Protecting the Public IPs of Secured Virtual Hub Azure Firewalls against DDoS Attacks
As discussed previously in the blog post “Fortify Your Azure Firewall: Custom Public IP Configuration on Secured Virtual Hub Deployments”, in the current cloud-focused environment, the management of network security has become increasingly important. Azure Firewall has long been an effective solution for securing virtual networks and virtual hubs, but recent updates have further enhanced its capabilities. The ability to specify your own Azure public IP to be used by your Azure Firewall within an Azure Virtual WAN Secured Virtual Hub, rather than relying on Azure to automatically assign one is a great feature that provides enhanced control over your network's public-facing IPs, enabling alignment with organizational security policies and compliance standards. In this blog, we'll discuss enhancing your secured virtual hub Azure firewall security by configuring Azure DDoS IP Protection for a comprehensive solution. Recap of the key benefits of using specific Public IPs for your Secured Virtual Hub Azure Firewalls Full Control: Gain complete ownership and management over the lifecycle of your firewall's public IP address. This means you can assign, reassign, and retire IP addresses as needed, ensuring that your network infrastructure remains agile and responsive to changing demands. By having full control, you can also implement custom configurations and policies that align with your specific security and operational requirements. Enhanced Security: Strengthen your network's defenses by enabling Distributed Denial of Service (DDoS) mitigation. This advanced security feature helps protect your infrastructure from malicious attacks that aim to overwhelm your network with excessive traffic. By proactively identifying and neutralizing potential threats, DDoS mitigation ensures that your services remain available and secure, providing peace of mind and uninterrupted access for your users. IP Address Flexibility: Enjoy the flexibility of allocating public IP addresses from a predefined IP prefix pool. This allows you to efficiently manage your IP resources, ensuring that you have the right number of addresses available for your current and future needs. With this flexibility, you can easily scale your network, accommodate new devices, and optimize IP address usage, all while maintaining a streamlined and organized IP address management system. How-to enable Azure DDoS IP Protection In this section we’ll configure Azure DDoS Protection to prevent DDoS attacks against the deployment. This is a key benefit that comes with the ability to configure your own public IPs on the Azure Firewall with Secured Virtual Hub. Select any of the public IPs you have associated with the firewall, this should bring you to the Overview blade of that resource. From the Overview blade, select the Protect button under Get Started. This will be how we enable the protection level for the public IP today, since the SKU that can be used for the protection will be Azure DDoS IP Protection, not Azure DDoS Network Protection. Since the virtual network used for the Virtual Hub is a managed virtual network, we cannot use the DDoS Network Protection SKU. You do have the option to enable this level of protection via Azure PowerShell or Azure CLI. From this view, we can see the various ways to configure DDoS protection for a public IP in Azure. As mentioned before, public IPs associated with an Azure Firewall in Secured Virtual Hub must use IP protection. In case you already have a DDoS Protection Plan, you will have the option to link it to the DDoS IP SKU when enabling the IP protection. When a DDoS IP SKU is linked to a plan, you will only be charged by your DDoS Protection Plan, instead of being charged for both. Once DDoS IP Protection is enabled, you can check the following 3 metrics, under the public IP resource, to validate the threshold levels applied to the public IP. Inbound SYN packet to trigger DDoS mitigation Inbound UDP packets to trigger DDoS mitigation Inbound TCP packet to trigger DDoS mitigation This indicates that the Azure DDoS IP Protection is on and protecting the workload behind the public endpoint. Conclusion Configuring specific public IP addresses for your Azure Firewall within a secured virtual hub represents a major leap forward in network security management. This feature not only offers enhanced control over your firewall's public-facing IPs but also significantly bolsters your security posture by incorporating Azure DDoS IP Protection. By utilizing this capability, you can safeguard your firewall against potential DDoS attacks, ensuring a more resilient and secure environment for your applications and services.Fortify Your Azure Firewall: Custom Public IP Configuration on Secured Virtual Hub Deployments
