Stay on top of database threats with Microsoft Defender for Azure Cosmos DB

Databases are constantly evolving to handle new use cases, incorporate more intelligence, and store more data, giving developers and organizations a wide range of database types to meet their varying needs. Because aspects including architecture, capabilities, configuration options, and authentication methods are unique to each database type, so are the security threats—requiring custom security measures and protection capabilities to address the most common threats across databases.

Azure Cosmos DB is a fully managed NoSQL database for modern, fast, and flexible app development, offering single-digit millisecond response times, automatic and instant scalability, and multiple SDKs and APIs to support a variety of non-relational data models.

Today we’re excited to announce a new addition to our database protection offering Microsoft Defender for Azure Cosmos DB in preview.

The new cloud workload protection capabilities are designed as an Azure-native layer of security, that detect attempts to exploit databases in your Azure Cosmos DB accounts based on the most common attack techniques and known bad actors—enabling security teams to detect and respond to these threats more effectively, using the Microsoft Defender for Cloud toolset.

These detections are delivered based on Microsoft Threat Intelligence, the Microsoft Defender SQL query analysis engine, and Microsoft Defender behavioral models. 

Detect the most critical threats targeting Azure Cosmos DB

Defender for Azure Cosmos DB monitors your Azure Cosmos DB accounts and protects them from various attack vectors, such as attacks originating from the application layer, SQL injections, suspicious access patterns, compromised identities, malicious insiders, and direct attacks on the database. Below is an overview of the key threat techniques that affect Azure Cosmos DB and are supported alert types in Microsoft Defender for Cloud.

SQL injections: It is not commonly known that one of the most popular attack techniques—SQL injection—can be executed against a database in Azure Cosmos DB. This technique allows the attacker to hide behind the application’s credentials and behaviors, so they can carry out an attack without the need to get their own credentials in order to exploit the database. Attackers can use SQL injection techniques to bypass the application’s access controls and extract sensitive data. Defender for Azure Cosmos DB detects these attempts early, as well as helps with recommendations and policies to harden your applications to help prevent these exploits in the first place.

Key extraction: This is an indicative pattern of a compromised identity looking for ways to access the crown jewels of your organization—your data. The most common way for compromised identities and malicious insiders to exploit an Azure Cosmos DB database is to extract the access keys to the account. These keys allow full access to all data in the Azure Cosmos DB account. In these cases, where an attacker manages to get hold of a compromised identity, it’s critical to detect a breach early and ensure they’re not able to scan your Azure Cosmos DB account and extract critical data. Defender for Azure Cosmos DB detects these compromises early and allows you to set up automation to block bad actors and mitigate the threat.
Known malicious indicators: Microsoft Defender for Cloud uses the extensive threat intelligence of Microsoft’s security platform, allowing security teams to detect and respond to malicious actors trying to access their databases more effectively.
Suspicious behavior patterns: Using behavioral modeling over time, Microsoft Defender for Cloud detects suspicious behaviors on your Azure Cosmos DB accounts that can indicate compromised identities, leaked keys, or malicious insiders. 

You can find a complete list of Defender for Azure Cosmos DB alerts with the Microsoft Defender for Azure Cosmos DB alerts reference guide.

Easily enable protection for all your database types in Microsoft Defender for Cloud

The new threat protection offering for Azure Cosmos DB is now available in Microsoft Defender for Cloud, alongside a newly designed database-centric enablement experience.

To simplify the process of enabling database protection across the different database types in your cloud and hybrid environments, we created a central management experience across SQL databases, MariaDB, and now Azure Cosmos DB. While each database type requires a tailored approach with custom security controls and uniquely optimized threat detection models, we have standardized the security experience in Microsoft Defender for Cloud across them.

You can enable protection for Azure Cosmos DB at either the subscription level or the resource level, or simply enable protection for all your database types with a single click. For detailed step-by-step instructions, check out our introduction to Microsoft Defender for SQL documentation.

With the addition of support for Azure Cosmos DB, Microsoft Defender for Cloud now provides one of the most comprehensive workload protection offerings for cloud-based databases, giving security teams and database owners a centralized experience to manage database security in their environments.

Microsoft Defender for Cloud is a solution for cloud security posture management (CSPM) and cloud workload protection (CWP) that finds weak spots across your cloud configuration, helps strengthen the overall security posture of your environment, and can protect workloads across multicloud and hybrid environments from evolving threats.

