1. Lara Rubbelke @sqlgal Microsoft

2. What does it mean? Why do you need to care? How can you achieve your SoD goals?

3. SQL Server Separation of Duties for the DBA Whitepaper: http://bit.ly/pOPsct http://bit.ly/pOPsct Download Separation of Duties (SOD) Framework sqlserversod.codeplex.com sqlserversod.codeplex.com Module Signing (BOL): http://bit.ly/pwcN13 http://bit.ly/pwcN13 Engine Separation of Duties for the Application Developer: http://bit.ly/pwcN13 http://bit.ly/pwcN13

4. Granular Perms User- defined roles User- schema separation Signed Modules/ Execute As Encrypt ion

8. CREATE PROCEDURE HRUser.MySalary WITH EXECUTE AS ‘HRAdmin’ AS DECLARE @User NVARCHAR(128); EXECUTE AS CALLER; SELECT @User = USER_NAME(); REVERT; SELECT * FROM HR.PAYROLL WHERE Name = @User; GO

10. Need ALTER ANY LOGIN server permission to ALTER LOGIN Need to GRANT ALTER ANY LOGIN TO Jason? – No! ALTER LOGIN Bob ENABLE Jason (non privileged login)

11. Jason has permission to call SP SP run under Jason’s context but with elevated privilege SP protected against tampering Jason (non privileged login) SP_ENABLE_LOGIN ALTER LOGIN Bob ENABLE Cert_login ALTER ANY LOGIN

12. When the door to your database is closed to the DBA Separation of Duties Framework sqlserversod.codeplex.com

13. Empower the DBA team to be Productive Responsive With a process that is Auditable Secure Easy to Implement and Manage Extensible

14. 1.Decide what tasks the DBA should be allowed to execute a.Create stored procedures or use the examples included in the framework 2.Execute the InstallScript.ps1 script a.Set up the database b.Set up the certificate and login/user c.Create the signed modules 3.Place DBAs/users in the new roles

15. Setting up the Separation of Duties Framework

16. There will always be at least one sysadmin The Separation of Duties Framework is designed to provide a means to limit the number of sysadmins The Separation of Duties Framework will complement existing processes

17. SQL Server Separation of Duties for the DBA Whitepaper: http://bit.ly/pOPsct http://bit.ly/pOPsct Download Separation of Duties (SOD) Framework sqlserversod.codeplex.com sqlserversod.codeplex.com Module Signing (BOL): http://bit.ly/pwcN13 http://bit.ly/pwcN13 Engine Separation of Duties for the Application Developer: http://bit.ly/pwcN13 http://bit.ly/pwcN13