Azure DDoS Sentinel Overview:

Microsoft has the "Azure DDoS Sentinel" service that can help protect your network endpoints from DDoS attacks.  Common DDoS attacks all basically use hundreds of bad actors to flood traffic into you architecture to overwhelm them.  Restricting traffic from the bad actor sources is key.  Mixing the Azure DDoS Sentinel Service with Azure WAF, allows us to identify the bad actions and just block these bad attackers.

DDoS - Increasing, multiple bad actors try overwhelm your resources.  Rate limiting can help, but ideally you want to let thru valid traffic and block bad traffic.  Azure DDoS Sentinel service can be coupled with WAF to protect correctly from DDoS attacks.  Normally UDP flood attacks, also protects HTTP(s) flood and TCP Flood attacks. Covers level 3-4 layer attacks.

Two SKU's:

• DDoS network protection: used on a VNet, service will work out and protect your public nodes.  Can put this in from for Azure WAF are Azure Firewall, After Front Door.  
• Cheaper Alternative is the DDoS IP protection, has most of the features and if only specific IP, like a web traffic IP it's a good option.

More Info:

Radimaging Ltd - Paul Beck's Technical Working Notes for Microsoft Technology: WAF Options (pbeck.co.uk)

Radimaging Ltd - Paul Beck's Technical Working Notes for Microsoft Technology: Azure Application Gateway Basics (pbeck.co.uk)

Azure Application Gateway Basics

Azure Application Gateway is a http traffic load balancer that allows me to manage my web traffic.  So based on urls, paths, the traffic can be pushed on accordingly.  It also provides for sticky sessions.  In my head I see Azure Application Gateway as a layer 7 HTTP Load Balancer and a Web Application Firewall (WAF).  There are 3 core concepts: Front-ends, rules and backends that are used to route traffic from the front-end to the back-ends.

Azure Load Balancer works at level 4 where Azure application gateway is for web traffic at layer 7 of the OSI model.

Azure Front Door is basically for world wide Application gateway functionality.

Checklist on the Application Gateway: 

• You should enable the WAF unless you already use another WAF like Imperva enterprise wide, do this under the "Web application firewall" option, setup OWASP rules.  
• Config session affinity, and HTTPS termination using the "HTTP settings".  
• "Listeners"  are what listens for incoming http requests.
• "Rules" bind the listeners to the backend pools.
• "Backend pools" are used to point traffic to the end points.  Also remember to setup "Health Probes", this allows the App pool to verify the backends are working.
•  Ensure you set the diagnostics logging to send logs to "Log Analytics" so you can examine the logs.

Features: 

1. SSL/TLS termination - Terminate SSL using certificate
2. Autoscaling - increase the size or instance count based on traffic requirements
3. Can be setup to be zone redundant
4. Static IP address that doesn't change
5. WAF and DDoS (pretty new 2022, applied using Azure DDoS Sentinel service) capabilities - The WAF allows you to apply OWASP rules and add additional custom rules.  Bot protection is also built in, rules need to be applied to get it to work.  
6. URL-based routing
7. Multiple domains/site hosting
8. Redirection
9. Sticky sessions/session affinity
10. HTTP/2 support
11. Custom error pages (so useful)
12. Rewrite headers and URL

References:

How an application gateway works | Microsoft Docs

WAF options

APIM High Availability and Performance across Regions

Overview:  APIM can be setup in multiple regions and incoming request will be routed to the closest APIM endpoint.  If there is only 1 APIM region, it is best to ensure the API/App Service/Function is hosted in the same region.  With multiple APIM's you can also host a API in the same region.  The routing is either done automatically using Azure Front Door or via policy on the APIM.

