Meeting Security Benchmarks and Compliance with Microsoft SQL Server

1. Meeting Security Benchmarks
and Compliance with Microsoft
SQL Server
K. Brian Kelley

2. About Me
• Security Related:
– Infrastructure & Security Architect
– Certified Information Systems Auditor (CISA)
– Accredited CISA Trainer
– Incident Handler / Penetration Tester
• SQL Server Related:
– Data Architect
– SQL Server security columnist / blogger
– SQL Server and Security speaker & trainer

3. Agenda
• What Audit and Compliance Focuses On
• The Three As
• Data Security
• Encryption and Obfuscation
• Detecting Structural Change

4. Audit and Compliance
Understanding the Jargon

5. What do I care about as an auditor?
• Information Systems (IS) processes
• Related business processes
• Controls over those processes

6. What’s a Control?
• Two parts:
– Objective
– Measure
• Objective: what you’re trying to achieve
• Measure: something done to fulfill said objective

7. The Control Mantra
• Documentation alone isn’t a control.
Therefore:
• No evidence? No control.
• No review? No control.

8. The Three A’s

9. What are the three A’s?
• Authentication: proving who you are
• Authorization: determining what rights/permissions
you have
• Accounting / Auditing: tracking what you do

10. Demo

11. Data Security

12. What to Look for in Data Security
• Permissions are important, so start there
• Should be tied to data classification
• Encompasses data encryption and obfuscation
• Data handling as well

13. Demo

14. Encryption / Obfuscation

15. Data Encryption
• Sensitivity of the data (data classification)
• Impact to the organization should information be stolen / lost
• Regulations, compliance requirements, laws, industry standards
• Algorithms for encryption and how they’re implemented

16. SQL Server Encryption Options
• Built-in Encryption Objects and Functions
• AlwaysEncrypted
• Transparent Data Encryption

17. Data Encryption – Operations
• Key Escrow must be specified, tested, and have
approved controls
• Performance impact
• Situations where the data exists in plaintext (in
memory, etc.)

18. Data Obfuscation
• Typically data, in its resting state, is unprotected.
• Could also exist at rest in non-encrypted way.
• For less that privileged access, data is masked in some way.
• Some include encryption as part of data obfuscation

19. Data Obfuscation in SQL Server
• Dynamic Data Masking - Introduced in SQL Server 2017
• Built into table definition - Uses algorithm you define
• Privileged users can still see unmasked data
• Seamless to application / reporting layer

20. Detecting Structural Change
DDL is important, too

21. What do I care about?
• Changes to Security Principals
• Changes to Security Permissions on Objects
• Changes to Objects Themselves
• Creation of New Databases
• Creation of New Objects

22. Out-of-the-box Options
• Extended Events are your friend.
• Other Options:
– Audit object (built on Extended Events)
– Triggers
– Default Trace
– Transaction Log (maybe)

23. Demo

24. What We Covered
• What Audit and Compliance Focuses On
• The Three As
• Data Security
• Encryption and Obfuscation
• Detecting Structural Change