Peter A. Carter - Securing SQL Server: DBAs Defending the Database

Any source code or other supplementary material referenced by the author in this book is available to readers on GitHub via the books product page, located at www.apress.com/9781484241608 . For more detailed information, please visit http://www.apress.com/source-code .

With repeated, high-profile data security breaches hitting the headlines, security is moving increasingly to the forefront of the minds of data professionals.

SQL Server provides a broad and deep set of security features that allow you to reduce the attack surface of your SQL Server instance, with defense-in-depth and principles of least privilege strategies.

The attack surface of SQL Server refers to the set of features and windows services, which attackers can (and will) attempt to exploit to either steal data or reduce the availability of data and services.

Defense-in-depth is a strategy used across the IT industry, where multiple layers of security are put in place. The idea is that if one layer of security is breached, then another layer will stop the attacker in their tracks.

To fully protect data against attack, SQL Server DBAs, developers, and architects alike must all understand how and when to implement each of the security features that SQL Server offers. This book attempts to address these topics.

The first section of this book begins by looking at how to holistically model threats before deep-diving into each of SQL Servers main areas of security, providing examples of how to implement each technology.

The second section of this book demonstrates some of the common threats that DBAs may face and how to guard against them. There is always an ethical question around revealing how attackers may try to penetrate your systems, but without knowledge and understanding of vulnerabilities that may be exploited, all too many DBAs do not implement the security measures that could easily avoid attacks from being successful. Every attack type discussed in this book is followed by a demonstration of how to use out-of-the-box SQL Server technologies to proactively stop the attacks occurring.

Many of the code examples in this book use the WideWorldImporters database. This database can be downloaded from github.com/Microsoft/sql-server-samples/releases/download/wide-world-importers-v1.0/WideWorldImporters-Full.bak

Some chapters also refer to CarterSecureSafe. This is a fictional company and product, which is purely designed to illustrate points made within this book.

I would like to thank Mark Burnett (xato.net) for allowing me to use his weak password list in this book.

I would also like to thank Ian Stirk, for a really good technical review, which has had a positive impact on the quality of this book.