Do you think that your data is not secured in the cloud? Is that one of the reasons for you to not migrate at least some workloads there? Things changed in the last few months in terms of Azure security. In this session we will take a closer look at what the features Row Level Security(RLS) and Dynamic Data Masking can do for your business and how they can help you secure your databases.

1. Boris Hristov, SQL Server MVP
Securing SQL Azure DB?

2. Organizer
SQLSaturday Rheinland 201513.06.2015

3. Bronze Sponsor
SQLSaturday Rheinland 201513.06.2015

4. Silver Sponsor
SQLSaturday Rheinland 201513.06.2015

5. Gold Sponsor
SQLSaturday Rheinland 201513.06.2015

6. You rock!
SQLSaturday Rheinland 201513.06.2015

7. That’s not a marketing talk!
DISCLAIMER:

8. So who is this guy Boris?
@BorisHristov

9. time
coolness
Session’s Timeline
Dynamic Data Masking Row Level Security

10. Dynamic
Data Masking

11. “Have you ever…”

12. SELECT * FROM
dbo.Customers
custid FirstName LastName PhoneNumber EmailAddress CreditcardNumber
1 Boris Hristov +359889000000 brshristov@live.com 1111-1111-1111-1111
2 Ivan Donev +359889000000 idonev@live.com 2222-2222-2222-2222
3 Stanislav Zhelyaskov +359889000000
szhelyaskov@live.com
3333-3333-3333-3333
4 Ivan Minchev +359889000000 iminchev@live.com 4444-4444-4444-4444

13. custid FirstName LastName PhoneNumber EmailAddress CreditcardNumber
1 Boris Hristov +359889000000 bxx@xxxx.com xxxx-xxxx-xxxx-1111
2 Ivan Donev +359889000000 ixxx@xxxx.com xxxx-xxxx-xxxx-2222
3 Stanislav Zhelyaskov +359889000000 sxx@xxxx.com xxxx-xxxx-xxxx-3333
4 Ivan Minchev +359889000000 ixx@live.com xxxx-xxxx-xxxx-4444
SELECT * FROM
dbo.Customers

14. Dynamic
Data Masking

15. DEMO
Dynamic Data Masking

16. Row Level
Security

17. “Have you ever…”

18. orderid custid orderdate shipdate shipcountry
1 1 4/20/2015 20:15:49 4/20/2015 20:15:49 Bulgaria
2 1 4/20/2015 20:15:49 4/20/2015 20:15:49 Germany
3 2 4/20/2015 20:15:49 4/20/2015 20:15:49 Germany
4 2 4/20/2015 20:15:49 4/20/2015 20:15:49 Bulgaria
5 3 4/20/2015 20:15:49 4/20/2015 20:15:49 Bulgaria
SELECT * FROM
dbo.Orders

19. orderid custid orderdate shipdate shipcountry
1 1 4/20/2015 20:15:49 4/20/2015 20:15:49 Bulgaria
4 2 4/20/2015 20:15:49 4/20/2015 20:15:49 Bulgaria
5 3 4/20/2015 20:15:49 4/20/2015 20:15:49 Bulgaria
SELECT * FROM
dbo.Orders

20. How is that
possible?

21. -- user defined function
CREATE FUNCTION Security.fn_securitypredicate
(@SalesRep AS sysname)
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN SELECT 1 AS fn_securitypredicate_result
WHERE @SalesRep = USER_NAME()
OR USER_NAME() = 'Manager';
-- security policy
CREATE SECURITY POLICY SalesFilter
ADD FILTER PREDICATE Security.fn_securitypredicate(SalesRep)
ON dbo.Sales WITH (STATE = ON);
No GUI, folks 

22. DEMO
Row Level Security

23. Cool, huh?

24. Not that fast…

25. time
coolness Session’s Timeline
Dynamic Data Masking Row Level Security

26. DEMO
Row Level Security Issues

27. So is that a
security feature
then?

28. Or is that a
programmability
feature?

29. Summary
There’s a lot going on in SQL Azure DB
Easily mask sensitive data with Dynamic Data Masking
Limit the rows users can see with Row Level Security
Be aware of the current issues of RLS

30. Save the date!
13.06.2015 SQLSaturday Rheinland 2015

31. Thank you!
Contacts:
brshristov@live.com
www.borishristov.com
@BorisHristov