In my last blog post, we took a look at the Data Discovery & Classification features within the Advanced Data Security (ADS) offering for Azure SQL. In this blog post, we will take a deep dive into the Vulnerability assessment.

The SQL Vulnerability assessment provides administrators with a streamlined approach to identify and even remediate potential security misconfigurations or vulnerabilities within their Azure SQL databases. The Vulnerability Assessment is a scanning service that contains a set of built-in rules based off of Microsoft’s best practices with security being the focal point.

Each scanned database will be compared against each security check to highlight areas where your databases deviate from the aforementioned best practice.  The scan contains 47 total security checks and will apply a risk-based on the individual check.

These security checks will focus on areas such as misconfigurations at the database and server level, least privilege access considerations, and surface-level checks for sensitive data classification and auditing. While some of these checks are very specific such as “Transparent data encryption should be enabled”, others are very vague and are left to the admins to determine whether the current configuration is acceptable.

This assessment should be used as a starting point, and should not be the only security measure that is being taken or reviewed. For example, while the vulnerability assessment checks whether sensitive columns are being classified, it is only indicating that the recommendations made in Discovery and Classification feature are being used to classify columns and does not go any further. Similarly, while the assessment checks that auditing and advanced threat detection are enabled, it does not indicate whether identified threats are being remediated.

Vulnerability Assessment Settings

In order to run the Vulnerability Assessment, ADS must be enabled. Refer to my previous blog post for detailed instructions on enabling ADS for your Azure SQL Database. Once enabled, you will have to provide additional information to configure the specific settings for the assessment. This includes:

• The specific Azure subscription
• The storage account that will be used to store the results of the scans
• Determining whether to enable periodic recurring scans
• An email address for the reports to be sent to, along with the ability to email notifications to administrators and subscription owners

Getting Started

To get started, click on the Vulnerability Assessment card under the Settings > Advanced Data Security page for your SQL database:

The landing page will provide a summary of the Total Failing and Total Passing checks, with a breakdown of the risk summary based on High Risk, Medium, or Low Risk. It will also present you with the date and time of the last scan. Run a scan by clicking Scan at the top of the page:

Analyze Results and Resolve Issues

Once a scan Is run, the results are automatically displayed within the Azure portal. The report will present an overview of your security state with a breakdown of how many of the checks have passed or failed, with a corresponding risk level. you can dive into the Failed and Passed results individually:

At this point, you can review your results and determine whether the failed checks present actual security issues within your environment. Clicking on an individual security check will provide additional details and remediation steps that should be taken:

Here, you will be able to decide whether the result is an acceptable baseline within your environment, or whether remediation is required. If the result is acceptable, you can click the ‘Approve as Baseline’ button at the top of the window:

Setting a baseline for a given security check customizes results reporting for future scans, resulting in a pass versus a failure when a baseline is met. Once all baselines are set, the Vulnerability assessment will only report failures as deviations from the baseline allowing administrators to focus their efforts on the specific areas that present issues within their environment. If the failed check is not considered a suitable baseline within your environment, administrators can remediate the issue following the remediation results provided:

Once you’ve set your baselines and resolved all remaining issues, you can rerun the scan to provide the results of the customized report:

You can easily export a copy of the report by clicking the ‘Export Scan Results’ button at the top of the page, which will provide a downloaded except report including both summary and detailed report results:

You can also manage your Vulnerability Assessments at scale by leveraging the Azure PowerShell cmdlets. Refer to this MSDN blog for script examples. 

Next Steps

With periodic scanning enabled for the Azure SQL Vulnerability Assessments, administrators can easily maintain consistent visibility over security issues within their Azure SQL databases and be provided with the necessary remediation steps to address these issues as they arise. This alleviates the never-ending headache for DBA’s who have historically needed to run these checks manually using a variety of methods and tools. In my next blog post, we will take a deep dive into the Advanced Threat Protection feature which is the final piece of the Advanced Data Security portfolio.