Securing SQL Server

Securing SQL Server 2nd Edition Coming Soon

mrdenny — Tue, 24 Apr 2012 21:13:59 +0000

I’m pleased to be able to announce that the 2nd edition of Securing SQL Server is going to be available soon. It’s just been made available for pre-order on Amazon.com. The second edition comes in at about 350 pages (according to Amazon, I don’t actually have a copy of it yet) while the first edition came in at about 270 pages so there has been a LOT of material added to the book.

While a lot of the new information is focused on SQL Server 2012, there is also a lot of new material which relates to older version of SQL Server including chapters on SQL Server Analysis Services and SQL Server Reporting Services, information on Instant File Initialization, EXECUTE AS, Database Firewalls, SAN Security, Actual Data Security (no idea how this got missed the first time around, but that’s to Brent Ozar for pointing it out).

As far as the SQL Server 2012 information you’ll find updated information about the SHA2 hashing algorithms, Securing AlwaysOn Availability Groups, Security and SQL Server Clustering, Security and Contained Databases and a lot more.

If you already have a copy of the 1st edition I encourage you to take a look at the second edition as well. I know that it’s really soon for a second edition of a book (the first edition just came out February 2011, but this new edition comes on the release of SQL Server 2012.

Hopefully you pre-order you copy today.

Denny

P.S. Yes this edition will be available for the Kindle as well, that takes a little time. As soon as I know that it’s been posted for the Kindle (usually happens a little after Amazon gets the physical books) I’ll post another announcement here.

P.P.S. If you visit my SecuringSQLServer.com site I’ve updated everything there for the new edition. You can always find the old edition listed on the Other Books page on that site or on the Books page on mrdenny.com.

180k+ websites attacked because of bad dev code

mrdenny — Mon, 24 Oct 2011 21:36:46 +0000

There is another massive SQL Injection attack going around. This time hitting 180k ASP.NET websites. The article which I referenced has a decent write up on the actual attack and it links to a post which has detailed information about the attack. However the article on IT World gives some really poor advice on how to protect yourself from a SQL Injection attack.

There’s no easy way to fix the vulnerability of the database to this attack except to “harden” the database by applying all the patches and making all the security requirements consistent. Monitoring the database for unusual activity is important, too.

Patching SQL Server will NOT prevent SQL Injection attack, at all. The SQL Server isn’t the attack vector for a SQL Injection attack, the web application is the attack vector. By the time the SQL Injection attack gets to the SQL Server database (or any database) it’s too late.

SQL Injection is actually really easy to protect yourself from. Simply stop using dynamically generated SQL and instead start using parametrized queries (also called bound queries). That’s it, that’s the big secret. Yes I understand that writing your .NET code as parametrized queries is harder to write than just doing string concatenation and running the query, but getting your site attacked and putting malware on your customers computers because you didn’t want to do a little typing is just no excuse.

As this is a blog about my book “Securing SQL Server” here’s the sales pitch. In the book I talk all about how to use parametrized queries. It really isn’t that hard there is lots of sample code on how to do it. You don’t need to use stored procedures to use parametrized queries. You can do it with normal dynamic SQL as well, it works basically the same.

In case you didn’t get my point yet, parametrized queries are the ONLY WAY that you can 100% be sure that you are protecting yourself from SQL Injection attacks. If you can’t find some links on how to use parametrized queries here are a few links for you PHP, .NET, and more .NET.

Denny

Exposing SQL Server to the public Internet is a pretty bad idea

mrdenny — Tue, 23 Aug 2011 15:02:28 +0000

Every once and a while we hear about the nightmare situation where a SQL Server has been broken into and data has been stolen. All to often when this happens because the SQL Server is exposed directly to the public Internet. When you ask people why the SQL Server is connected to the Internet the answer is pretty much always the same, to make it easier to manage so that they don’t have to RDP to the server and manage it from there.

While this is easier, is sure isn’t the safest solution. A much better solution would be to setup a VPN Network between the office and the data center so that the connection is secured so that people from the public Internet can’t access the SQL Server’s connection. This will prevent people who aren’t supposed to be connecting to the SQL Server from connecting to the SQL Server.

I talk about this more in Chapter 1 of “Securing SQL Server”. Check it out on Amazon, which will actually let you read a good portion of Chapter 1 online for free.

Meet the author, get your copy signed

mrdenny — Wed, 27 Jul 2011 17:00:53 +0000

There are several chances to meet the author of Securing SQL Server, ask questions, and get your copy of the book signed. These include (and are subject to change):

Dallas Tech Fest – August 13th, 2011

SQL PASS – October 11-14, 2011

SQL Saturday 95 – September 17th, 2011

SQL Excursions - May 17-19, 2012

I hope to see you at one (or all) of these great events. Feel free to bring your copy and get it signed making it a priceless collectable (OK, probably not but I do love signing copies).

Denny

Want to take a look at Securing SQL Server for 30 days?

mrdenny — Mon, 18 Jul 2011 23:08:16 +0000

Thanks to Amazon, now you can rent Securing SQL Server for 30 days, and if you like it you can buy it with the cost of the rental being applied to the cost to buy the digital copy of the book. This is all done through Amazon’s new ebook rental program for text books (which they have marked my book as being). So now you can rent the book starting at a little over 1/2 the current price of the book which gives you access to the entire book for 30 days. After the 30 days is up you can extend your rental or purchase with the initial rental price counting towards your new price (you pay the difference).