Written in collaboration with davidfrazee and gusmodena. In today's cloud-centric world, managing network security is more critical than ever. Azure Firewall has always been a robust solution for protecting your virtual networks, but recent updates have made it even more powerful. One of the latest enhancements allows you to configure which public IP addresses are used on your Azure Firewall in an Azure Virtual WAN Secured Virtual Hub, rather than having Azure automatically assign one for you. This new feature provides greater control over your network's public-facing IPs, enabling you to align them with your organization's security policies and compliance requirements. Moreover, this capability opens the door to leveraging Azure DDoS IP Protection. By selecting specific public IPs for your firewall, you can ensure that these addresses are shielded from distributed denial-of-service (DDoS) attacks, enhancing the overall security posture of your Azure environment. This integration not only fortifies your defenses but also simplifies the management of your network security infrastructure. In this blog, we will discuss our newly announced feature for Azure Firewall, detailing how to configure public IP addresses from your own subscription and highlighting the benefits of this enhancement. Key Benefits Full control – Own and manage the lifecycle of your firewall’s public IP. Enhanced security – Enable DDoS mitigation for better protection. IP address flexibility – Allocate public IPs from an IP prefix pool. How-To To get started with configuring public IP addresses on your Azure Firewall, you'll need to follow a few straightforward steps. This guide will walk you through the process, ensuring that you can take full advantage of this new feature. By the end of this section, you'll have a clear understanding of how to assign specific public IPs to your firewall, enhancing your control over network security and enabling the integration of Azure DDoS IP Protection. You’ve created an Azure Virtual WAN and now need to deploy secured virtual hubs. A great place to start with building out the environment in the Azure Portal will be in the Azure Firewall Manager. Here you’ll be able to have a centralized management portal to view your Azure Firewalls, firewall policies, Azure DDoS Protection plans, and more. Once you’re in Azure Firewall Manager, select Virtual Hubs to build a new secured virtual hub. Once you’ve configured the basic configurations for the secured virtual hub, you’ll have the option to start creating the Azure Firewall. You’ll notice a new option called Select source of public IP. Here we will select Customer provided (Preview) to define which public IPs will be used for the new secured virtual hub. You’ll have the option to choose a pre-created public IP or to create new from the firewall manager blade. With the secured virtual hub created, we can navigate back to Azure Firewall Manager and manage the new deployment from there. Under Virtual Hubs, select on the Firewall name to manage the public IP addresses. To add more public IPs to your Azure Firewall, you can either create new public IP resources or select from pre-created ones. This feature ensures that Azure won't just assign an IP for you; instead, you have the flexibility to choose or create the specific public IPs that align with your network requirements. This approach provides greater control and customization for your firewall's public-facing IP addresses. Now that we’ve added public IPs to the Azure Firewall, we can configure Azure DDoS Protection to prevent DDoS attacks against the deployment. This is a key benefit that comes with the ability to configure your own public IPs on the Azure Firewall with Secured Virtual Hub. Stay tuned for our next blog post where we’ll go through the steps needed to protect the Public IP associated to your secured virtual hub Azure Firewall. Conclusion The ability to configure specific public IP addresses for your Azure Firewall in a secured virtual hub marks a significant advancement in network security management. This feature not only grants you greater control over your firewall's public-facing IPs but also enhances your security posture by enabling the integration of Azure DDoS IP Protection. As we continue to navigate the complexities of cloud security, features like these empower organizations to tailor their security strategies to meet their unique needs and compliance requirements. Stay tuned for more updates and best practices on optimizing your Azure Firewall and protecting your network infrastructure.Building a DDoS Response Plan
In today's digital age, enterprises face significant threats from Distributed Denial of Service (DDoS) attacks, which target networks and applications to disrupt their availability and performance. Public IP addresses that are accessible via the internet are particularly susceptible to these attacks, which are classified into three main categories: Volumetric Attacks (saturating network links), Protocol Attacks (targeting server resources), and Resource Attacks (overwhelming application layers). Implementing effective mitigation strategies is crucial for maintaining network integrity. Azure DDoS Protection provides advanced, adaptive features designed for automatic protection against both Volumetric and Protocol Attacks. These features include traffic monitoring, real-time tuning, and detailed analytics. For Resource Attacks, pairing Azure DDoS Protection with Azure Web Application Firewall (WAF) ensures comprehensive Layer 7 (L7) protection. To thoroughly safeguard against DDoS attacks, it is essential to establish a comprehensive DDoS response plan. This blog will explore the development of a robust DDoS response plan by leveraging the capabilities offered by Azure DDoS Protection. Building a Robust DDoS Response Plan: Creating a thorough DDoS response plan is critical for protecting your online services and ensuring they remain accessible. The following steps are fundamental to developing a robust DDoS response strategy. Incident Detection: Utilize advanced monitoring tools and establish baseline traffic patterns to quickly identify abnormal activity indicative of a DDoS attack. Communication Protocols: Inform all relevant stakeholders through predefined channels and clarify roles and responsibilities to avoid confusion during the crisis. Mitigation and Recovery: Implement countermeasures such as traffic filtering, rate