You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/sql-database/sql-vulnerability-assessment.md
+54-49Lines changed: 54 additions & 49 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: SQL Vulnerability Assessment
3
-
description: Learn how to configure and SQL Vulnerability Assessment on SQL Database, and interpret the assessment reports.
3
+
description: Learn how to configure SQL Vulnerability Assessment on Azure SQL Database and interpret the assessment reports.
4
4
services: sql-database
5
5
ms.service: sql-database
6
6
ms.subservice: security
@@ -14,85 +14,90 @@ ms.date: 02/05/2020
14
14
tags: azure-synapse
15
15
---
16
16
17
-
# SQL Vulnerability Assessment service helps you identify database vulnerabilities
17
+
# SQL Vulnerability Assessment helps you identify database vulnerabilities
18
18
19
-
SQL Vulnerability Assessment is an easy to configure service that can discover, track, and help you remediate potential database vulnerabilities. Use it to proactively improve your database security.
19
+
SQL Vulnerability Assessment is an easy-to-configure service that can discover, track, and help you remediate potential database vulnerabilities. Use it to proactively improve your database security.
20
20
21
-
Vulnerability Assessment is part of the [advanced data security](sql-database-advanced-data-security.md)(ADS) offering, which is a unified package for advanced SQL security capabilities. Vulnerability Assessment can be accessed and managed via the central SQL ADS portal.
21
+
Vulnerability Assessment is part of the [Advanced Data Security](sql-database-advanced-data-security.md) offering, which is a unified package for advanced SQL security capabilities. Vulnerability Assessment can be accessed and managed via the central SQL Advanced Data Security portal.
22
22
23
23
> [!NOTE]
24
-
> Vulnerability Assessment is supported for Azure SQL Database, Azure SQL Managed Instance and Azure Synapse Analytics. For simplicity, SQL Database is used in this article when referring to any of these managed database services.
24
+
> Vulnerability Assessment is supported for Azure SQL Database, Azure SQL Database managed instance, and Azure Synapse Analytics. For simplicity, SQL Database is used in this article when referring to any of these managed database services.
25
25
26
-
## The Vulnerability Assessment service
26
+
## Vulnerability Assessment
27
27
28
-
SQL Vulnerability Assessment (VA) is a service that provides visibility into your security state, and includes actionable steps to resolve security issues, and enhance your database security. It can help you:
28
+
SQL Vulnerability Assessment is a service that provides visibility into your security state. Vulnerability Assessment includes actionable steps to resolve security issues and enhance your database security. It can help you:
29
29
30
-
- Meet compliance requirements that require database scan reports.
31
-
- Meet data privacy standards.
32
-
- Monitor a dynamic database environment where changes are difficult to track.
30
+
- Meet compliance requirements that require database scan reports.
31
+
- Meet data privacy standards.
32
+
- Monitor a dynamic database environment where changes are difficult to track.
33
33
34
-
Vulnerability Assessment is a scanning service built into the Azure SQL Database service. The service employs a knowledge base of rules that flag security vulnerabilities and highlight deviations from best practices, such as misconfigurations, excessive permissions, and unprotected sensitive data. The rules are based on Microsoft’s best practices and focus on the security issues that present the biggest risks to your database and its valuable data. They cover both database-level issues as well as server-level security issues, like server firewall settings and server-level permissions. These rules also represent many of the requirements from various regulatory bodies to meet their compliance standards.
34
+
Vulnerability Assessment is a scanning service built into Azure SQL Database. The service employs a knowledge base of rules that flag security vulnerabilities. It highlights deviations from best practices, such as misconfigurations, excessive permissions, and unprotected sensitive data.
35
35
36
-
Results of the scan include actionable steps to resolve each issue and provide customized remediation scripts where applicable. An assessment report can be customized for your environment by setting an acceptable baseline for permission configurations, feature configurations, and database settings.
36
+
The rules are based on Microsoft's best practices and focus on the security issues that present the biggest risks to your database and its valuable data. They cover database-level issues and server-level security issues, like server firewall settings and server-level permissions. These rules also represent many of the requirements from various regulatory bodies to meet their compliance standards.
