0

This is more of a general question regarding network security which came up while I was brainstorming about SQL Databases on Azure.

When you configure a SQL Database you have the Option to make the resource accessible to all Services within Azure (see Screenshot SQL Database Config Options)

The documentation as well as several other sources say that this is a security risk. But I don't understand why. In my understanding everybody could "knock on the door" of the database coming from within Azure but I am still the only one with the credentials and therefor only I have access. So what is the potential risk? How bad is it really to allow all Azure Services to connect to my SQL Database? What is the worst case scenario?

Thank you.

1 Answer 1

0

At least for the Azure Postgresql Database, what this option does is to whitelist all Azure IPs for access to the database (and I would assume it's similar with the other databases on Azure).

This means now everyone who somehow has an Azure IP address can connect to your database: Your VMs, the VMs of another tenant, my VMs ... or my Azure Batch service.

So nothing keeps me from using e.g. Azure Batch to brute-force the DB credentials. If I throw enough money at this, I just might get lucky.

And then I have access to your complete database, which is a major data breach.

On the other hand, if you connect up your DB to your VMs with the recently added VNET options, nobody ever can even try to guess the credentials. You don't have to rely on being lucky, your data is safe.

So the worst case scenario is: The adversary has money, luck, or you have weak credentials, or all three, and then he can copy or modify all your data as he pleases.

1
  • Thanks for your answer. So brute force is the problem here. But still: This always sounds like a theoretical threat to me from my naive POV. If I choose a very complex password it would take some time to guess it and by monitoring the logs I would be alerted if I see spikes in traffic. Furthermore I would expect Azure to have some kind of monitoring to see if this kind of attack was launched from within their network. Not to mention that the attacker would need to stumble across the database IP first. Please correct me If I'm wrong ;)
    – Lucas
    Dec 9, 2020 at 15:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .