Овај прегледач више није подржан.
Надоградите на Microsoft Edge бисте искористили најновије функције, безбедносне исправке и техничку подршку.
This security baseline applies guidance from the Microsoft cloud security benchmark version 1.0 to Microsoft Azure Managed Instance for Apache Cassandra. The Microsoft cloud security benchmark provides recommendations on how you can secure your cloud solutions on Azure. The content is grouped by the security controls defined by the Microsoft cloud security benchmark and the related guidance applicable to Microsoft Azure Managed Instance for Apache Cassandra.
You can monitor this security baseline and its recommendations using Microsoft Defender for Cloud. Azure Policy definitions will be listed in the Regulatory Compliance section of the Microsoft Defender for Cloud portal page.
When a feature has relevant Azure Policy Definitions, they are listed in this baseline to help you measure compliance with the Microsoft cloud security benchmark controls and recommendations. Some recommendations may require a paid Microsoft Defender plan to enable certain security scenarios.
Напомена
Features not applicable to Microsoft Azure Managed Instance for Apache Cassandra have been excluded. To see how Microsoft Azure Managed Instance for Apache Cassandra completely maps to the Microsoft cloud security benchmark, see the full Microsoft Azure Managed Instance for Apache Cassandra security baseline mapping file.
The security profile summarizes high-impact behaviors of Microsoft Azure Managed Instance for Apache Cassandra, which may result in increased security considerations.
| Service Behavior Attribute | Value |
|---|---|
| Product Category | Databases, Hybrid/Multi-Cloud |
| Customer can access HOST / OS | No Access |
| Service can be deployed into customer's virtual network | True |
| Stores customer content at rest | True |
For more information, see the Microsoft cloud security benchmark: Network security.
Description: Service supports deployment into customer's private Virtual Network (VNet). Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | True | Microsoft |
Feature notes: Azure Managed Instances for Apache Cassandra resources are hosted on a Microsoft tenant, with network interface cards (NICs) for each resource injected exclusively into Virtual Networks using private IPs. There are no public IPs exposed with this service.
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Reference: Security in Azure Managed Instance for Apache Cassandra - overview
Description: Service network traffic respects Network Security Groups rule assignment on its subnets. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | True | Microsoft |
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
For more information, see the Microsoft cloud security benchmark: Identity management.
Description: Service supports using Azure AD authentication for data plane access. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Feature notes: Azure Managed Instance for Apache Cassandra does not support Azure AD directly. However, the service does support LDAP authentication which can be integrated with Azure AD.
More information may be found here: How to enable LDAP authentication in Azure Managed Instance for Apache Cassandra
Configuration Guidance: This feature is not supported to secure this service.
Description: Local authentications methods supported for data plane access, such as a local username and password. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | False | Customer |
Feature notes: This is a Cassandra level feature, documentation is available in the public OSS domain. Avoid the usage of local authentication methods or accounts, these should be disabled wherever possible. Instead use Azure AD to authenticate where possible.
Configuration Guidance: Restrict the use of local authentication methods for data plane access. Instead, LDAP authentication may be configured for data plane access in Azure Managed Instance for Apache Cassandra, although this is currently in preview.
For more information, please visit: How to enable LDAP authentication in Azure Managed Instance for Apache Cassandra
Description: Data plane actions support authentication using managed identities. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Feature notes: Although this service does not support authentication to the data plane using managed identities, Azure Managed Instance for Apache Cassandra does use a system-assigned managed identity to support encrypting data on disk with a customer-managed key.
For more information, please visit: Customer-managed keys - overview
Configuration Guidance: This feature is not supported to secure this service.
Description: Data plane supports authentication using service principals. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: Data plane access can be controlled using Azure AD Conditional Access Policies. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: Data plane supports native use of Azure Key Vault for credential and secrets store. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Feature notes: Though the service does not support customer configurable certificates and secrets, the service does leverage Azure Key Vault on the backend. Certificates and keys are used to secure communication inside the cluster. If using Azure Firewall in your virtual network, be sure to configure it to allow communication to Azure Key Vault.
For more information, please visit: Virtual network service tags
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Privileged access.
Description: Service has the concept of a local administrative account. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | True | Customer |
Feature notes: Avoid the usage of local authentication methods or accounts, these should be disabled wherever possible. Instead use Azure AD to authenticate where possible.
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Additional Guidance: No Additional configurations are required as this is managed by Azure Platform
Reference: Create a managed instance cluster
Description: Azure Role-Based Access Control (Azure RBAC) can be used to managed access to service's data plane actions. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: Customer Lockbox can be used for Microsoft support access. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Data protection.
