0

我对来自公司网络的 DLP（数据泄露预防）有疑问。

我在公司网络上有一台虚拟机。VM 可以通过端口 1433 上的连接访问云中的 Azure SQL DB：aaa.database.windows.net。

但是，我不希望同一个 VM 连接到 bbb.database.windows.net。

Azure 对公共 IP 不提供任何保证（两台服务器可能显示为相同的 IP） - 我可以在公司的外围网络/防火墙上使用什么技术来允许访问 aaa 但不允许访问 bbb？

我担心的攻击是公司内部人员从 aaa 中查询数据并将其插入 bbb。例如，如果一台服务器是 ourcorporatedate.database.windows.net，另一台是 somerandom.database.windows.net，公司内部人员可以获取公司数据并将其写入某个随机数据库。

谢谢

4

3 回答 3

0

The current VPN feature in SQL Azure does not directly prevent this (but please look for future updates where this is planned for the service endpoints feature for SQL Azure). However, there are various mitigations you can use to detect or reduce the ability to do this:

  1. You can enable auditing on the aaa database. This can detect all logins and major state changes to the DB. (Detect)
  2. You can reduce the permissions for various kinds of users on the database to the bare minimum and use features which further reduce the size of the data that a customer can copy out of the database at all. This includes row-level security, data masking, always encrypted (which you would lock down to a specific app/user to be able to decrypt sensitive data in the client - other clients without the key just get cypertext), etc.
  3. Use firewall rules (as stated in the other answers) to restrict which clients can connect to the database at all - then you can restrict where they can connect with permissions.

Please note that SQL Azure's logical servers do not generally imply that every customer database in that server has the same IP. Currently there is a knob in service endpoints (docs page is currently down so I can't get you a link atm) to configure whether you go through the per-region gateway or not. If you don't (recommended), you would see the IP of the hosting node and this can change over time. The Service endpoints feature will give VPN users more control for network-level rules going forward, but some of these features have not yet landed in production. I encourage you to mitigate with other steps (above) until that is available to you.

于 2018-09-04T16:50:43.947 回答
0

如果数据库 aaa 和 bbb 具有相同的公共 IP 地址。我认为在本地防火墙中设置允许访问 aaa 但拒绝访问 bbb 并不是一个好方法。从同一个客户端，防火墙规则将具有相同的出站流量源 IP、协议、端口和目标 IP。

如果要选择性地授予对 Azure SQL 服务器中的一个数据库的访问权限，则只能为所需的数据库创建数据库级规则。此外，为数据库防火墙规则指定的 IP 地址范围超出服务器级防火墙规则中指定的 IP 地址范围，并确保客户端的 IP 地址在数据库级规则中指定的范围内。服务器级别规则允许访问 Azure SQL Server。这意味着客户端将有权访问存储在该 SQL Server 上的所有数据库。请参阅此文档。

于 2018-09-04T09:58:00.113 回答
0

您可以使用虚拟网络服务端点和规则。虚拟网络规则是一项防火墙安全功能，用于控制 Azure SQL 数据库或 SQL 数据仓库服务器是否接受从虚拟网络中特定子网发送的通信。了解如何使用它以及本文档的好处/限制。

于 2018-09-03T15:19:46.770 回答