Azure Cloud Tech Blog

Introduction

Securing network and application layers remains a critical aspect of modern web application deployment. Microsoft Azure provides comprehensive security solutions through tools like Azure Firewall, Application Gateway, and Web Application Firewall (WAF). This blog explores how these components work, addresses common questions about traffic management, and highlights the latest enhancements in Azure’s WAF that provide greater control over traffic inspection and security policies.

Understanding the Tools

Azure Firewall

Azure Firewall is a cloud-based network security service that protects your Azure Virtual Network resources. It is a fully stateful firewall as a service with built-in high availability and unrestricted cloud scalability. It provides outbound, inbound, and intra-Virtual Network traffic filtering and is primarily used to enforce and control network traffic rules at the perimeter.

Azure Application Gateway

At its core, the Azure Application Gateway is a load balancer that includes a Web Application Firewall (WAF) that provides centralized protection of your web applications from common exploits and vulnerabilities. It is designed to secure web applications at the application layer (OSI layer 7). The gateway routes traffic to specific resources in a backend pool while inspecting incoming requests for malicious activity.

Key Features and Scenarios

When to Use Azure Firewall vs. Application Gateway

• Azure Firewall is best utilized when you need broad protection across multiple virtual networks or subscriptions. It is ideal for filtering outbound, inbound, and spoke-to-spoke traffic, providing general network-level protection and monitoring.
• Application Gateway, on the other hand, is specifically useful when the primary concern is protecting web applications. Coupled with a WAF, it focuses on specific web-based threats and customizing rules based on applications’ requirements.

Common Questions Explained

• Why is my traffic blocked? Traffic might be blocked by the WAF due to specific rules it enforces to protect against threats or misconfigurations in the ruleset that may not align perfectly with the application’s traffic patterns.
• What is the purpose of an Application Gateway? It distributes user traffic across several servers, using the WAF layer to block malicious requests and prevent attacks on your web applications.

Detailed Security Threats and Mitigation Techniques

As cloud services expand, so too do the security challenges associated with deploying applications in the cloud. Azure Firewall and Application Gateway, equipped with Web Application Firewall (WAF), are essential tools in protecting Azure-hosted applications from a variety of threats. This section covers the most prevalent security threats today and describes how specific Azure features help mitigate these risks.

Common Security Threats

1. Distributed Denial of Service (DDoS) Attacks: These aim to disrupt services by flooding networks or applications with an overwhelming volume of traffic, rendering them inaccessible to legitimate users.
2. SQL Injection: Attackers can execute SQL queries via client input data to the application, potentially accessing or altering sensitive database information.
3. Cross-Site Scripting (XSS): In these attacks, malicious scripts are injected into content from trusted websites. When executed in a user’s browser, these scripts can steal cookies, session tokens, or other sensitive data.
4. Phishing Attacks: Commonly executed through email spoofing, these attacks deceive users into divulging sensitive information such as login credentials and financial data.

Azure Solutions for Threat Mitigation

Azure Firewall and Application Gateway with WAF address these threats through:

• DDoS Protection: Azure automatically provides basic DDoS protection, which includes continuous traffic monitoring and mitigation of common network attacks. Azure Firewall adds a layer of security with application-level traffic controls and threat intelligence.
• SQL Injection and XSS Mitigation: Azure Application Gateway’s WAF uses both custom and managed rule sets, including those based on the OWASP core rule sets, to block requests containing malicious SQL queries or scripts.
• Phishing Attack Prevention: Azure Firewall can help prevent access to phishing sites by restricting outbound HTTP/S traffic to known malicious URLs and IPs.

Implementing Security Measures

1. Configure Azure WAF with Custom and Managed Rules: Customize WAF settings to protect against both broad and specific vulnerabilities by integrating custom rules designed for your application’s unique requirements.
2. Regular Updates and Rule Reviews: Continually update and review firewall and WAF configurations to adapt to new threats. Azure regularly updates its threat intelligence to support these efforts.
3. Logging and Monitoring: Use Azure Monitor to log and analyze security events, helping identify patterns of potential threats and ensuring compliance with security policies.
4. Secure Architecture Practices: Implement secure architecture principles such as segmentation and least privilege. Configuring Azure Firewall to segment network traffic between workloads can minimize the impact of any single breach.