37
37
38
-
## Implementing Vulnerability Assessment
38
+
Results of the scan include actionable steps to resolve each issue and provide customized remediation scripts where applicable. You can customize an assessment report for your environment by setting an acceptable baseline for:
39
+
* Permission configurations.
40
+
* Feature configurations.
41
+
* Database settings.
39
42
40
-
The following steps implement VA on SQL Database.
43
+
## Implement Vulnerability Assessment
41
44
42
-
### 1. Run a scan
45
+
The following steps implement Vulnerability Assessment on SQL Database.
43
46
44
-
Get started with VA by navigating to **Advanced Data Security** under the Security heading in your Azure SQL Database pane. Click to enable advanced data security, and then click on **Select Storage** or on the **Vulnerability Assessment** card, which automatically opens the Vulnerability Assessment settings card for the entire SQL server.
47
+
### 1. Run a scan
45
48
46
-
Start by configuring a storage account where your scan results for all databases on the server will be stored. For information about storage accounts, see [About Azure storage accounts](../storage/common/storage-create-storage-account.md). Once storage is configured, click **Scan** to scan your database for vulnerabilities.
47
-
48
-
49
+
In your Azure SQL Database pane, under the **Security** heading, select **Advanced Data Security**. Then click **Select Storage** on the **Vulnerability Assessment** pane to open the Vulnerability Assessment settings pane for the entire SQL server.
50
+
51
+
Configure a storage account where your scan results for all databases on the server will be stored. For information about storage accounts, see [About Azure storage accounts](../storage/common/storage-create-storage-account.md). After storage is configured, select **Scan** to scan your database for vulnerabilities.
52
+
53
+
49
54
50
55
> [!NOTE]
51
-
> The scan is lightweight and safe. It takes a few seconds to run, and is entirely read-only. It does not make any changes to your database.
56
+
> The scan is lightweight and safe. It takes a few seconds to run and is entirely read-only. It doesn't make any changes to your database.
52
57
53
58
### 2. View the report
54
59
55
-
When your scan is complete, your scan report is automatically displayed in the Azure portal. The report presents an overview of your security state: how many issues were found and their respective severities. Results include warnings on deviations from best practices and a snapshot of your security-related settings, such as database principals and roles and their associated permissions.The scan report also provides a map of sensitive data discovered in your database, and includes recommendations to classify that data using [data discovery & classification](sql-database-data-discovery-and-classification.md).
60
+
When your scan is finished, your scan report is automatically displayed in the Azure portal. The report presents an overview of your security state. It lists how many issues were found and their respective severities. Results include warnings on deviations from best practices and a snapshot of your security-related settings, such as database principals and roles and their associated permissions.The scan report also provides a map of sensitive data discovered in your database. It includes recommendations to classify that data by using [data discovery and classification](sql-database-data-discovery-and-classification.md).
56
61
57
-
62
+
58
63
59
64
### 3. Analyze the results and resolve issues
60
65
61
-
Review your results and determine the findings in the report that are true security issues in your environment. Drill down to each failed result to understand the impact of the finding and why each security check failed. Use the actionable remediation information provided by the report to resolve the issue.
66
+
Review your results and determine the findings in the report that are true security issues in your environment. Drill down to each failed result to understand the impact of the finding and why each security check failed. Use the actionable remediation information provided by the report to resolve the issue.
62
67
63
68
64
69
65
70
### 4. Set your baseline
66
71
67
-
As you review your assessment results, you can mark specific results as being an acceptable *Baseline* in your environment. The baseline is essentially a customization of how the results are reported. Results that match the baseline are considered as passing in subsequent scans. Once you have established your baseline security state, VA only reports on deviations from the baseline and you can focus your attention on the relevant issues.
72
+
As you review your assessment results, you can mark specific results as being an acceptable *baseline* in your environment. The baseline is essentially a customization of how the results are reported. Results that match the baseline are considered as passing in subsequent scans. After you've established your baseline security state, Vulnerability Assessment only reports on deviations from the baseline. In this way, you can focus your attention on the relevant issues.
68
73
69
-
74
+
70
75
71
76
### 5. Run a new scan to see your customized tracking report
72
77
73
-
After you complete setting up your **Rule Baselines**, run a new scan to view the customized report. VA now reports only the security issues that deviate from your approved baseline state.
