>> Advanced data security brings unique capabilities to
your databases running in Azure like Advanced Threat Protection.
Stay tuned on this episode of
Data Exposed MVP edition to learn more.
[MUSIC]
>> Hi, I'm Anna Hoffman and welcome to
this episode of Data Exposed MVP edition.
Today I'm joined by a Principal Consultant,
Joey D'antoni of Denny Cherry and Associates.
Thanks so much for being here today Joey.
>> Thanks Anna.
>> Joey, why don't we start off by having you
tell us a little bit about yourself from what you do?
>> Yeah, sure. As you mentioned,
I'm Principal Consultant at Denny
Cherry and Associates Consulting.
We do a lot of work around Azure and
SQL Server and that intersection,
and we've been doing so for pretty much as
long as Azure has existed.
So we've got a great deal of experience with
the platform and using all the offerings there.
>> Awesome. Thanks so much for coming on the show today,
and we're going to provide some links to
more information about Denny Cherry and
Associates in the description.
So be sure to check that out.
Now, today we're going to talk about Advanced Data Security.
This is available in Azure SQL Database and Azure SQL MI,
and today, Joey, I think you're going to
dive into one specific aspect of that.
Can you go ahead and tell us a little bit about it?
>> Yeah. We're going to look at Advanced Threat Protection,
which is a feature that really
builds on some of the power of Azure,
because there's a lot of compute capacity that's
available on Azure that's not being utilized.
So it can monitor connections and queries against
your Azure SQL Database and your Azure SQL Managed Instance.
It looks up for things like anomalous login.
If you have somebody logging in from an unusual location,
I know it's flagged me when I've traveled all over
the world and logged in from an unusual location.
It works for potential vulnerabilities
in your database and probably the
biggest one in my opinion is SQL injection attacks.
We still have a big problem in
databases and IT in general with SQL injection attacks,
and that's where malformed code gets passed in from
an application to a database to grab data.
Recently, the feature is now
supported data exfiltration where a user is
dumping an unusual amount of data out of the database into
another storage location that can also be detected.
You should use this feature in conjunction
with auditing in your Azure SQL Database,
and I'll explain that in a second as we look at the feature.
>> Thanks, Joey. That's a great explanation.
From what I've heard and what I understand,
it's a very powerful capability.
I think you also had something you wanted to show us today?
>> Yeah. Let's dive in and
walk through the configuration of this feature.
This is configured at
the logical server level for your Azure SQL Database servers,
in MI it's configured similarly at the server level.
I'm going to click on "Advanced Data
Security" here in the Azure portal,
and I've already enabled this.
There's a couple of things you need to know.
You need to have a storage account to store your data,
so here you can see I have a system
generated storage account that I created.
I've enabled the feature cost $15 a month per server,
and I can send periodic scans to my account.
Typically, this happens once a week
and here I'm sending it to myself,
and I'm also sending e-mail notifications
to admins and subscription users.
If I look at the threat detection types that I'm looking for,
I can see SQL Injection.
So that's where somebody has tried to
launch a SQL Injection attack against my database.
SQL Injection vulnerability is
where Advanced Threat Protection is going to look at
my schema and identify if I have
any malformed parameters that can get passed in,
that could be vulnerable to SQL Injection.
Data exfiltration it's going to look for users shipping
an unusual amount of data out of
the database and potentially stealing my data.
It's also looking for unsafe actions.
So things that are anomalous,
like opening wide firewalls, brute-force log in,
so that would be an example of where some attack was trying to
hit your database over and over again using
a method like credential stuffing or using a password list.
Then finally, anomalous client login.
This is probably the most common one I've received,
where I'll get an alert that somebody has tried to
log to or somebody who has successfully logged
into my database from an unusual location.
Back when we were traveling and I was all over the world,
I would normally get some of these all the time
just because I was logging into
my database from a very unusual location,
whether it be Asia or Europe,
and typically all of
my logins were from my home here in Philadelphia.
But once that's enabled,
we can click "Okay".
The other thing to note that you should do
with this is enable an audit account.
Because well this will track and detect all those vulnerabilities,
in auditing we'll give you the whole history.
If there was an attack,
you can see what user was logged in and what they were running,
but without auditing you might not be able to have that context.
So it gives you a richer experience
by having auditing enabled as well.
>> Awesome. This is really interesting.
Now, how can I track once I've set this up if there
are any alerts or it looks like I can get it by e-mail,
but is there a way I can do it in the portal?
>> Yes. If you drill into the database,
and I don't have any alerts,
you can drill into Advanced Data Security at the database level,
and you can see there's reports here.
Currently, I don't have any alerts.
I didn't trigger anything, but
if I had them, it would be right here.
>> Thanks, Joey. So what you're saying is from the server level,
I can simply turn this on,
there's a small fee,
but I can also set up auditing so I
can see the complete history and then I
can monitor it from
an e-mail perspective as well as in the dashboard?
>> Correct. So if you receive an alert via e-mail,
you can drill in your audit logs in addition to the alert
and see what's going on before and after the alert took place.
So you can potentially further identify
any anomalous activity that was going on in your database.
>> Awesome. Well, thanks so much, Joey.
I certainly learned something during this episode,
and I hope our viewers have learned as well.
If you like this video,
please like this video,
subscribe to our channel and leave us
a comment on what you're doing with Advanced Threat Protection.
Thanks for watching this episode of Data Exposed.
[MUSIC]