limiting, and leveraging cloud-based DDoS protection services to ensure service availability for legitimate users. Post-Incident Steps: Assess the attack's impact, identify vulnerabilities, and enhance the response plan through a thorough post-mortem analysis to fortify defences against future attacks. By following these four steps, you can build a solid DDoS response plan that minimizes disruption and enhances your organization's resilience. Let’s explore these four steps using Azure DDoS Protection in detail. Incident Detection Identifying the signs of a DDoS attack is essential. This includes monitoring network traffic, reviewing logs, and analysing alerts. Key indicators to monitor for potential attacks are unusual traffic patterns, spikes in network traffic, service degradation, latency metrics, CPU, memory, and bandwidth usage. Azure DDoS protection metrics can be utilized for this purpose. DDoS Protection Metrics: Azure DDoS Protection Metrics can be accessed through the Azure Portal: Go to Azure Portal > Monitor > Metrics. In the Metrics scope pane: Select the resource group. Select a resource type of Public IP Address. Select your Azure public IP address. Choose from various DDoS metrics in the “Available metrics” pane. Alerts: Alerts can be configured for any of the available DDoS Protection metrics. When conditions are met, the specified email address receives an alert. Works for any of the available DDoS Protection metrics. Alerts when there’s an active mitigation during an attack (using Azure Monitor alert configuration). When the conditions are met, the specified email address receives an alert email. Impact to the Applications: We can also evaluate the health of our application using the metrics furnished by the Application Gateway. These metrics offer detailed insights during the attack time, including but not limited to the metrics listed below: Failed Requests – Count of Failed Requests that the App Gateway has served. Throughput – Number of Bytes per second the App Gateway has served. Backend First Byte Response Time – Approximating Processing time of backend server. Logging: Along with metrics, Azure DDoS Protection offers solid logging capabilities. For example, AzureDiagnostics | where Category == “DDoSProtectionNotifications”: This log category furnishes details about the initiation and cessation of DDoS mitigation. These logs serve as a basis for configuring alerts to notify the Security Operations Center (SOC) Analyst as necessary. The integration of Azure DDoS Protection with Microsoft Defender for Cloud (MDC) provides recommendations for unprotected public IP addresses and consolidates alerts into a unified dashboard, while also offering regulatory compliance guidance based on established standards. Additionally, the integration of Azure DDoS Protection with Microsoft Sentinel facilitates the ingestion of DDoS logs into Sentinel, where prebuilt queries can generate incidents and alerts. Automated remediation options are available as specified here. For comprehensive guidance on researching a DDoS attack, please refer to this blog: Azure DDoS Protection – SecOps Deep Dive Communication Effective communication is crucial during a DDoS attack. It is essential to establish a robust communication strategy to prevent panic-induced miscommunication or the failure to relay information through appropriate channels. The following image illustrates the critical components of a solid communication plan Azure DDoS Rapid Response: Azure DDoS Protection's Rapid Response Support team aids with attack investigations during incidents and post-attack analysis. Engage the DRR team if your protected resource's performance is significantly degraded or unavailable during an attack, if you suspect a DDoS attack but the DDoS Protection service isn't effectively mitigating it, if you're planning an event that will drastically increase network traffic, or if the attack has a critical business impact. You can contact the DRR team during an active attack via Help + Support in the Azure Portal using the below steps. Create a new support request and choose “Issue Type” as Technical. Choose the “Service” as DDOS Protection. Select a DDoS Plan that is being protected by DDoS Network Protection in the “Resource” dropdown. Select "Under attack" in the “Problem Type” dropdown. On the “Details” page, select the severity as A-Critical Impact. Complete additional technical details and submit the support request. Azure DDoS Rapid Response: https://learn.microsoft.com/en-us/azure/ddos-protection/ddos-rapid-response Mitigation and Recovery Mitigation and recovery efforts encompass the implementation of countermeasures to absorb or redirect malicious traffic, thereby ensuring uninterrupted access for legitimate users to services. Mitigation: Below are key mitigation techniques provided by Azure DDoS Protection Azure DDoS Protection Adaptive Tuning No user configuration required. Continuously profiles normal Public IP traffic. Utilizes machine learning algorithms to set mitigation thresholds. Azure DDoS Protection Thresholds: Azure DDoS Protection applies three auto-tuned mitigation policies (TCP SYN, TCP, and UDP) for each public IP of the protected resource. Thresholds are auto-configured via machine learning-based network traffic profiling. DDoS mitigation occurs for an IP address under attack only when the policy threshold is exceeded. Recovery: To ensure an effective recovery from a Distributed Denial-of-Service (DDoS) attack, the following critical steps must be meticulously executed: Isolate Affected Resources: It is imperative to identify and isolate the compromised