[Post updated on 8/22/2024] by Yura Lee
Introduction
This article is a continuation of Microsoft Defender PoC Series which provides you guidelines on how to perform a proof of concept for a specific Microsoft Defender plan. For a more holistic approach where you need to validate Microsoft Defender for Cloud, please read How to Effectively Perform a Microsoft Defender for Cloud PoC article.
There can be many security vulnerabilities in databases that are sometimes taken advantage of by malicious actors. According to the Github 2020 report, a vulnerability typically goes undetected for 218 weeks (just over four years) before being disclosed and fixed. Injection attacks, such as those on SQL and NoSQL, are among the most popular types of cyberattacks for web applications (as per OWASP Top 10).
SQL Injection attacks, brute-force attacks, SQL shell OS attacks leading to crypto-mining and ransomware, can be detected and remediated by the Microsoft Defender for SQL plan.
Microsoft Defender for SQL has two main capabilities that together will protect your SQL environments from cyberattacks. These capabilities are:
- Vulnerability Assessment, which is a service that helps you identify and remediate vulnerabilities in your database environments to improve your security posture
- Advanced Threat Protection, which detects suspicious activities related to your databases and alerts you with details and recommended actions.
There are other types of databases that will be protected via the advanced threat protection feature.
Planning
So, what actually gets protected through Microsoft Defender for SQL?
There are two Microsoft Defender plans that are comprised as part of Microsoft Defender for SQL:
- Microsoft Defender for Azure SQL database servers protects:
- Microsoft Defender for SQL servers on machines extends the protections for your to fully support hybrid environments and protects SQL servers hosted in Azure, other cloud environments, and even on-premises machines. It does this by protecting:
- SQL Server on Virtual Machines,
- On-premises SQL servers of Azure Arc enabled SQL Server
- SQL Server running on Windows machines without Azure Arc
There is a third plan called Microsoft Defender for open-source relational databases that brings threat protection for:
The final plan, Defender for Cosmos DB provides advanced threat detection capabilities for:
Preparation
You will need to first enable Microsoft Defender for SQL, and for this you need to have the role of Security Admin. For more information about roles and privileges, visit this article.
You can enable the three plans for Microsoft for SQL (for Azure SQL database servers, SQL servers on machines, and open-source relational databases) by following the instructions here.
If you are conducting this PoC in partnership with the SOC Team, make sure they are familiar with the alerts that may appear once you enable this plan. Review all alerts available at our Alerts Reference Guide.
From the readiness perspective, make sure to review the following resources to better understand Microsoft Defender for SQL:
- Microsoft Defender for SQL Documentation
- Defender for SQL and the Vulnerability Assessment | Defender for Cloud in the Field #1
- Microsoft Defender for Cloud webinar: Microsoft Defender for SQL Anywhere
- (new!) Enhancements in Defender for SQL Vulnerability Assessment | Defender for Cloud in the Field #24 - YouTube
Special Note for Defender for SQL servers on machines
Microsoft Defender for SQL servers on machines requires Azure Montior Agent (AMA) installed, as well as a SQL Iaas extension for discovery and registration and it should report to a workspace to hold data collection rules (DCR). This workspace can be specified or you can allow MDC to create a default one for you.
For machines that are not in Azure, all the above are required in addition to Arc installation. Read more about Arc-enabled servers here.
Workspace configuration and automatic SQL server instance registration (recommended) can be done in Settings & monitoring.
Make sure that Log analytics deployment is turned OFF, and AMA for SQL server on machines is turned ON.
Implementation and Validation
There are two ways to validate alerts. First, you can use the out of box sample alert feature to validate. To create these sample alerts, you will need to have the role Security Admin or Subscription Contributor.
To create sample alerts for Defender for SQL, go to Microsoft Defender for Cloud in the Security alerts section, click Sample alerts.
Select your subscription, choose Azure SQL Database and SQL Server on machines on the Microsoft Defender plans, and click Create sample alerts.
The other way is to run simulations against the server itself. Instructions for this is available on Github, as part of MDC labs here.
