TITLE: [MUSIC]
DAVID TRIGANO: Hello, everyone,
and welcome to
this Microsoft Build 2022 On-Demand session.
My name is David Trigano.
I'm a Program Manager in
the Microsoft Defender for Cloud [inaudible] Microsoft.
My team and I work on protecting Cloud databases.
In this session, we're going to see how
Microsoft Defender for Cloud provides
a comprehensive solution that
protects your databases hosted
inside and outside of Azure
against threats and malicious activities.
We will start this session with an overview of
the security challenges affecting databases
today and the impact threats
and data breaches can have for an organization.
Then we will have a review about
Microsoft Defender for Cloud, and finally,
we will focus on the capabilities offered by
Microsoft Defender for Cloud when
it comes to detect vulnerabilities,
misconfigurations,
and malicious activities on databases.
Let's start with the security challenges
that are affecting databases today.
As we all know, data is everywhere.
Organizations store their most critical data in
databases making them an obvious target for attackers.
According to multiple researchers and reports,
visibility is the top priority for
organization when it comes to security and compliance.
The recent increase in numbers of
attacks and data breaches forced
security administrators to protect
their data source and detect
any potential misconfiguration or
vulnerability that could allow
a future hole and lead to a data breach.
In 2021, the average cost of
a data breach was $4.24 million.
Finally, more and more organizations
are adopting a multi-Cloud strategy
which complexify
their security posture management and data governance.
Protecting data still has never been so complicated.
Now that we understand the challenges,
let's see what are the common ways
attacker use to gain access to your data.
While being one of the oldest and most popular attacks,
SQL injection is unfortunately
an attack the organization are still being vulnerable to.
The technique is always the same,
attackers enter malicious code into user input variables.
For example, a search field, a log in field,
or even a URL that are later passed
to an instance of SQL server for passing an execution.
Attackers can retrieve
all the users data presenting the database,
such as user details,
credit card information, social security number.
It can also gain access to
protected areas like the administrator portal.
It is also possible to delete the protected area like
the administrator portal and
many other user data from the table.
You have plenty of ways to protect
your obligation against SQL injections.
We have documentations on Microsoft that
provides you a lot of information about
the techniques that are available and
the available capabilities we often use for this.
Assuming your application is well coded and configured,
if your SQL Server is publicly
accessible to the Internet with a default port,
attackers can brute-force it.
In this case, we have seen
multiple attacks where attackers used
a joint dictionary of
commonly user local user with
a dictionary account of commonly user password.
This combination allow them to
breach weak users and gain access to the database,
usually with high privilege accounts.
Finally, malicious user can
use the breached identity that has
access to your environment and
by doing lateral movements,
get access to a database with sensitive information.
Here we just saw what are the common ways
attacker leverage to gain access to your data.
But in fact, not only the data.
I would like to tell your secrets.
Attackers are not looking for your data anymore.
Well, they're not always looking for your data.
We have seen more and more threats
where attackers gain access to
the SQL servers and use
the underlying compute to run crypto-miners.
When we talk about brute force,
I forget to mention something.
When attackers are connected to a database with
a user that has high privileges,
they can hijack any capability initially offered
by a feature in SQL Server called XP Commercial.
XP Commercial allows SQL administrators to run scripts on
their underlying operating system for
backups or any other legit actions.
Attackers are using these to run
malicious scripts such as crypto-miners or ransomware.
These are some global campaigns
targeting SQL workloads that
were recently discovered by
cybersecurity vendors and partners.
I invite you to search for
these campaigns that you see on your screen to
understand the consequences and the daily number
of affected resources and organization.
What is interesting here is that the attackers behind
these campaigns are using
the same patterns over and over again.
They usually scan SQL Server end points that are publicly
accessible via the default SQL porch, which is 1433.
Then they try to identify weak users,
and when they successfully brute force one of them,
they use XP Commercial to run crypto-miners.
Now the question is what Microsoft
do to help organizations
against these threats on databases?
The answer is super simple,
Microsoft Defender for Cloud.
In a nutshell, Microsoft Defender for Cloud
is the solution for Cloud Security Posture Management
and Cloud local protection that finds
weak spots across your Cloud configuration,
helps strengthen the overall
security posture of your environment,
and can protect workloads across multi-Cloud
and hybrid environment full of evolving threats.
It supports multi-Cloud and hybrid environments
and integrates with the range of
products to enable seamless response
and automation for the sake of steam.
Microsoft Defender for Cloud is uniquely
positioned to provide a complete solution and
protection in the Cloud across
your multiple Cloud and on-prem assets.
