>> Vulnerability Assessment and Advanced Threat Protection
are two awesome capabilities that come in Azure SQL.
But did you know that with Azure Defender for SQL,
you can actually get this anywhere your SQL is running?
Learn more in this episode of Data Exposed.
[MUSIC]
>> Hi, I'm Anna Hoffman and
welcome to this episode of Data Exposed.
Today I'm joined by David.
David, why don't you start by telling us
a little bit about yourself and what you do?
>> Hi Anna, hi everyone.
Thank you. Yes sure.
My name is David Trigano.
I'm a Program Manager at Microsoft
working on the Azure Security Center product group,
and my team and I focus on securing SQL Server anywhere.
>> Awesome, thanks David.
Securing SQL Server anywhere
that's related to what we wanted to talk about today
and that is Azure Defender for SQL.
Now, David, for those of us that are new to this.
I'm pretty new to this myself.
Can you tell us what is Azure Defender for SQL?
>> Sure. Good question, actually.
Azure Defender for SQL is a security bundle part
of the Azure Defender family.
It protects SQL Servers with two main capabilities.
The first one is called Advanced Threat Protection.
It's a feature that provides a set of advanced
security capabilities to detect anomalous activities,
indicating unusual and potential harmful attempts
to access or exploit SQL Servers.
The second capability or the second feature
is SQL Vulnerability Assessment.
It's a feature that helps customers to ensure
their SQL Servers are well configured
and allow them to improve their SQL security posture.
>> Thanks David.
That's really cool.
Vulnerability Assessment and Advanced Threat Protection
are two really awesome security capabilities.
Now, when we talk about Azure Defender for SQL,
where is this supported?
What versions?
What environments?
>> Recently we announced that Azure Defender for SQL
supports any type of SQL, any flavor of SQL anywhere.
It means that we can support Managed SQL that runs on Azure,
we can even support SQL Server that run outside of Azure
on any Cloud provider, powered by Azure Arc, On-Premise
or as I said, on any other Cloud provider.
>> Wow, that's pretty cool.
When you say anywhere, you mean anywhere?
>> Absolutely.
>> Now, if I wanted to go and set this up,
or deploy and configure this,
how easy is it to do that?
>> Well, this is super easy.
I'm going to show you within a minute.
It's a simple click.
You can use Azure Security Center
to deploy Azure Defender for SQL
and our customers can enable it
on their subscriptions on Azure,
allowing them to protect any existing SQL assets
and any new SQL that will be created in the future.
Let me show you how it works.
Here I am.
On my Azure Portal,
I'd open Azure Security Center,
clicked on "Pricing and settings" and selected my subscription.
You can see that currently on this subscription,
Azure Defender is not enabled,
but I can, with one simple click, enable it.
Now, Azure Defender protects my entire state
in both hybrid and multi-Cloud environments.
In addition, Azure Security Center
provides a dashboard centralizing Azure Defender coverage
and a view to track their layouts raised on the resources
both inside and outside Azure.
Now, let's focus into a specific Azure Arc
enabled SQL Server that is hosted outside of Azure.
With Azure Arc, Azure Defender for SQL
provides similar protection experience across SQL Servers,
both inside and outside of Azure.
Let's look at the security page to see
the security recommendations and alleles
that are available for both SQL Server
and the underlying Windows Operating System.
Let's drill down into the findings of high severity,
SQL Vulnerability Assessment recommendation.
Here, Azure Defender for SQL
continuously runs a set of security checks,
again, protected SQL Servers.
It reports a list of findings upon discovery
of security misconfigurations, excessive permissions,
or unprotected sensitive data.
Here you can see two typical findings that indicate this SQL Server
is vulnerable for attacks like the Vollgar campaign.
For example, you see the XP command shell
is currently enabled and should be disabled,
and the default login SA is not disabled.
Let's have a look into the second finding.
SQL Vulnerability Assessment provides
you relevant information about the vulnerability
that was found including the reason,
remediation steps, impact, and even a query to fix it.
It also provides you a list of security benchmarks
that are related to this finding.
Now, if we go back on the security page for this SQL Server,
you can see that Azure Defender
has also detected a brute force attempt on
this Azure Arc enabled SQL Server machine.
It is apparent that the brute force attack is related to the fact
that the well-known SQL SA log in has not been disabled.
Clicking on the alleles shows more details
on the resource that was attacked.
You can see the resource is Azure Arc enabled
as SQL Server and it's also tagged
as being for production environments.
In addition, you can see more information
about the suspicious activity that was detected.
You see that the attacker has made
100 attempts to exploit the SA login.
Let's see now what are the actions that are recommended
by Azure Defender to mitigate these threats.
The Azure Defender recommendation
suggests mitigating the threat by blocking
the attacking IP address of the client
from where the brute force attack came.
It also suggests disabling the SA login.
Lastly, you see that Azure Defender alleles
are integrated with Azure Sentinel,
which means the SecOp team can also see
this security incident using their central dashboard.
The SecOp team can choose to further investigate
the SQL brute force incident by using
Azure Sentinel's Advanced investigation tool.
The SecOp team can explore the host entity
in Azure Sentinel's Investigation Graph,
and can notice that there are additional security incident on
the SQL Server that indicates a popular threat has occurred.
In that case, it seems like the Vollgar campaign.
But going through the timeline,
you can see the chronology of the malicious activity
that indicates the attacker has gained initial access
through the SQL brute force attack,
then managed to leverage SQL Server XP command shell ability
to run a malicious script on the Windows machine
that learns your crypto miner.
>> Wow, David. That's a lot of things that you just showed us.
If I think about what you showed us,
first, you showed us how I can get
Advance or Azure Defender for SQL
on SQL Server that was not running in Azure.
That's what I wanted to make clear.
That was an Azure Arc enabled SQL Server,
so it could have been running On-Prem
or somewhere else, is that right?
>> Yes, exactly.
We now can secure and protect SQL anywhere.
It means it can be a SQL on Azure,
it can be a SQL outside of Azure using Azure Arc.
>> That's awesome.
Then what I also found really cool is that
we were able to see all of those resources,
whether they were living outside of Azure
or inside of Azure in one place,
and all of those recommendations.
That's really cool and then on top of that,
it integrates into this Azure Sentinel,
which again, I'm assuming is going to be across
all whether my SQLs are On-Prem or in Azure.
>> Absolutely.
In addition to this, because Azure Defender for SQL
is part of an Azure Defender ecosystem,
part of a family of products,
we can also integrate it with alerts that are coming
from the underlying Windows Operating System.
>> Awesome, cool.
Well, David this has being so interesting.
If people want to learn more about Azure Defender for SQL,
where do you recommend that they start?
>> That's a good question, actually.
My first advice for you guys is to start by looking into
Azure Defender for SQL in our documentation,
and of course, check into Azure Security Center.
>> Awesome, thanks David.
We'll also put a link in the description for you
to get pointed right to the correct documentation.
David, I want to thank you so much
for joining us today on the show.
I want to thank our viewers for joining us.
If you found this interesting, leave us a comment,
leave us a like, and subscribe to our channel.
We hope to see you next time on Data Exposed.
[MUSIC]