Fabiano Amorim has written an excellent article at Simple Talk on securing msdb. Here’s why you should read it if you’re a DBA or security professional. The article includes:
- Explanations of the typical attack paths.
- Scripts to run to detect and monitor for potential issues with security for msdb.
- Scripts to create Audit events to automate collection of events that may indicate a compromise attempt or what could lead to a compromise attempt.
- Scripts to use extended events to cover those cases were Audit isn’t sufficient.
- Details about monitoring backup and restore records and the need to have a restore quarantine space.
- Issues with cross-database ownership and what to watch out for.
- Recommended mitigation steps to address all of these concerns.