SQL Server Security

Name: SQL Server Security
Brand: McGraw-Hill Education
Price: 115.69 EUR
Availability: OnlineOnly

David Litchfield(Autor*in)

McGraw-Hill Education (Verlag)

1. Auflage

Erschienen am 22. August 2003

353 Seiten

E-Book

PDF mit Adobe-DRM

Systemvoraussetzungen

978-0-07-223032-1 (ISBN)

115,69 €inkl. 7% MwSt.

Systemvoraussetzungen

für PDF mit Adobe-DRM

E-Book Einzellizenz

Als Download verfügbar

Beschreibung

Weitere Details

Weitere Ausgaben

Inhalt

Intro
Copyright
Contents
Acknowledgments
Introduction
CHAPTER 1 SQL Server Security: The Basics
SQL Server History
Editions of SQL Server
General Database Security
SQL Server Security Vulnerabilities
Anatomy of a Worm: Why Slammer Was So Successful
Preventing Another Slammer
CHAPTER 2 Under Siege: How SQL Server Is Hacked
Picking the Right Tools for the Job
Data or Host?
Attacks that Do Not Require Authentication
Exploitation of Buffer Overflows
SQL Monitor Port Attacks
The "hello" Bug
Password Hunting
Attacks That Require Authentication
Buffer Overflows
Extended Stored Procedures
Bypassing Access Control Mechanisms
Resources
Code Listing 1
Code Listing 2
Code Listing 3
CHAPTER 3 SQL Server Installation Tips
Planning an Installation
Data Security
Fault Tolerance
Backup Scheduling
Disaster Recovery
Operating System Considerations
NT File System
Running the Installer
Locking Down the Server
Checklist
CHAPTER 4 The Network-Libraries and Secure Connectivity
Client/Server Connectivity
Secure Sockets Layer
SSL Basics
SSL Configuration
SQL Server Network-Libraries
Primary Network-Libraries
Secondary Network-Libraries
Configuring Connections
Server Network Utility
Client Network Utility
Best Practices
Never Expose SQL Server Ports to the Internet
Use TCP/IP Net-Library Whenever Possible
Only Configure the Net-Libraries that Are Needed
Use 128-Bit SSL Connections Instead of 40-Bit
Set Up an SSL Certificate to Secure Logins
Force Encryption for Highly Sensitive Data
Use the Hide Server Option when Configuring TCP/IP
CHAPTER 5 Authentication and Authorization
Authentication
Logins
Database Users
Roles
Authorization and Permissions
GRANT, REVOKE, and DENY
Auditing Access
Ownership Chains
Syslogins, Sysprotects, Syspermissions, and Other Mysteries
SIDs vs. SUIDs
syslogins and sysxlogins
sysusers
syspermissions
sysprotects
Best Practices
Windows Active Directory: Centered Administration
SQL Server Role-Centered Administration
Choosing an Approach
CHAPTER 6 SQL Server in the Enterprise
SQL Server Replication
Replication Overview
Security Considerations with Replication
Multiserver Administration
Active Directory Integration
CHAPTER 7 Auditing and Intrusion Detection
Case Study
RetailCo Database Operations
RetailCo Management
Security Policies
Surprises and Forensic Examination
Conclusion
SQL Server Auditing
Enabling Standard Auditing
C2 Level Auditing
Extending Audit Capabilities
Using the Built-in Trace Functions to Configure Manual Auditing
SQL Server Alerts
Configuring SQL Server Alerts
Using SQL Server Alerts As an Intrusion-Detection System
CHAPTER 8 Data Encryption
Encryption Explained
Hashing Algorithms
Salts
Key Management
Built-In Encryption Functions
Encrypting Custom Stored Procedures
Encrypting SQL Server Table Data
Encrypting SQL Server Network Traffic
Middle-Tier Encryption
Third-Party COM Components
CryptoAPI
CHAPTER 9 SQL Injection: When Firewalls Offer No Protection
SQL Injection Basics
Case Study: Online Foreign Exchange System
Audit Techniques
Vulnerability Identification
Exploiting the System
Analysis of Case Study
Advanced Topics
Extracting Information Using Time Delays
System Level Exploitation
Why SQL Server Is Prone to SQL Injection
Attack Vectors
SQL Injection Defense
Input Validation
Identifying Poor Designs
Strong Designs
Best Practices
Design
Development/Implementation
QA/Testing
Deployment
CHAPTER 10 Secure Architectures
Defense In Depth
Security Requirements
Gathering Requirements
The Existing Environment
Understanding Application Security Requirements
Protecting Your Application
Planning
Deciding On a Technology Set
Deciding On a Review Process
Deciding On Coding Standards
Coping with Time Slippage
Development
Good Coding Habits
Best Practices for Coding Stored Procedures
Input Validation
Recommended Development Defense Measures
Bad Coding Habits and How to Cope with Them
Testing
Approaches to Testing
Fuzzing
Skill Set
Depth and Coverage
Reporting Results
Deployment
Planning a Deployment
Build Procedures
Problem Resolution
Maintenance
Quick Fixes: Secure + Insecure = Insecure
Reading Logs
Forensic Readiness
APPENDIX A System and Extended Stored Procedure Reference
Limiting the Risks of Stored Procedures
Minimize Surface Area for Attack
Minimize SQL Server Privileges
Minimize Application Run-time Account Privileges
Stored Procedure Attack Strategies
Create Trojan Horse Stored Procedures
Use System Stored Procedures with Social Engineering
High-Risk System and Extended Stored Procedures
Extended Stored Procedures that Access the Registry
Stored Procedures that Reveal the SQL Server Development Environment
OLE Automation Extended Stored Procedures
Stored Procedures that Access the Operating System
Stored Procedures that Use E-Mail
Defensive Strategies
Drop the Stored Procedures You Don't Need
Revoke Public Access to Stored Procedures
Audit and Track Changes to Your SQL Server Source Code and Permissions
APPENDIX B Additional Technologies that Impact SQL Server Security
Visual Studio, Microsoft Office, and COM Connectivity Tools
Visual Studio
Microsoft Office
Data Access APIs
SQL Server Mail Interfaces
SQL Mail
SQLAgent Mail
Internet Information Server Integration
SQL Server Developer and Administrator Tools
SQL-DMO
SQL-NS
DB-Library API
ISQL.exe and OSQL.exe Tools
Replication Components
Linked Servers
Data Transformation Services
The Bulk Copy DTS Task
Extended Stored Procedure Development
Tabular Data Stream
APPENDIX C Connection Strings
Properties
Sample Connection Strings
Where to Place Connection Strings
Web.config or Global.asa Files
The Registry
Text File Encrypted Using DPAPI
UDL Files
Include Text Files
COM+ Catalog
APPENDIX D Security Checklists
SQL Server Version Checklist
Post-Install Checklist
Maintenance Checklist
Index

Systemvoraussetzungen

Als PDF speichern Als Link merken