Get Your Own Blog
If you would like to blog on SQLServerCentral.com then send an email to
Contact the author
for this blog
Hemantgiri S. Goswami is working as a Consultant at Surat, INDIA. He has been a Microsoft SQL Server MVP three years running; he also moderates multiple SQL Server community forums including http://www.sql-server-performance.com
. He actively participates and speaks at local user group events organized under the aegis of www.surat-user-group.org, DotNetChaps and CSI Surat chapters, of which he is a founding and active member. He regularly publishes article on his blog space http://www.sql-server-citation.com
. He has recently taken up a new initiative - blogging about SQL in his native language Gujarat through his blog http://sqlservercitation-gujarati.blogspot.com
. He is an Author of the book SQL Server 2008 High Availability.
2 November 2013
Recently I had a chance to speak my friend Ashish Sharma who is my colleague too. We were discussing Project Management topics (he recently passed PMP and ACP). Our discussion ended at very interesting topic – RISK Assessment.
Definition: According to PMBOK, Projects can have unforeseen event or activity that can impact the project’s progress, result or an outcome in negative or positive way. Further, A Risk can be assessed using two factors – impact and probability. Determining the quantitative or qualitative value of risk related to a concrete situation and recognized threats is known as Risk Assessment.
So, coming to the point, how do we do Risk Assessment for Database systems, especially SQL Server ?
I myself have never come to situation where I have created or used Risk Assessment Register for SQL Server. I was thinking is there some readily available Risk Assessment Register / document somewhere? Hence, I have decided to research little more on it. I found absolutely nothing on this very topic. However, searching for different term - SQL Server security, and Risk Assessment – none found.
After spending some time researching I have found a good sample document for Risk Assessment Register that we can use, you can download it from here. Now, this is what we have is Risk Register, how about threats? Sometime back, in 2009 I have wrote an article on SQL Server Security, using that article I have tried to pen down some threats that I can think off at this moment, they are:
References : http://en.wikipedia.org/wiki/Risk_assessmenthttp://en.wikipedia.org/wiki/Project_risk_managementhttp://www.brighthubpm.com/risk-management/3247-creating-a-risk-register-a-free-excel-template/photo credit: kenteegardin via photopin cc-- Hemantgiri S. Goswami (http://www.sql-server-citation.com )
|Possible Threats ||Risk Mitigation |
|Virus Attack ||Install AV on DB Server however do not forget to exclude SQL server files |
|Unauthorised Logins ||Always use Audit (C2, Windows, SQL or both) failed login attempts and analyze them regularly. Always, rename SA / Admin account and use strong password mechanism for all the servers. If possible always try to use domain authenticated acconts. |
|MiM Attack ||To metigate MiM attach do following : |
- Isolate database server from Application / IIS Server
- Configure SQL Server to use non-default port
- Use Encryption / SSL
- Use Firewall inbound / outbound rules
|Root Access ||To avoid someone getting root access do following: |
- Disable / Rename in-built Admin account
- Grant least access to Service Account
- Use strong / random password
|SQL Injection ||Do following: |
- Avoid using Dynamic SQL when you can
- use parameterized query / stored procedure 3) Always validate the value at form level before it's being passed to database server
- Refer above items
|Known Configuration ||Always try to customize default configuration if you can, for example: |
- Run SQL server on non standard port
- disable / rename SA account
- Disable xp_cmdshell and other extended procedures
Leave a comment on the original post
[feedproxy.google.com, opens in a new window]