Security Analysis Tool (SAT): Audit Databricks Security

0:04Hey folks, today I have the pleasure to host Shrill. He's shared technical services at Databricks. Hi Shil. >> Hey Yousef, thanks for having me. >> How are you doing? >> Yep, I'm doing good. How are you? >> All good and I have a question for you. I I know we're getting straight to the point. How can I easily monitor the security health of all my workspaces over time? That's a great question and I

0:28have one answer for you and that is SAT or security analysis tool. Um, and today we're going to sort of walk through what SAT is at a high level, dive into how you can deploy it, what some of the individual components of SAT are and how you can get the most value out of monitoring the security posture of both your Databricks account as well as all of your Databricks workspaces on all three clouds. >> This is amazing. So, we actually have a tool that can help us do the do

0:51>> Yeah, exactly. It's a tool built by the field and field security teams. Um, and it's used by a bunch of customers today to sort of get a holistic view of the security health of your entire Databricks environments. Everything from network security to data governance to identity and access management. Um, and we're constantly evolving the tool as more and more features come out to help you get the most value out of SAT. >> And what are the main components of uh

1:14the SAT? >> Yes, historically when we first deployed SAT and developed it, it was mostly focused on the security posture of your environments. Is my environment following best practices that Databricks has put out such as um uh deploying in a private link enabled workspace having proper um network isolation and stuff like that. But we've noticed that as the platform has evolved and we have more and more features

1:37coming out we sort of determined that we need to adopt SAT to fit the modern age of Databricks. So now we have more components on SAT such as secret scanning. If you scan all of your notebooks on the Databricks environment, SAT is going to tell you where you have hard-coded uh personal access tokens and secrets or any uh tokens or secrets that we have um available. These are going to be flagged by SAT across your entire workspaces. Um

2:00and most recently we also deployed a permissions analysis tool. So this is basically an easy way for um users on Databricks to get a holistic view of their entire security landscape. everything from resource and permissions analysis for Unity catalog to who has access to my environments, who has access to spin-up compute. Um, so it's an easy way. It's deployed as a Databricks app. So if you have an admin or

2:24any security individual needs to perform an audit on your Databricks landscape, they can run the permissions analysis tool to get a whole holistic view of your permissions. >> And I guess you have some slides maybe to walk us through. >> Yeah, definitely. Yep. So I'm going to share a couple slides just walking through SAT at a high level and then we can sort of walk through um a demo showcasing um SAT. >> That's amazing.

2:47>> So diving into security analysis tool um it's an easy way to monitor the security health of your workspaces. Um at Databricks security we have three three pillars. So we have define deploy and monitor. When it comes to define we have our security best practices documentations and white papers which are publicly available on the Databricks trust and security website. So it's an easy way to sort of understand what are the different controls and

3:09practices that you should have in place when it comes to administering Databricks at scale. Uh the next component is actually deployment. So how can cloud infrastructure admins and security teams sort of deploy Databricks according to best practices right from the get- go. And for that we have our security reference architecture Terraform templates um which are publicly available for all three clouds. Um and sort of the most secure and scalable way

3:32to deploy Databricks today. And then finally for monitoring this is where security analysis tool comes into play. Sort of how can you get a holistic view of your Databricks environment. Um as more and more features are coming out as more practitioners are onboarded onto your Databricks how can you make sure that you are always following the best practices for Databricks and proactively stay on top of any threats that could possibly arise. So those are the three pillars and we're going to focus mostly on security analysis tool.

