Securing Azure Blob Storage against deletion and data against ransomware attacks

MS Techie 2,676

We want to store data (40TB size) stored in Azure Storage blob .

What are the ways that we can secure Azure Blob storage and protect it from deletion and malware attacks

1 answer

Ramya Harinarthini_MSFT 5,306 Reputation points Microsoft Employee

2022-11-24T16:52:53.103+00:00

@MS Techie Welcome to Microsoft Q&A Forum, Thanks for posting here!!

Microsoft Defender for Storage is an Azure-native layer of security intelligence that detects unusual and potentially harmful attempts to access or exploit your storage accounts. It uses advanced threat detection capabilities and Microsoft Threat Intelligence data to provide contextual security alerts. Those alerts also include steps to mitigate the detected threats and prevent future attacks.

You can enable Microsoft Defender for Storage at either the subscription level (recommended) or resource level i.e Storage account
level.

Please checkout other security recommendations for Blob Storage :https://learn.microsoft.com/en-us/azure/storage/blobs/security-recommendations

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue

---------------------------------------------------------------------------------------------------------------------------

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Please sign in to rate this answer.

1 person found this answer helpful.
MS Techie 2,676 Reputation points

2022-11-25T10:32:52.627+00:00

Once a storage account is created by Azure admin , can we stop even the azure admin from deleting it ?

Ramya Harinarthini_MSFT 5,306 Reputation points Microsoft Employee

2022-11-25T12:18:18.403+00:00

@MS Techie Yes Azure Admin can delete the Storage account. However, you can set locks that prevent deletions. In the portal, these locks are called Delete. In the command line, these locks are called CanNotDelete

CanNotDelete means authorized users can read and modify a resource, but they can't delete it.

Also, we can recover the accidentally deleted Storage account from Azure Portal and you can also protect the accidental deletion of container and blobs by enabling soft delete

Hope it helps!!!

Please "Accept as Answer" if it helped so it can help others in the community looking for help on similar topics.

MS Techie 2,676 Reputation points

2022-12-05T13:05:44.617+00:00

Does Microsoft Defender for CLoud also include Microsoft Defender for Storage ?

Ramya Harinarthini_MSFT 5,306 Reputation points Microsoft Employee

2022-12-06T05:43:14.347+00:00

@MS Techie

Microsoft Defender for cloud also include Microsoft Defender for Storage.

To setup Microsoft Defender for Storage, you can follow this article: https://learn.microsoft.com/en-us/azure/storage/common/azure-defender-storage-configure?tabs=per-storage-account#set-up-microsoft-defender-for-storage

Hope this helps!
Kindly let us know if the above helps or you need further assistance on this issue.

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

EnterpriseArchitect 4,721 Reputation points

2023-02-06T15:23:24.4+00:00

Hi @Ramya Harinarthini_MSFT ,

What's the Azure Storage account that supports Immutability like the Amazon S3 Glacier object?

Ramya Harinarthini_MSFT 5,306 Reputation points Microsoft Employee

2023-02-06T17:18:58.3866667+00:00

@EnterpriseArchitect

Immutable storage for Azure Blob Storage enables users to store business-critical data in a WORM (Write Once, Read Many) state. While in a WORM state, data cannot be modified or deleted for a user-specified interval. By configuring immutability policies for blob data, you can protect your data from overwrites and deletes.

Immutable storage for Azure Blob Storage supports two types of immutability policies:

Time-based retention policies: With a time-based retention policy, users can set policies to store data for a specified interval. When a time-based retention policy is set, objects can be created and read, but not modified or deleted. After the retention period has expired, objects can be deleted but not overwritten. To learn more about time-based retention policies, see Time-based retention policies for immutable blob data.

Legal hold policies: A legal hold stores immutable data until the legal hold is explicitly cleared. When a legal hold is set, objects can be created and read, but not modified or deleted. To learn more about legal hold policies, see Legal holds for immutable blob data.

Supported account configurations are shown in the below table:

Check here to configure the immutability policies for containers.

Hope this helps!
Kindly let us know if the above helps or you need further assistance on this issue.

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.
Sign in to comment