>> In this episode,
we will cover the minimal TLS version setting
that is new and available in Azure SQL database.
Join us in Data Exposed.
[MUSIC]
>> Hi, and welcome to this episode of Data Exposed.
I'm Anna Hoffman and today I'm joined by Program Manager,
Rohit Nayak on the Azure SQL team.
Thanks for being with us again today, Rohit.
>> Thank you, Anna. Happy to be here.
>> We're happy to have you.
Today we're going to be talking about TLS.
This is an ongoing series that we've been doing
together talking about networking and network security.
I wanted to start today by just asking,
what is it and why should our SQL people care about TLS?
>> Perfect segment to my presentation here.
TLS stands for Transport Layer Security protocol.
What it does is basically it is used
when we log into the SQL database.
You should be familiar with this diagram by now, which is,
I'm showing a client on the left-hand side
and our SQL gateway on the right.
The first thing that happens when you try to connect is you have
a TCP handshake and then
the client usually sends a pre-login message.
This is all standard stuff which is part
of the TDS protocol that we use.
Within the TDS protocol,
we have what is called as a TLS handshake,
in which the client basically says what is
the version of TLS that it
wants to use while connecting to the server?
Then there's this back and forth that happens and
eventually the login to the database goes through.
This is where TLS gets used.
Now, as an end consumer of SQL database, why should you care?
It's primarily because TLS has multiple versions over the years,
and the most secure version that is
out there today that we support is TLS 1.2.
TLS 1.3 is also in the works
and we're working towards supporting it in the future,
but today what we want is for customers to be
able to use the most secure version that we support.
Primarily because like any of the protocols,
the older versions have
well-known vulnerabilities that make you susceptible to attacks.
That's the whole motivation here for us to
give customers the choice to
enforce a version of TLS at the server level.
>> Got you.
>> Here, and this is again
our demo server that we used even in the previous video.
Similar to the deny public network access,
we have a minimal TLS version that we allow at a server level.
Unlike the previous setting,
this particular setting you will see nothing is selected here.
The reason why it is is because, by default,
we allow you to connect with any version of TLS,
and this is, in fact,
a choice that you're making here by choosing a particular version.
Let me just show you. I have a demo setup here where on the VM,
I have a tool that I'm using to connect to my database.
This is a tool called DBeaver.
It's an open source tool,
but basically what it allows me to do is choose the version
of TLS that my driver uses to connect.
Here I go choose TLS 1.1 and I say Connect.
You can see I'm able to browse the tables and things like that,
so nothing new here.
>> Got it. With no TLS rule,
we're just going to allow you to connect
however you want and that's what you just showed us.
>> Correct, and this is how things are
today if there's nothing selected here.
Now let's make things interesting.
I go and I enforce TLS 1.2,
which is the most secure version of TLS that we support today.
If I flip back to my VM and just try to disconnect and reconnect.
Here's the error that I got,
login failed with invalid TLS version.
We have refined this error message a little bit.
In the latest version,
they'll actually say that the client tried to connect with
a TLS version that is lesser than what is enforced on the server,
which is exactly what happened here,
where the client was trying to connect with 1.1 and it was
denied and now I'm going to go edit the connection,
go to the driver properties and change this to 1.2.
Again, I try to connect,
and my connection is going through.
That is, in a sense,
a very simple demo of how this feature works, which is,
it enforces TLS version on
the server and any clients trying to connect with lesser versions,
namely 1.0 or 1.1,
will get rejected with an explicit error message.
>> I see. Thanks, Rohit.
Now, if I'm a user or
organizing this server or managing this server and I want
to make sure all my applications and
my users are still able to connect as I go towards 1.2,
is there a lot that I'm going to need to do?
>> Yes. In the coming months,
we are going to expose some telemetry
so that customers get to know first as a customer,
before setting this button to 1.2,
you want to be very certain
that none of your clients are using the lower protocols.
So we are working on customer facing telemetry through
the portal and through audit logs
that land in the next month or two.
That will give you visibility so that once you set this button,
then you are totally confident
that no clients are being disconnected because of this.
The other thing to note is,
once I set this, there's no going back.
I can't uncheck this and go back to the previous state.
That is why we will
give you the telemetry so that you can make an informed choice.
Of course, as customers,
you can transition to using different versions,
so if your applications are only supporting 1.2,
you can start at the extreme lower end of
the spectrum and then keep working your way up.
That's where we give you the flexibility to work with
different versions and then
eventually we would like you to be at this state,
where you are on the most secure version of TLS.
>> Awesome. Thanks, Rohit.
This has been really useful.
It seems like overall we're trying to get
our customers to the most secure configuration,
but we're here to help and we're not going
to force you and we're also going to try
to help you understand who's connecting
with those lower version so they don't get disconnected.
I personally think this was a great session.
I learned a few things.
Thanks for being here, Rohit.
We'll provide some links in
the description for you to go learn more,
and please like and subscribe to our channel
if you're interested in learning more about Azure SQL.
See you next time on Data Exposed.
[MUSIC]