Securing Azure Sql Server
- 1. Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com Access Azure SQL from Azure VMs through the Microsoft Azure backbone network without the need for internet endpoints on the SQL Server Securing your Azure SQL Server Mitesh Chauhan
- 2. Why should we use service endpoints ? Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com Access Azure SQL from Azure VMs through the Microsoft Azure backbone network without the need for internet endpoints on the SQL Server. • Neater way to access SQL from Azure VNET (No NAT device, load balancer or SQL public IP required) • If using forced tunnelling, you can now access SQL Server directly Notes • Service endpoints are applied at the subnet level, consider this in your virtual network design • VNET and SQL Server must be in the same region, can be in different subscriptions • There can be many unique service endpoints per subnet • Accessing SQL via service endpoints does NOT mean the SQL Server becomes part of your virtual network
- 3. SQL Database Server with Internet Endpoints Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com
- 4. SQL Database Server with Service Endpoints Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com
- 5. Steps required for connecting SQL Server to Subnet Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com VNET Create a service endpoint on your subnet • Specify which service (SQL) in which region can access the Subnet Azure SQL Server Create SQL Server Firewall Rule to connect to service endpoint for the subnet. • Specify which Service Endpoint in which vnet/ subnet to allow connections from. Network Security Group (NSG = Layer 4 Firewall Rules) Allow SQL traffic from desired region. • Attach NSG to required subnet
- 6. Tips To Secure Your SQL Server Further Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com 1. Use NSGs to lock down access to only the SQL service and region required We can select SQL or Storage for the service endpoint. We can then specify the service and the region in an NSG Security Features available for your production databases / servers 2. Enable Auditing and Threat Detection 3. Databases are encrypted by default. Microsoft Manage the encryption and keys. • Option to Bring Your Own Keys is also available.
- 7. Tips To Secure Your SQL Server Further Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com Use Dynamic Data Masking to protect personal data – Create Rules Enable dynamic data masking on your columns in your tables that have personally identifiable information.
- 8. Tips To Secure Your SQL Server Further Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com Use Dynamic Data Masking to protect personal data - Results Any non admin accounts (that have not been excluded) will only see masked data. Example Masking rule on customertable, EmailAddress Column RESULT > > >
- 9. Additional Reference Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com Subnet View • One service endpoint created • Service endpoint allows access FROM selected Azure SQL Services
- 10. Additional Reference Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com NSG Inbound Firewall Rules View • Rules are applied to all VMs in the subnet the NSG is attached to • Rule 110 = Known IP address has RDP access • Rule 200 = Allow access FROM the SQL Service running in the Azure East US Region • No Outbound rules configured (default is to allow all outbound traffic).
- 11. Additional Reference Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com Azure SQL Server Firewall Rules View • Access to all Azure Services switched Off • No Internet endpoint rules configured • (client IP address shown for info only) • Subnet with the service endpoint Selected
- 12. Additional Reference Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com SQL Server Security Settings View • Auditing and Threat Detection Enabled • Notification Email Set • Database Encryption Enabled (by default) with Microsoft Managed Keys.
- 13. Microsoft Source Reference Mitesh.chauhan@outlook.com @miteshchauhanuk Miteshc.wordpress.com • Use Virtual Network service endpoints and rules for Azure SQL Database • https://docs.microsoft.com/en-us/azure/sql-database/sql-database-vnet-service-endpoint-rule-overview • Virtual Network Service Endpoints • https://docs.microsoft.com/en-us/azure/virtual-network/virtual-network-service-endpoints-overview#key-benefits