Please enable JavaScript.

Coggle requires JavaScript to display documents.

WAF, AWS, INPUTS Business Requirements This is where we get inputs from,…

- - - - Update Domains:
        DC is logically sectioned into UDs. Host level maintenance
      - Fault Domain;
        represent a physical sections of DC,
        ensure rack diversity of servers in an availability set. FD align to the physical separation of shared hardware in the DC. This includes power, cooling, and network hardware that supports the physical servers located in server racks
      - With availability sets, you can ensure your application remains online if a high-impact maintenance event is required or hardware failures occur.
    - - AZ are independent physical DC locations within a region. Supported regions have a min 3 AZ
    - - essential in keeping your application resilient to individual component failures and to ensure your application is available to process requests
      - Azure Traffic Manager
        
        Global DNS LB
        DNS endpoints across Azure regions
      - Azure Application Gateway
        
        L7 LB, round-robin distribution of incoming traffic, cookie-based session affinity, URL path-paths routing, host multiple websites behind a single application gateway. It also monitors the health of all resources in its backend pool
      - Azure Load Balancer
        
        L4 LB, configure public and internal endpoints and define rules to map inbound connections to backend pool destinations by using TCP and HTTP.
    - - HA build-in. Examples Azure SQL, App Service, Service Bus. But consider SLAs, availability sets and zones.
  - - - Disaster recovery is about recovering from high-impact events that result in downtime and data loss. A disaster is a single, major event with an impact much larger and long-lasting than the application can mitigate through the high-availability portion of its design.
        
        Hackers
        
        Natural disaster
      - How to create a disaster recovery plan:
        A disaster recovery plan is a single document that details the procedures that are required to recover from data loss and downtime caused by a disaster, and identifies who's in charge of directing those procedures.
        
        Detailing recovery steps:
        Backups
        Data replicas
        Deployments
        Infrastructure
        Dependencies
        Configuration and notification
        
        Data recovery - Using backups and replication to restore lost data
        Process recovery - Recovering services and deploying code to recover from outages
      - Risk assessment and process inventory:
        The first step in creating a disaster recovery plan is performing a risk analysis that examines the impact of different kinds of disasters on the application.
      - Recovery Objectives:
        RPO + RTO
        
        Backup
        The final and most powerful line of defense against permanent data loss
        
        Establish backup and restoration requirements
        
        How much of this type of data can afford to be lost, measured in duration
        The maximum amount of time a restore of this type of data should require
        Backup retention requirements: how long and at what frequency do backups need to remain available
        
        Azure Backup
        
        Azure Backup Agent
        is a small Windows application that backs up files, folders, and system state from the Windows VM or server on which it's installed. It works in a way that's similar to many consumer cloud-based backup solutions, but requires configuration of an Azure Recovery vault. Once you download and install it onto a Windows server or VM, you can configure it to create backups up to three times a day.
        
        DPM: filesystems, VMs, bare metal backup of physical servers, app-aware backups
        
        Azure Backup Server, similar to DPM
        
        Azure IaaS VM Backup, backup VMs, app-consistent backups
        
        Azure Blob storage: Immutable blob storage
        
        Azure SQL database, automatic backups built-in. Full backups weekly and differential every 12 hrs and log backups created every 5 minutes
        
        Azure App Service, standard and premium supports manual and schedule backups
        
        Verify backups and test restore procedures
- - - - Azure Monitor
        Advisor
        Service Health
        Activity Log
    - - Log Analytics
        Management Solutions
        Service Map
        Network Monitoring
    - - Application Insights
    - - Alerts
        Dashboards
        Metric Explorer
  - - - Imperative and Declarative - automation
    - - Periodically searching for orphaned disks
        Installing the latest security patches on VMs
        Searching for and shutting down virtual machines in off-hours
        Running daily reports and producing a dashboard to report to senior management
  - - - IaC is a management of infrastructure in descriptive model
      - Deployment is fully automated and idempotent
        Consider PROD, DEV, TEST environments
      - ARM templates or Terraform: declarative approach
        
        Validation - Terraform supports this
        
        Dependency tracking (dependsOn & child resources)
        Subscriptions have subscription limits
        Visualise data workloads
        Tagging of resources
        you can categorise resources
      - Azure PowerShell or Azure CLI scripts: imperative
      - To automate infrastructure deployment, you can use Azure DevOps services, Jenkins, or other CI/CD solutions
    - - Azure Application Insights
        
        Dashboard
        Perf stats
        Dependency management via application map
        Usage analysis
        Smart detection
        Release annotations
        Snapshot debugger
        Codeless vs codebase monitoring
      - Azure Monitor
        (big brother)
        
        Monitors the entire landscape
        Supports on premise monitoring
        Platform monitoring
        Container insights
        
        Dashboards
        Workbooks are a interactive version of a Dashboard
        
        Network Watcher
        
        Traffic analytics
        Microsoft Threat Intelligence databases can detect malicious IPs
        VPN diagnostics
        Connection monitoring
        
        Activity logs
        Azure service health
        Azure advisor
        Azure security centre
        
        Create meaningful custom dashboards
        Share information with all relevant stakeholders
        Use notifications
        Use automation
        Review subscription limits
        Monitor expiration dates of digital certificates
    - - Improve build times
        Use hosted agents
        Figure out the right VM size
        Scale out build servers
        Build server location
        Use parallel execution of tests
- - - - Data: database, VM disk, software (SaaS), cloud storage. The people who store and control access to data are responsible for ensuring that it's properly secured. Often, regulatory requirements dictate the controls and processes that must be in place to ensure the confidentiality, integrity, and availability of the data.
      - Applications: secure + free of vulnerabilities, store sensitive app secrets in a secure storage medium, make security a design requirements for all application dev
      - Compute: secure access to VMs, implement endpoint protection and keep systems patched. Malware, unpatched systems, and improperly secured systems open your environment to attacks. The focus in this layer is on making sure that your compute resources are secure, and that you have the proper controls in place to minimize security issues.
      - Networking: limit communications between resources through segmentation + access control, deny by default, restrict inbound internet access and limit outbound where appropriate, implement secure connectivity to on-premise networks.
      - Perimeter: use DDoS protection to filter large-scale attacks, use perimeter firewalls to identify and alert on malicious attacks against your network
      - Identity and access: control access to infrastructure (change control), use SSO +MFA, audit events+change
      - Physical Security: Physical building security and control access to computing hardware within the DC are the first line of defence