Prevention
Microsoft Defender for SQL allows you to remediate SQL vulnerabilities and prevent SQL incidents and alerts using SQL vulnerability assessment. To configure it on your Azure SQL databases and Azure SQL Managed Instance, go to the Recommendations page in Microsoft Defender for Cloud, and select one of the following recommendations under the control Remediate security configurations:
- For Azure SQL databases, select the recommendation Vulnerability assessment should be enabled on your SQL servers.
- For Azure SQL Manage Instances, select the recommendation Vulnerability assessment should be enabled on your SQL managed instances.
When Microsoft Defender for SQL is enabled on your SQL Server on machines, SQL vulnerability assessment does not require initial configuration, as it is included with SQL Server.
In this article, we will demo SQL vulnerability assessment for Azure SQL database. Select the recommendation SQL servers should have vulnerability assessment configured.
From here, select the unhealthy resource that you’d like to configure vulnerability assessment on, and click Fix.
In the pane that appears, click Fix 1 resource.
Next, to remediate vulnerability findings from your SQL databases and SQL Server on machines, go to the Recommendations page in Microsoft Defender for Cloud. Under the control Remediate security configurations, select one of the following recommendations:
- For Azure SQL databases and Azure SQL Manage Instances, select the recommendation SQL databases should have vulnerability findings resolved.
- For SQL Server on machine, select the recommendation SQL servers on machines should have vulnerability findings resolved.
In this article, we will demo SQL databases should have vulnerability findings resolved.
From here, select any of the unhealthy resources.
Then select the finding you wish to remediate. In this example, we’ll be selecting Auditing should be enabled at the server level.
Then select the database.
Once again, click the finding you wish to remediate, which in our case is Auditing should be enabled at the server level.
Select Click here to remediate.
Alternatively, you may decide that this finding does not pose a security risk for your environment. In this case, you should create an acceptable baseline, which is essentially a customisation that tells the Vulnerability Assessment what is expected in your environment.
To do this, select Approve as Baseline, and follow the subsequent instructions.
Vulnerability Assessment recurring scans in your environment, and in upcoming scans after this, any results that match the baseline you established are considered as passes. Only reports on deviations from this baseline will appear as findings in the Vulnerability Assessment dashboard. This allows you to focus your attention only on the relevant issues. Learn more about this here.
Continue remediating and/or setting baselines across all the findings and databases to improve your SQL security posture.
Automations
Instead of following the manual process above to remediate recommendations on SQL databases, you can use the automated ways to remediate recommendations related to SQL like, Vulnerability assessment should be enabled on your SQL servers, Enable auditing on SQL server, Enable transparent data encryption on SQL databases and many more like these in our Microsoft Defender for Cloud Github repository. This repository gives you access to numerous sample security playbooks that will help in automating remediation for a recommendation.
You can also utilize workflow automation feature in Microsoft Defender for Cloud which can trigger Logic Apps on Security alerts, recommendations, and changes to regulatory compliance. For example, when Microsoft Defender for Cloud detects a brute force attack, you may want this to be automatically taken care off, you can use this playbook as a starting point.
To understand how to remediate security alerts using Microsoft Defender, make sure you check out this chapter from SC-200 certification exam learning guide. You can also create an automatic response to a specific security alert using an ARM template, read more about it in our documentation.
Further Resources
How Microsoft Defender for SQL can protect SQL servers anywhere - YouTube
Latest Updates
(new!) Microsoft Defender for Open-Source Relational Databases Now Supports Multicloud (AWS RDS)
(new!) Better Together = Defender CSPM + Database Protections - Microsoft Community Hub
Conclusion
By the end of this PoC you should be able to determine the value proposition of Microsoft Defender for SQL and the importance to have this level of threat detection to your workloads.
Stay tuned for more Microsoft Defender for Cloud PoC Series!
P.S. Subscribe to our Microsoft Defender for Cloud Newsletter to stay up to date on helpful tips and new releases and join our Tech Community where you can be one of the first to hear the latest Microsoft Defender for Cloud news, announcements and get your questions answered by Azure Security experts.
Reviewers
Special Thanks to Yuri Diogenes, Safeena Begum, David Trigano and Michael Makhlevich for reviewing this article.
