Protecting your database: Who's looking at your sensitive data?

There's a multitude of ways that unauthorized eyes can view sensitive data. SQL Server users can poke around and potentially stumble across sensitive data they shouldn't have access to. This is especially true when users share SQL Server accounts. There's no accountability and no fall-back plan when something happens. Another way people can view sensitive data is via SQL injection exploits carried out through poorly written Web applications. If users and roles aren't properly configured, as-designed data access via the application can even create confidentiality issues. These breaches can happen anytime, anywhere and both untrusted outsiders and trusted insiders can carry them out. Production, QA, test, development - you name it - all environments provide opportunities for data disclosure that can create security problems.

Outside of manual log perusal of your databases, applications, and operating systems (only recommended for the truly bored and faint of heart), you can do other things that lead to true data protection. For starters, there's SQL Profiler, a tool that will show you all queries that have been run against a SQL Server 2005 system. With it, you can audit all data-related operations and tweak system performance. SQL Profiler is more of a reactive tool in this case but it's better ...

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT Database Management and Administration Password cracking tools for SQL Server Using traces in SQL Server Profiler Meet compliance requirements with improved database security practices Hardening the network and OS for SQL Server security Securing the server and database in SQL Server How SQL Server 2008 components impact SharePoint implementations Troubleshooting Distributed Transaction Coordinator errors in SQL Server Achieving high availability and disaster recovery with SharePoint databases Clearing the Windows page file and its effect on server performance Deploying a SQL Server virtual appliance for Microsoft Hyper-V SQL Server Security Password cracking tools for SQL Server Meet compliance requirements with improved database security practices Hardening the network and OS for SQL Server security Securing the server and database in SQL Server SQL Server security made simple and sensible Blog: Protect your databases from the internal threat Setting up SQL Server Service Broker for secure communication The keys to database backup protection for SQL Server Understanding transparent data encryption in SQL Server 2008 The fine line between not encrypting your databases and breach notification

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary data corruption  (SearchSQLServer.com) data hiding  (SearchSQLServer.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

than no tool at all! On the proactive side, there are commercial tools that can be used in this context to monitor and report on what database users do and see, such as Pynlogic's Enzo, Lumigent's Audit DB with continuous, automated auditing; and Tizor's Mantra a data activity monitoring and reporting tool for structured and unstructured data.

When you log everything in your applications and tie specific database accounts to specific transactions, you gain in-depth insight into who saw what. Setting up unique logins for each application is another option. That way, you could tie each request back to specific applications. I know, none of this is easy, but security almost always comes with a price.

Maybe it's time to rethink your current authentication schemes, your logging policies, your database administration/security tools and data access on the application side. Chances are if you dig down deep, you'll find data disclosure weaknesses that someone with malicious intent can exploit.

ABOUT THE AUTHOR:   

Kevin Beaver is an independent information security consultant, speaker, and expert witness with Atlanta-based Principle Logic, LLC. He has more than 19 years of experience in IT and specializes in performing information security assessments revolving around compliance and IT governance. Kevin has authored/co-authored six books on information security including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley) as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He's also the creator of the Security On Wheels audiobooks providing security learning for IT professionals on the go. Kevin can be reached at kbeaver ~at~ principlelogic.com.
Copyright 2007 TechTarget

Rate this Tip To rate tips, you must be a member of SearchSQLServer.com. Register now to start rating these tips. Log in if you are already a member. DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.