SECURING SQL AZURE DATABASE? Boris Hristov SQLSaturday #413 Copenhagen

Say thank you to our Sponsors :

All our volunteers and organisers do not get paid for organizing this event – If you see them, please: ◦ Give them a hug ◦ Shake their hand ◦ Say thank you ◦ Spread the word ◦ Get involved yourself Don’t forget to thank the sponsors for their support Thank the speakers for donating their time, energy and expenses Stick around for RAFFLE and the AFTER EVENT!

That’s not a marketing talk! DISCLAIMER:

So who’s

time Session’s Timeline Dynamic Data Masking Row Level Security coolness

Dynamic Data Masking

“Have you ever…”

SELECT * FROM dbo.Customers custidFirstNameLastNamePhoneNumber AddressCreditcardNumber 1 Boris Hristov Ivan Donev Stanislav Zhelyaskov Ivan Minchev

custidFirstNameLastNamePhoneNumber AddressCreditcardNumber 1 Boris Hristov xxxx-xxxx-xxxx Ivan Donev xxxx-xxxx-xxxx Stanislav Zhelyaskov xxxx-xxxx-xxxx Ivan Minchev xxxx-xxxx-xxxx-4444 SELECT * FROM dbo.Customers

Dynamic Data Masking

DEMO Dynamic Data Masking

Row Level Security

“Have you ever…”

orderidcustidorderdateshipdateshipcountry 1 1 4/20/ :15:49 Bulgaria 2 1 4/20/ :15:49 Germany 3 2 4/20/ :15:49 Germany 4 2 4/20/ :15:49 Bulgaria 5 3 4/20/ :15:49 Bulgaria SELECT * FROM dbo.Orders

orderidcustidorderdateshipdateshipcountry 1 1 4/20/ :15:49 Bulgaria 4 2 4/20/ :15:49 Bulgaria 5 3 4/20/ :15:49 Bulgaria SELECT * FROM dbo.Orders

How is that possible?

-- user defined function CREATE FUNCTION Security.fn_securitypredicate AS sysname) RETURNS TABLE WITH SCHEMABINDING AS RETURN SELECT 1 AS fn_securitypredicate_result = USER_NAME() OR USER_NAME() = 'Manager'; -- security policy CREATE SECURITY POLICY SalesFilter ADD FILTER PREDICATE Security.fn_securitypredicate(SalesRep) ON dbo.Sales WITH (STATE = ON); No GUI, folks

DEMO Row Level Security

Cool, huh?

Not that fast…

time Session’s Timeline Dynamic Data Masking Row Level Security coolness

DEMO Row Level Security Issues

So is that a security feature then?

Or is that a programmability feature?

Take away RLS is great. Just be aware of the current issues! Easily mask sensitive data with Dynamic Data Masking A lot’s going on in SQL Azure DB…

Thank you! Contacts: