We Need To Talk Security Joe Gavin

Thank you to our SQL Saturday #892 Sponsors

Physical Security Joe Gavin

Security Patches Joe Gavin

Backup Security Joe Gavin

Authentication Joe Gavin

Windows Authentication Active Directory AD, a valid login was entered, may I have a security token? Here’s your token. Checks for valid AD login You’re connected SQL Server PC Joe Gavin

SQL Server Authentication Checks if valid login and password entered You’re connected SQL Server PC Joe Gavin

SQL Server Logins SQL Server Login Joe Gavin

Login Roles Joe Gavin

Login Roles Role Description Bulkadmin Run the BULK INSERT statement Dbcreator Create and drop databases Diskadmin Manage disk files Processadmin Kill processes Public Every login is part of public Securityadmin Can make themselves sysadmin Serveradmin Change server-wide configuration options and shut down the server Setupadmin Add and remove linked servers  Sysadmin Only logins that are used to manage the SQL Server should be in this group Joe Gavin

Database Users User Databases Login SQL Server Joe Gavin Joe Gavin @joseph_a_gavin

Joe Gavin

Database Level Roles Role Description db_accessadmin Add or remove access to the database db_backupoperator Back up the database db_datareader Read any table db_datawriter Write to any table db_ddladmin Create or delete any object(s) db_denydatareader Cannot read any data db_denydatawriter Cannot add, modify, or delete any data db_owner Highly privileged db_securityadmin Modify users public Every user is in public Joe Gavin

Logins and Users Joe Gavin

SQL Agent Proxy Joe Gavin

Credentials Joe Gavin

Schemas Joe Gavin

Login Auditing Joe Gavin

Troubleshooting With Login Auditing Joe Gavin

Troubleshooting With Login Auditing Message in X:\Program Files\Microsoft SQL Server\MSSQLxx\MSSQL\Log\ERRORLOG Explanation Could not find a login matching the name provided An attempt was made to log in with either a Windows or SQL Authentication login that doesn’t exist on the SQL Server Password did not match that for the login provided SQL Authentication login exists but wrong password entered An attempt to login using SQL authentication failed. Server is configured for Windows authentication only User is trying to connect to the SQL Server with a SQL Authentication login and password Failed to open the explicitly specified database Logged in successfully but there is no user in specified database or database doesn’t exist or is offline [CLIENT: <xxx.xxx.xxx.xxxx>] Ping –a xxx.xxx.xxx.xxxx to resolve DNS name of calling machine will indicate DNS name of machine initiating login attempt Joe Gavin

Gaining access to a SQL Server as Sysadmin How easy is it to get access? Have some else with sysadmin access add you Let’s look at another way Joe Gavin

Gaining access to a SQL Server as Sysadmin Joe Gavin

Gaining access to a SQL Server as Sysadmin It’s easy to gain access sp_helpsrvrolemember – produces list of all logins in server level roles Joe Gavin

Gaining access to a SQL Server as Sysadmin Joe Gavin

SSL (Secure Socket Layer) Encryption Data encrypted between network endpoints, E.g., Web Server and SQL Server Uses certificate installed on machine hosting SQL Server Joe Gavin

TDE (Transparent Data Encryption) Data files are encrypted at page level Pages are encrypted when written to disk and decrypted when read from disk Enabling TDE ALTER DATABASE [DbName] SET ENCRYPTION ON; Backup is also encrypted Joe Gavin

Backup Encryption SQL Server 2014 Backup file is encrypted Joe Gavin

Column Level Encryption Encryption is applied on specific columns Data remains encrypted in memory Requires code changes to use EncryptByKey and DecryptByKey functions Joe Gavin

Always Encrypted SQL Server 2016 SP1 - all editions Column level ‘At Rest’ or ‘In Transit” encryption Encrypt / decrypt done at client with driver No code changes Data remains encrypted over the network, in memory, and on the drive Can obfuscate data even from sysadmin Joe Gavin

References Introduction to SQL Server Security Server Roles Database Roles Connect to SQL Server When Administrator is Locked Out Great trick to connect to a SQL Server as sysadmin without a restart Getting Sysadmin Access to SQL Server When Locked Out that shows how to wrap Jason Brimhall’s method in an .xml file Joe Gavin

Joe Gavin

Joe Gavin joe@joegavin.net www.linkedin.com/in/joegavin @joseph_a_gavin Joe Gavin