Microsoft Defender for Cloud is
also built in within Azure,
allowing you to take advantage of
the security capabilities without
any deployment and integrate the security in
the resource provisioning process.
Of course, Microsoft Defender for Cloud provides
the same capabilities for AWS, GCP,
and your on-prem resources such as
Advanced Threat Protection and
protection capabilities and easy remediation and
automation to improve your multi-Cloud security posture.
Let's talk about Cloud Security Posture Management also called
CSPM that helps you to
harden your workloads using security recommendations.
Microsoft Defender for Cloud provides
a single inventory view of
all monitor on Cloud workloads across Azure,
AWS, GCP,
and your on-premise environment.
They also scan workloads to
identify vulnerabilities and misconfigurations,
provide clear and actionable remediation steps,
and quick fixes for fast and upscale remediation.
Finally, you can easily generate
compliance status reports and
stream your security posture to your tool of choice.
When it comes to remediation,
we understand that prioritization
can be a concern when it
comes to secure multiple resources
in multiple environments.
Therefore, we recently announced
a unique collaboration between
Microsoft Defender for Cloud and
Azure Purview allowing
security administrators to prioritize
security actions on their security Cloud data resources.
Azure Purview is a fully managed,
refined data governance solution that
helps organizations to discover,
scan, and classify
their on-premise multi-Cloud and
software as a service data.
Customers that classify their resources
with Azure Purview can take advantage of
the classification method data in Microsoft Defender
for Cloud to prioritize their sensitive resources.
With this collaboration, you can filter
resources with sensitive information
in the event or review and see unhealthier resources and
security recommendations now sorted
according to those sensitivity level.
Also, Microsoft Defender
for Cloud provides
a center for advanced
threat protection
capabilities to protect
your Cloud workload protection also called CWP.
You can easily monitor
activities across your workloads and
investigate security alerts or
suspicious events and of course,
take advantage of our collaboration
with Azure Purview to prioritize
your investigation on alerts affecting
sensitive resources to respond to existing threats.
Of course, Microsoft Defender for
Cloud provides a tool to automatically
integrate these alerts with our built-in SIEM called
Microsoft Sentinel or you can also
decide to use the SIEM of your choice.
Let me show you how it works.
Here I'm on my Microsoft Azure portal,
I can search here Microsoft Defender for Cloud,
and automatically here I can have an overview
of my security posture, the regulatory compliance,
all the benchmarks that I have within
Microsoft Defender for Cloud,
local protections, firewall manager,
my inventory and information protection,
which is the integration we
recently released with Azure Purview.
Here, I can see all the recommendations I
have alongside the secure score,
which is the representation of how secure
my environment is right
now against Microsoft best practices.
Here, sorted with controls,
I have the visibility around all the recommendations and
best practices that are built by
Microsoft on all my resources,
which can be Azure AWS and GCP.
Of course, I have another pivot, another view,
which is the inventory where here I can have access on
all the resources I actually
manage within my environment.
As you can see here,
I have close to 4,000 resources and
the main questions customers have
today is how do I prioritize those resources?
As I said before we integrated
Azure Purview classification into
Microsoft Defender for Cloud,
allowing you to filter those 4,000
resources to see only resources
that contain sensitive information.
By adding a new filter here,
removing resources that were unclassified,
you can see how quickly I start with
4,000 resources and I now
have only 80 resources that I should
focus on that contain sensitive information.
Here I have a SQL server called
ninjasql that contains some secret information.
Let's see what the SQL is about.
Here you see that I have some remediation and
some recommendations that I should
remediate some of them out, unhealthy.
Some of them are healthy,
some of them high, medium, and long.
Here I have access to
all the information that were found by
Azure Purview such as
the levels and the classification personnel,
editor number, debit card number, just to name a few.
Here I have access to the Purview catalog
and if I want I can continue my journey into
the data classification and the data governance to
see who started this scan,
when the scan came and when was
the last time someone scanned that resource?
Just to name a few options that you can do with
Azure Purview or I can decide to
come back to this resource and check what are
the elements that are affecting this resource actually.
Seriously that I have some brute force
happening on the SQL Server
here and if you remember on the previous page,
I had access to all the classifications that were found
by Azure Purview which is also the same here.
We are offering you the same level of details,
regardless of it is on the CSPN side or the CWP side.
If we go back here,
you see you have a page called security alerts where you
can see all of the alerts that are
actually affecting your environment.
Here you can see similarly have 7.6
thousand active alerts on my subscriptions.
If I want to focus or if I want to prioritize and
investigate alerts that are
affecting sensitive resources,
I can do very similar things
that I was able to do in the inventory.
