Post View : 2743
Azure PostgreSQL
Azure Database for PostgreSQL is a relational database service in the Microsoft cloud based on the PostgreSQL open source relational database. Azure Database for PostgreSQL delivers:
- Built-in high availability.
- Data protection using automatic backups and point-in-time-restore for up to 35 days.
- Automated maintenance for underlying hardware, operating system and database engine to keep the service secure and up to date.
- Predictable performance, using inclusive pay-as-you-go pricing.
- Elastic scaling within seconds.
- Enterprise grade security and industry-leading compliance to protect sensitive data at-rest and in-motion.
- Monitoring and automation to simplify management and monitoring for large-scale deployments.
- Industry-leading support experience.
For more detail, you can view Azure Learn.
By using the PostgreSQL Database on Azure, sometimes you may need to ensure the security of your PostgreSQL database. Security is important for nowadays modern architecture.
Data Encryption
User Azure Key Vault for key management and using the key to perform data encryption.
Requirements
- Customer-Managed Key
- No expiration date
- Not disabled (enabled)
- Able to perform get, wrap key, and unwrap key operations
- Permissions
- Subscription Administrator
Reference Link: Data encryption – Azure portal – for Azure Database for PostgreSQL – Single server
Azure Security Baseline Checklist
For PostgreSQL Database, Azure offers a checklist for us to review our database. By using the checklist we could have a preliminary understanding of the database security level.
- Network Security
- Protect Azure resources within virtual networks
- Monitor and log the configuration and traffic of virtual networks, subnets, and network interfaces
- Deny communications with known-malicious IP addresses
- Record network packets
- Deploy network-based intrusion detection/intrusion prevention systems (IDS/IPS)
- Minimize complexity and administrative overhead of network security rules
- Maintain standard security configurations for network devices
- Document traffic configuration rules
- Use automated tools to monitor network resource configurations and detect changes
- Logging and Monitoring
- Configure central security log management
- Enable audit logging for Azure resources
- Configure security log storage retention
- Monitor and review logs
- Enable alerts for anomalous activities
- Identity and Access Control
- Maintain an inventory of administrative accounts
- Change default passwords where applicable
- Use dedicated administrative accounts
- Use Azure Active Directory single sign-on (SSO)
- Use multi-factor authentication for all Azure Active Directory-based access
- Use secure, Azure-managed workstations for administrative tasks
- Log and alert on suspicious activities from administrative accounts
- Manage Azure resources from only approved locations
- Use Azure Active Directory
- Regularly review and reconcile user access
- Monitor attempts to access deactivated credentials
- Alert on account sign-in behaviour deviation
- Provide Microsoft with access to relevant customer data during support scenarios
- Data Protection
- Maintain an inventory of sensitive information
- Isolate systems storing or processing sensitive information
- Monitor and block unauthorized transfer of sensitive information
- Encrypt all sensitive information in transit
- Use an active discovery tool to identify sensitive data
- Use Azure RBAC to control access to resources
- Log and alert on changes to critical Azure resources
- Vulnerability Management
- Run automated vulnerability scanning tools
- Inventory and Asset Management
- Use automated asset discovery solution
- Maintain asset metadata
- Delete unauthorized Azure resources
- Define and maintain inventory of approved Azure resources
- Use only approved Azure services
- Limit users’ ability to interact with Azure Resource Manager
- Secure Configuration
- Establish secure configurations for all Azure resources
- Maintain secure Azure resource configurations
- Securely store the configuration of Azure resources
- Deploy configuration management tools for Azure resources
- Implement automated configuration monitoring for Azure resources
- Manage Azure secrets securely
- Manage identities securely and automatically
- Eliminate unintended credential exposure
- Malware Defense
- Pre-scan files to be uploaded to non-compute Azure resources
- Data Recovery
- Ensure regular automated backup
- Perform complete system backups and backup any customer-managed keys
- Validate all backups including customer-managed keys
- Ensure protection of backups and customer-managed keys
- Incident Response
- Create an incident response guide
- Create an incident scoring and prioritization procedure
- Test security response procedures
- Provide security incident contact details and configure alert notifications for security incidents
- Incorporate security alerts into your incident response system
- Automate the response to security alerts
- Penetration Tests and Red Team Exercises
- Conduct regular penetration testing of your Azure resources and ensure remediation of all critical security findings
For more details, you can refer to the reference on Azure Learn.
Next section, we will be discussing the enhancement of database security. Stay tuned.
Chris Wan
Microsoft Certified Trainer (MCT)
Application Architect, SOS Group Limited