I am tasked with a general problem to come up with senarios and possible preevntive measures to take for the database of our product.
Our product could be installed in a Server environment managed by an IT department or on a laptops for field inspectors. So I need to come up with ways that our data could be compromised and possible steps to take to prevent it.
Senario 1: Laptop on which Sql Server is installed in stolen.
Senario 2: Database file is stolen
Senario 3: Since the OS-logins on laptops could be admins, they could use Trusted Connection (-E) to connect to database and compromise data. When the Field Inspectors are not paying attention, after loggin in, someone could connect to database and compromise/alter the data.
Senario 4: .....
What could be done to prevent or make it harder to break into.
Encrypt the table data
Use DDL triggers to prevent direct connection to database from command prompt or SSMS
Only allow connections from the application account and from webserver
Please share some info or point at an article that talks about this.
thanks a lot,