Here I can just remove
the alerts that are targeting resources that are
not sensitive and here you can see that I now have
only 36 active alerts that I should focus on.
Of course, you don't have to wait for an alert to come
before to start investigating and
start to create automated pipeline,
you can generate sample alerts here by
hitting sample alerts in the security alerts,
and you just have to select
the resource type where you want
Microsoft Defender for Cloud to
generate you alerts and
automatically Microsoft Defender For Cloud will
generate new alerts on these particular resource type.
Here, Microsoft defender for
Cloud as long as you click on create,
sample alert will generate
sample alerts for you so you can
create your rule before something
bad happens within your environment.
Now that we understand what is
Microsoft Defender for Cloud and how it
provides you CSPM for
Cloud Security Posture Management and
CWP for Cloud Local Protection Capabilities,
let's focus on how you can
protect your databases everywhere.
To protect databases with
security posture management and
allow timely responses to threats,
we created a framework
composed with three major milestones;
enable, detect, and respond.
We believe that starting to protect
databases should be an easy step and so we
took advantage of the Microsoft Defender
for Cloud platform and provided
an experience that allows you to enable
the entire databases of state protection in one click.
We'll demonstrate that in a minute.
Right after you enabled the databases protection,
Microsoft Defender for Cloud will start
assessing your workloads to find
potential misconfigurations and
vulnerabilities alongside malicious activities.
These findings are natively
integrated in Microsoft Defender for Cloud as
security alerts and security recommendations
allowing you to respond accordingly.
As I said earlier,
you can take advantage of the built-in integrations with
Microsoft Sentinel and Azure Purview to
flow your alert and prioritize security actions.
These are the responses Microsoft Defender for
Cloud protects when it comes to databases.
It protects your manage
SQL resources such as Azure SQL Database,
Azure SQL Managed Instance,
Azure SQL Elastic Pools,
and of course dedicated SQL Pool in Azure Synapse.
SQL Server on machine are also protected,
the ones that run on-prem,
those using Azure Arc enabled SQL server,
SQL Server hosted on Azure Virtual Machine,
and more globally any SQL Server
hosted on any other Cloud.
We are also protecting managed
OSS DB such as Azure Database for MariaDB,
MySQL, and PostgreSQL.
Finally, we are happy to announce that we recently
extended our security capabilities for Azure Cosmos DB,
providing security recommendations and
threat protection for their
fully managed no SQL database
for modern apps development.
When SQL Server are hosted outside of Azure,
it can be hard to discover and protect them at scale.
Therefore, we are extremely excited to announce
a new automated protection enablement
for SQL Server hosting in AWS EC2.
Its new capability allows you to automatically
onboard your SQL Server hosted in AWS EC2
using the power of Azure Arc enabled
SQL Server and take advantage
of every existing capability
offered in Microsoft Defender for Cloud for existing
and newly created SQL Server in your AWS environments.
As mentioned earlier, enabling
databases protection has never been so easy.
In Microsoft Defender for Cloud,
select your environment's settings and turn
databases protection to on will
also provide the capability to granularity
decide which protection plan you want to enable.
Security recommendations and allowance
can be manipulated at two different levels,
according to the security admin
and the resourcing allowing
the security admin and
the resource owner to act accordingly.
First, the centralized estate view
build for the security admin.
Here you can view their entire databases state
to get context for
the entire environment security posture.
Also, the single SQL workload view
build for the resource owner and the database owner.
This view provides
a resource level focused recommendations and alerts,
to get the resource context and
fix configurations and misconfigurations.
Here is the list of databases protection
detections that are divided into three categories.
The first category is
query analysis with SQL injection data,
filtration, and many more.
The second one is threat intelligence with
suspicious access and
many anomalies detectors and finally,
brute force detection with multiple detectors,
giving you more context about
the potential threats and how to act accordingly.
Let me show you how it works.
Here again, on Microsoft Defender
for Cloud under management,
I have environment settings.
I can select one of the subscription I have access to
and very easily enable the databases protection.
Here I have a cyber subscription.
You see I have a database,
and all of my databases
are actually protected on Microsoft Defender for
Cloud and I can very easily
decide to disable one of this protection.
Of course, this is not something Microsoft recommend,
but you may have some cases
where you want to disable for example,
Azure Cosmos DB because this is in preview or you
may want to disable a SQL server
on a machine for any reason.
We give you that capability.
Now that you have all the information on how to
protect your database workloads anywhere,
you can start using our trial at
aka.ms/defenderforcloudtrial and
leverage our community
on github.com/azure/microsoftdefenderforcloud.
Thank you for your time, and I wish you
an excellent Microsoft Build 2022.