1. SECURING SQL AZURE DATABASE? Boris Hristov SQLSaturday #413 Copenhagen

2. Say thank you to our Sponsors :

3. All our volunteers and organisers do not get paid for organizing this event – If you see them, please: ◦ Give them a hug ◦ Shake their hand ◦ Say thank you ◦ Spread the word ◦ Get involved yourself Don’t forget to thank the sponsors for their support Thank the speakers for donating their time, energy and expenses Stick around for RAFFLE and the AFTER EVENT!

4. That’s not a marketing talk! DISCLAIMER:

5. So who’s Boris? @BorisHristov

6. time Session’s Timeline Dynamic Data Masking Row Level Security coolness

7. Dynamic Data Masking

8. “Have you ever…”

9. SELECT * FROM dbo.Customers custidFirstNameLastNamePhoneNumberEmailAddressCreditcardNumber 1 Boris Hristov +359889000000 brshristov@live.com 1111-1111-1111-1111 2 Ivan Donev +359889000000 idonev@live.com 2222-2222-2222-2222 3 Stanislav Zhelyaskov +359889000000 szhelyaskov@live.com 3333-3333-3333-3333 4 Ivan Minchev +359889000000 iminchev@live.com 4444-4444-4444-4444

10. custidFirstNameLastNamePhoneNumberEmailAddressCreditcardNumber 1 Boris Hristov +359889000000 bxx@xxxx.com xxxx-xxxx-xxxx-1111 2 Ivan Donev +359889000000 ixxx@xxxx.com xxxx-xxxx-xxxx-2222 3 Stanislav Zhelyaskov +359889000000 sxx@xxxx.com xxxx-xxxx-xxxx-3333 4 Ivan Minchev +359889000000 ixx@live.com xxxx-xxxx-xxxx-4444 SELECT * FROM dbo.Customers

11. Dynamic Data Masking

12. DEMO Dynamic Data Masking

13. Row Level Security

14. “Have you ever…”

15. orderidcustidorderdateshipdateshipcountry 1 1 4/20/2015 20:15:49 Bulgaria 2 1 4/20/2015 20:15:49 Germany 3 2 4/20/2015 20:15:49 Germany 4 2 4/20/2015 20:15:49 Bulgaria 5 3 4/20/2015 20:15:49 Bulgaria SELECT * FROM dbo.Orders

16. orderidcustidorderdateshipdateshipcountry 1 1 4/20/2015 20:15:49 Bulgaria 4 2 4/20/2015 20:15:49 Bulgaria 5 3 4/20/2015 20:15:49 Bulgaria SELECT * FROM dbo.Orders

17. How is that possible?

18. -- user defined function CREATE FUNCTION Security.fn_securitypredicate (@SalesRep AS sysname) RETURNS TABLE WITH SCHEMABINDING AS RETURN SELECT 1 AS fn_securitypredicate_result WHERE @SalesRep = USER_NAME() OR USER_NAME() = 'Manager'; -- security policy CREATE SECURITY POLICY SalesFilter ADD FILTER PREDICATE Security.fn_securitypredicate(SalesRep) ON dbo.Sales WITH (STATE = ON); No GUI, folks

19. DEMO Row Level Security

20. Cool, huh?

21. Not that fast…

22. time Session’s Timeline Dynamic Data Masking Row Level Security coolness

23. DEMO Row Level Security Issues

24. So is that a security feature then?

25. Or is that a programmability feature?

26. Take away RLS is great. Just be aware of the current issues! Easily mask sensitive data with Dynamic Data Masking A lot’s going on in SQL Azure DB…

27. Thank you! Contacts: brshristov@live.com www.borishristov.com @BorisHristov