Introduction
This article is a continuation of Microsoft Defender PoC Series which provides you guidelines on how to perform a proof of concept for a specific Microsoft Defender plan. For a more holistic approach where you need to validate Microsoft Defender for Cloud, please read How to Effectively Perform an Microsoft Defender for Cloud PoC article.
There can be many security vulnerabilities in databases that are sometimes taken advantage of by malicious actors. According to the Github 2020 report, a vulnerability typically goes undetected for 218 weeks (just over four years) before being disclosed and fixed. Injection attacks, such as those on SQL and NoSQL, are among the most popular types of cyberattacks for web applications (as per OWASP Top 10).
SQL Injection attacks, brute-force attacks, SQL shell OS attacks leading to crypto-mining and ransomware, can be detected and remediated by the Microsoft Defender for SQL plan.
Microsoft Defender for SQL has two main capabilities that together will protect your SQL environments from cyberattacks. These capabilities are:
- Vulnerability Assessment, which is a service that helps you identify and remediate vulnerabilities in your database environments to improve your security posture
- Advanced Threat Protection, which detects suspicious activities related to your databases and alerts you with details and recommended actions.
Planning
So, what actually gets protected through Microsoft Defender for SQL?
There are two Microsoft Defender plans that are comprised as part of Microsoft Defender for SQL:
- Microsoft Defender for Azure SQL database servers protects:
- Microsoft Defender for SQL servers on machines extends the protections for your to fully support hybrid environments and protects SQL servers hosted in Azure, other cloud environments, and even on-premises machines. It does this by protecting:
There is also a third plan called Microsoft Defender for open-source relational databases that brings threat protection for:
Preparation
You will need to first enable Microsoft Defender for SQL, and for this you need to have the role of Security Admin. For more information about roles and privileges, visit this article.
You can enable the three plans for Microsoft for SQL (for Azure SQL database servers, SQL servers on machines, and open-source relational databases) by following the instructions here.
If you are conducting this PoC in partnership with the SOC Team, make sure they are familiar with the alerts that may appear once you enable this plan. Review all alerts available at our Alerts Reference Guide.
From the readiness perspective, make sure to review the following resources to better understand Microsoft Defender for SQL:
- Microsoft Defender for SQL Documentation
- Defender for SQL and the Vulnerability Assessment | Defender for Cloud in the Field #1
- Microsoft Defender for Cloud webinar: Microsoft Defender for SQL Anywhere
Special Note for Defender for SQL servers on machines
Microsoft Defender for SQL servers on machines requires a Log Analytics agent installed and it should report to a workspace with enabled MicrosoftDefender for SQL.
Microsoft Defender for Cloud default workspaces are controlled through the subscription settings in Pricing & Settings.
Then ensure to turn SQL server on machines to be On.
However, for customer-created workspaces, you need to enable Defender for SQL servers on machines on the particular workspace. Instead of going into the subscription, select the workspace that is associated with Microsoft Defender for SQL servers on machines.
Then ensure that SQL servers on machines is turned On from here.
Implementation and Validation
You can use the sample alert feature to validate . To create these sample alerts, you will need to have the role Security Admin or Subscription Contributor.
To create sample alerts for Defender for SQL, go to Microsoft Defender for Cloud in the Security alerts section, click Sample alerts.
Select your subscription, choose Azure SQL Database and SQL Server on machines on the Microsoft Defender plans, and click Create sample alerts.
Prevention
Microsoft Defender for SQL allows you to remediate SQL vulnerabilities and prevent SQL incidents and alerts using SQL vulnerability assessment. To configure it on your Azure SQL databases and Azure SQL Managed Instance, go to the Recommendations page in Microsoft Defender for Cloud, and select one of the following recommendations under the control Remediate security configurations:
- For Azure SQL databases, select the recommendation Vulnerability assessment should be enabled on your SQL servers.
- For Azure SQL Manage Instances, select the recommendation Vulnerability assessment should be enabled on your SQL managed instances.
When Microsoft Defender for SQL is enabled on your SQL Server on machines, SQL vulnerability assessment does not require initial configuration, as it’s installed automatically.
In this article, we will demo SQL vulnerability assessment for Azure SQL database. Select the recommendation Vulnerability assessment should be enabled on your SQL servers.
From here, select the unhealthy resource that you’d like to configure vulnerability assessment on, and click Fix.
In the pane that appears, click Fix 1 resource.
To remediate vulnerability findings from your SQL databases and SQL Server on machines, go to the Recommendations page in Microsoft Defender for Cloud. Under the control Remediate security configurations, select one of the following recommendations:
- For Azure SQL databases and Azure SQL Manage Instances, select the recommendation SQL databases should have vulnerability findings resolved.
- For SQL Server on machine, select the recommendation SQL servers on machines should have vulnerability findings resolved.
In this article, we will demo SQL databases should have vulnerability findings resolved.
From here, select any of the unhealthy resources.
Then select the finding you wish to remediate. In this example, we’ll be selecting Auditing should be enabled at the server level.
Then select the database.
Once again, click the finding you wish to remediate, which in our case is Auditing should be enabled at the server level.
Select Click here to remediate.
Alternatively, you may decide that this finding does not pose a security risk for your environment. In this case, you should create an acceptable baseline, which is essentially a customisation that tells the Vulnerability Assessment what is expected in your environment.
To do this, select Approve as Baseline, and follow the subsequent instructions.
Vulnerability Assessment recurring scans in your environment, and in upcoming scans after this, any results that match the baseline you established are considered as passes. Only reports on deviations from this baseline will appear as findings in the Vulnerability Assessment dashboard. This allows you to focus your attention only on the relevant issues.
Continue remediating and/or setting baselines across all the findings and databases to improve your SQL security posture.
Automations
Instead of following the manual process above to remediate recommendations on SQL databases, you can also use the automated ways to remediate recommendations related to SQL like, Vulnerability assessment should be enabled on your SQL servers, SQL managed instances, Enable transparent data encryption on SQL databases, Advanced Data Security for SQL Servers and many more like these in our Microsoft Defender for Cloud Github repository which gives you access to numerous such sample security playbooks that will help you automate in remediating a recommendation.
You can also utilize workflow automation feature in Microsoft Defender for Cloud which can trigger Logic Apps on Security alerts, recommendations, and changes to regulatory compliance. For example, when Microsoft Defender for Cloud detects a brute force attack, you may want this to be automatically taken care off, you can use this playbook as a starting point.
To understand how to remediate security alerts using Microsoft Defender, make sure you check out this chapter from SC-200 certification exam learning guide. You can also create an automatic response to a specific security alert using an ARM template, read more about it in our documentation.
Further Resources
How Microsoft Defender for SQL can protect SQL servers anywhere - YouTube
Microsoft Defender for SQL Server (windows.net)
Latest Updates
Conclusion
By the end of this PoC you should be able to determine the value proposition of Microsoft Defender for SQL and the importance to have this level of threat detection to your workloads.
Stay tuned for more Microsoft Defender for Cloud PoC Series!
P.S. Subscribe to our Microsoft Defender for Cloud Newsletter to stay up to date on helpful tips and new releases and join our Tech Community where you can be one of the first to hear the latest Microsoft Defender for Cloud news, announcements and get your questions answered by Azure Security experts.
Reviewers
Special Thanks to Yuri Diogenes, Safeena Begum, David Trigano and Michael Makhlevich for reviewing this article.