Microsoft SQL Server Security and Auditing - isacantx.org Lunch... · Microsoft SQL Server Security and Auditing Clay Risenhoover ISACA North Texas April 14, 2016 ... Introduced in

Microsoft SQL Server Securityand Auditing

Clay RisenhooverISACA North TexasApril 14, 2016http://tinyurl.com/ISACAClay

© 2016, Risenhoover Consulting, Inc. All Rights Reserved 1

GoalsUnderstand new and important

security featuresDemonstrate use of some of themDiscuss security ramifications of

all of them


AssumptionsThe ideal student:• Not a DBA• Not freaked out by SQL• Understand security/assurance• Understand basic database

concepts (like ACID)


ACIDAtomicity (all or nothing

transactions)Consistency (transactions leave DB

in stable state)Isolation (concurrency)Durability (transactions don’t go

away once committed)


ModelServer hardeningConfidentialityIntegrityAvailability


Server HardeningPatch levelAuthentication modes


PatchingDetermine running versionSqlserverversions.blogspot.comselect @@versionselect SERVERPROPERTY('productversion')


AuthenticationDetermine authentication mode

SELECTSERVERPROPERTY('IsIntegratedSecurityOnly')

SELECT CASESERVERPROPERTY('IsIntegratedSecurityOnly')WHEN 1 THEN 'Windows Authentication'WHEN 0 THEN ‘Mixed Mode Authentication'

END as [Authentication Mode]


ConfidentialityEncryptionRow-level securityUser permissions


Encryption OptionsTransparent data encryption (TDE)Encrypted BackupsAlways encrypted


Encryption - TDEIntroduced in SQL Server 2008

EnterpriseEncrypts data at restUses hierarchy of keys


TDE Key Hierarchy

Database Encryption Key

Database Master Key

Service Master Key (OS Level)


TDE – Key BackupsBACKUP MASTER KEY TO FILE ='path_to_file' ENCRYPTION BYPASSWORD = 'password‘

RESTORE MASTER KEY FROM FILE ='path_to_file' DECRYPTION BYPASSWORD = 'password' ENCRYPTION BYPASSWORD = 'password' [ FORCE ]


Encryption – Encrypted BackupsIntroduced in SQL Server 2014Encrypt database backup filesCan use


Encryption – Always EncryptedIntroduced in SQL Server 2016Protects data in transit and at restColumns encrypted with keys

stored with application, not inserver


Encryption – Final ThoughtsBackup and protect all

cryptographic keysTEST YOUR BACKUPS


Row-Level SecurityIntroduced in SQL Server 2016Uses functions to restrict table

rows available to a userOlder versions, had to use views

and stored procedures toemulate


Special PermissionsServer-level permissions:• Apply to all databases, present

and futureIntroduced in SQL Server 2014:

CONNECT ANY DATABASESELECT ALL USER SECURABLES


IntegrityDelayed durabilityMark transaction as committed,

even if logs have not beenflushed

Makes our ACID a little less ACID-ic


Integrity – Delayed DurabilityMay be set at:• Database level• Transaction level• For in-memory natively

compiled procedures


Database levelALTER DATABASE dbnameSET DELAYED_DURABILITY= DISABLED | ALLOWED |FORCED;


Transaction LevelCOMMIT TRANSACTION WITH(DELAYED_DURABILITY =ON);


Atomic levelFor natively-compiled procedure

used with in-memory OLTP:BEGIN ATOMIC WITH(DELAYED_DURABILITY =ON, ...)


Delayed Durability CheckingDatabase properties dialog

Options tab

Query


Delayed Durability - Options


Delayed Durability – Query

SELECT name,DATABASEPROPERTYEX(name,'DelayedDurability') ASDelayedDurability,

DATABASEPROPERTYEX(name,Status') AS Status

FROM master.dbo.sysdatabasesORDER BY name


AvailabilityFor on-premise installations, a

number of Azure availabilityoptions:

• Managed backups to Azure• “Always on” availability groups

with Azure replicas


Managed Backup to AzureIntroduced in SQL Server 2014Automated backup to Azure

“blob” storage containerSimilar to disk/tape backup, but

stored in cloud“Backup to URL”


Backup to URLBACKUP DATABASE TestDB TO URL ='https://<accountname>.blob.core.windows.net/<containername>/TestDB.bak'

WITH CREDENTIAL ='<mycredentialname>' ,COMPRESSION,STATS = 5;


Always-On Azure ReplicasAlways-On availability groups

used for database replicationReplicas can be hosted in AzureFailover to on-premise or Azure

replica


ConclusionBrief overview of interesting

featuresNot exhaustive2016 deployments a good time to

re-check your DB environment


Questions

http://tinyurl.com/ISACAClay


Microsoft SQL Server Security and Auditing - isacantx.org Lunch... · Microsoft SQL Server Security and Auditing Clay Risenhoover ISACA North Texas April 14, 2016 ... Introduced in

Documents