Builtin Azure Service that automatically updates the attack signature heuristically ?

Question

Hi Experts,

We have the need to secure the Application Gateway and hundreds of API exposed to the Internet as part of our production environment, Using the existing builtin, Azure services, How to make it secure from Unknown Threat or 0-day attack exploit?

I wonder if Microsoft Azure has something that can do such Machine Learning or AI in this architecture diagram https://gallery.technet.microsoft.com/Cybersecurity-Reference-883fb54c

As per my understanding, we still have to manage or manually update the OWASP exploit Default protection policy in the Application Gateway-WAF settings.

Or if there is no automated Attack signature update or dynamic update heuristically solution from Azure that can update the Threat signature dynamically, is there any 3rd party vendor WAF+IPS&IDS or Firewall appliances/service that can do it automatically?

I'm open to any suggestion or ideas that you may have.

Thank you.

Answer 1

Hello @EnterpriseArchitect ,

You can use Azure DDoS Protection Standard which is simple to enable, and requires no application changes. Azure DDoS protection, combined with application design best practices, provide defense against DDoS attacks. The protection policies are tuned through dedicated traffic monitoring and machine learning algorithms. Policies are applied to public IP addresses associated to resources deployed in virtual networks, such as Azure Load Balancer, Azure Application Gateway, and Azure Service Fabric instances, but this protection does not apply to App Service Environments.

Application layer protection can be added through the Azure Application Gateway Web Application Firewall or by installing a 3rd party firewall from Azure Marketplace. When coupled with the Application Gateway web application firewall, or a third-party web application firewall deployed in a virtual network with a public IP, DDoS Protection Standard can provide full layer 3 to layer 7 mitigation capability.

Microsoft has also partnered with BreakingPoint Cloud to build an interface where you can generate traffic against DDoS Protection-enabled public IP addresses for simulations.

Please refer : https://learn.microsoft.com/en-us/azure/virtual-network/ddos-protection-overview

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.