Four New Table Level Security Features of SQL Server Karen Lopez, Data Evangelist & Architect

Transcription

1 Four New Table Level Security Features of SQL Server 2016 Karen Lopez, Data Evangelist & Architect

2 Karen López Data Evangelist Karen was born this way: loving data. She wants you to love your data, too,, as part of TeamData. She specializes in database design, architecture, and data modeling for SQL Server and other engines, including NoSQL solutions. She blogs at Linkedin.com/in/karenlopez Microsoft Data Platform MVP She is a chronic volunteer, frequent speaker, PASS Speaker Idol Judge, and Microsoft Imagine Cup Judge. She is also the leader of the PASS Toronto Data Platform User Group (@TorPASS) NASA Datanaut Mentor Karen is a mentor on the NASA Datanaut program, which helps new and established data professionals learn about NASA Open Data and technologies to gain insight into that data.

3

4 Every design decision comes down to cost, benefit and risk. - me

5 Security Features

6 Always Encrypted

7 Encryption BitLocker et al Nothing new until SQL 2016 SQL 2005 gave us celllevel encryption SQL 2008 gave us TDE

8 Security & Privacy SQL 2016 Cell level TDE Always Encrypted New! Data Masking* Row Level Security*

9 Security Always Encrypted How it works Enabled at column level Protects data at rest *AND* in memory Uses Column Master Key (client) and Column Encryption Key (server)

10 Security Always Encrypted

11 Always Encrypted

12

13 Security Always Encrypted Deterministic same value, same encryption. Must use binary2 collation order ALLOWED: Equality JOINs, Grouping Indexing Point lookups Randomized better security; cannot be indexed, many restrictions NOT ALLOWED: JOINs, Grouping Indexing Filtering Many constraints

14 Security Always Encrypted Not supported (partial list) text/ntext/image XML/hierarchyid/geography/geometry alias types/user-defined data types SQL_VARIANT rowversion (timestamp) System alias (SYSNAME) Computed columns* Identity columns Sparse column sets Temporal tables Triggers (partial support) Full text search Replication CDC In Memory OLTP Stretch database

15 Security Always Encrypted Foreign keys must match encryption types (key types & algorithms) Client code needs to support AE (currently this means.net 4.6)

16 Always Encrypted Wizard in SSMS Task -> Encrypt Columns

17 Insert / Query Example

18 Note: VIEW Permssions Default VIEW permissions for Encrypted Columns vary for SQL Server 2016 and Azure SQL Database: Public role defaults to grant VIEW permission in SQL Server 2016 Public role defaults to no VIEW permissions in SQL DB

19 Why would a DB Designer love it? Always Encrypted *Always* Encrypted, yeah. Allows designers to not only specify which columns need to be protected, but how. Parameters are encrypted as well Built in to the engine, easier for Devs

20 Row Level Security

21 Security Row Level Security

22 Security Row Level Security No indication that results have been filtered If all rows are filtered than NULL set returned For block predicates, an error returned Works even if you are dbo or db_owner role

23 Security Row Level Security Filtering result sets (predicate based access) Predicates applied when reading data Can be used to block write access User defined policies tied to inline table functions

24 Security Row Level Security DBCC SHOW_STATISTICS Not Allowed FILESTREAM Polybase Indexed views CDC nor change tracking

25 Row Level Security: Use Cases Departmental Segregation of Access Multi-Tenant Security Celebrity/VIP Snooping anyplace you want to use Predicate-based access controls. Customer Support Human Resources Accounting SaaS Websites Hospitals Tax Organizations Movie Rental WHERE clause based filtering

26 Warning SELECT 1/(SALARY ) FROM PAYROLL WHERE NAME='John Doe' Do the math here if John s salary is actually $100,000

27 Security Row Level Security Tips Recommended to create schema for RLS objects (predicate functions and security policies) Use ALTER ANY SECURITY POLICY permissions; this does not require SELECT on the columns Avoid type conversions in predicate functions to avoid runtime errors

28 Why would a DB Designer love it? Row Level Security You don t have hand-develop a solution There s a standard way to do this in your project SQL Server knows what these tables are and can optimize itself when it uses them.