Learn more

Get started with a free trial.
Visit our website to learn more about Microsoft Defender for Cloud.
Check out the product documentation to get started with Microsoft Defender for Azure Cosmos DB.
Subscribe to our YouTube series for product deep dives!
Follow us at @MSThreatProtect for the latest news and updates on cybersecurity.

Quelle: Azure

Azure Cost Management and Billing updates – February 2022

Whether you're a new student, a thriving startup, or the largest enterprise, you have financial constraints, and you need to know what you're spending, where, and how to plan for the future. Nobody wants a surprise when it comes to the bill, and this is where Azure Cost Management and Billing comes in.

We're always looking for ways to learn more about your challenges and how Azure Cost Management and Billing can help you better understand where you're accruing costs in the cloud, identify and prevent bad spending patterns, and optimize costs to empower you to do more with less. Here are a few of the latest improvements and updates based on your feedback:

Anomaly detection preview for subscriptions.
Help shape the future of invoice reconciliation.
What's new in Cost Management Labs.
Rightsize to maximize your cloud investment with Microsoft Azure.
Save big by using your on-premises licenses on Azure.
New ways to save money with Azure.
New videos and learning opportunities.
Documentation updates.
Join the Azure Cost Management and Billing team.

Let's dig into the details.

 

Anomaly detection preview for subscriptions

The cloud comes with the promise of radical cost savings compared to on-premises, but that requires diligence to proactively plan, govern, and monitor your cloud solutions. Unfortunately, even the best of us can be caught by surprise. Luckily, you have the Cost Management anomaly detection preview for your subscriptions.

Cost Management anomaly detection is available from the cost analysis preview when you select a subscription scope. You’ll see your anomaly status as part of Insights. And as with other insights, the experience is fairly simple: Start on a subscription scope, open any view in the cost analysis preview and, if you have a cost anomaly, you'll see an insight. It's that simple.

If you don't have any anomalies, you'll see a "No anomalies detected" insight, confirming the dates that were evaluated.

If you’d like to drill in, simply click the insight link to open a view in classic cost analysis and review your daily usage by resource group for the time range that was evaluated. Below is an example of the anomaly above, where we can see a large spike and eventual drop in usage from a temporary, short-lived resource.

Cost anomalies are evaluated for subscriptions daily and compare the day's total cost to a forecasted total based on the last 60 days to account for common patterns in your recent usage (for example, spikes every Monday).

Anomaly detection is available to every subscription monitored using the cost analysis preview. To enable anomaly detection for your subscriptions, simply open the cost analysis preview and select your subscription from the scope selector at the top of the page. You’ll see a notification informing you that your subscription is onboarded and you’ll start to see your anomaly detection status within 24 hours.

That's about it! This is an early preview and there's a lot in the backlog to expand anomaly detection capabilities – from surfacing more details and generating insights for other scopes to sending out email alerts and more. Check it out and let us know what you'd like to see next.

 

Help shape the future of invoice reconciliation

Are you responsible for understanding your organization's cloud spending? Do you review and compare your invoice charges with Azure usage? We’re exploring new tools to help streamline invoice/usage reconciliation and would like to learn about your experience in a 60-minute interview covering the processes and tools you use.

If you or someone you know has experience in this area, we would love to get your feedback. Please contact our research team and we’ll schedule a time for the interview.

 

What's new in Cost Management Labs

With Cost Management Labs, you get a sneak peek at what's coming in Azure Cost Management and can engage directly with us to share feedback and help us better understand how you use the service, so we can deliver more tuned and optimized experiences. Here are a few features you can see in Cost Management Labs:

Update: Subscription cost anomalies – Now available in the public portal
Identify subscription cost anomalies with insights in the cost analysis preview. You can enable the cost anomaly preview using Try preview. If you don't see anomaly details in insights after enabling the preview, check back after 24 hours. Note that anomaly detection is only available when viewing cost for a subscription scope.
Update: Total cost in the cost analysis preview – Now enabled by default in Labs
See your total cost at the top of the cost analysis preview. You can opt-in using Try Preview or by using the cost analysis preview in Cost Management Labs.
New: Grouping SQL databases and elastic pools
Get an at-a-glance view of your total SQL costs by grouping SQL databases and elastic pools under their parent server in the cost analysis preview. You can opt-in using Try Preview.
Average cost in the cost analysis preview
See your average daily cost at the top of the cost analysis preview. You can opt-in using Try Preview.
Charts in the cost analysis preview
View your daily or monthly cost over time in the cost analysis preview. You can opt-in using Try Preview.
Budgets in the cost analysis preview
Quickly create and edit budgets directly from the cost analysis preview. If you don’t have a budget yet, you’ll see a suggested budget based on your forecast. You can opt-in using Try Preview.
View cost for your resources
The cost for your resources is one click away from the resource overview in the preview portal. Just click View cost to quickly jump to the cost of that particular resource.
Change scope from the menu
Change scope from the menu for quicker navigation. You can opt-in using Try Preview.

