1. Enterprise Row Level Security: SQL Server 2016 and Azure SQL DB
Jamey Johnston
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

2. Agenda
Who am I?
What’s new in security for SQL Database V12 and SQL Server 2016
SQL Threat Detection (SQL Database V12)
Dynamic Data Masking
Always Encrypted
Azure Active Directory Authentication (SQL Database V12)
Row-level Security
Questions
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

3. Jamey Johnston Sr. Data Scientist for an O&G Company
20+ years DBA Experience
TAMU MS in Analytics
Semi-Pro Photographer
@STATCowboy
Download Code Here!
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

4. SQL Database Threat Detection
Detect anomalous database activities indicating a potential security threat to the database
Configurable threat detection policy via Azure portal
Multiple database threat detectors
Identify and alert upon anomalous database activities
Audit log viewer in Azure portal and Excel template
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

5. SQL Database Threat Detection
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

6. SQL Threat Detection: Learn More
Getting started with SQL Database Threat Detection
Channel 9 Videos:
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

7. Dynamic Data Masking
Limit sensitive data exposure by obfuscating it to non-privileged users
Limit exposure of sensitive data to app users
Avoid exposure of sensitive data to Engineers (e.g., Troubleshooting) IT, BI users
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

8. Dynamic Data Masking: Learn More
Getting Started (Azure SQL DB)
MSDN (SQL Server)
Blogs
Channel 9 Videos:
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

9. Always Encrypted
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

10. Always Encrypted – How It Works
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

11. Always Encrypted: Learn More
Books Online
SQL Security Blog (keyword Always Encrypted)
Channel 9 Videos
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

12. Azure Active Directory Authentication
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

13. Azure AD Authentication: Learn More
MSDN
SQL Security Blog (keyword Azure AD auth)
Channel 9 Videos:
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

14. Row Level Security
RLS allows for controlled access to rows in tables based on attributes of the user executing the query
2 Methods or RLS in SQL Server:
Filter Based (2005+)
SQL Server Security Label Toolkit
Use views on tables with “labels” to limit access
Problem is you have to change the application code and add views (i.e. upgrades are a pain, unsupported applications)
Predicate Based (2016 and Azure)
Uses functions and policies to apply predicates to the SQL
No application code changes and base database schema left intact (i.e. upgrades not impacted very much by RLS)
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

15. Row Level Security: Basic Steps
Define Table(s) for RLS
Create a new Schema, RLS, for Security Objects
Create Table Value Function to define “how” to enforce security on Table
Create a Security Policy on the table using the TVF
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

16. Table Value Functions User defined function that returns a data table
Powerful alternative to View
Expand beyond SELECT and use more powerful T-SQL
RLS uses them to return a 1 for row matches
CREATE FUNCTION AS sysname)
RETURNS TABLE
WITH SCHEMABINDING AS
RETURN SELECT 1 AS fn_RLSpredicate_result
WHERE USER_NAME() = 'VP_US' = USER_NAME(); GO
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

17. Security Policy Policy that is created to apply the Security Predicate
CREATE SECURITY POLICY Well_HeaderFilter
ADD FILTER PREDICATE RLS.fn_RLSpredicate(Region)
ON dbo.Well_Header
ADD BLOCK PREDICATE RLS.fn_RLSpredicate(Region)
ON dbo.Well_Header AFTER INSERT GO
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

18. Recursive Queries with CTE
Use them to query tables with Hierarchical Data
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

19. Why Predicate Based RLS for Business?
No application code changes and Base database schema left Intact (i.e. upgrades not impacted very much by RLS)
With ISV applications it is not advisable to change the Schema
Increased ventures with Internal Partners require row-level granular access to the applications
RLS allows for the row-level security and eliminates the need for federated/”broken-out” databases/applications
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

20. Demos Simple RLS Demo Advanced RLS Demo with Hierarchies May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

21. RLS with Parent/Child Hierarchies
Demo will show how an organizational hierarchy and asset hierarchy can be leveraged together to provide RLS on tables using the new predicate based RLS feature in SQL Server 2016 and Azure
Important Concepts:
Organization Unit
Represents a position in the company (not employee)
Security is assigned to the Organization Unit and propagated to the User ID
Hierarchy Based Security
Allows for inheritance of permissions via the Organization and Asset Hierarchy
Do NOT need to assign security to every node in the hierarchy.
Child nodes can inherit from Parent Nodes
Parent/Child Hierarchy
Employee ID / Manager ID - Unary Relationship
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

22. Asset Hierarchy Snapshot of the Asset Hierarchy May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

23. Organizational Hierarchy
Snapshot of the Org Hierarchy
May 2016
Session Title Here

24. Security Record for Every Employee is NOT Required!
Hierarchies and RLS
insert into [SEC_ASSET_MAP] values (100001, 'ALL', 'ALL');
Inherits from CEO
Inherits from SVP who Inherits from CEO
insert into [SEC_ASSET_MAP] values (100010, 'REGION', 'NORTHERN US');
insert into [SEC_ASSET_MAP] values (100028, 'ASSET_GROUP', 'PRB');
Inherits from Manger
Security Record for Every Employee is NOT Required!
May 2016
Session Title Here

25. RLS with HierarchyID Datatype
Demonstrates how the HierarchyID Datatype can be used for RLS
SEC_ORG_USER_BASE_HID
Same as SEC_ORG_USER_BASE but includes HierarchyID column to demonstrate RLS with HierarchyID data types
May 2016
Session Title Here

26. Parent/Child vs HierarchyID Data Type
Most familiar and most likely to be supported by ISV
Easier to implement security across multiple hierarchies (Org and Asset)
More flexible to support access across multiple node levels (i.e. User has access to multiple nodes in the Hierarchy)
HierarchyID Datatype
Does not work easily across multiple hierarchies and with multiple node level access
Very fast when working with one hierarchy
Still researching as it is fast and would like to use!
1/15/2016
Security Investments in SQL Server 2016 and Azure SQL Database

27. Demo ERD
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

28. Row-level Security: Learn More
Books Online
SQL Security Blog (keyword RLS)
Channel 9 Videos
channel9.msdn.com/Shows/Data-Exposed/Row-Level-Security-in-Azure-SQL-Database
Code Samples
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

29. Questions? Thank you for attending! @STATCowboy http://STATCowboy.com
Download Demos
SQL Server Security Blog
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database

30. Thank You Sponsors!
Visit the Sponsor tables to enter their end of day raffles.
Don’t Forget to go online and complete the Session Evaluations!
I do Read Them and Appreciate feedback, positive and negative!
May 2016
Security Investments in SQL Server 2016 and Azure SQL Database