SQL Organizational Security & Compliance. George Walters Senior Technical Evangelist for ISV Partners

Transcription

1 Organizational Security & Compliance SQL George Walters Senior Technical Evangelist for ISV on twitter

2

3 Why is security important? 4

4 Progress on SQL Engine security A Journey through time 5

5

6 Beginning with SQL Server 2016, all algorithms other than AES128, AES192, and AES256 are deprecated. To use older algorithms (not recommended) you must set the database to database compatibility level 120 or lower. ASE256 for backup keys SHA512 for password hashes Built-in cryptography hierarchy Transparent data encryption Extensible key management Sign code modules Encrypted connection on-premises and in Azure SQL database Audit, TDE, Always Encrypted in Azure SQL database or Azure SQL Managed Instance

7

8 USE master; GO CREATE MASTER KEY ENCRYPTION BY PASSWORD = '<UseStrongPasswordHere>'; Go CREATE CERTIFICATE MyServerCert WITH SUBJECT = 'My DEK Certificate'; go USE AdventureWorks2012; GO -- RED ALERT: BACKUP THE CERTIFICATE!!! CREATE DATABASE ENCRYPTION KEY WITH ALGORITHM = AES_128 ENCRYPTION BY SERVER CERTIFICATE MyServerCert; GO ALTER DATABASE AdventureWorks2016 SET ENCRYPTION ON; GO

9 better separation of duties allow flexible database access for

10

11 Mission-critical performance Performance Security Availability Scalability Operational analytics Insights on operational data; Works with in-memory OLTP and disk-based OLTP In-memory OLTP enhancements Greater T-SQL surface area, terabytes of memory supported, and greater number of parallel CPUs Query data store Monitor and optimize query plans Always encrypted Sensitive data remains encrypted at all times with ability to query Row-level security Apply fine-grained access control to table rows Dynamic data masking Real-time obfuscation of data to prevent unauthorized access Other enhancements Audit success/failure of database operations Enhanced AlwaysOn Three synchronous replicas for auto failover across domains Round robin load balancing of replicas Automatic failover based on database health DTC for transactional integrity across database instances with AlwaysOn Support for SSIS with AlwaysOn Enhanced database caching Cache data with automatic, multiple TempDB files per instance in multicore environments Native JSON Expanded support for JSON data Temporal database support Query data as points in time TDE support for storage of inmemory OLTP tables Enhanced auditing for OLTP with ability to track history of record changes

12 Always Encrypted SQL Server Azure SQL Database Azure SQL Managed Instance

13 Benefits of Always Encrypted Prevents Data Disclosure Client-side encryption of sensitive data using keys that are never given to the database system. Queries on Encrypted Data Support for equality comparison, incl. join, group by and distinct operators. Application Transparency Minimal application changes via server and client library enhancements. Allows customers to securely store sensitive data outside of their trust boundary. Data remains protected from high-privileged, yet unauthorized users.

14 Always Encrypted Help protect data at rest and in motion, on-premises & cloud Apps Trusted SQL Server SELECT Name FROM Patients WHERE SELECT Name FROM Patients Query Client side Enhanced ADO.NET Column Master Key Result Set Name Jim Gray Result Set Name Jim Gray dbo.patients Name Jane Doe ciphertext SSN Country 1x7fg655se2e USA Jim Gray 0x7ff654ae6d USA John Smith 0y8fj754ea2c USA Column Encryption Key

15 Types of Encryption for Always Encrypted Randomized encryption Encrypt(' ') = 0x17cfd50a Repeat: Encrypt(' ') = 0x9b1fcf32 Allows for transparent retrieval of encrypted data but NO operations More secure Deterministic encryption Encrypt(' ') = 0x85a55d3f Repeat: Encrypt(' ') = 0x85a55d3f Allows for transparent retrieval of encrypted data AND equality comparison E.g. in WHERE clauses and joins, distinct, group by Two types of encryption available Randomized encryption uses a method that encrypts data in a less predictable manner Deterministic encryption uses a method which always generates the same encrypted value for any given plain text value

16 Key Provisioning 1. Generate CEKs and Master Key Column Encryption Key (CEK) Column Master Key (CMK) 2. Encrypt CEK Encrypted CEK Security Officer 3. Store Master Key Securely CMK Store: Certificate Store HSM Azure Key Vault CMK 4. Upload Encrypted CEK to DB Encrypted CEK Database

