Defense In Depth: Minimizing the Risk of SQL Injection Rob Kraft

Rob Kraft I confess. I’m a developer, not a DBA Independent Consultant Primarily a Software Architect and Project Manager SQL Server DBA since Version 4.2 Co-authored books on SQL Server 7 Taught classes on SQL Server From Lee’s Summit, MO Rob Kraft – SQL Saturday Kansas City in 2015

The Scenario Your first week on the job as junior DBA and the senior DBA gets fired The company is concerned he did something malicious They want you to find out if the company is exposed to SQL Injection What is vulnerable? Document it, fix it, prevent it from happening again. Rob Kraft – SQL Saturday Kansas City in 2015

Learn about SQL Injection https://www.owasp.org/index.php/SQL_injection https://en.wikipedia.org/wiki/SQL_injection http://www.sqlinjection.net https://www.youtube.com/watch?t=170&v=PB7hWlqTSqs – A good ten minute video – all demo, no speaker https://www.youtube.com/watch?v=Fp47G4MQFvA - Troy Hunt teaches a three year old about SQL Injection https://www.youtube.com/watch?t=128&v=JqzWPLq7bJY – A good seven minute video http://www.pluralsight.com/courses/ethical-hacking-sql-injection - A very good five hour training course Rob Kraft – SQL Saturday Kansas City in 2015

What is SQL Injection? SQL Injection lets hackers run their own carefully crafted SQL against the database. Rob Kraft – SQL Saturday Kansas City in 2015

What Can Hackers Do? The application expects this: But the hacker enters this: To SQL, they look like this: Rob Kraft – SQL Saturday Kansas City in 2015

Can They Do More Than Query Data? They can Update data They can Insert data They can Delete data They can query to learn the database structure They can query to learn the data in any table Rob Kraft – SQL Saturday Kansas City in 2015

Isn’t This Hard for Hackers? Unfortunately the answer is usually NO! Automated tools make it easy Rob Kraft – SQL Saturday Kansas City in 2015

Could it get any worse? They can alter table structures They can drop tables They can drop databases They can stop SQL Server Rob Kraft – SQL Saturday Kansas City in 2015

Surely it Can’t Get Any Worse! But it can! Connect to other computers on the network Download Malware from the Internet Run the Malware Create user accounts in the Domain Rob Kraft – SQL Saturday Kansas City in 2015

Let’s look at some examples DEMO TIME Rob Kraft – SQL Saturday Kansas City in 2015

What Can We Do About It? Secure the Services Turn off xp_cmdshell Limit the permissions on the database connection strings Write code to prevent SQL Injection Use IIS, Firewalls and other appliances to filter SQL Injection Monitor our systems Rob Kraft – SQL Saturday Kansas City in 2015

Secure the Services Limit the OS permissions of the account running SQL Server Services Rob Kraft – SQL Saturday Kansas City in 2015

Secure the Services Avoid Use a “Managed Service Account” Local System An AD Administrator account Network Service An non-MSA AD account for SQL Server Use a “Managed Service Account” Permissions tailored for SQL Server Password of account managed by AD Don’t share Account with other Services Rob Kraft – SQL Saturday Kansas City in 2015

Secure the Services Use SQL Server Configuration Manager to set Services Accounts Rob Kraft – SQL Saturday Kansas City in 2015

Disable Features in SQL Server Turn off xp_cmdshell At least set up a proxy account for it Disable ‘CLR Enabled’ Disable SSIS, SSRS, or any other applications that are installed but not used Rob Kraft – SQL Saturday Kansas City in 2015

Limit the Connection String Don’t use sa or an admin account for connection strings Don’t allow sa or admin conn strings in development or test either Limit what the connected users can do to what they need to do Use stored procs for all data modifications Rob Kraft – SQL Saturday Kansas City in 2015

Connection String Challenges Windows Authentication Want to allow Select for reports, but only desire edits to be done through the app SQL Server Authentication Protecting and encrypting connection strings The application must prevent users from doing what they are not allowed to Rob Kraft – SQL Saturday Kansas City in 2015

Write Code Carefully In .Net, use parameters to pass values to the database in the SQL Do not manually construct SQL in code Beware of dynamic SQL inside of stored procedures Validate Input to the app Is the length longer than expected? Is the value the correct Data Type? Rob Kraft – SQL Saturday Kansas City in 2015

C# .Net Code DEMO TIME Note: Not just web sites, REST APIS too Rob Kraft – SQL Saturday Kansas City in 2015

Block Hacks Before They Get To The App In IIS, use URLScan or Request Filtering Block/Allow specific IP address ranges access to Web Server Purchase an Intrusion Detection System (IDS) Purchase an Intrusion Prevention System (IPS) Rob Kraft – SQL Saturday Kansas City in 2015

Keep Software Up To Date Apply the latest SQL Server Service Packs Apply Security Fixes Apply OS Service Packs Upgrade to a new OS Version Upgrade to a new version of SQL Server Update Firmware Rob Kraft – SQL Saturday Kansas City in 2015

Review Configurations Remember that developer that you gave admin privileges to while you went on vacation You forgot to revoke those privileges And he gave the credentials to all the other devs Remember that consultant that came in and fixed the backup problem six months ago? How did he do it? He moved the backup to another server and made it working by running SQL Server as LocalSystem Rob Kraft – SQL Saturday Kansas City in 2015

Review Configurations Use SQL Server Policy Based Management To notify you when something changes Xp_cmdshell is enabled SQL Server Login Mode changes To block those things from happening Manually review configurations Monitor SQL Logs, IIS Logs SQL Server Best Practices Analyzer Rob Kraft – SQL Saturday Kansas City in 2015

Security Who? Active Directory Admins DBAs Developers Web Admins Set up account(s) used by services DBAs Configure SQL Server, limit permissions Encrypt data and backups Developers Sanitize SQL Web Admins Firewalls, IDS, and IPS Auditing Review Configurations and Policies Rob Kraft – SQL Saturday Kansas City in 2015

Encrypt Data At Rest Hash Passwords Encrypt sensitive data Requires application code Makes reporting difficult Encrypt the entire database Only prevents use of database other servers Encrypt the database backups Rob Kraft – SQL Saturday Kansas City in 2015

Encrypt Data In Transit Connection strings are encrypted Encrypt data between the app and the database? Encrypt data to/from the web server (SSL/TLS) Rob Kraft – SQL Saturday Kansas City in 2015

Resources Managed Service Accounts https://msdn.microsoft.com/en-us/library/ms143504.aspx Use SQL Server, not “Local Services” to manage service accounts: How to run SQL Server Configuration Manager https://msdn.microsoft.com/en-us/library/ms174212(v=sql.120).aspx SQL Server Security Checklist http://www.kraftsoftware.com/Publications/SQLServerSecurityChecklist.aspx SQL Server Authentication Options http://www.kraftsoftware.com/Publications/SQLServerAuthenticationOptions.aspx SQL Server 2016 – Always Encrypted https://channel9.msdn.com/Blogs/mwilmot/SQL-Server-2016-Encryption SQL Server Best Practices Analyzer http://www.microsoft.com/en-us/download/details.aspx?id=29302 SQL Server 2014 Backup Encryption http://blogs.msdn.com/b/mvpawardprogram/archive/2014/06/02/sql-server-2014-backup-encryption.aspx Rob Kraft – SQL Saturday Kansas City in 2015