IT Pro Day Auditing in SQL Server 2012 Charley Hanania Principal Consultant, QS2 AG – Quality Software Solutions

Now: Database Consultant at QS2 AG Formerly: Production Product Owner of MS SQL Server Platform at UBS Investment Bank IT Professional since 1992 SQL Server Certified since 1988 On SQL Server since 1995 Version 4 on OS/2 Community Microsoft MVP: SQL ServerSQL Server PASS Chapter Leader – Switzerland PASS Regional Mentor – Europe European PASS Conference Lead International Event Speaker MCT Regional Lead (Switzerland) Database Days Conference Switzerland Lead B.Sc (Computing), MCP, MCDBA, MCITP, MCTS, MCT, Microsoft MVP: SQL Server, MCT Regional Lead (Switzerland)

Agenda Chapter 2/4

Agenda

Overview of regulatory standards and compliance

The Compliance and Policy Ecosystem Why all this is so important…

1. Identify Issues and Risks 2. Develop Policies to mitigate them 3. Architect Procedures & Solutions (frameworks) to meet (comply with) Policies 4. Implement methods to report compliance levels 5. Implement methods & countermeasures for exceptions and comprised systems 6. Implement Process Improvement methodologies for framework maturity

Major frameworks used for establishing IT controls…

AICPA/CICA Trust Services, Principles, and Criteria Carnegie Mellon University Software Engineering Institute (CMU/SEI) OCTAVE CICA CoCo – Criteria of Control Framework CICA IT Control Guidelines CMMI – Capability Maturity Model Integration CobiT – Control Objectives for Information and related Technology COSO – Internal Control Integrated Framework GAISP – Generally Accepted Information Security Principles ISF Standard of Good Practice for Information Security ISO 17799:2005 ISO 9000 ITIL – the IT Infrastructure Library Malcolm Baldridge National Quality Program Organization for Economic Cooperation and Development (OECD) Principles of Corporate Governance OPMMM – Organizational Project Management Maturity Model Six Sigma OECD - Organization for Economic Cooperation and Development Guidelines on the Protection of Privacy and Transborder Flows of Personal Data NIST SP Recommended Security Controls for Federal Information Systems The FFIEC Information Technology Examination Handbook series The major players in the IT framework arena are: source: Note:  There is no single framework that is all encompassing and "complete"  Some frameworks focus on process maturity analysis and others focus more on standardised policies and checklists.  These frameworks are used to bring organisations closer to compliance with one or more regulatory standards

Relevant Technology Components within SQL Server

SQL Server Audit Framework

Feature Overview SQL Server Audit Framework

SQL Server Audit

Enhancements in SQL Server 2012 SQL Server Audit Framework

Demo SQL Server Audit Framework

Policy Based Mgt Framework

Feature Overview Policy Based Mgt Framework

A framework which exposes sql server's properties as facets, allows you to create conditions which report back the status of those facets, and then create policies around those conditions. You can just report on those or enforce them. You can also import and export them and apply them to multiple servers. Policy Based Management

Demo Policy Based Mgt Framework

Wrap-Up

Summary Wrap-Up

The Audit Feature is enhanced in SQL Server 2012 It is a tool in the “Security and Compliance” arsenal It needs to be architected into the overall operational strategy, alongside strategic tools, policies and processes.

REGISTER NOW AND GET 10% OFF DISCOUNT CODE: CHMTD12 (Valid until December 10, 2012) A Preconference Day with 5-7 parallel technical workshops, focussed on critical role-based skills for Data Professionals. Two days of conference seminars across 3 technical tracks: - Database Administration - Business Intelligence - Data Platform Application Development. Check out

Questions? Wrap-Up

Contact Info Wrap-Up

Website: Twitter: Blog: Linked-in: Database Days: