Keep on prime of database threats with Microsoft Defender for Azure Cosmos DB | Azure Weblog and Updates

Databases are continuously evolving to deal with new use circumstances, incorporate extra intelligence, and retailer extra information, giving builders and organizations a variety of database sorts to fulfill their various wants. As a result of points together with structure, capabilities, configuration choices, and authentication strategies are distinctive to every database sort, so are the safety threats—requiring customized safety measures and safety capabilities to handle the commonest threats throughout databases.

Azure Cosmos DB is a completely managed NoSQL database for contemporary, quick, and versatile app improvement, providing single-digit millisecond response instances, automated and on the spot scalability, and a number of SDKs and APIs to assist a wide range of non-relational information fashions.

As we speak we’re excited to announce a brand new addition to our database safety providing Microsoft Defender for Azure Cosmos DB in preview.

The brand new cloud workload safety capabilities are designed as an Azure-native layer of safety, that detect makes an attempt to take advantage of databases in your Azure Cosmos DB accounts based mostly on the commonest assault strategies and recognized unhealthy actors—enabling safety groups to detect and reply to those threats extra successfully, utilizing the Microsoft Defender for Cloud toolset.

These detections are delivered based mostly on Microsoft Risk Intelligence, the Microsoft Defender SQL question evaluation engine, and Microsoft Defender behavioral fashions. 

Detect probably the most important threats concentrating on Azure Cosmos DB

Defender for Azure Cosmos DB displays your Azure Cosmos DB accounts and protects them from varied assault vectors, similar to assaults originating from the applying layer, SQL injections, suspicious entry patterns, compromised identities, malicious insiders, and direct assaults on the database. Under is an summary of the important thing risk strategies that have an effect on Azure Cosmos DB and are supported alert sorts in Microsoft Defender for Cloud.

• SQL injections: It isn’t generally recognized that one of the vital standard assault strategies—SQL injection—might be executed towards a database in Azure Cosmos DB. This method permits the attacker to cover behind the applying’s credentials and behaviors, to allow them to perform an assault with out the necessity to get their very own credentials so as to exploit the database. Attackers can use SQL injection strategies to bypass the applying’s entry controls and extract delicate information. Defender for Azure Cosmos DB detects these makes an attempt early, in addition to helps with suggestions and insurance policies to harden your functions to assist forestall these exploits within the first place.

• Key extraction: That is an indicative sample of a compromised identification searching for methods to entry the crown jewels of your group—your information. The most typical manner for compromised identities and malicious insiders to take advantage of an Azure Cosmos DB database is to extract the entry keys to the account. These keys enable full entry to all information within the Azure Cosmos DB account. In these circumstances, the place an attacker manages to pay money for a compromised identification, it’s important to detect a breach early and guarantee they’re not in a position to scan your Azure Cosmos DB account and extract important information. Defender for Azure Cosmos DB detects these compromises early and permits you to arrange automation to dam unhealthy actors and mitigate the risk.
• Identified malicious indicators: Microsoft Defender for Cloud makes use of the in depth risk intelligence of Microsoft’s safety platform, permitting safety groups to detect and reply to malicious actors attempting to entry their databases extra successfully.
• Suspicious conduct patterns: Utilizing behavioral modeling over time, Microsoft Defender for Cloud detects suspicious behaviors in your Azure Cosmos DB accounts that may point out compromised identities, leaked keys, or malicious insiders. 

You could find a whole listing of Defender for Azure Cosmos DB alerts with the Microsoft Defender for Azure Cosmos DB alerts reference information.

Simply allow safety for all of your database sorts in Microsoft Defender for Cloud

The brand new risk safety providing for Azure Cosmos DB is now obtainable in Microsoft Defender for Cloud, alongside a newly designed database-centric enablement expertise.

To simplify the method of enabling database safety throughout the totally different database sorts in your cloud and hybrid environments, we created a central administration expertise throughout SQL databases, MariaDB, and now Azure Cosmos DB. Whereas every database sort requires a tailor-made strategy with customized safety controls and uniquely optimized risk detection fashions, we have now standardized the safety expertise in Microsoft Defender for Cloud throughout them.

You possibly can allow safety for Azure Cosmos DB at both the subscription stage or the useful resource stage, or just allow safety for all of your database sorts with a single click on. For detailed step-by-step directions, try our introduction to Microsoft Defender for SQL documentation.

With the addition of assist for Azure Cosmos DB, Microsoft Defender for Cloud now offers one of the vital complete workload safety choices for cloud-based databases, giving safety groups and database house owners a centralized expertise to handle database safety of their environments.

Microsoft Defender for Cloud is an answer for cloud safety posture administration (CSPM) and cloud workload safety (CWP) that finds weak spots throughout your cloud configuration, helps strengthen the general safety posture of your atmosphere, and might shield workloads throughout multicloud and hybrid environments from evolving threats.

Study extra