3:55The number one question that a lot of customers and security teams ask is how do I know if I'm following data brick security best practices? Um and in the world of AI and new agentic workflows, this ask is always um getting more and more uh popular. And our answer is deploy and monitor and use the security analysis tool because it makes monitoring the security health of your Databricks account and workspaces a lot

4:18easier. So the security analysis tool um historically it was only composed of the component here on the left uh security best practices. So when SAT was first developed and published um it was really focused on monitoring your workspace against the different security checks that we had in place. Um but over time as our platform has become more and more evolved as new features are arising um

4:40we determined that we needed to keep up with all those different features. So we recently uh developed the secret scanning uh functionality which basically helps to scan your workspaces for any hard-coded secrets um and tokens in both of your Databricks notebooks as well as cluster configurations. Um, and the most recent update that we've made to SAT includes that resource and uh, permissions analysis tool. So, it's sort

5:02of a centralized way for all of your admins and security teams to get a holistic view of the different um, access and uh, resource permissions that every user and group has. Um, everything from Unity catalog to clusters to warehouses. All of that is covered by uh, permissions analysis tool. >> Yeah. And it's going to be very helpful because sometimes many people can forget and hard code an access token or pat

5:26access token or or maybe I don't know open API open AI or whatever >> exact access and then put it to a public repo um then the security get compromised. >> Exactly. Yeah. And the secret scanning is not just for Databricks tokens. It it uses truffle hogs uh security detection engine underneath the hood. So any API key or token that it supports

5:48would be covered by secret scanning. So like you mentioned Enthropic, GitHub keys, um AWS uh tokens, anything like that would be would be scanned. Yeah, definitely. So this is just showing once you deploy and get SAT configured, you're going to get basically a AIBI dashboard um that walks through at a high level what the different findings were um across all of your different workspaces. And I'll I'll showcase this a little bit more um hands-on. And then

6:10if you look at the detections, it's going to sort of show you like which detection was deviated, which one is following best practice. And then if one of them was flagged as being a deviation, it's going to show you the links to the documentations, your admins, your infrastructure teams can easily go in and fix those um according to best practices that Databricks has. And this is just showcasing the secrets uh scanning dashboard. So it's another AIBI dashboard baked into SAT that sort

6:33of shows you all the different secrets that were detected, which workspace it's coming from and it actually shows you the actual path to the notebook itself or the cluster as well. So you can easily go and remediate that um before it ends up in a public repository. And this is the newest feature, the permissions analysis tool. So permissions analysis is deployed as a Databricks app. And basically uh once you have the app up and running then your users can just go in and sort of

6:56play around with the different um features that we have understand which users and groups have access to what. Um and we'll also showcase this in the demo. And this is just a call to action. So if you want to learn more about SAT we have a link to our public documentation. Um SAT is available as a public GitHub repository. Um and if you have any feedback you can definitely send it to our email um satdaicks.com or directly raise a issue on GitHub.

7:21So now I'm going to showcase um the actual SAT tool itself. So now if I navigate over to my Databricks workspace. Um this is my Databricks environment that I've set SAT up on. Um this is a Azure environment. Um but SAT is available for both AWS Azure and GCP. So any cloud that you have SAT will be supported. Um and when you install SAT

7:43there's two options that you have. Um the first one is just a classic install.sh SH script that you can basically clone from a repository and it uses Databricks asset bundles underneath the hood to deploy SAT. Um if you if you're more comfortable using infrastructure as code, we also have a Terraform way to deploy SAT. So um on that repository, you can basically run the Terraform script that will basically

8:05install SAT on whatever environment that you want. Um so those are the two options that we have available. Very easy to install SAT. And once you have it installed, you'll see that underneath your jobs and pipelines will have these four workflows that get created. Um the initializer is basically how SAT gets set up. Um it it installs the um it it installs a dashboard. It configures the

8:27API calls and everything like that. The driver notebook is what actually runs the API scans. So it actually populates the dashboard with all the security findings. Um and then secret scanning is how the secrets get scanned across your notebooks and clusters. And then permissions analysis is for the uh permissions and resource analysis app. Any questions on on these uh different jobs? >> No, I understand it will deploy for jobs

