Securing Azure CosmosDb using Microsoft Defender

This session will aim at introducing the audience to the configuration level security best practices for Azure Cosmos DB. Further, the emphasis will be on Azure Defender for Azure Cosmos Db and help the audience understand how this integration adds an extra layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit Azure Cosmos DB accounts.

1. Securing Azure Cosmos DB using Microsoft Defender Ankit Rao Senior Software Engineer at Zscaler Cloud and Cloud Security Enthusiast AWS Community Builder Pune (MH), India : @_AnkitRao : @ankit-rao

2. Motivation Source: https://marketwatch.com The Global Cloud Security Market is expected to grow from USD 5 Billion in 2016 to USD ~13 billion by 2022, at an estimated CAGR of 17%. The lack of awareness about cloud security among organizations and the fear of losing their data confidentiality are among some factors restraining market growth. Further, the biggest identified cloud threats occur mostly due to the misconfiguration of cloud platforms.

3. Azure Cosmos DB – An overview Cloud Security – A shared responsibility model Microsoft Defender for Cosmos DB Azure Cosmos DB – Security best practices Demo References Agenda

4. Cloud Security – A shared responsibility model Cloud security refers to the technologies, policies, controls, and services that protect cloud data, applications, and infrastructure from threats. Cloud Security is a shared responsibility model. The diagram besides, shows how your responsibility decreases with a PaaS provider like Azure Cosmos DB.

5. Microsoft Defender for Cosmos DB Microsoft Defender for Cosmos DB provides an extra layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit Azure Cosmos DB accounts. This layer of protection allows you to address threats, even without being a security expert, and integrate them with central security monitoring systems. Security alerts are triggered when anomalies in activity occur. Access from unusual locations Unusual data extraction Further, Defender will provide a centralized view with respect to the security posture of the Cosmos DB, which helps users implement security best practices.

6. Azure Cosmos DB – Security best practices Network security and firewall settings Using an IP firewall is the first layer of protection to secure your database. Azure Cosmos DB supports policy driven IP-based access controls for inbound firewall support. Ensure that Cosmos DB is accessible over selected networks only.

7. Azure Cosmos DB – Security best practices Replicate data globally Global replication lets you scale globally, provide low-latency access to your data around the world. In the context of security, global replication ensures data protection against regional failures.

8. Azure Cosmos DB – Security best practices Backup and Restore Azure Cosmos databases are backed up regularly and stored in a geo redundant store. Azure Cosmos DB's point-in-time restore feature helps in multiple scenarios such as the following: To recover from an accidental write or delete operation within a container. To restore a deleted account, database, or a container. To restore into any region (where backups existed) at the restore point in time.

9. Azure Cosmos DB – Security best practices Key rotation Rotating keys periodically significantly reduces the chances that a compromised set of access keys can be used without your knowledge to access the database.

10. Azure Cosmos DB – Security best practices Resource lock Resource lock prevents users in your organization from accidentally deleting or modifying critical resources. The lock overrides any permissions the user might have.

11. Microsoft Defender for Cosmos DB - Demo

12. Security in Azure Cosmos DB Microsoft Defender for Cosmos DB (Preview) References

13. Questions ?? : @_AnkitRao : @ankit-rao

14. Thank you! Enjoy the upcoming sessions!