Securing SQL Server

Jail Looms For Man Who Revealed AT&T Leaked iPad User E-Mails

mrdenny | 20 Nov 201220 Nov 2012

This was reposted from Clean Up BlogThisSecurity feed and make it a snipit http://rss.slashdot.org/~r/Slashdot/slashdot/~3/5ifWhOwuT7U/story01.htm written by Soulskill. They get all the credit for this, not me.

concealment sends this quote from MIT’s Technology Review: “AT&T screwed up in 2010, serving up the e-mail addresses of over 110,000 of its iPad 3G customers online for anyone to find. But Andrew Auernheimer, an online activist who pointed out AT&T’s blunder to Gawker Media, which went on to publicize the breach of private information, is the one in federal court this week. Groups like the Electronic Frontier Foundation worry that should that charge succeed it will become easy to criminalize many online activities, including work by well-intentioned activists looking for leaks of private information or other online security holes. [Auernheimer’s] case hasn’t received much attention so far, but should he be found guilty this week it will likely become well known, fast.”

Second Edition of Securing SQL Server now longer available for pre-order. It’s Shipping!

mrdenny | 8 Aug 2012

I’m afraid that I’ve got some bad news. You can no longer pre-order Securing SQL Server 2nd Edition from Amazon.

Instead you have to settle for ordering the book outright and having it shipped to you. That’s right, no more being a pre-order book, it’s published and available to be shipped directly to you. Currently Amazon is selling the book at full price which is $49.95, but if you have Amazon Prime it is available for Amazon Prime shipping. Because it is considered to be a text book you get a $5 Amazon MP3 Credit (what ever terms and conditions that Amazon chooses do apply).

This is a totally updated edition of the book including all sorts of new information about security within SQL Server 2012. I of course cover things like how to secure AlwaysOn Availability Groups, how to use user defined server roles, contained users, etc. I also dive into how to properly secure SQL Server Reporting Services and SQL Server Analysis Services so they can’t be used to access data that people shouldn’t have access to.

All in all this book is much larger with Amazon showing it at 408 pages compared to just 272 pages for the 1st edition. If you find someone cheaper to purchase it make sure that you are in fact ordering the second edition. The ISBN number is 1597499471.

I hope that you pick up a copy of the book and that it is useful for you in securing your SQL Server environment.

Denny

Amazon, Kindle, Securing SQL Server

Kindle Version of Securing SQL Server 2nd Edition Is Available

mrdenny | 6 Aug 20125 Aug 2012

In true Amazon style the Kindle Edition of Securing SQL Server 2nd Edition is available for purchase from Amazon before the physical print book is available. I haven’t even gotten my preview copy yet (it should be here in a day or two) but you can get your digital copy from Amazon as of about a week ago.

So if you’ve been waiting for the 2nd edition to come out, there’s no need to wait any longer.

If you want that physical book you can pre-order it, and hopefully it’ll be shipping within just a couple of weeks. Amazon has August 15th listed on the US website, but I’m not sure if that is the actual date or not.

Denny

Amazon, Securing SQL Server

Securing SQL Server 2nd Edition Coming Soon

mrdenny | 24 Apr 201224 Apr 2012

I’m pleased to be able to announce that the 2nd edition of Securing SQL Server is going to be available soon. It’s just been made available for pre-order on Amazon.com. The second edition comes in at about 350 pages (according to Amazon, I don’t actually have a copy of it yet) while the first edition came in at about 270 pages so there has been a LOT of material added to the book.

While a lot of the new information is focused on SQL Server 2012, there is also a lot of new material which relates to older version of SQL Server including chapters on SQL Server Analysis Services and SQL Server Reporting Services, information on Instant File Initialization, EXECUTE AS, Database Firewalls, SAN Security, Actual Data Security (no idea how this got missed the first time around, but that’s to Brent Ozar for pointing it out).

As far as the SQL Server 2012 information you’ll find updated information about the SHA2 hashing algorithms, Securing AlwaysOn Availability Groups, Security and SQL Server Clustering, Security and Contained Databases and a lot more.

If you already have a copy of the 1st edition I encourage you to take a look at the second edition as well. I know that it’s really soon for a second edition of a book (the first edition just came out February 2011, but this new edition comes on the release of SQL Server 2012.

Hopefully you pre-order you copy today.

Denny

P.S. Yes this edition will be available for the Kindle as well, that takes a little time. As soon as I know that it’s been posted for the Kindle (usually happens a little after Amazon gets the physical books) I’ll post another announcement here.

P.P.S. If you visit my SecuringSQLServer.com site I’ve updated everything there for the new edition. You can always find the old edition listed on the Other Books page on that site or on the Books page on mrdenny.com.

Securing SQL Server

180k+ websites attacked because of bad dev code

mrdenny | 24 Oct 201124 Oct 2011

There is another massive SQL Injection attack going around. This time hitting 180k ASP.NET websites. The article which I referenced has a decent write up on the actual attack and it links to a post which has detailed information about the attack. However the article on IT World gives some really poor advice on how to protect yourself from a SQL Injection attack.

There’s no easy way to fix the vulnerability of the database to this attack except to “harden” the database by applying all the patches and making all the security requirements consistent. Monitoring the database for unusual activity is important, too.