17 Encryption metadata Encryption metadata Example Client - Trusted CMK Store SQL Server - Untrusted using (SqlCommand cmd = new SqlCommand( "SELECT Name FROM Customers WHERE SSN conn)) { cmd.parameters.add(new SqlParameter( "@SSN", SqlDbType.VarChar, 11).Value = " "); SqlDataReader reader = cmd.executereader(); Plaintext CEK Cache exec = N'@SSN = N'SELECT * FROM Customers WHERE SSN Encryption Type/ Algorithm DET/ AES 256 Encrypted CEK Value CMK Store Provider Name CERTIFICATE _STORE CMK Path Current User/ My/f2260 EXEC sp_execute_sql N'SELECT * FROM Customers WHERE = N'@SSN Result set (plaintext) Name Jim Gray Enhanced ADO.NET Encryption Type/ Algorithm Non-DET/ AES 256 Encrypted CEK Value Name 0x19ca706fbd9 CMK Store Provider Name CERTIFICATE _STORE CMK Path Current User/ My/f2260 Result set (ciphertext)

18 Setup (SSMS or SSDT) User Experience: SSMS or SSDT (Visual Studio) Select columns to be encrypted Set up the keys: master & CEK UI for selecting columns (no automated data classification) Key setup tool to automate selecting CMK, generating and encrypting CEK and uploading key metadata to the database Analyze schema and application queries to detect conflicts (build time) Static schema analysis tool (SSDT only)

19 Existing App Setup User Experience: SSMS or SSDT (Visual Studio) Select candidate columns to be encrypted UI for selecting columns (no automated data classification) Set up the keys Key Setup tool to streamline selecting CMK, generating and encrypting CEK and uploading key metadata to the database Analyze schema and application queries to detect conflicts and identify optimal encryption settings Select desired encryption settings for selected columns Schema/workload analysis tool analyzing the schema and profiler logs UI for configuring encryption settings on selected columns (accepting/editing recommendations from the analysis tool) Encrypt selected columns while migrating the database to a target server (e.g. in Azure SQL Database Encryption tool creating new (encrypted) columns, copying data from old (plain text) columns, swapping columns and recreating dependencies

20 Summary: Always encrypted Protect data at rest and in motion, on-premises & cloud Apps No app changes Encrypted query TCE-enabled ADO.NET library Data remains encrypted during query SQL Server Capability ADO.Net client library provides transparent client-side encryption, while SQL Server executes T-SQL queries on encrypted data Benefits Master key Columnar key

21 Row-Level Security SQL Server 2016 Azure SQL Database

22 Row-level security Protect data privacy by ensuring the right access across rows Fine-grained access control over specific rows in a database table Help prevent unauthorized access when multiple users share the same tables, or to implement connection filtering in multitenant applications Administer via SQL Server Management Studio or SQL Server Data Tools Enforcement logic inside the database and schema bound to the table. Customer 1 Customer 2 Customer 3 SQL Database

23 Benefits of row-level security Fine-grained access control Keeping multi-tenant databases secure by limiting access by other users who share the same tables. Application transparency RLS works transparently at query time, no app changes needed. Compatible with RLS in other leading products. Centralized security logic Enforcement logic resides inside database and is schema-bound to the table it protects providing greater security. Reduced application maintenance and complexity. Store data intended for many consumers in a single database/table while at the same time restricting row-level read & write access based on users execution context.

24 Row Level Security Concepts Predicate function User-defined inline table-valued function (itvf) implementing security logic Can be arbitrarily complicated, containing joins with other tables Security predicate Applies a predicate function to a particular table (SEMIJOIN APPLY) Two types: filter predicates and blocking predicates Security policy Collection of security predicates for managing security across multiple tables CREATE SECURITY POLICY mysecuritypolicy ADD FILTER PREDICATE dbo.fn_securitypredicate(wing, starttime, endtime) ON dbo.patients

25 Example CREATE FUNCTION int) RETURNS TABLE WITH SCHEMABINDING AS return SELECT 1 as [fn_securitypredicate_result] FROM StaffDuties d INNER JOIN Employees e ON (d.empid = e.empid) WHERE e.usersid = SUSER_SID() = d.wing; CREATE SECURITY POLICY dbo.secpol ADD FILTER PREDICATE dbo.fn_securitypredicate(wing) ON Patients WITH (STATE = ON) Fine-grained access control over rows in a table based on one or more pre-defined filtering criteria, e.g., user s role or clearance level in organization. Concepts: Predicate function Security policy

