Hiding SQL Server from External Crackers

We harden SQL Server to minimize the threats to SQL Server from rouges/hackers and crackers, but it may be equally important to harden systems other than SQL Server to protect our data. For example, coders and DBA’s need to ensure that calls to SQL Server are protected from SQL Injection attacks. Another valuable tactic is to prevent…


Enabling SSL on SQL Server Connections on Failover Clusters

With high-security SQL Server configurations we usually want to encyrpt the data-in-transit between SQL Server and the application servers. It’s a little more trouble with a Failover Cluster Instance (FCI) than a stand-alone instance, and this post is primarily just a link to help me make sure I can easily find this article: http://msdn.microsoft.com/en-us/library/ms191192.aspx. I’ll…


SQL Server Ports

 Quick cheat sheet for port numbers used by SQL Server services or services that SQL Server may depend on: 21 TCP FTP (replication) 80 TCP HTTP endpoints, Reporting Services, HTTP replication 135 TCP & UDP RPC, WMI, MSDTC, SQL Agent file copy, and TSQL Debugger (RPC used for multiple purposes including SSIS and clustering.) 137 UDP File…

3

Does the DoD STIG require Transparent Database Encryption (TDE)?

Does the DoD STIG require Transparent Database Encryption (TDE)? The short answer is: It depends on whether or not the Data Owner says the data must be encrypted. The current version of the DoD Database STIG is v8r1. Here are two relevant sections from that document: 3.1.4.3Unique security requirements (encryption of sensitive data)Access to sensitive…


SQL Server Accounts

Sometimes I run into established DBA’s who have a little confusion regarding the different types of accounts used with SQL Server. I suspect that kind of confusion may come from a history of installing/experimenting with SQL Server on a workstation or laptop where they do everything under a single account. The biggest problem with a…

2

The Database STIG’s System Security Plan

The Database STIG requires a written System Security Plan, and it’s the responsibility of the Information Assurance Officer (IAO) to create it (see section 3.1.9 below). Although the DBA doesn’t create it, the DBA can advise the IAO, and the DBA is required to maintain compliance with the security plan. The following excerpts are from…

3

Securing SQL Server Integration Services (SSIS)

I was recently asked about securing SQL Server Integration Services, and I knew next to nothing about it. After digging in for a while, here are my notes, mostly for myself, but shared in case they might help someone else. There are 3 areas that need to be secured: The SSIS Engine SSIS Packages SQL Server…

1

Separation of Duties for DBA’s

Someone recently asked me about the principle of separation of duties (aka segregation of duties) as it applies to SQL Server DBA’s, and I thought that would make a good topic for this blog, so here goes… The idea of separating duties in general is to prevent a single person from being able to complete…

3

SQL Server, the DoD, and Common Criteria

Common Criteria is an international standard for a set of security characteristics, and the U.S. Department of Defense (DoD) Database Security Technical Implementation Guide (STIG) (via the Security Readiness Review for SQL Server) requires it to be enabled. (See DG0084.) You can turn it on by using sp_configure (“common criteria compliance enabled”) or by using SQL Server…

2

Changing Domains on a SQL Server

Someone recently asked me what issues might arise when changing a server’s domain and the server is running SQL Server. Here are the possible issues I’m aware of as far as SQL Server is concerned: 1. SQL Server SysAdmin (SA) Access. The most important issue is if you only have SQL Server sysadmin via domain…

4