Auditing and logging Configure appropriate security event provides the ability to log activities for the right duration in logging durable storage. Appropriate retention of security event Auditing is also available for other services used by DDA. logs Subscribe to or implement appropriate Auditing data can be used for custom alerts with and for security monitoring forensic analysis if required. enables detection and response to potential threats. Azure Security Center (ASC) provides a record of Azure SQL Database Threat Detection Alert as well as a dashboard to . Cryptography Use approved Secret Storage Solution offers hardware security modules to protect keys. Use hardware security modules (HSM) to protect private keys Desired State Implement SQL Server Baseline Azure Security Center provides the ability to set a number of for Configuration Configuration some the services used by the DDA application. Implement Web Server Security Baseline Configuration Data Handling Support Secret and Key Rotation Always Encrypted support Network Isolation Endpoints enabling access to sensitive App Service and Azure Storage Account are public endpoints. data should not be publicly accessible Azure SQL Database provides a firewall but to be efficient, fixed IP addresses are needed. ISRM recommended the use of App Service Environment to isolate endpoints from public traffic. This enables configuration of tighter rules on the SQL Server firewall as well as using SignedIP parameter in Storage Shared Access Signature tokens. For more information Microsoft IT Showcase © 2018 Microsoft Corporation. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
Auditing and logging Configure appropriate security event logging Appropriate retention of security event logs Subscribe to or implement appropriate security monitoring provides the ability to log activities for the right duration in durable storage. Auditing is also available for other services used by DDA. Auditing data can be used for custom alerts with and for forensic analysis if required. enables detection and response to potential threats. Azure Security Center (ASC) provides a record of Azure SQL Database Threat Detection Alert as well as a dashboard to . Cryptography Use approved Secret Storage Solution Use hardware security modules (HSM) to protect private keys offers hardware security modules to protect keys. Desired State Configuration Implement SQL Server Baseline Configuration Implement Web Server Security Baseline Configuration Azure Security Center provides the ability to set a number of for some the services used by the DDA application. Data Handling Support Secret and Key Rotation Always Encrypted support Network Isolation Endpoints enabling access to sensitive data should not be publicly accessible App Service and Azure Storage Account are public endpoints. Azure SQL Database provides a firewall but to be efficient, fixed IP addresses are needed. ISRM recommended the use of App Service Environment to isolate endpoints from public traffic. This enables configuration of tighter rules on the SQL Server firewall as well as using SignedIP parameter in Storage Shared Access Signature tokens. For more information Microsoft IT Showcase © 2018 Microsoft Corporation. This document is for informational purposes only. MICROSOFT MAKES NO WARRANTIES, EXPRESS OR IMPLIED, IN THIS SUMMARY. The names of actual companies and products mentioned herein may be the trademarks of their respective owners.
7737_Protecting_highly_confidential_sales_data_with_Azure_SQL_Database_TWP.docx