1. # 66

2. Securing your SQL Server
Gabriel Villa
blog: com
# 66

3. About Gabriel MCPD, ASP.NET Developer
MCTS, SQL Server 2008 Database Development
SQL Server 7, 2000, 2005 and 2008
.Net Developer VB.Net and C#
# 66

4. Outline to Securing SQL Server
SQL Server Threats
Security Model
Authentication
Write Secure Code
Passwords
Physical Security
Security Patches
Network Security
Best Practices
# 66

5. “Yes, I am a criminal. My crime is that of curiosity
“Yes, I am a criminal. My crime is that of curiosity... My crime is that of outsmarting you, something that you will never forgive me for.”
- The Mentor Written January 8, 1986
# 66

6. SQL Server Threats Social Engineering SQL Injection
Manipulating people to gather data
Not using technical cracking tools or techniques
SQL Injection
Vulnerable to any RDBMS, not just MS SQL Server
Attacker post SQL commands via front end applications
Tools: ‘ , --, ;
# 66

7. SQL Injection
# 66

8. SQL Server Security Model
Principal
Windows Users
SQL Logins
Roles
Groups
Securable
Schemas
Windows Users
SQL Login
Database Users
DB Roles
Schemas
# 66

9. Authentication Windows Authentications Active Directory Integration
Supports Groups
Use Whenever Possible
# 66

10. Authentication Mixed Authentication
Legacy or Hard Coded Referenced Logins
Non Windows Clients
Connections over Internet
# 66

11. Authentication
# 66

12. Write Secure Code Valid SQL Check for Valid Input
Use Stored Procedures
Use Parameters
Customize Error Messages
Avoid errors returning securable names
Source Control
# 66

13. Passwords DO NOT hardcode passwords Strong Passwords
ASP.Net encrypt web.config
Encrypt password in your code
Strong Passwords
6 to 8 minimum characters
Leak speak or special characters (i.e s = 5 or 3 = E)
SQLPing checks for default passwords
Change passwords frequently
# 66

14. Physical Security Lock server room or rack when not in use
Restrict access to unauthorized individuals
If feasible, use security cameras
# 66

15. Security Patches Second Tuesday of every month
Test updates or hotfixes immediately on non-production servers
Schedule patches soon after tested
# 66

16. Network Security Avoid network shares on servers
Don’t surf the Web on the server
Only enable required protocols
Keep servers behind a firewall
# 66

17. Best Practices Encrypt your DB backups with third party tools
Monitor Failed attempts
Disable System SP
# 66

18. Please evaluate this sessions at http://speakerrate.com/extofer
Questions??
Please evaluate this sessions at
# 66

19. Thank you and Feedback
Thank you for attending “Secure your SQL Server” at SQL Saturday #66
Please make sure to fill out the session evaluation and place it in the box in the back of the room
# 66