Chapter 5. Securing an Azure SQL Database

Security is a major concern for organizations when migrating to the cloud, and so organizations are hesitant to move to this form of storage. Microsoft provides strong security protection at the physical, logical, and data layers of Azure services. Microsoft data centers are among the most secure data centers in the world.

Azure SQL Database provides multiple layers of security to control access to the databases using SQL Server or Active Directory ( AD) authentication as well as firewall rules, which limits access to the data through role-based permissions and Row-Level Security.

Azure SQL Database provides proactive security using Dynamic Data Masking, automating auditing, and Threat Detection.

It also provides Transparent Data Encryption to encrypt the data at rest and Always Encrypted to encrypt the data at rest or in motion.

This chapter teaches the students about all of these security mechanisms and how to implement and use them to secure...

Access Control

Azure SQL Database limits access to the database through firewall rules, which are authentication techniques which require users to log in to the database with a valid username and password. Azure SQL Database further controls access to the underlying data through role-based permissions and Row-Level security. We'll now look into different access control methods in detail.

Firewall Rules

Azure SQL Database uses firewall rules to limit access to authorized IPs and block access to unauthorized IPs. It's the first level of access control provided by Azure SQL Database. The firewall rules can be created at the server-level and at the database-level.

When a SQL database is provisioned, it's inaccessible to everyone. To make it accessible, you would first need to add a server-level firewall rule. A firewall allows an IP or range of IP addresses to connect to an Azure SQL Database. You can then create database firewall rules to enable certain clients to access individual secure...

Proactive Security

Azure SQL Database provides Auditing and Threat detection to proactively protect it from malicious attacks.

Auditing

Auditing tracks and records database events to an audit log in a given Azure Storage account. Auditing can help you to:

• Maintain regulatory compliance

• Understand database activity

• Catch discrepancies or anomalies indicating a security violation

Auditing allows you to:

• Define what database actions are to be audited

• Find unusual activity or trends by using preconfigured reports and dashboards to understand and analyze the audit log

Auditing can be configured at the server-level and database-level. If auditing is configured at the server level, it'll automatically apply to all of the databases in the server. Auditing configured at the database will only apply to a particular database.

It's recommended to audit the server instead of auditing individual databases.

Configure Auditing for Azure SQL Server

In this section, we’ll configure auditing for the toyfactory...

Summary

Security is one of the deciding factors for an organization when opting to put their data in the cloud. Microsoft provides the best security by not only securing the Azure SQL Database, but by also securing the data centers.

To connect to an Azure SQL Database, the machines or the client IP address should exist in the firewall settings. If not, the connection request is denied.

Azure SQL Database allows SQL and Windows Authentication as well. An organization can sync their domain with Azure, thereby allowing users to connect from domain accounts instead of SQL logins. Organizations can also create Active Directory Groups and give access to the group instead of giving access to individual user domain accounts.

In addition to this, you can use Row-Level security and dynamic data masking to further secure the data by allowing users to only see the data they need in order to do their work.

Azure SQL Database also provides proactive monitoring to detect threats such as SQL injection as and...