Best Practices for Your SQL Server Security

by Jan 20, 2021

Categories

Tags

Administration agent-based monitoring Agentless Monitoring alert responses alert thresholds alerting Alerts Amazon Aurora Amazon EC2 Amazon RDS Amazon RDS / Aurora Amazon RDS for SQL Server Amazon Redshift Amazon S3 Amazon Web Services (AWS) Analytics application monitoring Aqua Data Studio automation availability Azure Azure SQL Database azure sql managed instance Azure VM backup Backup and recovery backup and restore backup compression backup status Backup Strategy backups big data Blocking bug fixes business architecture business data objects business intelligence business process modeling business process models capacity planning change management cloud cloud database cloud database monitoring cloud infrastructure cloud migration cloud providers Cloud Readiness Cloud Services cloud storage cloud virtual machine cloud VM clusters code completion collaboration compliance compliance audit compliance audits compliance manager compliance reporting conference configuration connect to database cpu Cross Platform custom counters Custom Views customer survey customer testimonials Dark Theme dashboards data analysis Data Analytics data architect data architecture data breaches Data Collector data governance data lakes data lineage data management data model data modeler data modeling data models data privacy data protection data security data security measures data sources data visualization data warehouse database database administration database administrator database automation database backup database backups database capacity database changes database community database connection database design database developer database developers database development database diversity Database Engine Tuning Advisor database fragmentation database GUI database IDE database indexes database inventory management database locks database management database migration database monitoring database navigation database optimization database performance Database Permissions database platforms database profiling database queries database recovery database replication database restore database schema database security database support database synchronization database tools database transactions database tuning database-as-a-service databases DB Change Manager DB Optimizer DB PowerStudio DB2 DBA DBaaS DBArtisan dBase DBMS DDL Debugging defragmentation Demo diagnostic manager diagnostics dimensional modeling disaster recovery Download drills embedded database Encryption End-user Experience entity-relationship model ER/Studio ER/Studio Data Architect ER/Studio Enterprise Team Edition events execution plans free tools galera cluster GDPR Getting Started Git GitHub Google Cloud Hadoop Healthcare high availability HIPAA Hive hybrid clouds Hyper-V IDERA IDERA ACE Index Analyzer index optimization infrastructure as a service (IaaS) infrastructure monitoring installation Integrated Development Environment interbase Inventory Manager IT infrastructure Java JD Edwards JSON licensing load test load testing logical data model macOS macros managed cloud database managed cloud databases MariaDB memory memorystorage memoryusage metadata metric baselines metric thresholds Microsoft Azure Microsoft Azure SQL Database Microsoft PowerShell Microsoft SQL Server Microsoft Windows MongoDB monitoring Monitoring Tools Monyog multiple platforms MySQL news newsletter NoSQL Notifications odbc optimization Oracle PeopleSoft performance Performance Dashboards performance metrics performance monitoring performance schema performance tuning personally identifiable information physical data model Platform platform as a service (PaaS) PostgreSQL Precise Precise for Databases Precise for Oracle Precise for SQL Server Precise Management Database (PMDB) product updates Project Migration public clouds Query Analyzer query builder query monitor query optimization query performance Query Store query tool query tuning query-level waits Rapid SQL rdbms real time monitoring Real User Monitoring recovery regulations relational databases Releases Reporting Reports repository Restore reverse engineering Roadmap sample SAP Scalability Security Policy Security Practices server monitoring Server performance server-level waits Service Level Agreement SkySQL slow query SNMP snowflake source control SQL SQL Admin Toolset SQL CM SQL code SQL coding SQL Compliance Manager SQL Defrag Manager sql development SQL Diagnostic Manager SQL Diagnostic Manager for MySQL SQL Diagnostic Manager for SQL Server SQL Diagnostic Manager Pro SQL DM SQL Doctor SQL Enterprise Job Manager SQl IM SQL Inventory Manager SQL Management Suite SQL Monitoring SQL Performance SQL Quality SQL query SQL Query Tuner SQL Safe Backup SQL script SQL Secure SQL Security Suite SQL Server sql server alert SQL Server Migration SQL Server Performance SQL Server Recommendations SQL Server Security SQL statement history SQL tuning SQL Virtual Database sqlmemory sqlserver SQLyog Storage Storage Performance structured data Subversion Support tempdb tempdb data temporal data Tips and Tricks troubleshooting universal data models universal mapping unstructured data Uptime Infrastructure Monitor user experience user permissions Virtual Machine (VM) web services webinar What-if analysis WindowsPowerShell

SQL Server security has always been important. Protecting the enterprise data resources stored in SQL Server databases is arguably the prime responsibility of an organization’s DBAs. The performance and availability of mission-critical database applications quickly become irrelevant in the aftermath of a data breach. Data assets must be secured if they are to be used productively.

