1. SQL Server Security By Mattias Lind (@SoQooL) 2015-08-20 For PASS Security VC

2. Mattias Lind Senior Microsoft Data Platform & Business Intelligence Architect @Sogeti mattias.lind@sogeti.se MVP on SQL Server Microsoft Certified Trainer blog.mssqlserver.se sqlguru.se @SoQooL

3. Today’s Content Authentication SQL Server Logins & Windows Authentication Server Roles Database Users & Roles Partial Contained Databases NTLM vs. Kerberos

4. Authentication Validate connection Make sure right users consume Server level Database level

5. SQL Server Logins & Windows Authentication SQL Server Login Name Password Exists in the local instance Authenticated by SQL Server Windows User or Group Reference by SID Exists in AD or SAM Approved by SQL Server Connect To Server

6. Server Roles Delegates specific administrative control of the server Set of server fixed Custom server roles

7. Database Users & Roles Database Users approves access to a database A SQL Server Login are tied to a User Can be based on a Windows User or Group Database Roles groups permissions and are associated to Users A Role is not a group, it’s a Permission Set Application Roles have a password and can elevate permissions for the session

8. Partial Contained Databases Uses a Partial Contained Database User with a password Inherits permission to connect to server, no need for a Login Configurables are Server, Database, and Database User

9. NTLM vs. Kerberos NTLM is “old school” vs. Kerberos as “new school” Windows Server 2000 Active Directory Client SAM Server SAM Service

10. NTLM vs. Kerberos Client SAM Server SAM Service Domain

11. Thank You! @SoQooL @SoQooL