Deep Dive into OWASP 3.2 Ruleset and Its Impact

The OWASP 3.2 ruleset in Azure’s WAF provides a set of policies that protect against newly discovered vulnerabilities and security risks. Understanding these rules is crucial for developers to ensure that their applications are not only compliant but also secure from attacks.

• Impact on API Traffic: These rules mean that APIs need to be robust against a slew of attacks such as SQL injection, cross-site scripting, and others, necessitating stringent validation and sanitization of inputs.
• Backend Services Requirements: Backend services must be designed to handle sanitized inputs and should be resilient enough to withstand attacks even if front-end protections fail.

What’s New: Enhanced WAF Flexibility

Recent Updates to Azure’s WAF

The recent enhancements in Azure’s regional Web Application Firewall integrated with Application Gateway v2 focus on providing greater control over inspection limits and size enforcement for WAF policies:

• Independent Controls: You can now control request body inspection, maximum request body limit, and maximum file upload limit independently.
• Disabling Enforcement: It is possible to disable maximum request body limit enforcement and/or maximum file upload limit enforcement without turning off request body inspection. This update offers more flexibility, allowing for larger requests to be processed without being blocked due to size limits.

Cost Considerations and Optimization

Implementing robust security measures like Azure Firewall and Application Gateway involves not only technical considerations but also a strategic approach to cost management. Effective cost optimization ensures that an organization maximizes its investment in Azure services without sacrificing necessary protections. This section delves into the cost aspects of using Azure Firewall and Application Gateway, providing strategies for cost-effective deployment and ongoing management.

Understanding the Cost Structure

Azure Firewall and Application Gateway each have unique billing aspects that can impact the overall cost:

• Azure Firewall is billed based on two primary factors: the number of firewall units deployed and the volume of processed data. Firewall units are determined by the scale of your deployment, with costs scaling linearly as additional units are provisioned.
• Azure Application Gateway pricing depends on the chosen tier (Standard, Standard_v2, or WAF_v2) and the number of instances. Additional costs may accrue based on data processing and the number of configured web application firewall rules.

Strategies for Cost Optimization

1. Right-Size Your Deployment: Start with the minimum necessary capacity and scale up as required. Use Azure’s monitoring tools to assess performance and throughput needs, ensuring you are not paying for unused capacity.
2. Choose the Appropriate Tier: Select the Azure Application Gateway tier that matches your needs. For instance, if advanced WAF capabilities are not required, the Standard_v2 tier may offer substantial savings over the WAF_v2 tier.
3. Manage Data Processing Costs: For Azure Firewall, consider creating rules that minimize unnecessary data transfers and inspecting traffic. Use traffic filtering to prevent the inspection of trusted applications, reducing the volume of processed data and associated costs.
4. Use Reserved Instances: If your firewall and application gateway resources are required long-term, purchasing reserved instances can provide significant savings compared to pay-as-you-go pricing models.
5. Automate to Reduce Idle Resources: Implement scripts or use Azure’s native tools to automatically scale down or shut off unused instances during off-peak hours. This can be particularly effective for Application Gateway resources used in development or staging environments.
6. Review and Optimize Rules Regularly: Over time, the rules configured in both Azure Firewall and Application Gateway may become outdated or redundant. Regular reviews and optimizations of these rules can prevent inefficient and costly processing.

Implementing Cost-Saving Measures

1. Use Azure Pricing Calculator: Before deploying, use the Azure Pricing Calculator to estimate costs based on expected usage. This can help in budgeting and choosing the right configuration from the start.
2. Monitor and Adjust: Continuously monitor your deployments using Azure Cost Management and Billing tools. These tools provide insights into usage patterns, allowing for timely adjustments to avoid cost overruns.
3. Consolidate Resources: Where possible, consolidate networking resources to reduce overhead and management costs. Shared firewall and gateway services can serve multiple applications, optimizing resource utilization.

Conclusion

By understanding and utilizing these tools effectively, developers can significantly reduce the risk profile of their applications and respond more adeptly to the evolving cybersecurity landscape.