Description: Tools (such as Azure Purview or Azure Information Protection) can be used for data discovery and classification in the service. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: Service supports data in-transit encryption for data plane. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | True | Microsoft |
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Reference: How does Azure Managed Instance secure my database
Description: Data at-rest encryption using platform keys is supported, any customer content at rest is encrypted with these Microsoft managed keys. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | True | Microsoft |
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Reference: How does Azure Managed Instance secure my database
Description: Data at-rest encryption using customer-managed keys is supported for customer content stored by the service. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | False | Customer |
Configuration Guidance: If required for regulatory compliance, define the use case and service scope where encryption using customer-managed keys are needed. Enable and implement data at rest encryption using customer-managed key for those services.
Reference: Customer-managed keys - overview
Description: The service supports Azure Key Vault integration for any customer keys, secrets, or certificates. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | False | Customer |
Configuration Guidance: Use Azure Key Vault to create and control the life cycle of your encryption keys, including key generation, distribution, and storage. Rotate and revoke your keys in Azure Key Vault and your service based on a defined schedule or when there is a key retirement or compromise. When there is a need to use customer-managed key (CMK) in the workload, service, or application level, ensure you follow the best practices for key management: Use a key hierarchy to generate a separate data encryption key (DEK) with your key encryption key (KEK) in your key vault. Ensure keys are registered with Azure Key Vault and referenced via key IDs from the service or application. If you need to bring your own key (BYOK) to the service (such as importing HSM-protected keys from your on-premises HSMs into Azure Key Vault), follow recommended guidelines to perform initial key generation and key transfer.
Reference: Customer-managed keys - overview
Description: The service supports Azure Key Vault integration for any customer certificates. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
For more information, see the Microsoft cloud security benchmark: Asset management.
Description: Service configurations can be monitored and enforced via Azure Policy. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | False | Customer |
Feature notes: Azure Policy is supported; however, the scope is limited.
Configuration Guidance: Use Microsoft Defender for Cloud to configure Azure Policy to audit and enforce configurations of your Azure resources. Use Azure Monitor to create alerts when there is a configuration deviation detected on the resources. Use Azure Policy [deny] and [deploy if not exists] effects to enforce secure configuration across Azure resources.
For more information, see the Microsoft cloud security benchmark: Logging and threat detection.
Description: Service produces resource logs that can provide enhanced service-specific metrics and logging. The customer can configure these resource logs and send them to their own data sink like a storage account or log analytics workspace. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | False | Customer |
Configuration Guidance: Enable resource logs for the service. For example, Key Vault supports additional resource logs for actions that get a secret from a key vault or and Azure SQL has resource logs that track requests to a database. The content of resource logs varies by the Azure service and resource type.
Reference: Diagnostic settings in Azure
For more information, see the Microsoft cloud security benchmark: Backup and recovery.
Description: The service can be backed up by the Azure Backup service. Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| False | Not Applicable | Not Applicable |
Configuration Guidance: This feature is not supported to secure this service.
Description: Service supports its own native backup capability (if not using Azure Backup). Learn more.
| Supported | Enabled By Default | Configuration Responsibility |
|---|---|---|
| True | True | Microsoft |
Feature notes: Snapshot backups are enabled by default and taken every 4 hours with Medusa. Backups are stored in an internal Azure Blob Storage account and are retained for up to 2 days (48 hours). There is no cost for backups.
Backups can be restored to the same VNet/subnet as your existing cluster, but they cannot be restored to the same cluster. Backups can only be restored to new clusters. Backups are intended for accidental deletion scenarios, and are not geo-redundant. They are therefore not recommended for use as a disaster recovery (DR) strategy in case of a total regional outage. To safeguard against region-wide outages, we recommend a multi-region deployment.
Configuration Guidance: No additional configurations are required as this is enabled on a default deployment.
Reference: Backup and Restore
Обука
Модул
Implement backup and restore for Azure Cosmos DB for NoSQL - Training
Learn how to use the two backup models Azure Cosmos DB provides.
Цертификација
Microsoft Certified: Azure Database Administrator Associate - Certifications
Administer an SQL Server database infrastructure for cloud, on-premises and hybrid relational databases using the Microsoft PaaS relational database offerings.
Документација
Azure security baseline for SQL IaaS
The SQL IaaS security baseline provides procedural guidance and resources for implementing the security recommendations specified in the Microsoft cloud security benchmark.
Azure security baseline for Azure SQL
The Azure SQL security baseline provides procedural guidance and resources for implementing the security recommendations specified in the Microsoft cloud security benchmark.
Azure security baseline for Azure Database for PostgreSQL - Flexible Server
The Azure Database for PostgreSQL - Flexible Server security baseline provides procedural guidance and resources for implementing the security recommendations specified in the Microsoft cloud security benchmark.