8:49and I guess then the results are displayed in the uh in the AIBI. >> Exactly. So now if I go back to my dashboard tab over here, um let's take a look at this AIBI dashboard. So once SAT is populated, you're going to get this neat AIBI dashboard. Um sort of broken down into three main components. Uh the first one is going to be like the highle executive summary. So this is really

9:12what like your seuite leadership your CESOS are going to care about. It's sort of like at a high level across all my different environments what are the different findings just show me how many deviations I have. What can I do to quickly remediate them? So this is the executive summary page. Um right now SAT is only running on one workspace. Um and you can see here uh within this one workspace I have two high deviations um

9:3411 medium deviations and seven low ones. So sort of you can get a a gauge as to like which ones should be P zeros that we have to fix, which ones can we sort of put on the backlog and come back to uh fixing in the future. And if you go down, it's kind of going to it's going to break it down by like the different categories that we have. So the different categories could be network security. So are you following best practices when it comes to networking um such as using private link um IP access

9:58list? Then we also have AM. So are you using SSO? Are you using SKIM? um are you using rback, aback, stuff like that. And then data protection. So the actual data governance. So how are you storing your secrets? Are you do you have data expiltration processes? Um sort of everything related to data governance. And then specifically for governance, we also have checks to see are you using

10:20cluster policies? Do you have audit logging configured? Um have you disabled legacy access modes like DBFS and Hive? Um and then sort of the last one is justformational such as like how many admins do you have? what are the different user privileges? Um how are your git repos configured? So it's sort of a holistic coverage of everything that Databricks uh supports today. >> And of course we can also use genie to ask those questions in case we are

10:43>> exactly >> lazy to walk through the dashboard. >> Exactly. Yep. Genie is supported fully. So you can ask ask questions away. Um the next page is like that workspace drill down. So this is where you can sort of dive into each of the individual workspaces that were scanned. Get a more drill down view of what exactly is failing. And then like I mentioned before, it's going to show you like the actual links to the documentation so your admins can quickly go and remediate

11:06some of those some of those findings. Um, so these are the different checks that we have supported. Um, we're constantly working on ways to find more checks, remove any checks that might be outdated with the new features that are coming on on the platform. So this is sort of a baseline way for your for your security teams to understand the posture of your environment. So that's the workspace drillown page. Um and then sort of the last page is the secret

11:28scanning functionality. Um so like I mentioned, secret scanning scans both of your Databricks notebooks as well as cluster configurations. Um so in this one scan that I ran, um I found that one of my secrets was exposed in in a notebook. So SAT was able to find that. Um and if we select that workspace, it was found in this workspace over here. and it's going to show you um where

11:50exactly that path to that notebook is so that you can quickly go and either remove that secret or disable it so that it doesn't end up in a public uh repository. >> So once this finishes loading it it's going to show you the path and over here we see that uh within this notebook over here um under this object path there is a uh a secret over here. So most likely this is either a personal access token

12:13um created by a user or it's a service principles client secret um that ended up so you can quickly go and remediate this um at the path over here. So that is the core SAT dashboard. Um but the newest component is our permissions analysis tool. So permissions yeah permissions analysis tool is deployed as a Databricks app. So if you see over here this is basically the UI for that

12:35Databricks app. um at a high level it's going to show you um all the different uh principal analysis resource analysis who has access to what within your Databricks environment um and once you run the scan for it it's going to populate this app with data so if I navigate over to principal analysis over here um we can see uh we can browse by our different users groups and service

12:57principles so if I just click on all the different users that have access to my workspace um I can understand and see what they have access to so right now these are the only user users that are added to my workspace. If I click on my name, for example, it's going to show me all the different um uh resources that I have access to. So, if I wanted to perform an audit or understand why a specific user has access to a catalog,

13:19for example, this is sort of an easy way to sort of gauge that and and get a holistic view of it. So, right now, I'm a workspace admin, so I basically have full permissions to see anything on Databricks. So, it's going to show me everything that I have access to. Um, and it's going to show me that I have all privileges on this catalog. Um so it's an easy way to sort of understand all the um permissions that you have via it's a direct relationship or if it's

13:42like a nested permission uh via like a group uh that you've inherited. Um so that's a principal analysis. You can also do a straight view of the resources. So all the different resources that are supported on Databricks. Um everything from unity catalog um to clusters to um endpoints as well as secrets are supported. So you can quickly view and understand all those um all those resources.

