An end to end configuration of Azure App Gateway in front of Azure App Service with Log Analytics monitoring. You will see a demo of a simple penetration test and how you can monitor and alert with Log Analytics to detect common web attacks such as SQL injection and cross site scripting with the Gateway’s Web Application Firewall. You will walk away with an understanding of how Azure App Gateway and Log Analytics is applied as a security solution.

3. www.roykim.ca
roy@roykim.ca

6. Open Web Application Security Project
OWASP ModSecurity Core Rule Set (CRS)

7. OWASP Top 10 Most Critical Web Application Security Risks
A1:2017-Injection
A2:2017-Broken Authentication
A3:2017-Sensitive Data Exposure
A4:2017-XML External Entities (XXE)
A5:2017-Broken Access Control
A6:2017-Security Misconfiguration
A7:2017-Cross-Site Scripting (XSS)
A8:2017-Insecure Deserialization
A9:2017-Using Components with Known Vulnerabilities
A10:2017-Insufficient Logging&Monitoring

8. *
https://www.zaproxy.org/
https://github.com/zaproxy/zap-hud

10. Azure Application Gateway
 An application delivery controller
 layer 7 load balancing/routing capabilities
 web application firewall.

11. OWASP
ModSecurity Core Rule Set

12. https://docs.microsoft.com/en-us/azure/azure-monitor/azure-monitor-rebrand#log-analytics-redefinition

13. • Configuration
• Penetration Test
• Monitoring with Log Analytics
• Alert
* see appendix slides for demo screenshots

15. roy@roykim.ca