Microsoft Defender for Cloud PoC Series – Microsoft Defender for SQL

Published Aug 18 2021 04:22 AM 2,916 Views

  Introduction

This article is a continuation of Microsoft Defender PoC Series which provides you guidelines on how to perform a proof of concept for a specific Microsoft Defender plan. For a more holistic approach where you need to validate Microsoft Defender for Cloud, please read How to Effectively Perform an Microsoft Defender for Cloud PoC article

 

There can be many security vulnerabilities in databases that are sometimes taken advantage of by malicious actors. According to the Github 2020 report, a vulnerability typically goes undetected for 218 weeks (just over four years) before being disclosed and fixed. Injection attacks, such as those on SQL and NoSQL, are among the most popular types of cyberattacks for web applications (as per OWASP Top 10).

SQL Injection attacks, brute-force attacks, SQL shell OS attacks leading to crypto-mining and ransomware, can be detected and remediated by the Microsoft Defender for SQL plan.

 

sqlpocfig1.PNG

Microsoft Defender for SQL has two main capabilities that together will protect your SQL environments from cyberattacks. These capabilities are:

  • Vulnerability Assessment, which is a service that helps you identify and remediate vulnerabilities in your database environments to improve your security posture
  • Advanced Threat Protection, which detects suspicious activities related to your databases and alerts you with details and recommended actions.

 

Planning

So, what actually gets protected through Microsoft Defender for SQL?

There are two Microsoft Defender plans that are comprised as part of Microsoft Defender for SQL:

There is also a third plan called Microsoft Defender for open-source relational databases that brings threat protection for:

 

sqlpocfig2.png

 

Preparation   

You will need to first enable Microsoft Defender for SQL, and for this you need to have the role of Security Admin. For more information about roles and privileges, visit this article.

 

You can enable the three plans for Microsoft for SQL (for Azure SQL database servers, SQL servers on machines, and open-source relational databases) by following the instructions here.

 

If you are conducting this PoC in partnership with the SOC Team, make sure they are familiar with the alerts that may appear once you enable this plan. Review all alerts available at our Alerts Reference Guide.

 

From the readiness perspective, make sure to review the following resources to better understand Microsoft Defender for SQL:

 

Special Note for Defender for SQL servers on machines

 

Microsoft Defender for SQL servers on machines requires a Log Analytics agent installed and it should report to a workspace with enabled MicrosoftDefender for SQL.

 

Microsoft Defender for Cloud default workspaces are controlled through the subscription settings in Pricing & Settings.

 

sqlpocfig3.png

 

Then ensure to turn SQL server on machines to be On.

 

sqlpocfig4.PNG

 

However, for customer-created workspaces, you need to enable Defender for SQL servers on machines on the particular workspace. Instead of going into the subscription, select the workspace that is associated with Microsoft Defender for SQL servers on machines.

 

 

sqlpocfig5.PNG

 

Then ensure that SQL servers on machines is turned On from here.

 

sqlpocfig6.PNG

Implementation and Validation      

You can use the sample alert feature to validate . To create these sample alerts, you will need to have the role Security Admin or Subscription Contributor.

 

To create sample alerts for Defender for SQL, go to Microsoft Defender for Cloud in the Security alerts section, click Sample alerts.

 

sqlpocfig7.PNG

 

Select your subscription, choose Azure SQL Database and SQL Server on machines on the Microsoft Defender plans, and click Create sample alerts.

sqlpocfig8.PNG

 

Prevention      

Microsoft Defender for SQL allows you to remediate SQL vulnerabilities and prevent SQL incidents and alerts using SQL vulnerability assessment. To configure it on your Azure SQL databases and Azure SQL Managed Instance, go to the Recommendations page in Microsoft Defender for Cloud, and select one of the following recommendations under the control Remediate security configurations:

  • For Azure SQL databases, select the recommendation Vulnerability assessment should be enabled on your SQL servers.
  • For Azure SQL Manage Instances, select the recommendation Vulnerability assessment should be enabled on your SQL managed instances.

 

When Microsoft Defender for SQL is enabled on your SQL Server on machines, SQL vulnerability assessment does not require initial configuration, as it’s installed automatically.