26 RLS in Three Steps Two Three One App Security Policy user manager Policy (e.g., transparently nurse) creates selects filter rewrites predicate from Patients query and table security to apply policy filter predicate in T-SQL, binding the predicate to the Patients table Nurse Database Policy Manager Security Policy Filter Predicate: INNER JOIN Application SELECT * FROM Patients Patients CREATE FUNCTION dbo.fn_securitypredicate(@wing int) RETURNS TABLE WITH SCHEMABINDING AS return SELECT 1 as [fn_securitypredicate_result] FROM SELECT * StaffDuties FROM Patients d INNER JOIN Employees e SEMIJOIN ON (d.empid APPLY dbo.fn_securitypredicate(patients.wing); = e.empid) WHERE e.usersid = SUSER_SID() = d.wing; SELECT CREATE Patients.* SECURITY POLICY FROM Patients, dbo.secpol StaffDuties ADD FILTER d PREDICATE INNER JOIN dbo.fn_securitypredicate(wing) Employees e ON (d.empid = e.empid) ON Patients WHERE e.usersid = SUSER_SID() AND Patients.wing = d.wing; WITH (STATE = ON)

27 Create Security Policy -- The following syntax creates a security policy with a filter predicate for the Customer table, and leaves the security policy disabled CREATE SECURITY POLICY [FederatedSecurityPolicy] ADD FILTER PREDICATE [rls].[fn_securitypredicate]([customerid]) ON [dbo].[customer]; -- Create a new schema and predicate function, which will use the application user ID stored in CONTEXT_INFO to filter rows. CREATE FUNCTION rls.fn_securitypredicate (@AppUserId int) RETURNS TABLE WITH SCHEMABINDING AS RETURN ( SELECT 1 AS fn_securitypredicate_result WHERE DATABASE_PRINCIPAL_ID() = DATABASE_PRINCIPAL_ID('dbo') -- application context AND CONTEXT_INFO() = GO Creates a security policy for row level security. The following examples demonstrate the use of the CREATE SECURITY POLICY syntax. For an example of a complete security policy scenario, see Row Level Security.

28 Dynamic Data Masking SQL Server 2016 Azure SQL Database

29 Dynamic Data Masking Prevent the abuse of sensitive data by hiding it from users Configuration made easy in the new Azure portal Policy-driven at the table and column level, for a defined set of users Table.CreditCardNo Data masking applied in real-time to query results based on policy Multiple masking functions available (e.g. full, partial) for various sensitive data categories (e.g. Credit Card Numbers, SSN, etc.) Azure SQL Database SQL Server 2016 CTP2+ Real-time data masking; partial masking

30 Other security enhancements Audit success/failure of database operations Enhanced auditing for OLTP with ability to track history of record changes Transparent Data Encryption support for storage of Inmemory OLTP Tables Backup encryption now supported with compression

31 gmsa support Group Managed Service Accounts (gmsa) Automatically set domain scope for Managed Service Accounts Automatic password rotation Much more secure than regular domain accounts Enables cross-system security context Why would I want a gmsa? No need to manually change passwords on all AlwaysOn instances How does it work? Passwords are managed by domain What versions will it be supported in? Supported in SQL Server 2014 and SQL Server 2016

32 Domain-independent Availability Groups Environments supported: Cross domains (with trust) Cross domains (no trust) No domain at all Cluster management via PowerShell only SQL management as normal Use of certificate-secured endpoints like DBM What versions will it be supported in? SQL Server 2016 SQL 2017: Cross-Windows-and-Linux Availability Groups

33 SQL 2017 new Security Features.NET CLR (common language runtime) CLR uses Code Access Security (CAS) in the.net Framework, which is no longer supported as a security boundary. (Safe might no longer be safe!) sp_configure option called clr strict security is introduced to enhance the security of CLR assemblies. New Permissions DATABASE SCOPED CREDENTIAL is now a class of securable, supporting CONTROL, ALTER, REFERENCES, TAKE OWNERSHIP, and VIEW DEFINITION permissions. ADMINISTER DATABASE BULK OPERATIONS, which is restricted to SQL Database, is now visible in sys.fn_builtin_permissions.

34 Security resources SQL Server Security Center SQL Server Security Documentation (2016) #Security SQL Server 2017 New Features SQL Injection Resources

35 Vulnerabilities ( ) Self-service BI per user SQL SERVER /10th the cost of Oracle I N D U S T RY - L E A D I N G P E R F O R M A N C E A N D S E C U R I T Y N O W O N L I N U X A N D D O C K E R Choice of platform and language Industry-leading performance Most secure over the last 7 years Only commercial DB with AI built-in End-to-end mobile BI on any device 200 T-SQL Java C/C++ C#/VB.NET PHP Node.js Python Ruby 1/10 #1 TPC-H performance 1TB, 10TB, 30TB #1 TPC-E performance #1 price/performance R R and Python + in-memory at massive scale Native T-SQL scoring $2,230 $480 $120 Microsoft Tableau Oracle A fraction of the cost Private cloud In-memory across all workloads Most consistent data platform Public cloud

36 Thank on twitter Resources: