Browse books > Securing SQL Server

Securing SQL Server

Protecting Your Database from Attackers

By
  • Denny Cherry, (MCSA, MCDBA, MCTS, MCITP, MCM) has been working with Microsoft technology for over 15 years starting with Windows 3.51 and SQL Server 6.5.

There is a lot at stake for administrators taking care of servers, since they house sensitive data like credit cards, social security numbers, medical records, and much more. In Securing SQL Server you will learn about the potential attack vectors that can be used to break into your SQL Server database, and how to protect yourself from these attacks. Written by a Microsoft SQL Server MVP, you will learn how to properly secure your database, from both internal and external threats. Best practices and specific tricks employed by the author will also be revealed. Learn expert techniques to protect your SQL database environment.

,

Published: January 2011

Imprint: Syngress

ISBN: 978-1-59749-625-4

Reviews

  • "Denny Cherry is what would happen if Bill Gates and AC/DC got together to create a sibling. He’s a bare-knuckles, no holds-barred technologist, and you can bet that if he tells you that something does or doesn’t work, he’s speaking from experience. Active in the community, his passion is sharing. You’ll enjoy this book."

    -Buck Woody, Senior Technology Specialist, Microsoft

     

    "Securing SQL Server is a must read for any architect or database administrator wanting to secure their SQL Servers. Given the sensitive data that SQL Servers could hold, it is vital that one understands the potential attacks and how to protect yourself from them. This is the book to help you understand."

    -InfoSecReviews Book Awards


Contents

  • Chapter 1: Securing the Network

    Securing the Network

    Public IP Addresses vs. Private IP Addresses

    Accessing SQL Server from Home

    Physical Security

    Social Engineering

    Finding the instances

    Testing the Network Security

    Summary

    References

    Chapter 2: Database Encryption

    Database Encryption

    Encrypting Data within Tables

    Encrypting Data at Rest

    Encrypting Data on the Wire

    Encrypting Data with MPIO Drivers

    Encrypting Data via HBAs

    Summary

    References

    Chapter 3: SQL Password Security

    SQL Server Password Security

    Strong Passwords

    Encrypting Client Connection Strings

    Application Roles

    Using Windows Domain Policies to Enforce Password Length

    Summary

    References

    Chapter 4: Securing the Instance

    What to install and when

    SQL Authentication and Windows Authentication

    Password change policies

    Auditing failed logins

    Renaming the sa account

    Disabling the sa account

    Securing Endpoints

    Stored Procedures as a security measure

    Minimum Permissions Possible

    Linked Servers

    Using Policies to secure your instance

    SQL Azure Specific Settings

    Instances that leave the office

    Summary

    Chapter 5: Additional Security for an Internet Facing SQL Server and Application

    SQL CLR

    Extended Stored Procedures

    Protecting your connection strings

    Database Firewalls

    Clear virtual memory pagefile

    User Access Control (UAC)

    Other domain policies to adjust

    Reporting Services

    Summary

    Chapter 6: SQL Injection Attacks

    What is a SQL Injection Attack?

    Why are SQL Injection Attacks so Successful?

    How to Protect Yourself from a SQL Injection Attack

    Cleaning Up the Database After a SQL Injection Attack

    Summary

    References

    Chapter 7: Database Backup Security

    Overwriting Backups

    Media Set and Backup Set Passwords

    Backup Encryption

    Transparent Data Encryption

    Compression and Encryption

    Offsite Backups

    Summary

    References

    Chapter 8: Auditing for Security

    Login Auditing

    Data Modification Auditing

    Data Querying Auditing

    Schema Change Auditing

    Using Policy Based Management to ensure policy Compliance

    C2 Auditing

    Common Criteria Compliance

    Summary

    References

    Chapter 9: Server Rights

    OS Rights needed by the SQL Server Service

    OS Rights needed by the DBA

    OS Rights needed to install Service Packs

    OS Rights needed to access SSIS remotely

    Console Apps Must Die

    Default sysadmin rights

    Vendor’s and the sysadmin fixed server role

    Summary

    Appendix A: External Audit Checklists

    PCI DSS

    Sarbanes-Oxley

    HIPPA

    Summary

    References

     

     

Advertisement

advert image