This document discusses meeting security benchmarks and compliance with Microsoft SQL Server. It covers the key areas of focus for audits and compliance including authentication, authorization, and auditing ("the three A's"). It also discusses data security best practices such as permissions, encryption, and obfuscation techniques in SQL Server like AlwaysEncrypted and Transparent Data Encryption. The document demonstrates how to detect structural changes to databases and objects using extended events and other out-of-the-box SQL Server options.

1. Meeting Security Benchmarks
and Compliance with Microsoft
SQL Server
K. Brian Kelley

2. About Me
• Security Related:
– Infrastructure & Security Architect
– Certified Information Systems Auditor (CISA)
– Accredited CISA Trainer
– Incident Handler / Penetration Tester
• SQL Server Related:
– Data Architect
– SQL Server security columnist / blogger
– SQL Server and Security speaker & trainer

3. Agenda
• What Audit and Compliance Focuses On
• The Three As
• Data Security
• Encryption and Obfuscation
• Detecting Structural Change

4. Audit and Compliance
Understanding the Jargon

5. What do I care about as an auditor?
• Information Systems (IS) processes
• Related business processes
• Controls over those processes

6. What’s a Control?
• Two parts:
– Objective
– Measure
• Objective: what you’re trying to achieve
• Measure: something done to fulfill said objective

7. The Control Mantra
• Documentation alone isn’t a control.
Therefore:
• No evidence? No control.
• No review? No control.

8. The Three A’s

9. What are the three A’s?
• Authentication: proving who you are
• Authorization: determining what rights/permissions
you have
• Accounting / Auditing: tracking what you do

10. Demo

11. Data Security

12. What to Look for in Data Security
• Permissions are important, so start there
• Should be tied to data classification
• Encompasses data encryption and obfuscation
• Data handling as well

13. Demo

14. Encryption / Obfuscation

15. Data Encryption
• Sensitivity of the data (data classification)
• Impact to the organization should information be stolen / lost
• Regulations, compliance requirements, laws, industry standards
• Algorithms for encryption and how they’re implemented

16. SQL Server Encryption Options
• Built-in Encryption Objects and Functions
• AlwaysEncrypted
• Transparent Data Encryption

17. Data Encryption – Operations
• Key Escrow must be specified, tested, and have
approved controls
• Performance impact
• Situations where the data exists in plaintext (in
memory, etc.)

18. Data Obfuscation
• Typically data, in its resting state, is unprotected.
• Could also exist at rest in non-encrypted way.
• For less that privileged access, data is masked in some way.
• Some include encryption as part of data obfuscation

19. Data Obfuscation in SQL Server
• Dynamic Data Masking - Introduced in SQL Server 2017
• Built into table definition - Uses algorithm you define
• Privileged users can still see unmasked data
• Seamless to application / reporting layer

20. Detecting Structural Change
DDL is important, too

21. What do I care about?
• Changes to Security Principals
• Changes to Security Permissions on Objects
• Changes to Objects Themselves
• Creation of New Databases
• Creation of New Objects

22. Out-of-the-box Options
• Extended Events are your friend.
• Other Options:
– Audit object (built on Extended Events)
– Triggers
– Default Trace
– Transaction Log (maybe)

23. Demo

24. What We Covered
• What Audit and Compliance Focuses On
• The Three As
• Data Security
• Encryption and Obfuscation
• Detecting Structural Change