[MUSIC] >> Hi, and welcome to this episode of Data Exposed.
I'm Jeroen ter Heerdt, and today I'm joined by Michal Bar,
my colleague. Hi Michal.
>> Hi.
>> How are you?
>> Good. Thank you. Thank you for having me.
>> Sure. What do you do at Microsoft?
>> So I'm a Program Manager on the SQL team,
and my team focuses on data security and building
cool features to help our customers secure
that their data and feel secure about their data.
>> So today, we're going to look
at one of those cool features, right?
>> Absolutely. So, yes.
We are very excited to announce
that we are going to have this feature generally available.
It's called SQL Data Discovery and Classification,
and this feature brings with it
the set of capabilities that allow customers to discover,
classify, label, and protect their data.
>> That's sounds important. So that
basically means that as a customer, what does it mean for me?
>> So customers always tell us that
they're required to protect their data,
but how can you,
for all reasons because they need to be compliant,
because they need to mitigate risks of data breach, etc.
I don't need to explain you know what data security is all about.
>> Absolutely.
>> But how can they protect
their data if they don't know where it is?
So that's the first part of it.
That's all about discovery.
The second part is about classifying data.
I know it may sound weird,
but not all data was created equal.
Some data needs more protection than other data.
>> I get that.
>> Yes. So with this set of features,
we help customers classify their data and understand what is
the plan that they need to put together to protect
their data and to what extent?
>> Okay. Wow. So can you show me how this works?
>> Yes, absolutely.
So here's where we start.
We start at the Advanced Data Security page.
Advanced Data Security is basically
a unified package for advanced SQL security capabilities.
It provides a single go-to location for
enabling and managing these capabilities
and it includes three pillars.
The first one is this one,
the Data Discovery and Classification,
which is the functionality for
discovering and classifying sensitive data,
and we'll use most of this session to talk about this.
>> Okay.
>> The second pillar here is about surfacing and
mitigating potential database vulnerabilities,
vulnerability assessment.
The third part, the third pillar,
is all about detecting
anomalous activities that could indicate threat to your database,
and this is the Advanced Threat Protection.
>> Okay, cool. So as a customer,
what do I need to do to start using this?
>> So Advanced Data Security package needs to be enabled.
So customers should go to
"Settings" if they want to use these capabilities,
go to "Settings" here and
enable "Advanced Data Security" as a whole these three pillars.
>> Okay.
>> So let's go into Data Discovery and
Classification which is what we are showing here today.
What you see here is the high-level overview
of the current state of
classification for the database that we're working on.
So for example, at the first glimpse,
you can see that you have nine classified columns out of
109 and four tables were identified
as containing sensitive data with three unique information types.
You can also look at more into
details here and see that eight columns
were identified as confidential while just
one was marked as highly confidential.
You can also look at the same slicing by information type.
So there is one column that is financial,
two credentials, and six contact info.
>> So this dashboard,
this overview gives me a lot of
detailed information about my data,
does this appear automatically?
>> So basically, this is all
given that you have classifieds your columns.
>> Okay, right. So as a customer,
I need to pre-classify the data and then I'll get all the changes.
>> Right. I will show you in a second how
we tried to make it easy for you to classify those columns.
If we scroll down here,
we get a longer list and more detail
of all the columns that have been classified.
There is also a way for you to use filters.
So you filter by schema, or by table,
by information type, or sensitivity label.
>> Okay, cool.
>> Yeah, so as you said and asked,
this is all about classification.
>> Yeah.
>> So let's move on to Classification tab.
Here I see the nine classified columns that
we've seen in the high level view before.
But the interesting part is really the recommendation.
So once the classification engine scans the database,
it looks for columns with potential sensitive data,
and this is what we see here in the recommendation.
These are five more columns
that have classification recommendations.
What I can do here is either accept these recommendations.
So I can look at these and say, "That makes sense."
Because FirstName, LastName, Phone, Username,
these are columns, very obvious.
These are columns that probably contain
sensitive data or private data.
So I want to accept these recommendations.
The other thing that I can do is
look at this column for example and say,
"This strange to me."
I see credit CreditCardApprovalCode.
But I know so our engine identified this as something that
may potentially have sensitive data.
However, I know that data in it,
and I know that this is not really credit card information.
I know that this is a reference to
something else or just a code that is meaningless.
So what I can do if I don't want to see this recommendation again,
is dismiss the selected recommendation.
>> Quick reminder to save
your changes because it's important always.
>> Yeah.
>> Then we're back to see the overview and this is updated,
and I don't see that I have new recommendations.
So this is a good state to be in,
this is where I want to be.
