>> You've been hearing a lot about Microsoft Defender for Cloud,
but what really is it and what SQL databases does it protect?
Learn all about it, this week on Data Exposed.
[MUSIC].
>> Hi, I'm Anna Hoffman and welcome to
this episode of Data Exposed.
Today I'm joined by Ido from the Defender for SQL Team.
Thanks so much for joining me today.
Can you tell us a little bit about what you do in your team?
>> Yeah, of course. Thank you for having me here.
My name is Ido, and I'm a Program Manager
in Microsoft Defender for Cloud Products.
I've been in the company for
around one year and I'm
managing security products for the past 10 years.
Microsoft, my team and I are focused on defender for SQL,
a product designed to protect SQL workloads in Azure,
Multi-Cloud and hybrid environments.
>> Awesome. You are the perfect person to have on
to tell us more about Defender for Cloud and Defender for SQL.
But before we get into it,
I wanted to ask you, based on all your experience,
what are some of the main security challenges
that organizations are facing?
>> Sure. That's perfect. Let me just quickly share my screen.
In our day today, we are all very task focused.
We are creating, we're updating and we're managing databases.
What we do is we tend to forget that
organizations store their most critical data in databases,
making them an obvious and prime target for attackers.
Following numerous meetings with customers and also
backed up by multiple researches and reports,
we have identified these three main security challenges.
Visibility is the top priority for
organizations when it comes to security and compliance,
and you can see that
more than half of the organizations site secure
configuration of Cloud resource as their top priority.
In addition, customers are also
challenged by the increase in numbers,
sophistication of attacks and also the costs of data breaches.
In 2021, the average cost of data breach,
reached a staggering figure of $4.24 million.
Finally, more and more organizations
are adopting a Multi-Cloud strategy.
This adds a lot of complexity to
the specific expertise and
the knowhow which is required for
each one of the different Clouds.
The bottom line is that protecting
data stores has never been so complicated.
This is exactly why the Defender for
Cloud Platform and more specifically Defender for SQL comes in.
>> Got it. Makes sense.
These challenges are actually a little bit scary,
but it's good to know that we have a solution.
Sometimes I hear a lot of things about
the different defender products.
What is Defender for Cloud?
>> Sure. As a security center
was rebranded last year to Microsoft Defender for Cloud,
and that's the source of a lot of the confusion.
In a nutshell, Microsoft Defender for Cloud is a platform
providing Cloud Security Posture and Posture Management,
CSPM and Cloud Workload Protection, CWP.
That, first of all,
helps you find weak spots across your entire Cloud configuration.
It also helps you strengthen
the overall security posture of your environment and even more so,
it's designed to detect threats and protect
workloads across very diverse environments.
Microsoft Defender for Cloud Support,
Multi-Cloud and Hybrid Environments while
integrating with a very wide range of
security products to enable seamless response
and automation for your security operation teams.
Those integrations can be with Azure Sentinel,
with Purview, with Flag, for example,
or ServiceNow, and of course,
there are many others.
>> Got it. That definitely helps.
I can use Microsoft Defender for Cloud at
the highest level to protect all my services,
regardless of where they're running.
Now, when it comes to data exposed,
and we think about our viewers who are mostly SQL experts
are not information security specialists, though some are.
Can you tell us a little bit more about the Defender
for SQL, how does it work?
What workloads does it protects?
And news of best practices?
>> Yeah, of course. Let me start by
saying that Defender for Cloud has two main features;
a vulnerability assessment solution
and an advanced protection solution.
It's basically designed to protect your SQL state
everywhere in Azure, in Multi-Cloud,
in Hybrid Environment,
providing a single pane of glass for
your security needs across all environments.
Let's drill down and talk about how it actually works.
We created a framework composed out of
three major phases when using Defender for SQL,
enable, detect, and response.
For the enablement phase,
our goal was seamless onboarding.
We focused on an experience that allows you to enable and of
course enforce protection on
your entire database estate with just a single click.
In the detection phase,
Microsoft Defender for SQL will
start assessing your workloads to find
potential misconfiguration and
vulnerabilities alongside malicious activities.
For the response part,
the findings are natively integrated into the Microsoft Defender
for Cloud Portal as security alerts and security commendation,
allowing you to triage,
investigate and response accordingly.
In addition, you can take advantage
of the built in integration that I mentioned
before as integration with Microsoft Sentinel and Azure Purview.
They allow you to further investigate
the alert and prioritize the security actions.
>> Got it. This seems really interesting and also really powerful,
especially with all the different integrations that it has.
Now, I noticed when you had the slide up,
it says Protect SQL,
OSS and Azure Cosmos DB.
Are you saying that Defender for SQL isn't just for SQL DB?
>> Yeah, that's entirely correct.
These are the resources Microsoft Defender for
a SQL protect and you can see there are lots of them.
For a SQL PaaS resources,
we protect Azure SQL Databases,
Azure SQL manage instances,
Azure SQL Elastic Pools,
and dedicated SQL pools in Azure synapse.
SQL Servers on machines are also protected.
We protect them on prem.
We protect them using Azure Arc on Azure Arc Enable server.
Whether they are hosted in as a virtual machine and more globally,
we are protecting SQL Server hosted on any other Cloud.
We also protect manage OSS databases as Azure MariaDB,
Azure MYSQL and Azure PostgreSQL.
We recently extended our security capabilities
to also include Azure Cosmos DB,
which is currently in public preview.
We know that when SQL Server are hosted outside of Azure,
it can be hard to discover and protect them at scale.
This is why I am so excited to announce we'll soon be releasing
an automated protection enablement platform
for SQL Server hosted in AWS,
EC2, and GCP compute engine.
This new capability allows you to
automatically onboard your SQL Server
hosted in AWS or GCP using the power of Azure Arc Enable SQL.
It's still leveraging all the capabilities
offered in Microsoft Defender for SQL,
and it helps you protect the existing databases and
newly created SQL Servers in your Multi-Cloud environment.
>> Wow, that's pretty cool. I didn't
know we were going to make an announcement
like this. Very exciting.
If I understand this correctly,
this means basically if I opt in
for an Azure enabled SQL Server running and AWS or GCP,
then I can get all the same benefits that I'm
getting for my SQL PaaS databases,
for example, running in Azure.
Is that how that's going to work?
>> Yeah, exactly. You got it right.
>> Awesome.
>> Thank you. I really urge you to get started
today and protect your databases, workloads everywhere.
Using Microsoft Defender for Cloud.
>> Awesome. Thanks so much, Ido.
This is really interesting,
it's also super exciting to
announce something like that at the end of the show.
Very exciting to see that for our viewers,
if you like this episode, go ahead and give it a like.
Leave us a comment and let us
know what you think about Microsoft Defender for
Cloud and more broadly or more
narrowly Microsoft Defender for a sequel.
Also, check the description.
We put those links that you shared so you can
learn more and get started with Microsoft Defender for Cloud.
Thanks to our viewers and we hope to see you next time.
On Data Exposed.
[MUSIC].