78
+
After you finish setting up your **Rule Baselines**, run a new scan to view the customized report. Vulnerability Assessment now reports only the security issues that deviate from your approved baseline state.
74
79
75
-
80
+
76
81
77
-
Vulnerability Assessment can now be used to monitor that your database maintains a high level of security at all times, and that your organizational policies are met. If compliance reports are required, VA reports can be helpful to facilitate the compliance process.
82
+
Vulnerability Assessment can now be used to monitor that your database maintains a high level of security at all times, and that your organizational policies are met. If compliance reports are required, Vulnerability Assessment reports can be helpful to facilitate the compliance process.
78
83
79
84
### 6. Set up periodic recurring scans
80
85
81
-
Navigate to the Vulnerability Assessment settings to turn on **Periodic recurring scans**. This configures Vulnerability Assessment to automatically run a scan on your database once per week. A scan result summary will be sent to the email address(es) you provide.
86
+
Go to the Vulnerability Assessment settings to turn on **Periodic recurring scans**. This setting configures Vulnerability Assessment to automatically run a scan on your database once per week. A scan result summary is sent to the email addresses you provide.
82
87
83
88
84
89
85
90
### 7. Export an assessment report
86
91
87
-
Click**Export Scan Results** to create a downloadable Excel report of your scan result. This report contains a summary tab that displays a summary of the assessment, including all failed checks. It also includes a **Results** tab containing the full set of results from the scan, including all checks that were run and the result details for each.
92
+
Select**Export Scan Results** to create a downloadable Excel report of your scan result. This report contains a summary tab that displays a summary of the assessment. The report includes all failed checks. It also includes a **Results** tab that contains the full set of results from the scan. The results include all checks that were run and the result details for each.
88
93
89
94
### 8. View scan history
90
95
91
-
Click**Scan History** in the VA pane to view a history of all scans previously run on this database. Select a particular scan in the list to view the detailed results of that scan.
96
+
Select**Scan History** in the Vulnerability Assessment pane to view a history of all scans previously run on this database. Select a particular scan in the list to view the detailed results of that scan.
92
97
93
-
Vulnerability Assessment can now be used to monitor that your database maintains a high level of security at all times, and that your organizational policies are met. If compliance reports are required, VA reports can be helpful to facilitate the compliance process.
98
+
Vulnerability Assessment can now be used to monitor that your database maintains a high level of security at all times, and that your organizational policies are met. If compliance reports are required, Vulnerability Assessment reports can be helpful to facilitate the compliance process.
94
99
95
-
## Manage Vulnerability Assessments using Azure PowerShell
100
+
## Manage vulnerability assessments by using Azure PowerShell
Converts vulnerability assessment scan results to an Excel file
134
+
Converts Vulnerability Assessment scan results to an Excel file.
130
135
131
136
For a script example, see [Azure SQL Vulnerability Assessment PowerShell support](https://blogs.msdn.microsoft.com/sqlsecurity/20../../azure-sql-vulnerability-assessment-now-with-powershell-support/).
132
137
133
-
## Manage Vulnerability Assessments baseline rules using Resource Manager templates
138
+
## Manage Vulnerability Assessment baseline rules by using Resource Manager templates
134
139
135
140
To configure Vulnerability Assessment baselines by using Azure Resource Manager templates, use the `Microsoft.Sql/servers/databases/vulnerabilityAssessments/rules/baselines` type.
136
141
137
-
Ensure that you have enabled vulnerabilityAssements on the computer that's running SQL Server before you add baselines.
142
+
Ensure that you have enabled `vulnerabilityAssessments` on the computer that's running SQL Server before you add baselines.
138
143
139
-
Here's an example for defining Baseline Rule VA2065 to masterdb and VA1143 userdb as resources in a Resource Manager template:
144
+
Here's an example for defining Baseline Rule VA2065 to masterdb and VA1143 to userdb as resources in a Resource Manager template:
140
145
141
146
```json
142
147
"resources": [
@@ -183,13 +188,13 @@ Here's an example for defining Baseline Rule VA2065 to masterdb and VA1143 userd
183
188
}
184
189
```
185
190
186
-
For user database and master database, the resource names are defined differently:
191
+
For master database and user database, the resource names are defined differently:
0 commit comments