Hello everyone.
My name is Narayan Annamalai.
I'm here to talk to you about what's new
in Azure Network Security.
So without further delay, let's jump in.
The global pandemic has changed our lives forever.
On the back end of it,
a huge digital transformation has taken place.
The assets from on-premises
has moved to the cloud.
What that means is
the traditional network security boundaries
have disappeared.
Customers now need cloud native security tools
to protect their assets.
The way we work has changed.
More than 65% of us now work from home,
but we still need access to the corporate resources.
So it's been quite a challenge for organizations
to protect the personal devices
with which we connect.
On top of all this,
the internet based attacks has increased.
Just in the last year
we have had 50% more attacks than usual.
Mobilian and Colonial Pipeline are just a few,
to name, that we have seen in the news,
but there are more sophisticated attacks
that are happening every day.
This makes it difficult to defend against threats.
The threat landscape has continued to evolve
and on top of that,
all nations lack skilled security personnel,
and must keep up with evolving data privacy
and industry regulations.
This new reality requires a zero trust approach to security.
Microsoft has a holistic approach
to zero trust based architecture.
This should extend to the NTL digital estate.
We can do this by focusing on six foundational elements.
Everything starts with the identity.
Having a strong identity management
provides the foundation for zero trust.
There is identity, there is endpoints,
and then there is data that the customers store,
the apps that use the data,
the infrastructure that runs on the app and the network.
For today's conversation we will focus on the network.
So, network is kind of the center
that glues everything together.
And it's also typically what is operationally
the most challenging for customers.
When I think about network,
there are really three main things.
You think fastest to segmentation.
Customers should always think about segmenting
the network into smaller parts
so that they can prevent lateral movements.
Next is having a really good way
to have threat prevention and protection against threat.
Lastly, we need to have data encrypted
that flows between the systems.
Now let's see how we can do this today.
When we think about segmentation
it's really about breaking the deployment down
into smaller islands
and having controls specifically on those islands,
both ingress and egress.
By doing such a model,
it will make the bad actors to penetrate to other parts
and for threat protection we need something
that can be very reactive,
because threats are happening all the time
and there are new and sophisticated ones.
And with this word encryption we have number
of tools with which data could be encrypted.
Customer applications can use things like SSL and TLS
to encrypt the data.
And when they cannot think from on premises,
they can use things like VPN gateway to encrypt the data.
And within the cloud Azure offers a number
of different ways to encrypt the data.
Now we going to see the different Azure products
and how
you can use them
to achieve a zero trust space
network security.
Microsoft provides a comprehensive set of services
to achieve this.
And again, I've just listing out the ones
I'm going to talk about today
and classify them as to where will they help you
with.
Segmentation, outright protection or encryption.
Let's start with the virtual network manager.
Like we said,
segmentation is a key aspect of a zero trust architecture.
So you should look at having your workloads group
into smaller islands
and having security control for each of those islands.
Now, as you grow, the footprint grows.
There'll be number of such islands
and maintaining an uniform security pusher
across all of this could become quite challenging.
The Azure VNet manager is created
to help with just that.
So with the VNet manager,
you can group these individual islands or VNets together,
both at a subscription level, across subscriptions,
as well as across management groups.
Once you create these groups,
you would be able to define a common security policy
to apply to this groups
as well as a common connectivity policy
on how these groups talk to one another.
So it just gives the administrators
and the security network admins
more control and ease of use.
It also gives two unique value props.
One, as the workloads come on
they'll automatically inherit the security policies
defined for their group.
And the admins can define the grouping
in a dynamic way,
such that a new VNet automatically joins the group.
And every workload that's getting deployed
into this VNet
will automatically inherit the security policies.
Additionally, when a high risk event has happened,
it's very easy to do an emergency patching,
because using a single click,
a port could be blocked
across the entire customer's deployment.
So the VNet manager really makes
network segmentation easier to manage.
Moving along.
Private Link has been there now for a few years
and Private Link is a very useful tool
to secure the PaaS resources from internet exposure.
While it still does that very well
with the announcement of support
for network security groups
and user defined routes customers can now
segment their networks better and more secure
and restrict access to the sparse resources.
Like we already talked about,
everything cannot be trusted within a network.
The whole zero trust approach is about explicit verification
and zero implicit trust,
which means threats could start or happen
from inside the network.
So it's very important to segregate this network
and only allow certain parts of the network access
to the data.
So with NSC and a private end point
only certain net elements
of the network could be allowed to access
the private end point.
And with user defined routing
more appliances could be brought in line
before even actors allowed
for a particular app or a user.
So, by using these controls,
you can enhance the segmentation
or the micro-segmentation posture for your deployments.
Azure Bastion is another key service
that customers should use
to prevent exposure to internet
for the virtual machines.
Everyone needs access to RDP or SSH,
that's completely understandable,
but there doesn't have to be a need
to expose the VM's to the internet for that.
Using an Bastion service, customers can connect
through secure SSL means to the Bastion
and Bastion can then connect privately
to all these virtual machines.
What we're announcing new here
is that Bastion can now work
across multiple VNets.
So with a single Bastion service
you could reach all the VMs
across peered VNets as well.
So this makes it easier for customers to configure
and deploy and maintain and manage.
So this is another important element
of how you prevent an internet based threats
from even entering your deployment.
Now, as you talk about internet based attacks and threats,
it's super important for us
to think about DDoS space attacks.
Now recently you would have, all of us know that,
the attacks have increased both in volume
as well as the sophistication of the attacks.
Recently Microsoft successfully mitigated
a large DDoS attack that was aimed at a property
that was running in Azure.
This attack was of the size of 3.4 terabytes,
but Azure DDoS prevented it.
