Microsoft Advertising 16:9 Template Light Use the slides below to start the design of your presentation. Additional slides layouts (title slides, tile slides, etc.) are available to you in the slide master.

Grid Use this grid to align your copy, imagery and charts/graphs.

Jasmin Azemović, Ph.D, MVP, MCT Fakultet informacijskih tehnologija, Mostar SQL Server Threats and Countermeasuers

Inspirirani ljudima. Ugasite mobitele. Hvala.

Agenda SQL Server Security Model Threat Modeling Security during and after installation Threats from authorized users Physically data stealing Data transfer sniffing SQL code injection Auditing

SQL Server Security Model SQL Server security model is very granular. You can set it up from: Servers-side Database-side Table/Object/Column-level LoginAuthenticationAuthorization Server side Backup files, configuration...Database sideObjects and dataTables, views, columns

Threat modeling is a formalized process of describing security aspects of a system. Minimize the potential cost Minimize need to rework code Locate and eliminate security risks Threat Modeling System diagram Identify threats Mitigate Validate solution

Example of threat model

Security during and after installation Security Steps During Installation Service Accounts Types of Authentication Administrator Account Security Steps After Installation Using SQL Server Configuration Manager Working with Windows Firewall SQL Server Resources Consumers Types of SQL Server Consumers Password Issues Password Policy

Examples:

Threats from authorized users „Inner“ threats are more dangerous : False sense of security Do we trust our users ? User roll is not enough to ensure security and privacy elements

Examples: Read permission Database, Schema, Table,...  BI/Reporting  Power Users  Information consumers So where is problem here? User can read “private” tables !

Countermeasures Explicit deny on specific object(s) Table, column... DENY will override GRANT Don‘t use direct access... use views, sp‘s, schema‘s Don't allow ad-hoc queries in production Use: Policy Management Resource Governor

Physically Data Stealing This threat is ignored...why? Weak Points Inside/Outside of SQL Server envinroment

Two major areas where a database can be compromised Weak Points Inside SQL Server envinroment Inside threats Data files AttachDetach Backup files Copying

The area where risk is outside of SQL Server jurisdiction Weak Points Outside of SQL Server Outside threats File system Operating system Network

What we can do on SQL Server? Client SQL Server Instance Client file system Backup files Communication SQL Server data files

What we can do on SQL Server? Client SQL Server Instance Client file system Communication Backup files SQL Server data files

What we can do on SQL Server? Client SQL Server Instance Client file system SQL Server data files Backup files Communication

What we can do on SQL Server? Client SQL Server Instance Client file system Backup files Communication SQL Server data files

What we can do on SQL Server? Client SQL Server Instance Client file system Backup files Communication SQL Server data files

What we can do on SQL Server? Client SQL Server Instance Client file system Backup files Communication SQL Server data files

What we can do on SQL Server? Client SQL Server Instance Client file system Backup files Communication SQL Server data files

Countermeasures SQL Server countermeasures Table/column encryption Transparent Database Encryption-TDE Encrypted backups Using volume encryption BitLocker TrueCrypt Passwords on back-up archives (ZIP, RAR) Limiting the number of administrative staff Efficient audit policy Don‘t carry DB backups on your laptops, usb, sd cards...

Data Transfer Sniffing SQL Server uses classic client/server communication Anything can happen in the network environment: Communication monitoring Data sniffing Data tampering

Why a Firewall is Not Enough? Firewall is a necessary but not a sufficient security condition. Firewall will NOT help in these situations : Poorly written application Bad data access layer Input validation etc.

Countermeasures Server can use SSL to encrypt data transfer Encryption level is 40-bit or 128-bit SSL encryption does slow performance

SQL Code Injection SQL injection attack exploits vulnerabilities in input validation Occur when your application uses input to construct dynamic SQL statements to access the database Using the SQL injection attack, the attacker can execute custom commands in the database

Example: SqlDataAdapter myCommand = new SqlDataAdapter( "SELECT * FROM Users WHERE UserName ='" + txtuid.Text + "'", conn); ; DROP TABLE Customers -- SELECT * FROM Users WHERE UserName=''; DROP TABLE Customers --' SqlDataAdapter myCommand = new SqlDataAdapter( "SELECT * FROM Users WHERE UserName ='" + txtuid.Text + "'", conn); ; DROP TABLE Customers -- SELECT * FROM Users WHERE UserName=''; DROP TABLE Customers --'

Countermeasures Perform thorough input validation. Your application should validate input prior to sending a request to the database. Use parameterized stored procedures or SQL parameters Use least privileged accounts to connect to the database.

Auditing Digital Evidence Methods for Collecting Data Securing Digital Evidence

Digital Evidence SQL Server Profler Triggers (DDL/DML) SQL Server Audit Other tools Digital evidence When?Who?What?

Finale facts Databases contain critical information for business; Database servers are kept private, sensitive and secure information; This is the last line of the defense

Inspirirani ljudima. Pitanja i odgovori.