1. Overview of Security Investments in SQL Server 2016 and Azure SQL Database Jamey Johnston 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database 1 |

2. Agenda  Who am I?  What’s new in security for SQL Database V12 and SQL Server 2016  SQL Threat Detection (SQL Database V12)  Dynamic Data Masking  Always Encrypted  Azure Active Directory Authentication (SQL Database V12)  Row-level Security  Questions 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database2 |

3. Jamey Johnston  Data Scientist for an O&G Company  20+ years DBA Experience  TAMU MS in Analytics (2016)  http://analytics.stat.tamu.edu http://analytics.stat.tamu.edu  Professional Photographer  http://jamey.photograhy http://jamey.photograhy  @STATCowboy  http://blog.jameyjohnston.com http://blog.jameyjohnston.com 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database3 |

4. SQL Database Threat Detection  Detect anomalous database activities indicating a potential security threat to the database  Configurable threat detection policy via Azure portal  Multiple database threat detectors  Identify and alert upon anomalous database activities  Audit log viewer in Azure portal and Excel template 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database4 |

5. SQL Database Threat Detection 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database5 |

6. SQL Threat Detection: Learn More  Getting started with SQL Database Threat Detection  http://go.microsoft.com/fwlink/?LinkId=691678 http://go.microsoft.com/fwlink/?LinkId=691678  Channel 9 Videos:  https://channel9.msdn.com/Shows/Data-Exposed/Azure-SQL-Database-Threat-Detection https://channel9.msdn.com/Shows/Data-Exposed/Azure-SQL-Database-Threat-Detection 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database6 |

7. Dynamic Data Masking 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database7 |  Limit sensitive data exposure by obfuscating it to non-privileged users  Limit exposure of sensitive data to app users  Avoid exposure of sensitive data to Engineers (e.g., Troubleshooting) IT, BI users

8. Dynamic Data Masking: Learn More  Getting Started (Azure SQL DB)  https://azure.microsoft.com/documentation/articles/sql-database-dynamic-data-masking-get-started/ https://azure.microsoft.com/documentation/articles/sql-database-dynamic-data-masking-get-started/  MSDN (SQL Server)  https://msdn.microsoft.com/library/mt130841.aspx https://msdn.microsoft.com/library/mt130841.aspx  Blogs  http://blogs.msdn.com/b/sqlsecurity/archive/2015/10/22/dynamic-data-masking-highlighting-the-latest- improvements.aspx http://blogs.msdn.com/b/sqlsecurity/archive/2015/10/22/dynamic-data-masking-highlighting-the-latest- improvements.aspx  https://azure.microsoft.com/blog/limit-the-exposure-of-sensitive-data-in-azure-sql-database-using-dynamic- data-masking/ https://azure.microsoft.com/blog/limit-the-exposure-of-sensitive-data-in-azure-sql-database-using-dynamic- data-masking/  Channel 9 Videos:  https://channel9.msdn.com/Shows/Data-Exposed/Dynamic-Data-Masking-Updates https://channel9.msdn.com/Shows/Data-Exposed/Dynamic-Data-Masking-Updates  https://channel9.msdn.com/Shows/Data-Exposed/Dynamic-Data-Masking-in-Azure-SQL-Database https://channel9.msdn.com/Shows/Data-Exposed/Dynamic-Data-Masking-in-Azure-SQL-Database 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database8 |

9. Always Encrypted 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database9 |

10. Always Encrypted – How It Works 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database10 |

11. Always Encrypted: Learn More  Books Online  https://msdn.microsoft.com/en-us/library/mt163865.aspx https://msdn.microsoft.com/en-us/library/mt163865.aspx  SQL Security Blog (keyword Always Encrypted)  http://blogs.msdn.com/b/sqlsecurity/archive/tags/always+encrypted/ http://blogs.msdn.com/b/sqlsecurity/archive/tags/always+encrypted/  Channel 9 Videos  https://channel9.msdn.com/Shows/Data-Exposed/SQL-Server- 2016-Always-Encrypted https://channel9.msdn.com/Shows/Data-Exposed/SQL-Server- 2016-Always-Encrypted  https://channel9.msdn.com/Shows/Data-Exposed/Getting-Started- with-Always-Encrypted-with-SSMS https://channel9.msdn.com/Shows/Data-Exposed/Getting-Started- with-Always-Encrypted-with-SSMS 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database11 |

12. Azure Active Directory Authentication 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database12 |

13. Azure AD Authentication: Learn More  MSDN  https://azure.microsoft.com/en-us/documentation/articles/sql-database- aad-authentication/ https://azure.microsoft.com/en-us/documentation/articles/sql-database- aad-authentication/  SQL Security Blog (keyword Azure AD auth)  http://blogs.msdn.com/b/sqlsecurity/ http://blogs.msdn.com/b/sqlsecurity/  Channel 9 Videos:  https://channel9.msdn.com/Shows/Data-Exposed/Azure-Active- Directory-Authentication-for-SQL-Database-V12 https://channel9.msdn.com/Shows/Data-Exposed/Azure-Active- Directory-Authentication-for-SQL-Database-V12 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database13 |

14. Row Level Security  RLS allows for controlled access to rows in tables based on attributes of the user executing the query  2 Methods or RLS in SQL Server:  Filter Based (2005+)  SQL Server Security Label Toolkit  http://sqlserverlst.codeplex.com/ http://sqlserverlst.codeplex.com/  Use views on tables with “labels” to limit access  Problem is you have to change the application code and add views (i.e. upgrades are a pain, unsupported applications)  Predicate Based (2016 and Azure)  Uses functions and policies to apply predicates to the SQL  No application code changes and base database schema left intact (i.e. upgrades not impacted very much by RLS) 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database14 |