29 Why would a DB Designer love it? Row Level Security Allows a designer to do this sort of data protection IN THE DATABASE, not just rely on code. Many, many pieces of code.

30 Privacy Feature

31 Privacy Dynamic Data Masking

32 Dynamic Data Masking limits exposure of sensitive data

33 Security Dynamic Data Masking CREATE TABLE Membership( MemberID int IDENTITY PRIMARY KEY, FirstName varchar(100) MASKED WITH (FUNCTION = 'partial(1,"xxxxxxx",0)') NULL, LastName varchar(100) NOT NULL, Phone# varchar(12) MASKED WITH (FUNCTION = 'default()') NULL, varchar(100) MASKED WITH (FUNCTION = ' ()') NULL); INSERT Membership (FirstName, LastName, Phone#, ) VALUES ('Roberto', 'Tamburello', ' ', 'RTamburello@contoso.com'), ('Janice', 'Galvin', ' ', 'JGalvin@contoso.com.co'), ('Zheng', 'Mu', ' ', 'ZMu@contoso.net');

34 Dynamic Data Masking How it works. Done at column level Data in the database, at rest, has no protection. It s not encryption Meant to complement other methods Performed at the end of a database query right before data returned, so Performance impact small

35 Security Dynamic Data Masking 4 functions available. today Default Custom String Random

36 DDM Functions Function Mask Example Default Based on Datatype String XXX Numbers Date & Times :00: Binary Single Byte 0 xxxx :00: First character of , then Xs, then.com Always.com Kxxx@xxxx.com Custom First and last values, with Xs in the middle kxxxn Random For numeric types, with a range 12

37 Security Dynamic Data Masking Data in database is not changed Ad-hoc queries *can* expose data Does not aim to absolutely prevent users from exposing pieces of sensitive data If you can query temp table, you can see unmasked data CAST can unmask data

38 Security Dynamic Data Masking Cannot mask an encrypted column (AE) Cannot be configured on computed column But if computed column depends on a mask, then mask is returned Using SELECT INTO or INSERT INTO results in masked data being inserted into target (also for import/export)

39 Warning.

40 Best Thing about DDM? Defining a: Standard Consistent Researched Recognized Architected Enterprise data privacy method

41 Why would a DB Designer love it? Dynamic Data Masking Allows central, reusable design for standard masking Offers more reliable masking and more usable masking Removes whining about we can do that later

42 Security & Privacy - Summary Key differences TDE AE DDM RLS Encryption Y Y N N Protect data in memory N Y N N Overhead Low High Low Low Block updates N N N Y

43 Security & Privacy - Summary Which ones are right for your project? Data quality? Data availability? Data recovery? Query performance? Legal requirements?

44 But wait there s more.

45 System Version Tables

46

47 Temporal Tables System-Versioned Temporal Tables ANSI SQL 2011 based Current data Access to historical data Point-in-time analysis Uses period columns

48

49 System Versioned Table: Temporal Table

50 Temporal Tables Current Data Previous Data

51 System Versioned Table: Temporal Table

52 System Versioned Table: Temporal Table Can be a type of informal auditing I prefer tracking Not a security feature Can be helpful to track changes to data in troubleshooting If you need security auditing, look to more robust solutions

53 Why would a DB Designer love it? System Versioned Tables Don t have hand-develop a solution, because that s really hard to do SQL Server knows what these tables are and can optimize itself when it uses them. There s a standard method for doing temporal / history tables.

54 Launch! Get out there to see which features can help you love your data better.

55 Karen López Linkedin.com/in/karenlopez Thank you! You ve all been great! Don t forget to thank the organizers and moderators! Yes, you should submit to speak next time.! toronto.sqlpass.org Join your local PASS user group Join PASS open.nasa.gov Reach out to learn about out of this world data and technologies.

56 THANK YOU FOR ATTENDING

57