>> Okay. This is all great since it's all in the portal,
but what if I want to share this information with my colleagues,
my peers, my manager,
is there any way for me to take this data?
>> Yeah. Absolutely. So what you can do is export.
>> Okay.
>> You export to Excel.
So yes.
So I just downloaded an Excel file with
the report the same way I saw it in my dashboard,
and I have the classified columns and the recommendations,
and this is exactly the information that you as a DBO or
security admin would like to share with
stakeholders and managers in
your company about the state off your database.
>> Cool. That's very useful to
have that in a separate file as well.
>> Yeah. The other thing that I wanted
to show you is how you can add classifications.
So looking back at our schema at
the classification recommendations and
how the columns were classified,
you can always add a classification
in case it wasn't recommended for some reason.
So I can choose the schema,
the table, column name,
and then add an information type from this list,
and a sensitivity label,
and these two are populated with
predefined sets of labels and information types.
>> Okay. So that's how I classify,
but what if what I wanted to
classify doesn't necessarily fit in those categories?
So what if I want to take it to
the next level as a customer, what can I do?
>> Yeah. So I think this is
exactly the kind of thing that we were
trying to do with Azure Security Center.
>> Okay.
>> Azure Security Center gives you
a central place to manage policies.
So it's currently in preview,
I'm going to demo this.
But it's in preview, and what you can do here is we were letting
customers customize all the taxonomy that's
involved in with information protection and how we classify data.
So they can change labels, information types,
and also customize the way the logic of our classifier.
So this is Azure Security Center,
and in the data and storage blade,
these are all my SQL databases.
But the thing that I'm interested in is
the SQL Information Protection button here.
>> Okay.
>> When I open this,
this is where I can change
and customize labels, and information types.
I can add labels,
let's go to manage information texts real quick.
You can configure each and
every one of these built-in information types,
you can add new ones here.
You remember how I mentioned that you can
also change the logic of the classifier?
>> Yes.
>> You can do that by
moving the information types
up and down and basically changing
the order in which we're classifying.
>> Right. So with this, I can just customize
all of it to meet exactly my scenario, right?
>> Exactly. That's the goal.
The goal is for customers to be able to
customize the policy that we're using or
the classifier engine that we're using
to their internal information protection policy.
>> Without me as a customer requiring to write a new classifier.
>> Exactly.
>> Now I don't want to write the algorithm,
I want it customize it.
>> Exactly. With Azure Security Center,
they're giving the flexibility and
control over sensitive data classification,
and it basically allows them to align how
they're looking at things from their end,
their policy with how we classify data for them.
>> Cool. That's awesome.
So now we customize the classification engine, right?
We have classified our data, so that's all great.
So what is an example of what we can do with that knowledge now?
>> Yeah. I guess it's not enough to just
know that you have sensitive data in your database,
the question is, what do I do with this knowledge?
You're absolutely right. Then what we did next is to combine
this information about sensitive data in your database with audit.
>> Okay.
>> So this is the next level of
knowing not just that I have sensitive data in my database,
but that I can tell who tried to access it.
So in order to do that,
if you have auditing enabled on
your database and you've chosen Log Analytics,
which is currently in preview,
but if you've chosen this and you configured correctly,
then you can go and look at the audit logs.
We're actually introducing new dashboards to
look at audit logs that were saved to Log Analytics.
These audit logs combine data about who tried to
access what with information that we have about sensitive data.
So here in this drill down,
you can see a few data points
about grouped by sensitivity labels and by formation type.
So you can see the number of queries that we're
executed against your database by sensitivity label,
who add access, and IP access to classify data,
and again, similar things just by information type.
So it really makes it very easy for someone who
wants to be in control of their data,
especially sensitive data to know who tried to
access or to identify things that require more attention.
>> Right. Cool. So this is very impressive stuff.
I mean, the classification, the security,
then taking it to the level of doing
the auditing as well, I like it.
So what do we recommend customers do now?
>> Try it out.
>> Okay.
>> This is becoming generally available as we speak.
>> Cool.
>> It's rolling out to customers and I would really
love to have as many people try it out,
I think it could really add value to what you're
already doing in terms of securing your SQL databases.
So yes. Please give it a try.
Don't forget to send us your feedback
because we are always looking
to hear from you and to know how we can further improve.
>> Well, so I have nothing more to that,
and we know that note.
It's time to end, so thanks a lot for sharing.
>> Yeah.
>> Thanks a lot for being here.
Thank you for watching.
Please leave us a comment,
provide us feedback when you use this feature.
Tell us what to improve and what you like,
and also talking about liking,
please like as you subscribe to the channel.
I hope to see you next time. Thanks.
>> Thank you.
[MUSIC]