Patching SQL Server will NOT prevent SQL Injection attack, at all. The SQL Server isn’t the attack vector for a SQL Injection attack, the web application is the attack vector. By the time the SQL Injection attack gets to the SQL Server database (or any database) it’s too late.

SQL Injection is actually really easy to protect yourself from. Simply stop using dynamically generated SQL and instead start using parametrized queries (also called bound queries). That’s it, that’s the big secret. Yes I understand that writing your .NET code as parametrized queries is harder to write than just doing string concatenation and running the query, but getting your site attacked and putting malware on your customers computers because you didn’t want to do a little typing is just no excuse.

As this is a blog about my book “Securing SQL Server” here’s the sales pitch. In the book I talk all about how to use parametrized queries. It really isn’t that hard there is lots of sample code on how to do it. You don’t need to use stored procedures to use parametrized queries. You can do it with normal dynamic SQL as well, it works basically the same.

In case you didn’t get my point yet, parametrized queries are the ONLY WAY that you can 100% be sure that you are protecting yourself from SQL Injection attacks. If you can’t find some links on how to use parametrized queries here are a few links for you PHP, .NET, and more .NET.

Denny

Amazon, Securing SQL Server

Exposing SQL Server to the public Internet is a pretty bad idea

mrdenny | 23 Aug 20117 Jul 2012

Every once and a while we hear about the nightmare situation where a SQL Server has been broken into and data has been stolen. All to often when this happens because the SQL Server is exposed directly to the public Internet. When you ask people why the SQL Server is connected to the Internet the answer is pretty much always the same, to make it easier to manage so that they don’t have to RDP to the server and manage it from there.

While this is easier, is sure isn’t the safest solution. A much better solution would be to setup a VPN Network between the office and the data center so that the connection is secured so that people from the public Internet can’t access the SQL Server’s connection. This will prevent people who aren’t supposed to be connecting to the SQL Server from connecting to the SQL Server.

I talk about this more in Chapter 1 of “Securing SQL Server”. Check it out on Amazon, which will actually let you read a good portion of Chapter 1 online for free.

Securing SQL Server

Meet the author, get your copy signed

mrdenny | 27 Jul 201126 Jul 2011

There are several chances to meet the author of Securing SQL Server, ask questions, and get your copy of the book signed. These include (and are subject to change):

Dallas Tech Fest – August 13th, 2011

SQL PASS – October 11-14, 2011

SQL Saturday 95 – September 17th, 2011

SQL Excursions – May 17-19, 2012

I hope to see you at one (or all) of these great events. Feel free to bring your copy and get it signed making it a priceless collectable (OK, probably not but I do love signing copies).

Denny

Amazon, Kindle

Want to take a look at Securing SQL Server for 30 days?

mrdenny | 18 Jul 201118 Jul 2011

Thanks to Amazon, now you can rent Securing SQL Server for 30 days, and if you like it you can buy it with the cost of the rental being applied to the cost to buy the digital copy of the book. This is all done through Amazon’s new ebook rental program for text books (which they have marked my book as being). So now you can rent the book starting at a little over 1/2 the current price of the book which gives you access to the entire book for 30 days. After the 30 days is up you can extend your rental or purchase with the initial rental price counting towards your new price (you pay the difference).

As an author I’m not sure how I feel about this, good I guess because it gives people a chance to give the book a try. As a reader I like this because I can try the book for less, and if I like it keep it. If it doesn’t serve me any purpose I don’t need to keep it, and it only cost be 1/2 the cash to find out.

You don’t need to have a Kindle to make use of this, just the Kindle app installed on your PC, phone, iPad, etc.

Denny

Microsoft, Securing SQL Server

Securing SQL Server will be available at the Tech Ed bookstore

mrdenny | 4 May 20112 May 2011

If you are going to Tech Ed 2011, and you were thinking about purchasing a copy of “Securing SQL Server” but you wanted to thumb through it before purchasing, now is your chance. I’ve just be told that the Tech Ed book store will be stocking “Securing SQL Server”. If you pick up a copy at Tech Ed and you want it signed I’ll be working at the SQL Server booth most afternoons. Bring it on by, and I’ll be happy to sign it for you or at least draw funny faces in it.

Denny

Securing SQL Server

Looks like MySQL isn’t the only company to be succeptable to a SQL Injection Attack (looking at you Barracuda)

mrdenny | 12 Apr 2011

Apparently Barracuda (who is in the network security business) had one of their applications broken into this week as reported by CNet. While no source code was stolen from Barracuda, it still has to be embarrassing to have names and email addresses of employees, leads and partners to be downloaded all thanks to a poorly written PHP application. Passwords were also downloaded as part of the data dump, but the passwords were only stored as MD5 hashes. However MD5 isn’t considered to be very secure any more (which is one of the reasons that SQL Server “Denali” is including SHA2 which is still considered to be secure).

Apparently the website which was attacked is normally secured using a Barracuda Web Application Firewall, but it was taken offline during a maintenance window on Friday night (April 8th, 2011). On Saturday night at about 5pm a script being crawling the website looking for SQL Injection weaknesses, which is found about two hours later.

Sadly this isn’t the first SQL Injection attack to happen recently. Just a couple of weeks ago MySQL.com’s website was attacked also using SQL Injection and a large amount of information was taken from their database as well.

You can read more about the Barracuda breach on CNet or on Barracuda’s own blog.

Denny