SQL Server Security

Marek Chmel
Lead Database Administrator @ AT&T
MVP: Data Platform | MCSE: Data Management and Analytics
MCT: Regional Lead | Certified Ethical Hacker CEHv8
[email protected]
@MarekChmel
Motivation
§ SQL Server is a major part of IT infrastructure
§ SQL Server stores sensitive data
§ Properly securing SQL Server is crucial for application and DBA team
Session Agenda
§ Understanding Authentication Modes
§ Server Level Security
§ Database Level Security
§ Security Audit
§ Security Review
SQL Security Progress through the time
§ Redefined Engineering security processes – 2005
§ SQL no longer a windows admin – 2005
§ CC EAL4+ for SQL 2005 SP2
§ T-SQL Encrypt/Decrypt functions – 2005
§ Audit – 2008
§ TDE – 2008
§ EKM – 2008
§ Support for Windows Core – 2012
§ Separation of Duty – 2014
§ Always Encrypted, RLS and more on 2016
Organizational Security & Compliance
§ Data Protection
§ Control Access
• User Defined Server Roles
• Default Schema for Groups
• Contained Database Authenticaton
• AAD
§ Compliance
• SQL Server Audit
w Resilience
w User Defined
w Filtering
• 3rd party verified (Common Criteria)
Data Protection
Known for the lowest vulnerabilities across major RDBMS

§ Powerful Encryption Technologies

• AES256 for backups
• SHA512 for password hashes
§ Built on Advanced Security Infrastructure
• Built-in cryptography hierarchy
• Transparent Data encryption
• Extensible Key Management
• Sing code modules
SQL Server Service Security Overview
§ Startup accounts used to start and run SQL Server can be domain user
accounts, local user accounts, managed service accounts, virtual
accounts, or built-in system accounts – default is virtual account
§ gMSA - Auto managed
§ Virtual account is a local managed account
• Can access network with credentials of computer account
• Can Register SPN
• Cannot be used for clustered instance
SPN, Kerberos and Extended Protection
§ When SQL Server starts, it tries to automatically register
its SPN with Active Directory.
• If the SQL Server service account doesn't have the right to do so,
the SPN is not created and Kerberos authentication is not
possible.

SELECT auth_scheme, net_transport, client_net_address

FROM sys.dm_exec_connections;

§ Extended Protection for Authentication is providing two

mechanisms: service binding and channel binding
• Service binding requires that the client adds to the
authentication request a signed SPN
• Channel binding establishes a secure channel using Transport
Layer Security
Games with TLS
§ SQL Server can be configured to support TLS 1.2 from 2008+
§ Requirments for TLS
• patch level
• Registry
• Private Key Security
DEMO

Configuring TLS 1.2

SQL Security Framework
§ What Are Principals?
§ What Are Securables?
§ SQL Server Permissions
SQL Principals
Securables
Permissions
Principals
Windows Group
Domain User Account

Windows Local User Account

SQL Server Login

Server Role
SQL Server

User
Database Role

Database Application Role

What Are Securables?
Securables
Permissions
Principals
Windows Group
Files
Domain User Account
Registry Keys
Windows Local User Account

SQL Server Login Server

Server Role
SQL Server
Database

User Schema
Database Role

Database Application Role

SQL Server Permissions
§ Server-Level Permissions
• Logins
• Credentials
• Server-Level Roles
§ Database-Level Permissions
• Users
• Schemas
• Database Level Roles
Working with SQL Logins
§ We need to understand the linkage between logins, users, credentials,
proxies, linked server logins etc.
§ Two types of logins – Windows and SQL
• SQL Logins have a hashed password stored locally in master DB

§ SQL 2012+
• hashBytes = 0x0200 | fourByteSalt | SHA512(utf16EncodedPassword+fourByteSalt)

§ SQL 2008R2 and Older

• hashBytes = 0x0100 | fourByteSalt | SHA1(utf16EncodedPassword+fourByteSalt)
Local System Admins
§ Local Windows Administrator has always access to SQL Server via several
ways
• Up to 2008r2 local system account has SA rights
• 2012+ SQL server writer has SA rights
SQL Authentication
§ 2 Modes for authentication
• Windows
• SQL and Windows
§ Authentication mode configured via SSMS or via registry
• Changing auth mode requires service restart
DEMO

SQL SA
SQL Single User Mode
§ There are several parameters which can be used to start the SQL Server
• Startup parameters –f and –m (single user and minimal configuration)
• With any of these parameters local windows admins are sysadmins for SQL
§ No logon triggers apply with this configuration
DEMO

Local System Admin

SQL Roles
Using SysAdmin for Information Gathering
§ Sysadmin has unlimited access to information stored within SQL server
• Even while this information is encrypted
§ Interesting sources of information
• Login PWD
• Linked Servers
• Credentials
w Encrypted using AES (2012+) or 3DES
Locating SQL Server instances
§ MS SQL Server identification, through TCP/UDP port scanning, can be
performed with tools such as Nmap, Nessus, SQLping3, OSQL/SQLCMD,
MSF’s mssql_ping module and PowerUpSQL

msf > use auxiliary/scanner/mssql/mssql_ping

msf auxiliary(mssql_ping) > set RHOSTS Target_IP_or_CIDR_identifier
msf auxiliary(mssql_ping) > run
Escalating the priviledge
§ escalating privileges within SQL Server is unauthenticated user / local
user / domain user -> SQL login