resources promptly. This isolation helps in containing the attack and prevents further damage to the network and associated systems. Business Continuity Plans: Disaster Recovery: Develop comprehensive disaster recovery protocols to restore normal operations swiftly. This includes predefined strategies to address the attack's impact and ensure a seamless transition back to standard operations. Backups: Regularly maintain secure and up-to-date backups of critical data and systems. These backups should be readily accessible to facilitate rapid restoration in case of data loss or corruption caused by the attack. Failover Mechanisms: Establish efficient failover mechanisms to shift critical services and applications to alternative servers or locations. This redundancy ensures minimal downtime and continuous service availability during recovery efforts. Patching Vulnerabilities: Conduct a thorough assessment to identify and remediate any vulnerabilities that the attack may have exploited. Implementing patches and updates promptly is essential to fortify the system against future incidents and enhance overall security posture. Post Incident Steps: After an attack, conducting a post-attack investigation and analysis, implementing best practices, and performing simulation testing is important. DDoS Protection Workbook: Utilizing the Azure DDoS Protection Workbook is highly recommended to triage and understand the DDoS Threat landscape. Best Practices: Here are some of the best practices to follow Design for Security Prioritize security throughout the application lifecycle. Understand your architecture and focus on software quality. Prepare for direct application-level attacks. Design for Scalability Use horizontal scalability to handle increased load. Avoid single points of failure. Provision multiple instances for resilience. Defense in Depth Implement multi-layered security. Reduce attack surface using approval lists and NSGs. DDoS Attack Simulation: Test your assumptions about how your services will respond to an attack by generating traffic against your applications to simulate DDoS attack. Don’t wait for an actual attack to happen! Approved Simulation Partners include Breaking Point Cloud, Red Button, Red Wolf and MazeBolt Conclusion: DDoS attacks are a serious threat, and having an effective response plan is critical. Utilize effective communication, safeguards, and best practices, and ensure regular testing and updates to stay protected. References: Azure DDoS Protection Overview | Microsoft Learn Microsoft DDoS protection response guide | Blog Azure | Microsoft AzureUnderstanding the Evolving Threat of DDoS Attacks in 2024
You can access the full report here Microsoft Digital Defense Report 2024 The Rise of Network and Application Layer Attacks Beginning in mid-March 2024, there was a noticeable rise in network DDoS attacks, peaking at approximately 4,500 attacks per day by June. These attacks primarily targeted medium-sized applications, with a significant shift towards application layer attacks. Unlike traditional network-level attacks, application layer attacks are more stealthy, sophisticated, and difficult to mitigate. These attacks, which range from 100,000 to 1 million packets-per-second, are aimed directly at specific web applications, revealing the relentless nature of attackers trying to evade volumetric DDoS protection tactics. Without adequate protection, these applications would experience significant availability issues. The increased focus of DDoS attacks on the application layer rather than the more traditional network layers has created a greater risk of impact on business availability. This shift has affected critical services such as online banking and airline check-ins, highlighting the need for robust application layer protection The Emergence of Application Loop Attacks A new type of cyberattack, known as the "loop attack," is targeting the protocols that are essential for internet communication. This vulnerability affects application-layer protocols that rely on the User Datagram Protocol (UDP), such as TFTP, DNS, and NTP, as well as legacy protocols like Echo, Chargen, and QOTD. The loop attack triggers an endless loop of error messages between servers, leading to severe degradation of service and network quality. Unlike traditional UDP-based floods, loop attacks do not amplify traffic volume with each spoofed packet but can still cause significant disruption by trapping multiple servers in a never-ending communication loop. This attack highlights the vulnerabilities within our network protocols and underscores the need for continuous vigilance and robust security measures to protect against such sophisticated threats. Mitigation Efforts and Actionable Insights To combat the increasing threat of DDoS attacks, it is crucial to minimize the exposure of your applications over the public internet. This reduces the attack surface area and helps protect against potential threats. For applications that must be exposed, adopting a defense-in-depth strategy is essential. Ensure that network layer DDoS protection is in place to protect these applications. Specifically for web applications, deploying a web application firewall is vital to provide comprehensive application layer protection. Integrating DDoS simulations into the software development lifecycle and making them a regular part of security operations is also recommended. This ensures that applications and workloads have the appropriate level of protection and can scale effectively to handle potential attacks. The Impact of DDoS Attacks in India In 2024, India continued to be heavily impacted by