Securing SQL Server
ABSTRACT
A default SQL Server installation is reasonably secure, but "reasonably secure" doesn't cut it in an era in which one bad line of code, one weak password, or one open port can result in your customer database ending up on Pastebin. In this talk, we will look at different methods of securing a SQL Server instance, from venerable (principle of least privilege, Transparent Data Encryption) to novel (Always Encrypted, row-level security). These tools and techniques will show us ways for developers, database administrators, and network specialists to work together to secure SQL Server instances.ADDITIONAL MEDIA
No recordings or additional media are available for this talk.SLIDES
Click here to access the slides for this presentation.
The slides are licensed under Creative Commons Attribution-ShareAlike.
DEMO CODE
Click here to access demo code for this presentation.
The source code is licensed under the terms offered by the GPL.
LINKS & FURTHER INFO
Basic Links
- If you're interested in SQL injection, check out my presentation on the topic.
- For a book-length treatment on the topic, I highly recommend Denny Cherry's book, Securing SQL Server.
- Robert Sheldon looks at 12 security failures.
- Jes Borland covers several security features at high level.
Certificates And Connection Encryption
- How to enable SSL encryption.
- Using a self-signed certificate with SQL Server. This is NOT the recommended approach for a production environment. You should use a valid certificate generated by an appropriate granting authority.
- William Durkin walks through an issue the .NET Framework 4.5 and SQL Server connection encryption.
- Sebastian Milne shows how to restore a SQL Server certificate.
Transparent Data Encryption
- John Magnabosco digs into Transparent Data Encryption.
- I show how to set up TDE with database mirroring.
- Simon McAuliffe argues that TDE is not a viable security mechanism.
Always Encrypted
- Hemantgiri S. Goswami covers Always Encrypted at a high level.
- Aaron Bertrand looks at Always Encrypted performance.
- Aaron Bertrand follows up on hi previous Always Encrypted performance post.