Is your data secured? Are you a victim of a SQL injection hack? In this session, you'll discover some commonly overlooked practices in securing your SQL Server databases. Presenter Gabriel Villa will explain aspects on physical security, passwords, privileges and roles, and preventative best practices. He will also demonstrate auditing and look at some .Net code samples to use on your applications. He will also show the new security features in SQL Server 2012.

3.  Recently moved to Colorado Springs
 SQL Server 7, 2000, 2005 and 2008
 .Net Developer VB.Net and C#
 www.extofer.com
 twitter: @extofer

4.  Security Model
 Authentication
 Passwords
 Threats
 Physical Security and other best practices

5.  Principal Windows Users
SQL Login
 Windows Users
 SQL Logins
Database Users
 Roles DB Roles
 Groups
 Securables
Schemas
 Schemas

6.  Windows Authentications
 Domain or local Windows Account
 Active Directory Integration
 Supports Groups
 Use Whenever Possible

7.  Mixed Authentication
 Legacy or Hard Coded Referenced Logins
 Non Windows Clients
 Connections over Internet

9.  Strong Password
 10 – 12 characters in length
 Use Upper and Lower Case
 Numbers
 Special Characters (symbols)
 l33t speak
 E = 3 or A=4 or @, T= + or 7
 l33t password generator

10.  DO NOT hardcode passwords
 ASP.Net encrypt web.config
 Encrypt password in your code
 SQLPing checks for default passwords
 Change passwords frequently
 Do Not use the same passwords

11.  Social Engineering
 SQL Injection
 Beware of Port Sniffers

12.  Social Engineering
 Manipulating people to gather data
 Not using technical cracking tools or techniques

14.  SQL Injection
 Vulnerable to any RDBMS, not just MS SQL
Server
 Attacker post SQL commands via front end
applications
 Tools: ‘ , --, ;

15.  Check for Valid Input
 DDL Triggers
 Use Stored Procedures
 Use Parameters
 Customize Error Messages
 Avoid errors returning securable names

16.  Change default port

19.  Lock server room or rack when not in use
 Restrict access to unauthorized individuals
 If feasible, use security cameras

20.  Second Tuesday of every month
 Test updates or hotfixes immediately
on non-production servers
 Schedule patches soon after tested

21.  Avoid network shares on servers
 Don’t surf the Web on the server
 Only enable required protocols
 Keep servers behind a firewall

22.  Encrypt your DB backups
 Test backups by restoring
 Restrict System Stored Proc’s and
XP

23. http://www.sqlservercentral.com/Books/
 Defensive Database Programming by Alex Kuznetsov
 Protecting SQL Server Data by John Magnabosco
 SQL Server Tacklebox by Rodney Landrum

24. Slide Deck at http://www.extofer.com
Gabriel Villa
email: extofer@gmail.com
blog: www.extofer. com
twitter: @extofer