going to ask me to review and create
before you turn this on.
It's expensive. It's expensive for a reason.
I mean, it has high value, but don't just turn this on for fun.
I turned this on in a training
before I just to show everyone and it was 42 bucks for the training.
And if you turn this on, on an enterprise, it could be quite huge.
So we're going to click the Create button.
You can see it deploying and within a few minutes it's going to say, there we go.
From then on, you have a plan now
and so you can go, let's see about before perfect.
It's pretty easy.
The hardest part I would say is budgeting out
how much it's going to cost
and then getting all the written approvals to spend the money.
It is worth pointing out if I and tell me if you agree that for example, on, on
Hanselman.com and my Hanselminutes websites I use Azure Front Door
and as your front door is more sophisticated but you get as part of that
for free built into the price of Azure front door as your basic protection.
Definitely a content
delivery network is good if you're going to have a fair amount of traffic.
But DDoS protection would be more if you feel like maybe you're a target
and you have a bit more threats going on or you need to have a higher security
like a more strict security posture.
So for instance, you know, you and I have a certain
level of Internet-ness fame
when people say like, what do you do for a living?
And like I tweet a lot, but for people that are like really,
really, really famous,
you know, government really large corporations or
if for some reason, whatever the site is, it has huge value. Ryan Reynolds.
Those are rare.
Yeah, exactly.
Famous Canadians. Famous Canadians.
Famous Canadians.
He is one of our favorite Canadians, Ryan and his dad.
His dad's actually equally funny and awesome
can I show you some more cool features that we.
Absolutely. Absolutely.
OK, so if we go over so this used to be called Security Center
then it was called Azure Defender and now it's called Microsoft Defender for Cloud.
So if you're getting a little confused and you're like,
I don't know what's going on here, don't worry, we've got you
if you look over here, it's probably near the bottom.
I always drag mine to the top because obviously security
should come first
and if you come down here to workload protection.
So these are the things that come with your license when you buy
Microsoft Defender that are my favorite things
so some of these things you can still get for free,
even if you don't actually subscribe to the paid version of Microsoft Defender.
Like you can still get some cool recommendations you'll see.
I have none, but I should have some.
But it's because I just turn this on before.
But if you go down to our workflow protections, you'll see at the bottom here
all these advanced protection services that come with your paid subscription.
And so before this, Scott and I were talking about just in time access control.
So what this does is basically it closes every single port
on whatever virtual machine that you tick it off for.
And then you just open ports as you're using it
and then it automatically closes it for you later.
And when I first saw this, I was like, I don't need that.
Of course I'm going to remember.
And I was doing a project with one of my teammates from Microsoft,
and I'd given him access to something and I was like,
Obviously I'll remember to close that port after.
And then two weeks later we're working on it again.
And he's like, Oh, OK, can you open like the RDP port for me?
And I was like, Sure. And I was like,
It's still open.
I forgot.
And so what it does is it automatically closes things for you
after and it closes all the other 65,000 ports
which I like to think of as zero trust for your ports, right?
Like you only open something if you absolutely need to,
and in order to do so,
you have to like sign into the portal and you should say enabled.
So this is a good thing in my opinion.
And then the other two, because we were talking about ransomware,
so ransomware is wildly popular
with cyber criminals because it's really profitable.
And so as a security professional, I hate ransomware and I think it's awful
so one of the ways that you can fight ransomware is by putting
adaptive application control tooling and file integrity
monitoring on your virtual machines.
As a combination toolset.
So when you accidentally get malware on your machine,
the first thing it tries to do is it tries to start itself
adaptive application control tooling.
What it does is you make a list of this software is OK to run and nothing else is.
And so if it's not on the approved list, it can't start.
So it's sitting there, it's like I'm fantastic malware.
I'm going to boot up the adaptive application, which will stop it.
And then it's like, I know what I'll do.
I'll rename myself to a system file
and then I'll already be on that proof list, and then I can start that file
integrity monitoring sees you trying to change the name of a system file
or trying to change a file that is on its list of Do Not Change.
And then it stops you.
And then the ransomware is just it can't do anything.
I actually worked somewhere once and it sent something away,
a hard drive away for forensic analysis
and it had to do with something else
I'm not talking about, but the forensic people came back.
They're like, Oh yeah, by the way, you want to wipe that drive
no matter what?
And and I was like, Yeah, yeah, I know.
Like, blah, blah, blah.
And they're like, No, no, there's there's malware on there,
but your firm and your application control tooling stopped it.
But you have it's not ransomware.
It was a different type of malware. They're like, But it's dead in the water.
But don't get that.
Don't get that out without wiping it.
I was like, Oh, wow, good job. Guys. Thanks.
I thought that was pretty cool.
Yeah.
So all of these different things, once you turn on for cloud,
these are all advanced protections that you can choose to apply.
Once you've started your your subscription for Defender for Cloud.
Yes, there are third-party tools
that do similar things, but these are all just out of the box, like click a button.
It deploys itself beautifully.
That's part of the niceness of cloud native things provided by the provider,
by the vendor.
It just magically works every time.
Yeah, definitely.
I love the idea to have that just in time VM access or to closing ports
when you're not using them.
When my, when my kids are using the stove and then they leave,
I ask them to text a picture of the stove off.
And that's kind of like the
I've left the house have I have I left an iron going or I left the stove going.
That happens to the best of us
in the cloud and in the real world as well. Yeah.
And sometimes it can be the difference
between a data breach and not, or a gigantic cloud
bill you weren't expecting. Yeah, yeah. Yeah.
So those were the things I wanted to show in the small amount of time we have.
But I was also hoping to share about my security community.
Let's hear about it.
So I run a small free
online security community called We Hack Purple Community.
So this is a safe place to come.
And learn with a whole bunch of other people that are interested in security.
So it's application security, network security, cloud security.
We have online free events, all the time.
Sometimes we have contests.
You can share articles.
I have tons of articles in there that I wrote.
We have other people like writing articles for the first time
and sharing them in there.
You can share things that you read that you think are cool,
but the idea is, is basically if you want to be able
to learn new things and meet new people, is a great way.
And so,
yeah, come on and hang out with us.
Very cool.
So folks can go and learn all about Defender in the cloud
you can check out our docs on all of that information and set up security.
Like I mentioned before,
I use Azure Front Door, which gets me DDoS protection basic.
You're going to do standard as you pointed out, it's a nontrivial move.
So there is the built in details protection
that Azure gives you at the front.
There's the basic and then there's the more standard
and different advanced options
so I'm sure that you'll be able to find something
that'll work for you from a DDoS perspective.
And then Defender for Cloud has a whole host of great features
and things that you can apply to whatever resources that you have available.
And then take a look at the it was a We Hack Purple.
Yeah, WeHackPurple.com and click on community
there's also lots of really great resources on Microsoft learn
about Microsoft Azure.
Yes, absolutely.
Microsoft Learn is the spot to pick to do tests
and learn about stuff and get certificates and meet Community.
So there's a lot of great people out there that are going to help you secure Azure
and have a lot of fun doing it.
Thanks so much. For chatting with me today.
My pleasure. Thanks for having me, Scott.
All right.
I'm learning all about
securing Azure and Cloud Native Security today on Azure Friday.
Hey, thanks for watching this episode. Of Azure Friday.
Now I need you to like it, comment on it, tell your friends retweeted watch more
Azure Friday.