News

Advanced Threat Protection Rolls Out for Azure SQL

• By Kurt Mackie
• 05/21/2018

Microsoft has expanded its sprawling Advanced Threat Protection (ATP) product line with "a new security package" designed for Azure SQL Database.

The new SQL ATP is accessed through the Azure Portal or the Azure Security Center and has three main capabilities: "Data Discovery and Classification," "Threat Detection" and "Vulnerability Assessment." The latter two capabilities are now production-ready, with Vulnerability Assessment having reached "general availability" status last week. However, the Data Discovery and Classification segment of SQL ATP is still at the preview stage.

Microsoft charges for using SQL ATP, although there's a 60-day free trial. Pricing for SQL ATP seemed to be unlisted at press time. However, this Microsoft overview article suggested that the costs are similar to Azure Security Center pricing.

"ATP pricing aligns with Azure Security Center standard tier at $15/node/month, where each protected SQL Database server is counted as one node," the article stated.

It also appears that some of the three SQL ATP capabilities, which are built into the Azure SQL Database service, can be used by organizations running SQL Server "on-premises" (that is, on their own infrastructure and not using Azure services). The capabilities are available through SQL Server Management Studio (SSMS). For instance, Microsoft's announcement explained that "VA [Vulnerability Assessment] is available for Azure SQL Database customers as well as for on-premises SQL Server customers via SSMS."

Microsoft is touting the Vulnerability Assessment segment of SQL ATP as being a useful means for meeting compliance standards, including the European Union's General Data Protection Regulation (GDPR) privacy stipulations, which will become enforceable law on May 25. Vulnerability Assessment is based on Microsoft best practices and will run a scan for "misconfigurations, excessive permissions and unprotected sensitive data," per Microsoft's documentation. Users get a report plus "actionable steps to resolve each issue," along with "customized remediation scripts where applicable."

Threat Detection performs continuous monitoring of databases. It provides users with alerts about "suspicious database activities, potential vulnerabilities, and SQL injection attacks, as well as anomalous database access patterns," according to Microsoft's documentation. It also provides recommended actions to take.

The Data Discovery and Classification segment provides a means for scanning and identifying sensitive data within databases. Microsoft also touts it as being useful for staying compliant with the GDPR. Users can add metadata labels to classify the data. Details show up in a dashboard view.