 

sqlpocfig9.PNG

 

In this article, we will demo SQL vulnerability assessment for Azure SQL database. Select the recommendation Vulnerability assessment should be enabled on your SQL servers.

 

sqlpocfig10.png

 

From here, select the unhealthy resource that you’d like to configure vulnerability assessment on, and click Fix.

 

sqlpocfig11.png

 

In the pane that appears, click Fix 1 resource.

 

sqlpocfig12.png

 

To remediate vulnerability findings from your SQL databases and SQL Server on machines, go to the Recommendations page in Microsoft Defender for Cloud. Under the control Remediate security configurations, select one of the following recommendations:

  • For Azure SQL databases and Azure SQL Manage Instances, select the recommendation SQL databases should have vulnerability findings resolved.
  • For SQL Server on machine, select the recommendation SQL servers on machines should have vulnerability findings resolved.

 

sqlpocfig13.png

 

In this article, we will demo SQL databases should have vulnerability findings resolved.

 

sqlpocfig14.png

 

From here, select any of the unhealthy resources.

 

sqlpocfig15.png

 

Then select the finding you wish to remediate. In this example, we’ll be selecting Auditing should be enabled at the server level.

 

sqlpocfig16.png

 

Then select the database.

 

sqlpocfig17.PNG

 

Once again, click the finding you wish to remediate, which in our case is Auditing should be enabled at the server level.

 

sqlpocfig18.PNG

 

Select Click here to remediate.

sqlpocfig19.PNG

 

Alternatively, you may decide that this finding does not pose a security risk for your environment. In this case, you should create an acceptable baseline, which is essentially a customisation that tells the Vulnerability Assessment what is expected in your environment.

 

To do this, select Approve as Baseline, and follow the subsequent instructions.

 

sqlpocfig 20.PNG

 

Vulnerability Assessment recurring scans in your environment, and in upcoming scans after this, any results that match the baseline you established are considered as passes. Only reports on deviations from this baseline will appear as findings in the Vulnerability Assessment dashboard. This allows you to focus your attention only on the relevant issues.

 

Continue remediating and/or setting baselines across all the findings and databases to improve your SQL security posture.

 

Automations      

Instead of following the manual process above to remediate recommendations on SQL databases, you can also use the automated ways to remediate recommendations related to SQL like, Vulnerability assessment should be enabled on your SQL servers, SQL managed instances, Enable transparent data encryption on SQL databases, Advanced Data Security for SQL Servers and many more like these in our Microsoft Defender for Cloud Github repository which gives you access to numerous such sample security playbooks that will help you automate in remediating a recommendation.

 

You can also utilize workflow automation feature in Microsoft Defender for Cloud which can trigger Logic Apps on Security alerts, recommendations, and changes to regulatory compliance. For example, when Microsoft Defender for Cloud detects a brute force attack, you may want this to be automatically taken care off, you can use this playbook as a starting point.

 

To understand how to remediate security alerts using Microsoft Defender, make sure you check out this chapter from SC-200 certification exam learning guide. You can also create an automatic response to a specific security alert using an ARM template, read more about it in our documentation.

 

Further Resources

How Microsoft Defender for SQL can protect SQL servers anywhere - YouTube

Microsoft Defender for SQL Server (windows.net)

 

Latest Updates

Microsoft Defender for SQL is now available on the SQL Virtual Machine blade. - Microsoft Tech Commu...

 

Conclusion

By the end of this PoC you should be able to determine the value proposition of Microsoft Defender for SQL and the importance to have this level of threat detection to your workloads.

 

Stay tuned for more Microsoft Defender for Cloud PoC Series!

 

P.S. Subscribe to our Microsoft Defender for Cloud Newsletter to stay up to date on helpful tips and new releases and join our Tech Community where you can be one of the first to hear the latest Microsoft Defender for Cloud news, announcements and get your questions answered by Azure Security experts.

 

Reviewers

Special Thanks to Yuri Diogenes, Safeena Begum, David Trigano and Michael Makhlevich for reviewing this article.

 

2 Comments
Version history
Last update:
‎Nov 02 2021 09:23 AM
Updated by:
www.000webhost.com