1. We Need To Talk Security
Joe Gavin

2. Thank you to our SQL Saturday #892 Sponsors

3. Physical Security
Joe Gavin

4. Security Patches
Joe Gavin

5. Backup Security
Joe Gavin

6. Authentication
Joe Gavin

7. Windows Authentication
Active Directory
AD, a valid login was entered, may I have a security token?
Here’s your token.
Checks for valid AD login
You’re connected
SQL Server PC
Joe Gavin

8. SQL Server Authentication
Checks if valid login and password entered
You’re connected
SQL Server PC
Joe Gavin

9. SQL Server Logins
SQL Server
Login
Joe Gavin

10. Login Roles
Joe Gavin

11. Login Roles Role Description Bulkadmin Run the BULK INSERT statement
Dbcreator
Create and drop databases
Diskadmin
Manage disk files
Processadmin
Kill processes
Public
Every login is part of public
Securityadmin
Can make themselves sysadmin
Serveradmin
Change server-wide configuration options and shut down the server
Setupadmin
Add and remove linked servers 
Sysadmin
Only logins that are used to manage the SQL Server should be in this group
Joe Gavin

12. Database Users User Databases Login SQL Server Joe Gavin Joe Gavin
@joseph_a_gavin

13. Joe Gavin

14. Database Level Roles Role Description db_accessadmin
Add or remove access to the database
db_backupoperator
Back up the database
db_datareader
Read any table
db_datawriter
Write to any table
db_ddladmin
Create or delete any object(s)
db_denydatareader
Cannot read any data
db_denydatawriter
Cannot add, modify, or delete any data
db_owner
Highly privileged
db_securityadmin
Modify users
public
Every user is in public
Joe Gavin

15. Logins and Users
Joe Gavin

16. SQL Agent Proxy
Joe Gavin

17. Credentials
Joe Gavin

18. Schemas
Joe Gavin

19. Login Auditing
Joe Gavin

20. Troubleshooting With Login Auditing
Joe Gavin

21. Troubleshooting With Login Auditing
Message in X:\Program Files\Microsoft SQL Server\MSSQLxx\MSSQL\Log\ERRORLOG
Explanation
Could not find a login matching the name provided
An attempt was made to log in with either a Windows or SQL Authentication login that doesn’t exist on the SQL Server
Password did not match that for the login provided
SQL Authentication login exists but wrong password entered
An attempt to login using SQL authentication failed. Server is configured for Windows authentication only
User is trying to connect to the SQL Server with a SQL Authentication login and password
Failed to open the explicitly specified database
Logged in successfully but there is no user in specified database or database doesn’t exist or is offline
[CLIENT: <xxx.xxx.xxx.xxxx>]
Ping –a xxx.xxx.xxx.xxxx to resolve DNS name of calling machine will indicate DNS name of machine initiating login attempt
Joe Gavin

22. Gaining access to a SQL Server as Sysadmin
How easy is it to get access?
Have some else with sysadmin access add you
Let’s look at another way
Joe Gavin

23. Gaining access to a SQL Server as Sysadmin
Joe Gavin

24. Gaining access to a SQL Server as Sysadmin
It’s easy to gain access
sp_helpsrvrolemember – produces list of all logins in server level roles
Joe Gavin

25. Gaining access to a SQL Server as Sysadmin
Joe Gavin

26. SSL (Secure Socket Layer) Encryption
Data encrypted between network endpoints, E.g., Web Server and SQL Server
Uses certificate installed on machine hosting SQL Server
Joe Gavin

27. TDE (Transparent Data Encryption)
Data files are encrypted at page level
Pages are encrypted when written to disk and decrypted when read from disk
Enabling TDE
ALTER DATABASE [DbName]
SET ENCRYPTION ON;
Backup is also encrypted
Joe Gavin

28. Backup Encryption
SQL Server 2014
Backup file is encrypted
Joe Gavin

29. Column Level Encryption
Encryption is applied on specific columns
Data remains encrypted in memory
Requires code changes to use EncryptByKey and DecryptByKey functions
Joe Gavin

30. Always Encrypted SQL Server 2016 SP1 - all editions Column level
‘At Rest’ or ‘In Transit” encryption
Encrypt / decrypt done at client with driver
No code changes
Data remains encrypted over the network, in memory, and on the drive
Can obfuscate data even from sysadmin
Joe Gavin

31. References Introduction to SQL Server Security Server Roles
Database Roles
Connect to SQL Server When Administrator is Locked Out
Great trick to connect to a SQL Server as sysadmin without a restart
Getting Sysadmin Access to SQL Server When Locked Out that shows how to wrap Jason Brimhall’s method in an .xml file
Joe Gavin

32. Joe Gavin

33. Joe Gavin joe@joegavin.net www.linkedin.com/in/joegavin
@joseph_a_gavin
Joe Gavin