The document discusses how to keep databases secure by monitoring them on a daily basis. It recommends automating the monitoring process using tools like SQL Agent and scripts to check for critical changes to authentication and authorization daily and all authentication changes weekly. Less frequent checks should monitor encryption, outdated accounts, and configurations granting elevated privileges. Starting with a short list of items and running quick checks minimizes time spent while still providing security awareness.

1. HOW TO KEEP YOUR DATABASES SECURE
IN JUST MINUTES A DAY
Ed Leighton-Dick

2. ABOUT ME
Email: ed@leightondick.com
Blog: edleightondick.com
Twitter: @eleightondick

3. JOIN ME AT PASS SUMMIT 2017!
• “Three Steps to Lasting Encryption”
• “How to Keep Your Databases Secure In Just Minutes a Day”

4. WHAT WE’LL DISCUSS
• Why, what, where, and how
• What to watch when

5. WHY, WHAT, WHERE, AND HOW

6. WHY
• Catch potential problems early… before they become a
problem
• Awareness of potential vulnerabilities
• Awareness of changes others have made
• Make formal audits easier
• It makes you look GOOD!

7. WHAT
• Changes with security implications
• Items requested by third-party audits
• Regulations (PCI, HIPPA, SOX)
• Frameworks (NIST)
• Information requested by management
• Bottom line: What do you want to know?

8. WHERE
• Catalog views
• DMOs
• Error logs
• Default trace
• SQL Audit
• system_health session – Ring buffers
• Custom XEvents and traces

9. WHERE
• Windows
• Logs
• Registry
• AD
• WMI

10. HOW
• Make it automated
• Make it quick to run
• Make it quick to get results
• Keep data for longer-term trending and analysis

11. HOW
• SQL Agent
• Jobs – T-SQL, PowerShell
• Events
• WMI queries
• Event Notifications
• Traces/XEvent sessions

12. HOW
• Centralized server
• Use data compression
• Use encryption
• Service Broker

13. HOW
• Reporting
• SSRS
• Analytics
• SSAS
• Power BI
• SIEM tools/Splunk

14. WHAT TO WATCH WHEN

15. IMMEDIATE/DAILY
• Critical changes to authentication and authorization
• Suspicious patterns of access

16. WEEKLY
• All changes to authentication
• Significant changes to authorization
• Potentially dangerous settings and actions

17. LESS FREQUENT… BUT NO LESS
IMPORTANT
• All authentication and authorization
• Check for outdated accounts
• Configuration
• Pay special attention to items that grant elevated privileges
• Encryption
• Is it current?
• Is it secure?

18. WRAP-UP

19. WHAT WE DISCUSSED
• Why, what, where, and how
• What to watch when

20. NEXT STEPS
• Download the demo scripts
• Get a short list of items to track
• Start!

21. QUESTIONS?
Email: ed@leightondick.com
Blog: edleightondick.com
Twitter: @eleightondick

22. THANK YOU FOR ATTENDING!
~ Please remember to fill out your comment cards ~