• In-place encryption. You can now encrypt your column, rotate a column encryption key, or change an encryption type of a column, without moving your data out of the database – the data can be encrypted, re-encrypted or decrypted locally on the server side, inside the secure enclave. And, you can trigger such cryptographic transformations using ALTER TABLE ALTER COLUMN Transact-SQL statements, without client-side tools, such as Always Encrypted wizard in SSMS or PowerShell.
• Rich computations. The SQL Server Engine can now delegate some operations on encrypted database columns to the enclave, which can decrypt the sensitive data and execute the operations requested in the query on plaintext values. This dramatically expands the types of queries supported on sensitive data, and therefore opens Always Encrypted to new scenarios and new applications. The new operations supported in SQL Server 2019 preview are pattern matching (LIKE) and equality comparisons on columns using randomized encryption (which is stronger than the alternative deterministic encryption).

• Enabling indexing to accelerate rich computations (LIKE, range queries) on encrypted columns.
• Adding support for Intel SGX enclaves, which are now available in Azure. This will enable us to bring Always Encrypted with secure enclaves to Azure SQL Database customers.

Please note that using Event hubs or Log Analytics as targets for audit logs at the server level is currently not supported for secondary geo-replicated databases. 

Managing Vulnerability Assessment with cmdlets

Example script using Vulnerability Assessment cmdlets

1. Turn on Advanced Threat Protection on the server
2. Set up Vulnerability Assessment for all databases on that server, including setting recurring scans to run automatically once per week.
3. Set a customized baseline value for one of the checks run by the scan
4. Run a vulnerability scan on the database, and consume the results
5. Download the scan results to an Excel summary file

{

# set parameters - resource group, server, database and storage account
$params =  @{ rgname = "rg";
     serverName = "my-server";
     databaseName = "my-db";
     storageAccount = "mystorage"
}
# Turn on ATP
Enable-AzureRmSqlServerAdvancedThreatProtection -ResourceGroupName $params.rgname -ServerName $params.serverName

# Set Vulnerability Assessment storage settings for all the databases in the server

Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName `
        | where {$_.DatabaseName -ne "master"}  `
        | Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings `
            -StorageAccountName $params.storageAccount 

# Update vulnerability assessment settings to turn ON recurring scans, and provide email to receive results
$scanNotificationEmail = @("user1@microsoft.com")
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName`
        | where {$_.DatabaseName -ne "master"}  `
        | Update-AzureRmSqlDatabaseVulnerabilityAssessmentSettings `
            -RecurringScansInterval Weekly `
                 -NotificationEmail $scanNotificationEmail `
                 -EmailAdmins $true

# Set Vulnerability Assessment baseline for rule VA1143 on all the databases in the server 
$ruleId = "VA1143"
$baselineResult = @( '1')
Get-AzureRmSqlDatabase -ResourceGroupName $params.rgname -ServerName $params.serverName `
            | where {$_.DatabaseName -ne "master"}  `
            | Set-AzureRmSqlDatabaseVulnerabilityAssessmentRuleBaseline `
                -RuleId $ruleId `
                -BaselineResult $baselineResult

# Run a new scan on a database
$scanId1 = "custom-scan1"
$scanJob = Start-AzureRmSqlDatabaseVulnerabilityAssessmentScan `
                 -ResourceGroupName $params.rgname `
                 -ServerName $params.serverName `
                 -DatabaseName $params.databaseName `
                 -ScanId $scanId1 `
                 -AsJob

$scanJob | Wait-Job
$scanRecord = $scanJob | Receive-Job

# Convert the raw scan results to an Excel file
$convertScanResult = Convert-AzureRmSqlDatabaseVulnerabilityAssessmentScan `
                                    -ResourceGroupName $params.rgname `
                                    -ServerName $params.serverName `
                                    -DatabaseName $params.databaseName `
                                    -ScanId $scanId1

# Download the scan results Excel summary file
$connectionStringToStorageAccount = "DefaultEndpointsProtocol=https;AccountName=......."
$convertedScanResultsDownloadLocalFolder = "C:\ScanResults\"
$storageAccountContext = New-AzureStorageContext -ConnectionString $connectionStringToStorageAccount
$convertScanResultSplitted = $convertScanResult.ExportedReportLocation -split "/"
$containerName = $convertScanResultSplitted[3]
Get-AzureStorageBlobContent -Blob ($convertScanResult.ExportedReportLocation -split $containerName + '/')[1] `
                            -Container $containerName `
                            -Destination $convertedScanResultsDownloadLocalFolder `
                            -Context $storageAccountContext
}

Reference

Get started now with VA PowerShell Cmdlets

Vulnerability Assessment

• Meet compliance requirements that require database scan reports.
• Meet data privacy standards.
• Monitor a dynamic database environment where changes are difficult to track.

Cmdlets for managing assessments

Get started now with VA PowerShell Cmdlets

• Helping meet data privacy standards and regulatory compliance requirements, such as GDPR.
• Data-centric security scenarios, such as monitoring (auditing) and alerting on anomalous access to sensitive data.
• Controlling access to and hardening the security of databases containing highly sensitive data.

What is SQL Information Protection?

• Discovery & recommendations – The classification engine scans your database and identifies columns containing potentially sensitive data. It then provides you an easy way to review and apply the appropriate classification recommendations via the Azure portal.
• Labeling – Sensitivity classification labels can be persistently tagged on columns using new classification metadata attributes introduced into the SQL Engine. This metadata can then be utilized for advanced sensitivity-based auditing and protection scenarios.
• Monitoring/Auditing – Sensitivity of the query result set is calculated in real time and used for auditing access to sensitive data (currently in Azure SQL DB only).
• Visibility – The database classification state can be viewed in a detailed dashboard in the portal. Additionally, you can download a report (in Excel format) to be used for compliance & auditing purposes, as well as other needs.

How does SQL IP work?

Get started today!

• Azure SQL Database: Getting Started Data Discovery & Classification
• SQL Server (on-prem): Getting Started with Data Discovery & Classification

SQL Vulnerability Assessment

What are people saying about Vulnerability Assessment?

“I personally like the tool, and the feedback from other teams has been positive. Everyone found the tool very easy to run, the findings easy to understand, and fixes were straightforward thanks to the remediation scripts.” - Anton Popov, Principal Security Engineer at Schneider Electric Software, LLC   “This is another example of Microsoft making security more approachable, even if you are not a security expert. After running a scan you will probably see some quick wins making your database more secure step by step.” - Tom Kerkhove, Azure Consultant at Codit and Microsoft Azure MVP

Now in SSMS

Get started now

• Inside Microsoft Azure datacenter hardware and software architecture with Mark Russinovich - fast forward to 49' 53''
• Secure your data in Azure SQL Database and SQL Data Warehouse - fast forward to 34' 17''