14:05Um we also have functionality for escalation paths. So what is basically the amount of hops that it takes for a regular user to be escalated to the highest privilege uh persona on Databricks which would be like an account or workspace admin. So you can sort of understand what your possible threat vectors are. If you just have like a contractor or um a temporary person

14:27that's accessing your database workspace, you want to make sure that they can't um escalate to being a workspace or account admin um unnecessarily. So this is sort of an easy way to sort of understand what is that path to escalation. Um we also support like impersonation. So um dis you can basically discover how one entity can impersonate another one through various paths. So you can sort of play around with that and understand

14:49if someone should uh not have access to something that they shouldn't be uh able to view. Um and then we also have a bunch of built-in security reports. So everything from like who are the highest privileges, highest privileged users? So we can take a look here and we say that we have six workspace admins. Um do we really need all six of those to be workspace admins? So you can sort of understand that. Um who are the different catalog owners? Um and then

15:12you can sort of uh go and audit those individuals or groups. um isolated principles. So these are like principles with minimum uh connections. Um so these could be like individuals who are no longer at your company, no longer added to the workspace, but they still have ownership of certain um assets. So you can sort of understand those um resources. And then for orphaned resources, these

15:35are resources that have no explicit permissions grants. Um so you may need specific access controls um directly added to those resources. We also have overprivileged. So these are principles with excessive permissions across the environment. So sort of an uh a way to understand who has access to what um and if they actually need access to that um environment. And then the final component is secret scopes. These could

15:57be very um dangerous if you don't audit them correctly. Who has access to your secret scopes? Should they actually have read or write access on your secrets? So this is sort of an easy way to understand it. Right now I only have one secret scope that's configured on my environment and the only one that has access is my service principle. Um yeah, this is sort of a baseline way to understand at a high level who has access to your entire Databricks environment. >> Yeah, it's very easy. I mean you can

16:19deploy it quickly. >> The plat the UI is very intuitive. I don't think no one can get lost. The titles are very explicit. you know like how to understand like who like which person has permissions which permissions how to like I like remove people that are for left the company because for some for one or many reasons people are

16:42this company is not using SSO so they still have access it's the right the right like the right time to get rid of this person and make sure because sometimes and this is something very important if a resource is assigned to a person who left the company in case that account is deactivated this resource may no longer work. So that's why again it's

17:06just a best practice make sure to assign service principles to uh to assets not users. Make sure that even if this person lives your asset or your job or whatever feature is will still be working. >> Exactly. Yeah. Yeah. And yeah, I think it's it's a sort of an easy way to understand at a high level like how your

17:28environment is configured. Like most of these things admins can write a bunch of complex SQL queries, go through the UC cataloges and find these things, but there's not like a easy um one solution way to sort of understand your full permissions landscape. And that's sort of what um permissions analysis aims to solve um through a Databricks app. Make it a lot easier for your for your security teams to operate. >> That's perfect. Thank you so much, Sil.

17:51Yeah, >> thank you for your amazing presentation and the tool is just insane. All the links in the description of this video. Make sure to deploy it and if you have any questions, please reach out to Shr or the team. We're going to leave the contact in near the uh near the links. Thank you. >> Thanks so much, Yousef. Yep. Really appreciate it. Thanks for having me, Ysef. >> No problem.

18:16Delta Lake tables a glow unity catalog governs league base oy text to SQL MOSA AND CHA PROLONGS you quitting co-host light the fire dream scale higher and higher next drop