And it was business as usual for customers.
Now, while DDoS is great at preventing
volume metric based attacks,
it's also important that in scenarios like gaming,
you have to have the DDoS protection that is in line.
You don't have a lot of time for the attack to happen,
and then mitigate it.
The attack should be mitigated
as and when they're happening.
To do this, now we announcing
something called as Gateway Load Balancer,
which is going to bring services in line very easily.
So using this Gateway Load Balancer
traffic coming from internet could be directed
to go through an appliance for further inspection
before it is allowed to access the game servers.
And when the inspection is happening by a partner NVA,
it'll also inspect for DDoS space attacks.
And if the traffic appears to be malicious,
it will be dropped right there
and won't even be sent to the game servers.
So using this mechanism of Gateway Load Balancer
the security posture for these applications
could be increased a lot
by providing inline DDoS or even advanced firewall
could be deployed on the path.
Now, the other element to complete
the internet based threat and attacks
is Azure firewall.
Azure firewall, as you all may know,
is a fully managed cloud native firewall solution,
which has been, the standard version has been there
in the market for a few years.
What we are announcing now is the premium version.
The premium version is a full next generation firewall
that has a full IDS, IPS implementation inbuilt in it.
Along with that, it also has the ability to have,
to scan the payload for more
than 58,000 signatures of malware.
So by putting the Azure firewall
in between your workload and the internet,
you can prevent lot of these internet based attacks
from even entering into your deployments.
The Azure firewall could also be used
to protect and inspect traffic that is flowing
between Azure and on premises,
or even between virtual networks in Azure.
The Azure Firewall Premium is now available
in all the regions.
And it's also five X more performant
from a throughput standpoint.
And so along with Azure Firewall
and Azure DDoS standard versions,
there's lot of threat protection that customers can get.
Azure Firewall Manager is a management tool
that's going to make the security management much easier.
Azure Firewall Manager was previously only managing
Azure Firewalls across the customer's fleet.
Now Azure Firewall Manager can also manage
the DDoS profiles and very soon the WAF ones too.
So, this is going to be an single place dashboard
from where all of the security controls
could be configured and maintained and managed.
So, this is going to make it easier
for customers to operate.
Now we talked about lot of the network segmentation aspect
and threat based aspects.
We should also now look at for web based workloads
what protections customers can leverage in Azure.
I want to start with Azure Front Door.
Azure Front Door is the layer seven load balancer
or the edge based load balancer that we have in Azure.
Now, this was giving a lot of performance enhancements
for applications.
While it continues to do that
the latest version that is in preview right now,
which is the Azure Front Door Premium
also has enhanced security.
A key feature I like to highlight
is the Private Link integration.
With the Private Link integration
the origin servers could be kept completely private
while the Front Door is exposing
the end point to the internet.
It can terminate the SSL traffic
or SDPS traffic right there,
and then connect privately to the origin servers.
So by keeping the origin servers completely private
the servers can now avoid any kind of DDoS attacks
or internet based attacks
directly onto the origin servers.
So all of that would be handled by the Front Door
and customers don't have to worry about mitigating
against those in that origin servers.
So that's a key benefit.
So this Azure Front Door Premium is in preview
and we'll encourage customers to try this.
So along with Azure Front Door,
in fact, we have an integrated WAF
that goes with Azure Front Door,
but WAF can also be leveraged both for the Front Door
as well as application gateway.
Now, what's new with WAF is
We have lot of newer rule sets
that we have built into the WAF product.
In addition to the rule sets the,
both the analytics and the security pushes
have also been increased.
We now have Microsoft based rules
also added to the Azure Front Door WAF.
So combining WAF with the Front Door solution
provides the full protection for applications
that are exposed to the web
When they're running in Azure.
Also excited to announce that
a recent study from Forrester,
where they interview the customers
and finding out the return of investments
the customers have on the expenditure
that they have on network security.
We found out that customers have like
several millions of dollars of savings
implying a network security cloud
native retro security based solution.
We found that they can save almost a month
of time in deployment
and over 35% of expenditure that they actually
spend on on-premises cloud solutions
could be saved by using cloud native solutions.
So, as important as it is
to have a zero trespass architecture
on a cloud native security solution,
there's also good return of investments,
you know, when customers invest on this.
We like to kind of also highlight
now a recent, a case study that with the customer,
where it is quite clear that by adopting
a more integrated approach, you know,
that Microsoft provides
as being a lot more beneficial
than having to go and individually select
and set up the security solutions on premises
like firewalls and whatnot.
With Microsoft,
everything is provided in integrated manner
and one place shop.
And this has been a hugely beneficial
with respect to their inner management
and this simplifies the process a whole lot.
In summary, I would like to remind that
customers should look at security in new lights.
They should adopt a zero trust base approach
in securing their assets.
And to recap,
it should look at segmentation
and adhere to the principles
of having smaller islands,
where which has full ingress / egress controls.
And restricting the need for this island
to talk to one another,
a widening internet exposure as much as possible.
And if at all,
the way the workloads have to talk to one another
putting the right level of east-west controls
between them like firewalls
or proper internet with security rules.
And then ensuring that when the traffic goes out,
it's going on encrypted channel
and having a good threat detection
and threat mitigation is essential,
by using products like DDoS and firewall,
whenever there is any communication
over internet is super important.
And lastly,
when there are applications that have to be exposed
to the web,
using a secure app delivery mechanism,
combined with WAF,
a different door would be what is required
to fully secure the customers deployments.
And to end with,
I'll also like to provide these different links
of sessions that are going deeper
into these technologies.
So it'll be good for you to listen to them.
And with that I like to thank you for watching
and have a great day.