Building a Home Grown Auditing Infrastructure for SQL Server K. Brian Kelley

About Me Infrastructure and security architect Database Administrator / Architect Former Incident Response team lead Certified Information Systems Auditor (CISA) SQL Server security columnist / blogger Editor for SQL Server benchmarks at Center for Internet Security

Contact Information K. Brian Kelley Email: kbriankelley@acm.org Twitter: @kbriankelley Infrastructure/Security Blog: http://truthsolutions.wordpress.com Personal Development Blog: http://gkdba.wordpress.com

Agenda What to Audit How to Audit Reporting Your Results Taking Auditing One Step Further

Agenda What to Audit How to Audit Reporting Your Results Taking Auditing One Step Further

Auditing Too Little Compliance / Regulatory requirements Organizational procedures & standards Comfort level to track change Real time notifications?

Auditing Too Much More means slower to process & get results More means more storage required (cost) More means more complex reporting How much is too much? Can you find the details you need?

Design Philosophy Where to filter? If you filter during the collection, you’ll never have the events/info If you filter during the reporting, you slow collection & reporting This sounds like a data warehouse problem – It is! (more on this later)

Agenda What to Audit How to Audit Reporting Your Results Taking Auditing One Step Further

Tools to Use – The Data sys.server_principals sys.database_principals sys.server_role_members sys.database_role_members sys.databases sys.server_permissions sys.database_permissions

Tools to Use – Retrieving Data DDL Triggers Extended Events Linked Servers SSIS Packages PowerShell scripts SQL Server Agent Task Scheduler

Tool Spotlight – DDL Triggers Including Logon Triggers in this Can fire on particular actions Work across all supported versions of SQL Server If there’s a problem with the trigger, action will be blocked (including login)

Tool Spotlight – Extended Events Each new version has expanded Know what events you have on based on version Useful for alerting Set up to be active at SQL Server service start up

Tool Spotlight - SSIS Does require Integration Services to be installed Does require package development Think about what we’re talking about: Extracting Data Comparing Data (Transforming) Loading Data May be easier than PowerShell for you

Tool Spotlight - PowerShell “Swiss Army Knife” Doesn’t require BIDS/SSDT or BIML/Mist Harder to extract and load data than SSIS Doesn’t have additional licensing cost

Tool Spotlight – SQL Server Agent You’re going to want to automate collection Outstanding scheduler / job engine Better than Task Scheduler Can run from audit collection database server

Simple Audit DB Design Instances Databases Logins You’re going to need more than this. This small sample shows some of the issues.

Sample Audit DB Schema

What Are We Missing? Historic tracking of changes Who did what and when Other relevant properties – database example Recovery model TDE Trustworthy?

Agenda What to Audit How to Audit Reporting Your Results Taking Auditing One Step Further

Focus on Reporting / Tracking Collecting and storing data is relatively easy Figure out how to compare data to show change Figure out how to filter to only produce what is needed Executives & Management Auditors Application Teams

Reporting & Tracking We’re basically talking a data warehouse: Stage environment to take in data Compare stage environment to previous “warehouse” Store changes for reporting Update “warehouse” for additional reporting

Agenda What to Audit How to Audit Reporting Your Results Taking Auditing One Step Further

Where to Go from Here? Exporting key data into other systems Monitoring the automation Third Party solutions Correcting detected issues automatically

Agenda What to Audit How to Audit Reporting Your Results Taking Auditing One Step Further

Contact Information K. Brian Kelley Email: kbriankelley@acm.org Twitter: @kbriankelley Infrastructure/Security Blog: http://truthsolutions.wordpress.com Personal Development Blog: http://gkdba.wordpress.com