DDoS attacks, particularly in the gaming sector. The number of DDoS attacks per customer in India has more than doubled since 2020, with mid-size throughput attacks reaching around 1,000 attacks per day on the gaming sector alone. This accounted for approximately 20% of all attacks in the APAC region during that period. The finance, technology, and government sectors were also major targets. The attack volume per customer increased from 1.4 Gbps to 2.4 Gbps. Layer 4 (L4) attacks were the most prevalent type of DDoS attack in the APAC region and globally. DNS query floods were the most common type of application-level DDoS attacks in India. Hacktivists, who use cyberattacks to express their political, social, or ideological views, were a major source of these attacks. There was a notable spike in DDoS activity in June 2024, coinciding with India's national elections. To mitigate these threats, it is essential to implement robust DDoS protection solutions, secure the network and application infrastructure, harden the DNS infrastructure, and prepare an incident response plan. Here are some actionable insights: Implement a DDoS Protection Solution: Secure the network and application infrastructure, harden the DNS infrastructure, and prepare an incident response plan. Security Measures: Implement security measures such as firewalls, load balancers, and routers to secure the network and application infrastructure. DNS Hardening: Implement security measures such as DNSSEC and DNS filtering to harden the DNS infrastructure. By following these actionable insights, organizations can better protect themselves against the increasing threat of DDoS attacks and ensure the availability and security of their critical services. Leveraging Azure DDoS Protection To effectively combat DDoS attacks, customers can leverage Azure DDoS Protection. This service provides comprehensive protection against DDoS attacks by continuously monitoring traffic and automatically mitigating threats. Azure DDoS Protection integrates seamlessly with Azure services, offering enhanced security for your applications and ensuring business continuity even during an attack. Azure DDoS Protection provides several key features: Always-on Monitoring: Monitors traffic 24/7 and automatically mitigates attacks once detected. Adaptive Tuning: Learns your application's traffic patterns and adjusts profiles in real-time. Attack Analytics: Provides detailed reports during and after attacks, with logs for real-time monitoring. Attack Alerts: Configurable alerts for attack start, stop, and duration, integrating with operational software. Rapid Response: Access to the DDoS Rapid Response team for attack investigation and post-attack analysis. Platform Integration: Integrated into Azure with easy configuration through the Azure portal. Turnkey Protection: Simplified setup that protects all resources on a virtual network immediately. Multi-Layered Defense: Works with Azure WAF to protect both network (Layer 3 and 4) and application layers (Layer 7). It is important to note that Azure DDoS Protection primarily provides protection against layer 3 and 4 DDoS attacks. To achieve comprehensive application layer protection, customers can supplement Azure DDoS Protection with Azure Web Application Firewall (WAF). Azure WAF offers robust security features to protect web applications from common threats and vulnerabilities at the application layer. By utilizing Azure DDoS Protection and Azure WAF, organizations can protect their digital assets and maintain high availability of their services. For more detailed insights and to learn how to implement Azure DDoS Protection, visit Azure DDoS Protection Overview | Microsoft Learn Conclusion The Microsoft 2024 Security Report underscores the evolving nature of DDoS attacks and the need for continuous vigilance and robust security measures. As attackers become more sophisticated, it is essential for organizations to stay ahead of the curve by implementing comprehensive DDoS protection strategies and regularly testing their defenses through simulations and security operations. For more detailed insights, you can access the full Microsoft 2024 Security Report Microsoft Digital Defense Report 2024
Getting Started with Azure DDoS Protection REST API: A Step-by-Step Guide
Learn how to create, update, and delete Azure DDoS Protection for your internet facing applications. We'll cover how to create an Azure DDoS Network Protection plan to safeguard entire virtual networks from DDoS attacks, and how to enable DDoS protection to single IP resources for targeted defense that cater to SMB customers.Monitoring Azure DDoS Protection Mitigation Triggers
In today’s digital landscape, Distributed Denial of Service (DDoS) attacks pose a significant threat to the availability and performance of online services. Azure DDoS Protection provides robust mechanisms to protect your applications and services against such attacks. In this blog post, we’ll explore how to monitor Azure DDoS Protection metrics for public IPs and demonstrate how to fully utilize the available metrics to monitor your public IPs for DDoS attacks.Portal extension for Azure Firewall with DDoS protection
The new Azure Firewall flow creation process represents a significant advancement in network security management. This process is designed to be user-friendly, providing a more streamlined experience for setting up and managing firewalls. It offers a host of features and benefits that make it a superior choice over the previous . These improvements not only enhance the user experience but also contribute to a more secure network environment.
