Microsoft is eliminating a blind spot for businesses looking to keep their cloud databases safe and compliant with regulations affecting how their industries manage and secure data.
Matt Usher, senior program manager, Microsoft SQL Engineering, announced in a blog post that the database auditing feature on Azure SQL Database has been enabled for customers to use. “Using a very simple and intuitive configuration interface, you can now have auditing up and running on your database within minutes,” he said.
Configuring database auditing is straightforward and requires that administrators specify the Azure Storage account the service writes audit logs to, said Usher, noting that the logs count against a customer’s cloud storage plan. “Once auditing has been enabled, an Azure Table is automatically created on that designated storage account, and records for selected events (based on what you configured) are written to that table,” stated Usher.
Naturally, Microsoft also provides ways to view and interpret the audit data.
“To view the logs, you can connect to the Azure Storage account via your tool of choice, such as Azure Storage Explorer, or via our predefined Excel dashboard and reports template, which can retrieve the logs from your Azure Storage Account using Power Query,” said Usher. Power Query is an Excel add-on that links Microsoft’s spreadsheet software with its cloud-based business intelligence offering, Power BI.
Recorded events can help businesses spot activity that not only puts their data at risk, but also places them in the cross hairs of regulatory bodies.
One use for the new database auditing feature is to sniff out signs of authorized access and other suspicious activities. “An analysis of audit data can expose discrepancies and anomalies in data-related activities across the organization. This can lead to the identification of potential security incidents,” Usher said.
Another, less obvious use of the audit data is as a business performance indicator.
Data that reveals changes in database activity can provide business managers with an early warning system, of sorts.
Usher asserted that an audit trail “can readily be used to enhance business visibility; such data can help to identify business trends or potentially indicate business concerns. For instance, an analysis of the data may identify a drop in activity levels over time in a database located in a particular geographic location, which can then be addressed by the business.”
Finally, and perhaps must crucially for businesses operating in regulated industries, the database auditing helps keep the lawman away.
“Auditing is a valuable tool that can be used to help organizations meet various industry compliance requirements and regulations, such as PCI DSS [Payment Card Industry Data Security Standard], SOX [Sarbanes-Oxley] or HIPAA [Health Insurance Portability and Accountability Act],” Usher said. “Many such regulations require an audit trail on data-related activities against the underlying databases.”
Auditing only goes so far, Usher said. Often, it can only expose problems, not prevent them. “It remains the organization’s responsibility to ensure the application design and database practices are implemented to adhere to the required corporate or industry security and compliance standards,” he said.