How do you perform a VA on a cloud-based database service?

The best is selecting a tool that can perform scan on multiple environments and is cloud-friendly. Triggering this type of scan from your physical appliance can affect the performance of your firewall and impact your business operations. Tools such as Qualys and Tenable has agents that could be installed on those servers and are capable to run multiple type of scans, such as OS, Data Base, ICS, and application. If you can't install agents, you can consider deploying virtual appliances on each network zone (usually those are included on common VA licenses). Always avoid triggering scans that transposes different network segments

Cloud-based database vulnerability assessment include: >Catalog of Cloud-based database assets. >Dependencies are mapped for the better understanding. >Utilize Microsoft Defender for Azure SQL. >Common vulnerabilities and misconfigurations shall be scanned regularly. New ones shall also be constantly monitored. >The manual PT should be run and validate the results of automated scan. >Engage security experts for intense analysis and exploit test for high impact vulnerabilities. >Patch and update deployment on vulnerabilities. >Configuration changes to harden the database environment. >Detailed reports of findings when assessments are carried out. >Continuous openness for feedback to enforce change and improvement.

I've had good results using Nessus, it offers comprehensive coverage, gives accurate reports, regular updates, user-friendly interface, automation, strong community support, and regulatory compliance features. Its also has a reliability and proven track record make it highly recommended for vulnerability assessment and security management.

Start reviewing the assets that you will include in your scope. You may consider start my adding agentless devices first by including your servers and exposed services (anything sitting on your VLAN) and expand to workstations once you are able to deploy the agents (unless your company is not favorable with that approach). Make sure you create groups or tags based on the asset objective (for example: External Facing, Data Base, Critical Service, Etc.) as this will help you on next few steps. You may start with unauthenticated scans first (based on the scenario that an attacker did not compromise any credentials).

Utilize plugins designed for your specific cloud provider to leverage cloud-specific features and optimize scanning. Consider integrating Nessus with other cloud security tools, such as cloud security posture management (CSPM) solutions, for a more comprehensive approach.

You can start with a few assets first and scale as you progress. You may consider scanning assets that are exposed to the internet, followed by critical and sensitive servers. Exposure to threats includes access from internal users. If you have sensitive assets that are used by several internal users, even if those are not directly accessible through the internet, you may also want to consider scanning workstations too. Remember that it requires one single exposed and vulnerable asset for an attacker to gain persistency and move laterally within your network

As scans are performed, review results and compare progress of vulnerabilities that are remediated. Now, in order to keep your progress rolling you have two options: either you go and enable auto-patch, or work with asset owners on a very collaborative and #teamplayer approach otherwise you won't progress much.

This might be the most challenging activity, in especial on services that are directly related to an application. In some cases, remediation measures (such as patching) may generate an impact which would require a developer to modify the source code. In these cases, remediation work is always put aside. Use a risk-bases approach where you consider the exposure to threats, probability of attack based on how easy it is to exploit, and threat landscape. For example, you have an application that is critical to your business functionality, exposed to the internet, there are exploits available for that particular vulnerability, this should be priority number one. If devOps decides to not move ahead, C-level should sign a letter of risk acceptanc