§ Get-SQLInstanceDomain | Invoke-SQLAuditWeakLoginPw
DEMO

Locating SQL Instances

What Are Credentials?
§ Contain windows authentication information
§ Allow SQL Accounts to connect to non-SQL resources
§ SQL Logins can only map to one credential
§ Created automatically. Associated with specific endpoints
DEMO

Credential passwords
Linked server passwords
Managing Users
§ Create a login
§ Create a database scope user
§ Assign permissions to the user
Special Users
§ DBO
The sa login and members of sysadmin role are mapped to dbo account

§ Guest
This user account allows logins without user accounts to access a
database
SQL Server Cryptography Architecture
When to Use Keys and Certificates
§ When to use Certificates
• To secure communication in database mirroring
• To sign packets
• To encrypt data or connections
§ When to use Keys
• To help secure data
• To sign plaintext
• To secure symmetric keys
Auditing Security
§ What Is Auditing?
§ Security Auditing with Profiler
§ Auditing with DDL Triggers
§ Introducing SQL Server Audit
§ SQL Server Audit Action Groups and Actions
Auditing with triggers
§ DDL Triggers
• Prevent certain changes in your database schema
• You want something to occur in the database in response to a change in your
database schema
• You want to record changes or events in the database schema
• Start, stop, pause and modify the trace results
• Replay the trace results
§ Logon Triggers
CREATE TRIGGER tr_LogOn_CheckIP ON ALL SERVER
FOR LOGON
Introducing SQL Server Audit
§ SQL Server Auditing
• Tracks and logs events that occur on the system
• Can track changes on the server or database level
• Can be managed with Transact-SQL
DEMO

SQL Audit
Row Level Security
§ Fine-grained access control over specific rows in a
database table
§ Help prevent unauthorized access when multiple
users share the same tables, or to implement
connection filtering in multitenant applications
§ Administer via SQL Server Management Studio or
SQL Server Data Tools
§ Enforcement logic inside the database and schema
bound to the table.
Benefits of row-level security

Fine-grained Application Centralized

access control transparency security logic
Keeping multi-tenant Enforcement logic resides
RLS works transparently at
databases secure by inside database and is
query time, no app changes
limiting access by other schema-bound to the table
needed.
users who share the same it protects providing greater
tables. security. Reduced
Compatible with RLS in
other leading products. application maintenance
and complexity.
DEMO

Row Level Security

Dynamic Data Masking

Regulatory Sensitive Data

Compliance Protection
Minimal Impact on Existing Apps
§ No need to modify existing application queries
§ Complimentary to other data protection features
DEMO

Dynamic Data Masking

Transparent Database Encryption
§ Entire database is protected
§ Applications do not need to explicitly encrypt/decrypt data!
§ No restrictions with indexes or data types (except FILESTREAM)
§ Performance cost is small
§ Backups are unusable without key
§ Can be used with Extensible Key Management
Transparent Data Encryption: Mechanism
§ Very simple:
• Database pages are encrypted before being written to disk
• Page protection (e.g. checksums) applied after encryption
• Page protection (e.g. checksums) checked before decryption
• Database pages are decrypted when read into memory
§ When TDE is enabled, initial encryption of existing pages happens as a
background process
• Similar mechanism for disabling TDE
• The process can be monitored using the encryption_state column of
sys.dm_database_encryption_keys
w Encryption state 2 means the background process has not completed
w Encryption state 3 means the database is fully encrypted
Transparent Data Encryption: Backups
§ A backup of a TDE encrypted database is also encrypted using the
database encryption key
§ To restore the backup OR attach the database, the DEK must be available!
• There is no way around this – if you lose the DEK, you lose the ability to restore
the backup (that’s the point!)
• Maintain backups of server certificates too
DEMO

Transparent Data Encyption

Always Encrypted

Allows customers to store sensitive data outside of their trust boundary.

Data remains protected from high-privileged, yet unauthorized users incl. rouge
admins & hackers.
Encryption Types
§ Two types of encryption Randomized encryption
available Encrypt('123-45-6789') = 0x17cfd50a
Repeat: Encrypt('123-45-6789') =
• Randomized encryption uses 0x9b1fcf32
Allows for transparent retrieval of
a method that encrypts data encrypted data but NO operations
in a less predictable manner More secure
• Deterministic encryption uses Deterministic encryption
a method which always Encrypt('123-45-6789') = 0x85a55d3f
Repeat: Encrypt('123-45-6789') =
generates the same 0x85a55d3f
encrypted value for any given Allows for transparent retrieval of
plain text value encrypted data AND equality
comparison
E.g. in WHERE clauses and
joins, distinct, group by
How It Works
DEMO

Always Encrypted
Q&A

Marek Chmel
MVP: Data Platform | MCSE: Data Management and Analytics | MCT: Regional Lead | CEH v8
[email protected]
@MarekChmel