Of course, that's not all. Every change in Azure Cost Management is available in Cost Management Labs a week before it's in the full Azure portal. We're eager to hear your thoughts and understand what you'd like to see next. What are you waiting for? Try Cost Management Labs today.

 

Rightsize to maximize your cloud investment with Microsoft Azure

If you’re running on-premises servers, chances are you utilize a fraction of your overall server cores most of the time but are forced to over-provision to handle peak loads. Moving those workloads to the cloud can greatly reduce cost by “rightsizing” server capacity as needed.

Rightsizing is one of the key levers you have for controlling costs and optimizing resources. By understanding cloud economics, and using what Azure provides, you can identify the smallest virtual server instances that support your requirements and realize immediate savings by eliminating unused capacity.

To learn more, see Rightsize to maximize your cloud investment with Microsoft Azure.

 

Save big by using your on-premises licenses on Azure

Are you still hesitating to move some or all your workloads to the cloud due to the added cost? One of the easiest ways to significantly lower your cost of ownership is by using a special licensing offer called Azure Hybrid Benefit.

When migrating Windows Server or SQL Server on-premises workloads to Microsoft Azure, Azure Hybrid Benefit allows you to use your existing licenses covered by Software Assurance (SA) or other subscriptions in Azure. By bringing both Windows and SQL Server licenses with SA to Azure, you can save up to 85 percent compared to pay-as-you-go pricing.

To learn more, see Save big by using your on-premises licenses on Azure. And after reading about how much you can save, learn about how you can manage Azure Hybrid Benefit for SQL Server in the Azure portal.

 

New ways to save money with Azure

You have two new generally available offerings to help you save money this month:

Azure Monitor Diagnostic settings for Azure Storage.
Azure Key Vault increased service limits.

 

New videos and learning opportunities

If you're using Azure Backup, here's a new video you might be interested in:

Improve the price-performance of your apps with the latest Azure Virtual Machines (25 minutes).
Azure Virtual Desktop Master Class.

Follow the Azure Cost Management and Billing YouTube channel to stay in the loop with new videos as they’re released and let us know what you'd like to see next.

Want a more guided experience? Start with Control Azure spending and manage bills with Azure Cost Management and Billing.

 

Documentation updates

One important update to documentation that you’ll want to check out this month:

Added a new Subscribe to cost alerts section to the Save and share customize views article to subscribe to updates or a recurring schedule to get alerted as costs change. You can also set up alerts to be shared with others who may not have direct access to costs in the portal.

Want to keep an eye on all of the documentation updates? Check out the Cost Management and Billing documentation change history on GitHub. If you see something missing, select Edit at the top of the document and submit a quick pull request.

 

Join the Azure Cost Management and Billing team

Are you excited about helping customers and partners better manage and optimize costs? We're looking for passionate, dedicated, and exceptional people to help build best in class cloud platforms and experiences to enable exactly that. If you have experience with big data infrastructure, reliable and scalable APIs, or rich and engaging user experiences, you'll find no better challenge than serving every Microsoft customer and partner in one of the most critical areas for driving cloud success. To learn more, watch the video below:

Join our team.

What's next?

These are just a few of the big updates from last month. Don't forget to check out the previous Azure Cost Management and Billing updates. We're always listening and making constant improvements based on your feedback, so please keep the feedback coming.

Follow @AzureCostMgmt on Twitter and subscribe to the YouTube channel for updates, tips, and tricks. You can also share ideas and vote up others in the Cost Management feedback forum or join the research panel to participate in a future study and help shape the future of Azure Cost Management and Billing.

We know these are trying times for everyone. Best wishes from the Azure Cost Management and Billing team. Stay safe and stay healthy.
Quelle: Azure