As an author I’m not sure how I feel about this, good I guess because it gives people a chance to give the book a try. As a reader I like this because I can try the book for less, and if I like it keep it. If it doesn’t serve me any purpose I don’t need to keep it, and it only cost be 1/2 the cash to find out.

You don’t need to have a Kindle to make use of this, just the Kindle app installed on your PC, phone, iPad, etc.

Denny

Securing SQL Server will be available at the Tech Ed bookstore

mrdenny — Wed, 04 May 2011 19:32:07 +0000

If you are going to Tech Ed 2011, and you were thinking about purchasing a copy of “Securing SQL Server” but you wanted to thumb through it before purchasing, now is your chance. I’ve just be told that the Tech Ed book store will be stocking “Securing SQL Server”. If you pick up a copy at Tech Ed and you want it signed I’ll be working at the SQL Server booth most afternoons. Bring it on by, and I’ll be happy to sign it for you or at least draw funny faces in it.

Denny

Looks like MySQL isn’t the only company to be succeptable to a SQL Injection Attack (looking at you Barracuda)

mrdenny — Tue, 12 Apr 2011 18:46:53 +0000

Apparently Barracuda (who is in the network security business) had one of their applications broken into this week as reported by CNet. While no source code was stolen from Barracuda, it still has to be embarrassing to have names and email addresses of employees, leads and partners to be downloaded all thanks to a poorly written PHP application. Passwords were also downloaded as part of the data dump, but the passwords were only stored as MD5 hashes. However MD5 isn’t considered to be very secure any more (which is one of the reasons that SQL Server “Denali” is including SHA2 which is still considered to be secure).

Apparently the website which was attacked is normally secured using a Barracuda Web Application Firewall, but it was taken offline during a maintenance window on Friday night (April 8th, 2011). On Saturday night at about 5pm a script being crawling the website looking for SQL Injection weaknesses, which is found about two hours later.

Sadly this isn’t the first SQL Injection attack to happen recently. Just a couple of weeks ago MySQL.com’s website was attacked also using SQL Injection and a large amount of information was taken from their database as well.

You can read more about the Barracuda breach on CNet or on Barracuda’s own blog.

Denny

Securing SQL Server is available at #DevConnections / #SQLConections

mrdenny — Tue, 29 Mar 2011 17:55:10 +0000

If you are at the Dev Connections / SQL Connections conference and wanted to pick up a copy of “Securing SQL Server” it is available at the Dev Connections book store over by the check in booth.

Denny

MySQL.com compromised via SQL Injection attack. Someone should have read Chapter 6.

mrdenny — Sun, 27 Mar 2011 19:39:43 +0000

For those of you that were wondering, SQL Server isn’t the only platform which can be attacked via a SQL Injection attack. Apparently the MySQL.com website which hosts the official distribution channel for the MySQL database platform was attacked using good old SQL Injection earlier today (notice sent out via seclists.org including their schema).

Often I hear from MySQL professionals that MySQL isn’t susceptible to SQL Injection attacks. Apparently not only is it susceptible to SQL Injection attacks, but the company that writes the MySQL engine can’t correctly secure their website from being attacked. According to sucuri.net the “customer view application was used as the entry point, where the attackers were able to list the internal databases, tables and password dump…”. Not only was the password dump captured and posted only, but people have begun cracking the passwords, and some of these passwords are stupidly simple. The account sysadm (which I assume is pretty important) has a password of “qa”.

Apparently the Director or Product Management (who has 20+ years experience with most database platforms) used a 4 digit numeric password (probably his ATM pin code) as his password.

Needless to say, if you have an account on mysql.com and you use that password anywhere, you should probably change that password anywhere else that you use it.

If you think that your application is susceptible to SQL Injection attack, I recommend chapter 6 (SQL Injection Attacks) of “Securing SQL Server” which talks about how to prevent SQL Injection attacks. The examples which I provide are not SQL Server specific and the techniques shown to prevent SQL Injection attacks can be used against pretty much any relational database platform.

Denny

UPDATE (1pm PST 2011/03/27): Apparently the SSL certificate for logging into the MySQL.com website expired a month ago. The reason that I found this was that I was going to try and log in with my normal passwords (I’m pretty sure I have a mysql.com account) but with this error message, I’m not so sure about that. It’s probably OK, but still…

Sean and Jen McCown talk about “Securing SQL Server” on their show.

mrdenny — Sat, 26 Mar 2011 15:45:25 +0000

A couple of weeks ago Sean and Jen McCown (twitter | Sean’s Blog | Jen’s Blog) talked about “Securing SQL Server” on their DBAs@Midnight web show. While this isn’t a full review, they got the book about six hours before the recorded the show, it does give you a little insight into the book. Sean was able to read a couple of the sections before he recorded the show, and his response to the book was pretty positive.

Apparently there are a couple of spelling errors that he’s found so far (I already know about the one in the dedication which he didn’t mention), but if those are the biggest problem that he finds with the book I’m doing pretty good.

You can download the video from the DBAs@Midnight – Get Away From Me web page on their site. They start talking about the book at 34 minutes into the video, and they are done at about the 42 minute mark. Sean said that he’ll be doing a full review of the book on their IT Bookworm book review site. If his full review is as positive as this video was, I’ll be a very happy book writer.

Denny