Introduction to SQL 2005 Security Nick Ward SQL Server Specialist Nick Ward SQL Server Specialist

Database Security Prevent SQL injection attacks Encrypt data in the database Secure data over the network Secure database connection strings Handle data access exceptions

SQL Server 2005 Overview

SQL Server 2005 Security Initiatives Trustworthy Computing Initiative Security, privacy, reliability and business practices SD3+C Secure by design Secure by default Secure in deployment Communications

Reduction in Surface Area Secure by Default More optional installation options Default: Demonstration databases not installed Default: CLR disabled Default: HTTP endpoint disabled Minimized Attack surface: Features require explicit configuration Surface Area Configuration Tool

SQL Server 2005 Security Surface Area Configuration Tool Nick Ward SQL Server Technology Specialist Microsoft Nick Ward SQL Server Technology Specialist Microsoft

The Least Privilege Principal Granular permissions Grant/revoke/deny Hierarchical permissions Security execution context EXECUTE AS Functions, procedures, views and triggers DDL Triggers

Security: Execution Context User 3 Select Perms checked for User3 Execute Perms checked for User3 User2.Proc1 User1.T1 Execute Perms checked for User3 Select Perms checked for User3 No permission – User1.Proc1 fails User 3 User2.Proc1 User1.T1 ‘Execute AS ‘X’ ’ Execute Perms checked for User3 Select Perms checked for ‘X’. Not for user3 User2.Proc1User1.T1

Security: Execution Context Execute AS CALLER Default – same as SQL Server 2000 behavior Execute AS SELF Last person to create or alter the module Execute AS OWNER Execute as current owner of the module Execute AS “UserName” Execute AS “LoginName” Only for DDL triggers with server-wide execution

SQL Server 2005 Security EXECUTE AS ‘x’ Nick Ward SQL Server Technology Specialist Microsoft Nick Ward SQL Server Technology Specialist Microsoft

DDL Triggers Triggers fire when Data Definition Language (DDL) is executed Used to: Prevent DDL changes to your schema Cause something to occur when schema changes To record changes or events in the database schema Fire after the statement Can roll back the statement’s effect Can run managed code

SQL Server 2005 Security DDL Triggers Nick Ward SQL Server Technology Specialist Microsoft Nick Ward SQL Server Technology Specialist Microsoft

Secure in Deployment Microsoft Update services integration Automatic or manual Systems Management Server (SMS) integration Deployment security content: “Security Considerations for SQL Server” Windows server Network Windows service accounts Surface Area All SQL Server components

Authorization Enhancements Already discussed Granular permission control Module execution context Still to come… User schema separation Metadata security Encryption enhancements

New DDL for user and schemas CREATE/ALTER/DROP for USER, ROLE, and SCHEMA Dropping user does not require application rewrite Security Schema v object permission Default schema Schema Security: User-Schema Separation Table Function View Stored Procedure Bill Owned ByContained InOwned By Mary Server.Database.Owner.ObjectServer.Database.Schema.Object

SQL Server 2005 Security User-Schema Separation Nick Ward SQL Server Technology Specialist Microsoft Nick Ward SQL Server Technology Specialist Microsoft

Security: Certificates Encryption enhancements Encryption uses symmetric keys, asymmetric keys and certificates SQL Server 2005 can generate certificates for encryption RC4, RSA, Triple-DES and AES encryption supported Encryption can be used with any level of SQL Server 2005 securable Key Management

Security Hierarchy

SQL Server 2005 Security Data Encryption Nick Ward SQL Server Technology Specialist Microsoft Nick Ward SQL Server Technology Specialist Microsoft

Metadata No visibility without permission “VIEW DEFINITION” permission

SQL Injection Consider the following: var Shipcity; ShipCity = Request.form ("ShipCity"); var sql = "select * from OrdersTable where ShipCity = '" + ShipCity + "'"; Enter “Melbourne”: select * from OrdersTable where ShipCity = ‘Melbourne' Enter “Melbourne'; drop table OrdersTable—” select * from OrdersTable where ShipCity = ‘Melbourne';drop table OrdersTable--'

SQL Injection – What to do? Validate all input: length, type, ranges, valid values etc. Reject control characters: ; ‘ -- /* */ xp_ Never build T-SQL statements from user input – beware string concatenation Use stored procedures Visual Studio Team System 2005 Type-safe SQL parameters SqlDataAdapter myCommand = new SqlDataAdapter("AuthorLogin", conn); myCommand.SelectCommand.CommandType = CommandType.StoredProcedure; SqlParameter parm = SqlDbType.VarChar, 11); parm.Value = Login.Text;

© Microsoft Corporation. All rights reserved. This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.