Data security is an ever-growing topic, which has become a vital type of security in the world today. Cybercriminals and world governments are seeking to access databases as the data contained within holds immense monetary and other forms of value.
1. Azure offers a multi-layered view of security, rather than relying on just a single protective measure. Several layers of security must be breached to reach the customer data that lies at the heart of it all.
The first and foremost layer is Network Security. Azure SQL databases have their firewalls off by default, meaning they cannot be connected unless the IP is whitelisted. You must explicitly allow other Azure services to access the database, regardless of credentials like usernames and passwords. Moreover, you can protect the whole server or just individual databases, as SQL commands allow you to create firewalls that allow and block traffic. It is also possible to control traffic from other Azure services and virtual networks, which are both regulated by network security groups and virtual network security protocols.
2. Access Management is a crucial part of identity management and authentication. It can be accomplished using either SQL authentication, which is comprised of a username and password, or Azure Active Directory (Azure AD). To ensure maximum security, the initial user is created using a root username and password during setup. Subsequent users are authenticated via Azure Active Directory. This method allows the management of security to be concentrated in a single centralized location instead of managing SQL Server’s authentication database.
Once a user is logged in with their username and password, access levels are established based on the Principle of Least Privilege. Microsoft suggests this method to avoid excessive permissions; thus, preventing users from having too many privileges, and administrators from doing daily work with an admin account. In addition, applications should not be running with the permissions of a database owner. Setting the right levels of users, roles, and permissions can safeguard your system from a security breach.
Azure Role-Based Access Control (Azure RBAC) helps manage who has access to Azure’s resources, what they can do with those resources, and the areas they have access to. This extra layer of protection further keeps people from accessing data that they should not have access to. Finally, SQL Server also provides a Row Level of Security, where access to specific columns can be allowed to users. This way, authorization can be performed at a much more detailed and fine-grained level.
3. Threat Protection: Azure Monitor serves as the ultimate destination for alerts, log files, monitoring, and other essential functions. If you decide to use Advanced-Data Security, there’s a free trial and it costs roughly $20-$30 per month per server. It provides three cool features for threat protection.
Data Discovery and Classification are neat; it reviews and audits your data to determine which fields contain personally identifiable information (PII) subject to deep GDPR and API constraints. With this, you can identify and tag such columns and apply the necessary security rules.
Vulnerability Assessment investigates your server to ascertain if there are too many IP addresses enabled, roles and users with excessive privileges, and other critical security matters. Additionally, Advanced Threat Protection is designed to protect against SQL injection attacks and similar efforts where malicious individuals try to gain access by guessing passwords.
4. Information Security.
Data Security – At Rest: By default, Azure uses Transparent Data Encryption (TDE) to encrypt your data, with Azure controlling the keys. Furthermore, if an unauthorized person gains access to an Azure Data Center, they won’t be able to access the data. Provided they pass authentication, authorization, and identification checks, however, they will.
Data Security – In Transit: Any data transmitted beyond Azure must be encrypted using SSL/TLS (e.g. HTTPS).
Always Encrypted: Certain Azure Database services feature an “always encrypted” mode, wherein the data is encrypted at the client and stored in an encrypted state. The client holds the only key that can read the data, so if the client is compromised, the information can be accessed.
Data Masking – Anonymizing: If certain data fields aren’t always needed, access to PII can be restricted to select accounts. Data masking returns asterisks for the fields in question.
Store Data Encrypted: Rather than encrypting the data once it has reached the server, the application can handle the encryption. For example, if you’re dealing with passwords, it is better to hash them using salt and an appropriate hashing algorithm. This prevents the passwords from being sent in plain text.
5. Secure customer data is ensured by Transport Layer Security (TLS) encryption during transit when utilizing a SQL Database or SQL Managed Instance.