Remote work, which greatly expanded due to the COVID-19 pandemic, adds to security concerns and makes it more difficult to protect valuable databases. Potentially unsecured devices being used to access sensitive data present inviting new targets for hackers. There is no lack of cybercriminals who would like nothing better than to compromise your SQL Servers.

Some fairly recent examples illustrate the dangers your SQL Servers are under every day. Hacker campaigns such as Vollgar are affecting thousands of instances with malware designed to mine cryptocurrency. Malware infections can create backdoor access to SQL Servers like that seen in the Skip-2.0 exploitation tool. The tool allows remote attackers to use a “magic” password to connect to any account and hides its tracks by disabling logging while performing an intrusion.

Needless to say, these are the kinds of stories that give database teams nightmares. They need to accept the fact that their systems are potentially subject to malicious internal or external entities who want to compromise their data. Traditional hacking methods like brute force attacks and SQL injection are still used to take advantage of vulnerable systems. 

This is a troubling state of affairs, but some remedies can help alleviate security concerns and enable team members to get a better night’s sleep. These best practices offer essential recommendations to increase the security of enterprise SQL Server databases.

What Can a DBA Do?

There are many ways in which a DBA can strengthen the SQL Server security landscape. With the right mix of configuration decisions and regular activities, system security can be substantially increased. Here are some of the things the database team can do to protect their SQL Servers more effectively. 

  • Keep SQL Servers and the Windows machines on which they are installed updated with security patches. If at all possible, patches should first be introduced in a test environment rather than risk problems with production systems. Run periodic patch audits to ensure all systems are up to date from a security perspective and address any identified issues immediately.

  • Use stored procedures whenever possible. Since they depend on specific input, it is less likely that SQL injection attacks by random hackers will succeed. 

  • Employ Windows authentication over SQL authentication to provide enhanced security using operating system tools and the ability to centralize accounts with Active Directory. If SQL authentication is being used, disable the SA account as it is a favorite target of hackers looking for a backdoor into your systems. 

  • Isolate SQL Servers on subnetworks away from general network traffic. Don’t provide Internet access to the servers and consider using nonstandard port numbers to thwart hackers.

  • Limit the applications running to one per server if possible. Do not install unnecessary components and refrain from running non-utility, non-SQL apps on the server. Fewer applications mean fewer opportunities for vulnerabilities to be exploited. 

  • Institute strong access control policies that assign role-based permissions. In some cases, you may find it necessary to define more granular permissions, including row-level security to limit access to table information. Try to balance security and functionality when implementing access control to avoid breaking the application or making it too hard to manage while demonstrating regulatory compliance. 

  • Use strong passwords. Brute force attacks are still used by hackers because they work. Stronger password cracking algorithms combined with increased computing power have made traditional guidelines for creating strong passwords obsolete. You should consider using password generators to obtain long sequences of random characters for extra security.

  • Perform regularly scheduled security audits to identify violations and uncover unusual access patterns that may indicate malicious activity. Excessive numbers of failed logins can be the result of brute force password attacks and should be thoroughly investigated.  

A Tool for Enhanced SQL Server Security

A TechGenix webinar sponsored by IDERA and presented by Brien Posey and Elan Kol goes into more detail concerning the methods DBAs can use to strengthen SQL Server security using SQL Secure. This dedicated SQL Server security tool provides DBAs with valuable features to harden database defenses. Its features include:

  • The ability to identify users’ effective rights and find gaps in your security models;
  • Details on who has access to sensitive data resources and how they are being used;
  • Customizable policy templates so you can audit for compliance with regulatory standards;
  • Weak password detection;
  • Access to historical security information for analysis of changes;
  • A security scorecard to quickly identify potential issues;
  • Over 20 out of the box reports enabling security information to be shared across the enterprise.

DBAs interested in securing their SQL Servers should take the time to view the webinar and take advantage of the free 14-day trial of SQL Secure. Testing the full functionality of the product will demonstrate how it can help you protect your enterprise databases.

Ask any victim of a data breach if they wish they had taken stronger measures to prevent it. With the right tools and best practices, you can make it harder for hackers to gain access to your SQL Servers. It’s worth the effort.