1. Bill Wilder, CTO, Finomial Corporation
Azure SQL Database Not just a cloud version of SQL Server
SQL Saturday 674
23-Sep-2017
2:15-3:15 – Room Washington
Bill Wilder, CTO, Finomial Corporation
HELLO
my name is
Bill Wilder
Speaker: Bill Wilder
Duration: 60 minutes
Track: Cloud Application Development & Deployment
SQL Server originally shipped in A full 20 years later, in 2009, Microsoft announced SQL Azure, currently known as Azure SQL Database. What is it? Is Azure SQL Database a hosted version of SQL Server? A subset? A superset? Actually, none of those simple explanations really capture it. Come join cloud computing veteran Bill Wilder to dig into the topic and go over the key differences between them, understand your cloud options, with a focus on how you would put Azure SQL Database to work today, including deploying, managing, securing, scaling, and DR enabling. By the end of this session you should have a feel for how your SQL Server skills transfer to Azure SQL Database, which aspects of management & control Microsoft takes on, and how to use the toolbox of goodies for encryption, threat detection, DR, and global scale.
Unless otherwise noted, slide deck contents copyright (c) 2017, Bill

2. The Plan Azure? High Level Comparison to SQL Server
Most Important Slide about the differences
Drill into random interesting capabilities
Securing
Some demos (mixed in)
Won’t cover everything (not even remotely close)
@codingoutloud

3. Global Enterprise Cloud Platform
42 Azure regions, more than any cloud provider
42 Azure regions

4. Preview Version 1.7 ( )
* Preview Services

5. Preview Version 1.7 ( )
* Preview Services

6. Azure SQL is SQL Server Except…
Common
SQL Server
Azure SQL DB
“Just change the connection string…”
Innovation
Additional information on Differences:

7. What’s the Same Team Core Code Base Transact-SQL Most of the features
Yes, full support
Most of the features
Mature
@codingoutloud

8. What’s Missing (or is it?)
Category 1: Takes a Different Approach
Example: SQL Agent
Category 2: On the way
Network Support
But in the works…
Category 3: No plan (?)
@codingoutloud

9. CORE Intentional Differences
Most Important Slide
CORE Intentional Differences
Azure SQL Database
SQL Server
Control Plane matters
Storage ecosystem
Limited vertical scale
(4 TB max), can do horizontal
License (pay) by hour
Manageability over control
Installed/Physical Security
“The database”
Unlimited*
*Available hardware (Biggest VM?)
Box License (or VM)
Control over manageability
Standard_G5 = 32 cores GiB RAM + VMs support up to 16 TB of disk
@codingoutloud

10. DEMO Create a Database Azure Portal Plans Monitoring
AAD authentication
Firewall
DTU
Pools
DEMO

11. “Bring Your Own” ____ as a Service
BYO Users
BYO Applications
BYO Virtual Machines
SaaS
PaaS
IaaS

12. Manageability Server Management so easy - not available!
You control schema, indexes, users, etc. as usual
PaaS model
99.95% uptime SLA (one instance)
Geo-DR/FO/BC (Active/Passive)
Geo-Replication (Active/Active RO)
Backups, PiTR
@codingoutloud

13. Data Platform Ecosystem
“feel free to scale horizontally” – or heterogeneously (polyglot)
Data Lakes
Pooled SQL Instances
Data Warehouse
Blob Storage – files, unstructured
CosmosDB – NoSQL (graph, k/v, document)
First party: PostgreSQL, MySQL; Third party: Mongo (Oracle)
Tools: Hadoop Connector, Data Factory, Stretch, more
@codingoutloud

14. Azure Data & Storage Services
@codingoutloud

15. Performance
DMV Views DTU eDTU
@codingoutloud

16. https://azure. microsoft
SQL Azure DMV views
@codingoutloud

17. Data Throughput Unit http://dtucalculator.azurewebsites.net/
Show: DTU definition us/documentation/articles/sql-database- service-tiers/#understanding-dtus
@codingoutloud

18. Pricing
SQL Pools Geo Repl
@codingoutloud

19. Pricing in Tiers and Pools
Show: Pricing options
tiers/
@codingoutloud

20. the HARRENHAL fortress
Harrenhal
Threats Change Over Time
"The largest and greatest fortress ever built in Westeros..
Harren thought the walls of his massive castle could withstand any assault, but he did not realize that dragons could simply fly over them.”
Threat models CHANGE over time!
"The largest and greatest fortress ever built in Westeros..
Harren thought the walls of his massive castle could withstand any assault, but he did not realize that dragons could simply fly over them.”
Threats Change Over Time
The architecture of Harrenhal did not anticipate a world where they would need to defend airborne attack from fire-breathing dragons.
The architecture of most legacy enterprise infrastructure did not anticipate a world where there is no longer a security perimeter.
Architect is fundamental. Hard to change.
@codingoutloud

21. Mark Russinovich, Microsoft Azure CTO
“[Cloud security] is a shared responsibility between the customer and the cloud vendor.”
Mark Russinovich, Microsoft Azure CTO
Securing SQL Azure
Cloud Spaces; Dropbox; Top Azure Risks; Shadow IT; Cloud Outages
@codingoutloud

22. A Cautionary Tale: Code SpaceS
Can I restore a deleted Azure SQL Database?
Can I restore a deleted Azure SQL Database?
“If the database is deleted but the logical server has not been deleted, you can restore the deleted database to the point at which it was deleted.”
DDoS
Ransom demand
Security breach noticed
Fighting back
Malicious destruction of assets
Security & Business #fail
A Cautionary Tale: Code SpaceS
ELAPSED TIME: 12 HOURS
“Code Spaces has a full recovery plan that has been proven to work and is, in fact, practiced.”
Data plane (data access) vs. mgmt/control plane (Portal, APIs, PowerShell)
Azure Backup Vault
RBAC permissions
Open a support ticket
@codingoutloud

