SQL Server Security & Intrusion Prevention Gabriel Villa www.extofer.com SQL Saturday #94 Salt Lake City

“Please allow me to introduce myself” … Rolling Stones Gabriel Villa SQL Server 7, 2000, 2005 and 2008 .Net Developer VB.Net and C# www.extofer.com twitter: @extofer

Session Outline SQL Server Threats Security Model Auditing Write Secure Code Best Practices Physical Security Security Patches Network Security Resources

SQL Server Threats Social Engineering SQL Injection Manipulating people to gather data Not using technical cracking tools or techniques SQL Injection Vulnerable to any RDBMS, not just MS SQL Server Attacker post SQL commands via front end applications Tools: ‘ , --, ;

SQL Injection

SQL Server Security Model Principal Windows Users SQL Logins Roles Groups Securables Schemas Windows Users SQL Login Database Users DB Roles Schemas

Authentication Windows Authentications Active Directory Integration Supports Groups Use Whenever Possible

Authentication Mixed Authentication Legacy or Hard Coded Referenced Logins Non Windows Clients Connections over Internet

Authentication

Passwords DO NOT hardcode passwords Strong Passwords ASP.Net encrypt web.config Encrypt password in your code Strong Passwords 8 to 10 minimum characters L33t speak or special characters (i.e s = 5 or 3 = E) SQLPing checks for default passwords Change passwords frequently

Roles Roles Group users roles based on usage Database Roles and Server Roles Server Level Roles Sysadmin, bulkadmin, securityadmin, dbcreator Group users roles based on usage Database Roles and Server Roles Server Level Roles Sysadmin, bulkadmin, securityadmin, dbcreator

Roles and “Denali” Roles Group users roles based on usage Database Roles and Server Roles Server Level Roles sysadmin, bulkadmin, securityadmin, dbcreator “Denali” User Defined Server Roles Allow creation of new Server Roles Help prevent the use of sysadmin

Securables Using Schema to secure database objects Schema is a name space container Simplify Access Permissions Group objects into Schemas Grant permissions to schemas, not objects

Auditing Server and Database Level Events Audit Failed Login Attempts Server Operations Database Actions Audit Specifications Server Audit Specification Audit Failed Login Attempts

New “Denali” Auditing Features SQL Auditing for all editions User Defined Audit – applications write customer events to audit logs Filtering – filter unwanted events Resilience – recover auditing data from temporary file of network issues

Write Secure Code Check for Valid Input DDL Triggers Use Stored Procedures Use Parameters Customize Error Messages Avoid errors returning securable names Source Control

Best Practices Physical Security Windows Updates Network Security

Physical Security Lock server room or rack when not in use Restrict access to unauthorized individuals If feasible, use security cameras

Security Patches Second Tuesday of every month Test updates or hotfixes immediately on non-production servers Schedule patches soon after tested

Network Security Avoid network shares on servers Don’t surf the Web on the server Only enable required protocols Keep servers behind a firewall

Other Tips Encrypt your DB backups Test backups by restoring Restrict System Stored Proc’s and XP

Best Practices Resources http://www.sqlservercentral.com/Books/ Defensive Database Programming by Alex Kuznetsov Protecting SQL Server Data by John Magnabosco SQL Server Tacklebox by Rodney Landrum

Slide Deck at http://www.extofer.com Questions?? Slide Deck at http://www.extofer.com Gabriel Villa email: extofer@gmail.com blog: www.extofer. com twitter: @extofer

Thank you to our sponsors Gold Blog Prize Bronze