Front Door can be substituted with Azure WAF, or Cloudflare or Barracuda's SaaS solution.

https://www.pbeck.co.uk/2020/10/waf-options.html

More Info: 

https://docs.microsoft.com/en-us/azure/api-management/api-management-howto-deploy-multi-region

WAF Options

Overview:  HTTP Traffic from users to web sites and API's need to have WAF protection.  Both Azure and AWS have good services to protect your API's and applications.  There is also the option to use a dedicated WAF Services.  When protecting large organizations with hybrid cloud providers then options like Barracuda, Imperva/Encapusla, F5 and Cloudflare are good enterprise level options.  Fundamentally, a WAF sits as an intermediary between the user and the resource they are requesting using HTTP.  I like to set my highest priority rule to DENY all HTTP & HTTPS traffic, then i specifically open the rules that i want to flow thru, a lot people do it the other way around in smaller implementations.

WAF Options:

• Azure WAF simple in 1 region for a WAF especially with APIM and if you are an Azure customer simple got for an Azure Application Gateway with WAF enabled.  DDoS is s separate service that can be integrated before Azure WAF or Azure Firewall.  Cheaper per IP SKU option for specific IP adrs.
• Azure Front Door WAF is pretty amazing, Cloudflare is historically the leader with similar functionality.  On Microsoft Azure the main two options for WAF are Front Door WAF (Best, most expensive) and Azure Application Gateway WAF.
• Competitor  options: Barracuda WAF SaaS Service or Any software firewall KEMP, F5, Check Point, Fortinet/Fortigate, Cloudflare WAF, Akamai, AWS WAF, AWS Network Firewall, Cloud Armor is GCPs WAF I believe, ....  
• Check WAF service has protection at least for DDoS, XSS, SQL injection attacks, SSL Termination if you need it, Managed RuleSets.
• AWS WAF is for web traffic (layer 7), there is a separate AWS Shield service that is used for DDos attacks.  AFS can be applied at a Application Load Balancer, Amazons API Gateway, and Amazon CloudFront.  With AWS WAF you also get Shield (standard free).  Shield adds advanced features and the standard version that is always included by default with AWS WAF has monitoring and DDoS protection.

• Barracuda WAF is a SaaS Service that has worked fairly well for me.  Has a fair amount of options and rules.  Has add-ons like anti-virus scanning.
• Imperva WAF was previously called Incapsula WAF, that provides a SaaS WAF service including Smart DDoS (block dodgy traffic and passes thru good requests), API Security, SQL injections, Xss.  Multiple data centers around the world.

• Cloudflare is a Secure access service edge (SASE).  Cloudflare provides a WAF service at hundreds of endpoints around the globe (for instance there are 5 Cloudflare endpoints in Australia).  WAF functionality like SSL, DDoS (L7), customer rule e.g. rate limiting, OWASP rules applied, "api protection", et al. is done close to the user request (nice low latency) and then if successful it is pushed to the backend.

 

Last Updated: 2022-03-15

AntiVirus for Windows 2008 Developer Machines or WAF

Problem: My developer machine always runs Windows 2008 R2 x64.  I use the machine to browse the Internet and would like anti-virus installed.  No workstation based anti-virus will install on Windows 2008 Sever.

Initial Hypothesis: All the vendors that provide Anti-virus for Windows 2008 are expensive and are Server based anti-virus software whereas I am using my developer machine to surf and occasionally bring on files so I only need workstation based anti-virus.  Unfortunately I have never found a regular anti-virus that runs on Windows 2008 until now ... and best of all it's free and from Microsoft.

Resolution:  Use "Microsoft Security Essentials"
http://www.microsoft.com/en-gb/security_essentials/default.aspx

List of anti-virus plug ins

Update: 04 Sept 2013 - Antivirus and SharePoint 2013 (Spencer Harbar)

Update: 31 May 2022 - WAF sometimes don't have a anti-virus or cost a lot.  This is a simple approach to use a Linux container to provide an Open API endpoint to programmatically allow files and links to be scanned.

"The SWS Virus Scan Container project leverages ClamAV docker image and provides a REST API over it, which can be used to scan files and URLs. This container image is compatible with Azure Web apps for Containers and could also be run within other orchestrators like Kubernetes (and AKS)."

GitHub - sws-algorithm-competition/GNU-virus-scan_sws-virus-scan: This is a GNU Virus Scan called sws virus scan made by shaoqirui sws