23. Top Azure Risks Leading to Tenant Breach
(Slide from Mark Russinovich’s talk at RSA 2015)
Top Azure Risks Leading to Tenant Breach
Risk
Mitigation
Internet Exposed RDP or SSH Endpoints
Network ACLs or Host-based Firewall; Strong passwords; VPN or SSH Tunnels
Virtual Machine Missing Security Patches
Keep Automatic Updates Enabled;
Web Application Vulnerability
Securing Azure Web Applications; Vulnerability scan/penetration test
Weak Admin/Co-Admin Credentials
Azure Multi-Factor Authentication; Subscription Management Certificate
Unrestricted SQL Endpoint
Azure SQL Firewall
Storage Key Disclosure
Manage Access to Storage Resources
Insufficient Security Monitoring
Azure Security and Log Management;
Cloud is not magic – but it can help A LOT
iCloud, Dropbox, encryption, MFA, …
ShellShock help

24. SSO for Microsoft Cloud Services
Use same AAD where makes sense across
Azure
Office 365
Visual Studio Team Services
Windows 10 (Intune)
Azure SQL Database (including 2FA)
@codingoutloud

25. Logging In with AAD Credentials
AAD / Office 365
2FA
Universal Authentication
DEMO

26. Manage Control Plane Access: RBAC
Classic Portal artifact: Co-Admin
RBAC only available on portal.azure.com
Activity Log in portal
Resources:
roles/
configure/
Manage MEMBERSHIP within AAD
Demo: Add a Reader to Azure SQL DB Server
@codingoutloud

27. 1. Portal 2. PowerShell 3. SDKs (C#)
Managing the Control Plane
@codingoutloud

28. Logical constructs Physical ($) Azure Account contains…
Azure Subscription contains…
Azure Resource Group contains…
SQL Database Server contains…
Anchored in single region
SQL Database
Physical construct
nesting
Logical constructs
Physical ($)
@codingoutloud

29. DEMO PowerShell & CLI Create Resources – show up in portal
Auth & 2FA outside portal
Auto-login with “portal command shell”
DEMO

30. 1. Always Encrypted 2. TDE, CLE 3. Data Masking 4. Auditing
Protecting Your SQL Database
@codingoutloud

31. Data Masking
Dynamic Data Masking: us/documentation/articles/sql-database-dynamic-data-masking-get-started/
Server-side
@codingoutloud

32. SQL DB Data Encryption Always Encrypted
Demo: Transparent Data Encryption
Server-side
Always Encrypted: us/updates/public-preview-always-encrypted-for-azure-sql-database/
Client-side
@codingoutloud

33. GEO-REPL PITR BackupS (long-term) RTO, RPO with Geo-Replicas
Disaster Recovery and Business Continuity
GEO-REPL PITR BackupS (long-term) RTO, RPO with Geo-Replicas
@codingoutloud

34. https://docs. microsoft
database/sql-database-business-continuity
@codingoutloud

35. PITR
@codingoutloud

36. AZURE SQL DB Long-Term BACKUps
Up to 10 Years
TDE okay
Geo-replicating DB okay
database/sql-database-long-term-retention
@codingoutloud

37. Networking & Perimeter Security
@codingoutloud

38. Firewalls & VNETS Database Level: sp_set_firewall_rule
VNET lockdown (defense in depth)
@codingoutloud

39. Compliance (wow!) Court Battle Avoiding Future Court Battle
Privacy & Compliance
Compliance (wow!) Court Battle Avoiding Future Court Battle
@codingoutloud

40. Compliance & Privacy Security vs. Compliance
Microsoft, Azure, Azure Government strong compliance story
us/TrustCenter/Compliance/
Dublin Microsoft (+10 amicus briefs) fighting a US Gov’t SCA extra-territorial subpoena for customer data in Dublin (since 2013)
Data Trustee Model “German data trustee, Deutsche Telekom, will control and oversee all access to customer data” for Microsoft
Encryption *between* data centers since Snowden
FBI vs. Apple (San Bernadino)
By Brad Smith:
@codingoutloud

41. @codingoutloud

42. Scope and Depth (and Partners)
Azure Security Center is a Service – “Azure Security Center, now in private preview, works with companies like Barracuda, Checkpoint, Cisco Systems Inc., CloudFlare, F5 Networks, Fortinet, Imperva, Incapsula, and Trend Micro Inc. to offer advanced, analytics-driven threat detection that helps you protect, detect and respond to security threats in real-time.”
Alert: “VM X and DB Y are not secure”
Alert: “Asset Z has been compromised”
Services are UPDATED ALL THE TIME w/o you having to do anything
@codingoutloud

43. Scope and Depth (and Partners)
Azure Security Center Service – “Azure Security Center, now in private preview, works with companies like Barracuda, Checkpoint, Cisco Systems Inc., CloudFlare, F5 Networks, Fortinet, Imperva, Incapsula, and Trend Micro Inc. to offer advanced, analytics-driven threat detection that helps you protect, detect and respond to security threats in real- time.”
Alert: “VM X and DB Y are not secure”
Alert: “Asset Z has been compromised”
Services are UPDATED ALL THE TIME w/o you having to do anything
@codingoutloud

44. Where’s My Azure?
Retail EA BizSpark, DreamSpark MSDN Account Free Trial
@codingoutloud

45. Subliminal  … 0.25

46. Find this slide deck here
Questions?
See you at Boston Azure
bostonazure.org
Find this slide deck here
Bill
blog.codingoutloud.com
linkedin.com/in/billwilder