Basic SQL Server security principles you can't afford to miss

People in management – especially IT management – often refer to the terms accountability, compliance and risk management. "They're our goal and our process and that's how we do it here" is the mantra. Yet, the very essence of the business's existence – its electronic databases – often lacks even the most basic security controls. To keep database security in check, you've got to have them. There's no amount of technical controls that can fix this gaping hole and prevent breaches long term. Unfortunately, it's the big iron firewalls, fancy database intrusion prevention technologies and database encryption that are getting all the attention.

If you step back and look at your database environment closely, it's easy to find many real-world weaknesses where not using the practices of least privilege, delegated administration and separation of duties shines clear. SQL Server database security weaknesses include:

1. Running applications with admin-level privileges and relying on front-end controls to protect the back-end database.


2. DBAs using admin-level accounts for day-to-day tasks that don't require such privileges.


3. Multiple administrators with their hands in the same systems.


4. Sharing of Windows administrator accounts to manage the database.


5. Not using stored procedures where possible.


6. Not creating database views based on user or group permissions.


7. Audit logs going unviewed and untouched.


8. Multiple administrators for database storage and backup management.


9. Little or no data classification thus placing every database on the same level of importance.

These ...

Digg This!     StumbleUpon     Del.icio.us

RELATED CONTENT SQL Server Security Meet compliance requirements with improved database security practices Hardening the network and OS for SQL Server security Securing the server and database in SQL Server SQL Server security made simple and sensible Blog: Protect your databases from the internal threat Setting up SQL Server Service Broker for secure communication The keys to database backup protection for SQL Server Understanding transparent data encryption in SQL Server 2008 The fine line between not encrypting your databases and breach notification Securing SQL Server with access control, login monitoring and DDL triggers Database Management and Administration Meet compliance requirements with improved database security practices Hardening the network and OS for SQL Server security Securing the server and database in SQL Server How SQL Server 2008 components impact SharePoint implementations Troubleshooting Distributed Transaction Coordinator errors in SQL Server Achieving high availability and disaster recovery with SharePoint databases Clearing the Windows page file and its effect on server performance Deploying a SQL Server virtual appliance for Microsoft Hyper-V How to create SQL Server virtual appliances for Hyper-V Push vs. pull: Configuring SQL Server replication

RELATED GLOSSARY TERMS Terms from Whatis.com − the technology online dictionary data corruption  (SearchSQLServer.com) data hiding  (SearchSQLServer.com)

RELATED RESOURCES 2020software.com, trial software downloads for accounting software, ERP software, CRM software and business software systems Search Bitpipe.com for the latest white papers and business webcasts Whatis.com, the online computer dictionary

data security weaknesses can, at the least, lead to an unnecessary remote system compromise and malware infection. More important, they create accountability and oversight problems and lead to the situation where no one is truly responsible for security of the system.

If you want to buy yourself better SQL Server database security, then focus less on fancy security products and technical controls and more on the basics of security operations. It's hard to fight the marketing machine and their all-in-one technologies that can harden your database environment virtually guaranteeing security and compliance. But go against the grain. Set your sights on getting your processes right first.

Once you have the basics down pat, you can then go about finding ways to automate your controls to take some of the effort out of the process. This will have the double benefit of closing that ever-evasive change management loop and providing a rock solid database environment that you know you've gone the extra mile to lock down.

ABOUT THE AUTHOR:   

[IMAGE]Kevin Beaver is an independent information security consultant, speaker and expert witness with Atlanta-based Principle Logic LLC. He has nearly two decades of experience in IT and specializes in performing information security assessments regarding compliance and risk management. Kevin has authored/co-authored six books on information security including Hacking For Dummies and Hacking Wireless Networks For Dummies (Wiley) as well as The Practical Guide to HIPAA Privacy and Security Compliance (Auerbach). He's also the creator of the Security On Wheels information security audio programs providing security learning for IT professionals on the go. Kevin can be reached at kbeaver@principlelogic.com. Copyright 2007 TechTarget

Rate this Tip To rate tips, you must be a member of SearchSQLServer.com. Register now to start rating these tips. Log in if you are already a member. DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.