Why Azure MySQL database compromised?

Question

This question is being posted as part of an internal effort at Microsoft to share emerging content with the community. A Microsoft employee will be following up with an answer shortly. If you have feedback regarding this issue, we encourage the community to start a discussion in the comments.

Answer 1

The server security is a shared responsibility between Azure and the customer. Hereunder are some insights can help you securing the server data against any unintentional deletion or drop.

• Make sure to remove 0.0.0.0 from the server firewall and restrict the connections to only trusted clients. For more information check out Azure MySQL documentation:
  https://learn.microsoft.com/en-us/azure/mysql/concepts-security

Also, you can improve the connectivity security by using private endpoints, More details can be found at Microsoft Tech Community blogs:
Securing Connectivity to Azure Database for MySQL - Microsoft Tech Community - https://techcommunity.microsoft.com/t5/azure-database-for-mysql-blog/securing-connectivity-to-azure-database-for-mysql/ba-p/783076
Connectivity and network security improvements for Azure Database for MySQL - Microsoft Tech Community - https://techcommunity.microsoft.com/t5/azure-database-for-mysql-blog/connectivity-and-network-security-improvements-for-azure/ba-p/1231180

• Enable Audit, and make sure to have audit event.

audit_log_events: controls the events to be logged. See below table for specific audit events. For example:-

Event Description
CONNECTION - Connection initiation (successful or unsuccessful)
DML DML = DML_SELECT + DML_NONSELECT
DDL Queries like "DROP DATABASE"

More information can be found at references:
https://learn.microsoft.com/en-us/azure/mysql/concepts-audit-logs
https://learn.microsoft.com/en-us/azure/mysql/howto-configure-audit-logs-portal

• tighten the user access and privileges. work with DBA to create different users than the database admin with less privileges,
  you can refer to the document: Create databases and users - Azure Database for MySQL | Microsoft Learn
  https://learn.microsoft.com/en-us/azure/mysql/howto-create-users?tabs=single-server

You can find more information and best practices to securing the azure server for MySQL at:
Azure security baseline for Azure Database for MySQL | Microsoft Learn - https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/mysql-security-baseline
App development best practices - Azure Database for MySQL | Microsoft Learn - https://learn.microsoft.com/en-us/azure/mysql/app-development-best-practices

We do sincerely understand the inconvenience might be caused by such incident, nonetheless We do assure that applying the best practices will allow you to prevent, audit, monitor and control such incidents in the future.

Hope this helps!