15. Row Level Security: Basic Steps 1.Define Table(s) for RLS 2.Create a new Schema, RLS, for Security Objects 3.Create Table Value Function to define “how” to enforce security on Table 4.Create a Security Policy on the table using the TVF 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database15 |

16. Table Value Functions  User defined function that returns a data table  Powerful alternative to View  Expand beyond SELECT and use more powerful T-SQL  RLS uses them to return a 1 for row matches CREATE FUNCTION RLS.fn_RLSpredicate(@Region AS sysname) RETURNS TABLE WITH SCHEMABINDING AS RETURN SELECT 1 AS fn_RLSpredicate_result WHERE USER_NAME() = 'VP_US' or @Region = USER_NAME(); GO 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database16 |

17. Security Policy  Policy that is created to apply the Security Predicate CREATE SECURITY POLICY Well_HeaderFilter ADD FILTER PREDICATE RLS.fn_RLSpredicate(Region) ON dbo.Well_Header ADD BLOCK PREDICATE RLS.fn_RLSpredicate(Region) ON dbo.Well_Header AFTER INSERT GO 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database17 |

18. Recursive Queries with CTE  Use them to query tables with Hierarchical Data https://technet.microsoft.com/en-us/library/ms186243(v=sql.105).aspx 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database18 |

19. Why Predicate Based RLS for Business? No application code changes and Base database schema left Intact (i.e. upgrades not impacted very much by RLS) With ISV applications it is not advisable to change the Schema Increased ventures with Internal Partners require row-level granular access to the applications RLS allows for the row-level security and eliminates the need for federated/”broken-out” databases/applications 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database19 |

20. Demos  Simple RLS Demo  Advanced RLS Demo with Hierarchies 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database20 |

21. RLS with Parent/Child Hierarchies  Demo will show how an organizational hierarchy and asset hierarchy can be leveraged together to provide RLS on tables using the new predicate based RLS feature in SQL Server 2016 and Azure  Important Concepts:  Organization Unit  Represents a position in the company (not employee)  Security is assigned to the Organization Unit and propagated to the User ID  Hierarchy Based Security  Allows for inheritance of permissions via the Organization and Asset Hierarchy  Do NOT need to assign security to every node in the hierarchy.  Child nodes can inherit from Parent Nodes  Parent/Child Hierarchy  Employee ID / Manager ID - Unary Relationship 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database21 |

22. Asset Hierarchy 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database22 | Snapshot of the Asset Hierarchy

23. Organizational Hierarchy 1/15/2016Session Title Here23 | Snapshot of the Org Hierarchy

24. Hierarchies and RLS 1/15/2016Session Title Here24 | insert into [SEC_ASSET_MAP] values (100010, 'REGION', 'NORTHERN US'); Inherits from CEO Inherits from SVP who Inherits from CEO insert into [SEC_ASSET_MAP] values (100001, 'ALL', 'ALL'); insert into [SEC_ASSET_MAP] values (100028, 'ASSET_GROUP', 'PRB'); Inherits from Manger Security Record for Every Employee is NOT Required!

25. RLS with HierarchyID Datatype  Demonstrates how the HierarchyID Datatype can be used for RLS  SEC_ORG_USER_BASE_HID  Same as SEC_ORG_USER_BASE but includes HierarchyID column to demonstrate RLS with HierarchyID data types  https://msdn.microsoft.com/en-us/library/bb677290.aspx https://msdn.microsoft.com/en-us/library/bb677290.aspx 1/15/2016Session Title Here25 |

26. Parent/Child vs HierarchyID Data Type  Parent/Child  Most familiar and most likely to be supported by ISV  Easier to implement security across multiple hierarchies (Org and Asset)  More flexible to support access across multiple node levels (i.e. User has access to multiple nodes in the Hierarchy)  HierarchyID Datatype  Does not work easily across multiple hierarchies and with multiple node level access  Very fast when working with one hierarchy  Still researching as it is fast and would like to use! 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database26 |

27. Demo ERD 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database27 |

28. Row-level Security: Learn More  Books Online  https://msdn.microsoft.com/en-us/library/dn765131.aspx https://msdn.microsoft.com/en-us/library/dn765131.aspx  SQL Security Blog (keyword RLS)  http://blogs.msdn.com/b/sqlsecurity/archive/tags/rls/ http://blogs.msdn.com/b/sqlsecurity/archive/tags/rls/  Channel 9 Videos  https://channel9.msdn.com/Shows/Data-Exposed/Row-Level-Security-Updates https://channel9.msdn.com/Shows/Data-Exposed/Row-Level-Security-Updates  https:// channel9.msdn.com/Shows/Data-Exposed/Row-Level-Security-in-Azure-SQL- Database https://channel9.msdn.com/Shows/Data-Exposed/Row-Level-Security-in-Azure-SQL- Database  https://channel9.msdn.com/Shows/Data-Exposed/SQL-Server-2016-Row-Level- Security https://channel9.msdn.com/Shows/Data-Exposed/SQL-Server-2016-Row-Level- Security  Code Samples  https://rlssamples.codeplex.com/ https://rlssamples.codeplex.com/ 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database28 |

29. Questions? Thank you for attending!  @STATCowboy  http://blog.jameyjohnston.com http://blog.jameyjohnston.com  Download Demos  SQL Server Security Blog  http://blogs.msdn.com/b/sqlsecurity http://blogs.msdn.com/b/sqlsecurity 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database29 |

30. Thank You Sponsors! 1/15/2016Security Investments in SQL Server 2016 and Azure SQL Database30 | Visit the Sponsor tables to enter their end of day raffles. Turn in your completed Event Evaluation form at the end of the day in the Registration area to be entered in additional drawings.