Chapter 12: Securing Data on Azure Synapse

Data is the new gold, so you have got to protect your wealth. Azure Synapse Analytics provides a relational database service for the cloud. Azure provides multiple security measures to access any data in Azure Synapse Analytics. However, it is important for the user to be aware of all these security measures and how to use them appropriately. In this chapter, we are going to learn about the different layers of security options provided by Azure Synapse Analytics. We will learn how to secure the network to protect our data, and the access management section will outline SQL authorization and Active Directory integration. We are also going to learn about some of the advanced features provided by Azure, including threat protection and information protection.

The following diagram represents the different layers of security surrounding customer data:

Figure 12.1 – Different layers of enterprise-grade security...

Implementing network security

Azure Synapse Analytics helps protect your data by using IP firewall rules. We can also use the managed workspace virtual network to isolate one workspace from another. We are going to learn about these options in the following sections.

Managed workspace virtual network

Azure Synapse provides you with the option to enable a managed workspace virtual network while creating your Synapse workspace. It ensures that your workspace is isolated from another workspace. If you have enabled a managed workspace virtual network in your Synapse workspace, then data integration and Spark resources are also deployed in the same virtual network; however, SQL pools (dedicated or serverless) reside outside this managed virtual network.

You can go through the following steps to enable a managed workspace virtual network on your Synapse workspace while creating it:

1. Log in to the Azure portal at https://portal.azure.com.
2. Click on the + Create a resource...

Enabling threat protection

It is important to protect our data from any anomalous activities that could be potentially harmful attempts to exploit our databases. Synapse provides you with two ways to protect your data against any threat. The first one is SQL auditing, which captures the activities related to all the changes to security, access to tables, and many more activities besides, to protect your data. The second is Azure Defender, which checks the vulnerability of your SQL pools and provides advanced data security for your data.

Let's learn a little more about Azure SQL auditing in the next subsection.

Azure SQL auditing

Azure SQL auditing captures all the events in a Synapse SQL pool and writes them to an audit log in your Azure Storage account. These audit logs can be used to analyze anomalous activities or unexpected behavior in the SQL pool.

This feature will be disabled by default, but you can enable it on the Azure SQL Auditing tab of your Azure Synapse...

Understanding information protection

Sometimes, just storing data securely is not sufficient. We need to protect data even when it is in motion and in use. Azure provides different security features to protect your data at any given time so that you can meet all the data-related compliances. These are as follows:

• Encryption-in-flight (Transport Layer Security – TLS): The Synapse SQL pool secures your data by encrypting data in motion with TLS.
• Encryption-at-rest (Transparent Data Encryption – TDE): TDE encrypts your databases, backups, and logs at rest. This setting is specific to one particular SQL pool. If you create another SQL pool in your Synapse workspace, then you need to enable this setting separately for that pool.

  The following screenshot shows how to enable data encryption for your Synapse SQL pools:

Figure 12.22 – Enabling TDE for the dedicated SQL pool in Azure Synapse

• Encryption-in-use (always encrypted...

Summary

In this chapter, we learned about different ways of securing our data in an Azure Synapse SQL pool. We got to learn how to implement network security, access management, threat protection, and information protection. We learned how to use SQL authorization and AAD authorization for connecting to the dedicated SQL pool.

We also learned how to send alerts to any specific user in case of any malicious activity in the SQL pool. Although we now know all the various layers of security in a SQL pool, we need to be careful to implement these forms of security properly in order to secure our data from all possible threats.

In the next chapter, we will learn how to manage and monitor various resources of your Azure Synapse workspace using Synapse Studio.