Securing SQL Server, Protecting Your Database from Attackers by Cherry, Denny -- Read -- Imperial Library of Trantor

Index

Cover Title page Table of Contents Copyright Dedication Author Biography Technical Editor Biography Acknowledgments Introduction Chapter 1: Identifying Security Requirements

Abstract What are Security Objectives? When Should Security Objectives been Identified? How to Identify Security Objectives?

Chapter 2: Securing the Network

Abstract Securing the Network Public IP Addresses versus Private IP Addresses vLANs Accessing SQL Server from Home Physical Security Social Engineering Finding the Instances Testing the Network Security Antivirus Installation on SQL Servers Summary

Chapter 3: Key Management

Abstract Service Master Key Database Master Key Encryption Password Management Enterprise Key Management High Availability and Disaster Recovery for Key Management Conclusions

Chapter 4: Database Encryption

Abstract Database Encryption Encrypting Data within Tables Encrypting Data at Rest Encrypting Data on the Wire Encrypting Data with MPIO Drivers Encrypting Data via HBAs Summary

Chapter 5: SQL Password Security

Abstract Login Types SQL Server Password Security Strong Passwords Password Change Policies Renaming the SA Account Disabling the SA Account Users versus Logins Contained Database Users in SQL Server 2012 and Beyond Schemas Encrypting Client Connection Strings Application Roles Using Windows Domain Policies to Enforce Password Length Contained Users Summary

Chapter 6: Securing the Instance

Abstract What to Install, and When? SQL Authentication and Windows Authentication Password Change Policies Auditing Failed Logins Renaming the SA Account Disabling the SA Account Securing Endpoints Stored Procedures as a Security Measure Minimum Permissions Possible Instant File Initialization Linked Servers Using Policies to Secure Your Instance SQL Azure Specific Settings Instances that Leave the Office Securing AlwaysOn Availability Groups Securing Contained Databases SQL CLR Extended Stored Procedures Protecting Your Connection Strings Database Firewalls Clear Virtual Memory Pagefile User Access Control (UAC) Other Domain Policies to Adjust Summary

Chapter 7: Analysis Services

Abstract Logging into Analysis Services Securing Analysis Services Objects Summary

Chapter 8: Reporting Services

Abstract Setting up SSRS Security within Reporting Services Reporting Services Authentication Options Report Server Object Rights Summary

Chapter 9: SQL Injection Attacks

Abstract What is an SQL Injection Attack? Why are SQL Injection Attacks so Successful? How to Figure out you have been Attacked How to Protect Yourself from an SQL Injection Attack Cleaning up the Database after a SQL Injection Attack Other Front end Security Issues Using xEvents to Monitor for SQL Injection Summary

Chapter 10: Database Backup Security

Abstract Overwriting Backups Media set and Backup set Passwords Backup Encryption Transparent Data Encryption Compression and Encryption Offsite Backups Summary

Chapter 11: Storage Area Network Security

Abstract Securing the Array Securing the Storage Switches Summary

Chapter 12: Auditing for Security

Abstract Login Auditing Data Modification Auditing Data Querying Auditing Schema Change Auditing Using Policy-based Management to Ensure Policy Compliance C2 Auditing Common Criteria Compliance Summary

Chapter 13: Server Rights

Abstract SQL Server Service Account Configuration OS Rights Needed by the SQL Server Service OS Rights Needed by the DBA OS Rights Needed to Install Service Packs OS Rights Needed to Access SSIS Remotely Console Apps Must Die Fixed Server Roles User Defined Server Roles Fixed Database Roles User-defined Database Roles Default Sysadmin Rights Vendor’s and the Sysadmin Fixed Server Role Summary

Chapter 14: SQL Server Agent Security

Abstract Proxies SQL Agent Job Steps Granting Rights to Proxies Job Ownership Summary

Chapter 15: Securing Data

Abstract GRANTing Rights DENYing Rights REVOKEing Rights Table and view Permissions Stored Procedure Permissions Signing Stored Procedures, Functions and Triggers Function Permissions Service Broker Objects Separation of Duties Summary

Appendix A: External Audit Checklists Subject Index