Microsoft.dbformariadb.servers.administrators.write

​

Event Information

• The Microsoft.DBforMariaDB.servers.administrators.write event in Azure for Azure Database Service refers to an event where a write operation is performed on the administrators of a MariaDB server in Azure.
• This event indicates that there has been a change or update made to the administrators’ settings or permissions for the MariaDB server.
• It is important to monitor this event to track any modifications made to the administrators’ access, ensuring proper security and compliance measures are in place.

​

Examples

1. Unauthorized access: If security is impacted with Microsoft.DBforMariaDB.servers.administrators.write in Azure for Azure Database Service, it could potentially allow unauthorized users to gain write access to the administrators’ role. This could lead to unauthorized modifications, data breaches, or even complete data loss if sensitive information is tampered with or deleted.
2. Privilege escalation: A security impact could occur if an attacker gains write access to the administrators’ role in Azure Database Service. This could allow them to escalate their privileges and gain unauthorized access to other resources or perform actions that they are not supposed to, potentially compromising the entire database environment.
3. Malicious code execution: If security is impacted with Microsoft.DBforMariaDB.servers.administrators.write in Azure for Azure Database Service, an attacker with write access to the administrators’ role could potentially execute malicious code within the database environment. This could lead to the execution of unauthorized commands, data manipulation, or even the installation of backdoors or malware, posing a significant security risk to the database and its associated data.

​

Remediation

​

Using Console

1. Enable auditing for Azure SQL Database:
   • Go to the Azure portal and navigate to the Azure SQL Database service.
   • Select the specific database you want to enable auditing for.
   • In the left-hand menu, under the Security section, click on “Auditing”.
   • Click on “Enable” to enable auditing for the database.
   • Configure the desired audit settings, such as storage account, retention period, and events to audit.
   • Click on “Save” to apply the changes.
2. Enable encryption at rest for Azure SQL Database:
   • Go to the Azure portal and navigate to the Azure SQL Database service.
   • Select the specific database you want to enable encryption for.
   • In the left-hand menu, under the Security section, click on “Transparent data encryption”.
   • Click on “Enable” to enable encryption at rest for the database.
   • Wait for the encryption process to complete, which may take some time depending on the database size.
   • Once the encryption is enabled, the status will change to “Enabled”.
3. Enable Azure Security Center recommendations:
   • Go to the Azure portal and navigate to the Azure Security Center.
   • In the left-hand menu, click on “Recommendations”.
   • Review the list of recommendations provided by Azure Security Center for your Azure resources.
   • Locate the recommendations related to Azure Database Service and click on them to view the details.
   • Follow the recommended steps provided by Azure Security Center to remediate the identified issues.
   • Once the remediation steps are completed, the recommendation status will change to “Remediated”.

​

Using CLI

1. Enable auditing for Azure SQL Database:
   • Use the az sql server update-auditing command to enable auditing for the Azure SQL Server.
   • Specify the necessary parameters such as --state Enabled and --storage-account-resource-id to configure auditing settings.
   • Example command: az sql server update-auditing --resource-group <resource-group-name> --name <sql-server-name> --state Enabled --storage-account-resource-id <storage-account-resource-id>
2. Enable diagnostic settings for Azure SQL Database:
   • Use the az monitor diagnostic-settings create command to enable diagnostic settings for the Azure SQL Database.
   • Specify the required parameters such as --name, --resource-id, and --workspace.
   • Example command: az monitor diagnostic-settings create --name <diagnostic-settings-name> --resource <sql-database-resource-id> --workspace <log-analytics-workspace-id>
3. Enable threat detection for Azure SQL Database:
   • Use the az sql db threat-policy update command to enable threat detection for the Azure SQL Database.
   • Specify the necessary parameters such as --name, --resource-group, and --storage-account.
   • Example command: az sql db threat-policy update --name <database-name> --resource-group <resource-group-name> --storage-account <storage-account-name> --state Enabled

​

Using Python

1. Monitor and alert on database service events:
   • Use the Azure Monitor service to set up alerts for specific events or metrics related to the Azure Database Service.
   • Create a Log Analytics workspace and configure it to collect and analyze logs from the database service.
   • Use the Azure Monitor Python SDK to programmatically create and manage alerts and log analytics queries.
2. Implement automated backups and retention policies:
   • Use the Azure Backup service to schedule automated backups for your Azure Database Service.
   • Configure the retention policies to retain backups for a specific duration.
   • Utilize the Azure Python SDK to programmatically create and manage backup policies and retention settings.
3. Implement security best practices:
   • Enable firewall rules to restrict access to your Azure Database Service.
   • Implement Azure Active Directory authentication for better security.
   • Utilize the Azure Key Vault service to securely store and manage database connection strings and credentials.
   • Use the Azure Python SDK to automate the configuration of firewall rules, enable Azure AD authentication, and interact with Azure Key Vault.