Securing SQL Server Processes with Certificates. Robert, Davis, Database Engineer, BlueMountain Capital Management Moderated By: Ivan Sanders

Transcription

1 Securing SQL Server Processes with Certificates Robert, Davis, Database Engineer, BlueMountain Capital Management Moderated By: Ivan Sanders

2 Technical Assistance If you require assistance during the session, type your inquiry into the question pane on the right side. Maximize your screen with the zoom button on the top of the presentation window. Please fill in the short evaluation following the session. It will appear in your web browser.

3 Thank You to Our Sponsors Empower users with new insights through familiar tools while balancing the need for IT to monitor and manage user created content. Deliver access to all data types across structured and unstructured sources. Redgate Software makes ingeniously simple software used by 650,000 IT professionals who work with SQL Server,.NET, and Oracle. More than 100,000 companies use Redgate products, including 91% of the Fortune 100. Redgate s philosophy is to design highly usable, reliable tools which elegantly solve the problems that developers and DBAs face every day.

4 Join PASS PASS is a not-for-profit organization which offers year-round learning opportunities to data professionals. Access to online training and content Join Local Groups and Virtual Groups Get advance notice of member exclusives Enjoy discounted event rates MEMBERSHIP IS FREE, JOIN TODAY

5 Robert L Davis MCM/MCSM, MVP, DBA SQL Server Certified Master, Data Platform MVP, and experienced DBA, evangelist, speaker, writer, and trainer. Currently works as a Database Engineer at BlueMountain Capital Management. facebook.com/robert.l.davis.75 twitter.com/sqlsoldier linkedin.com/in/robertldavis/ Blogger, writer Check out my blog at where I also have links to the many whitepapers I have written as well as articles for SQL Server Pro magazine. PASS Security Virtual Chapter Co-founder and co-leader of the PASS Security Virtual Chapter. If interested in speaking or volunteering for the Security VC, contact us at securityvc@sqlpass.org

6 Securing SQL Server Processes with Certificates Robert, Davis, Database Engineer, BlueMountain Capital Management

7 Robert L Davis, Database Engineer

8 Robert L Davis MCM/MCSM, MVP, DBA SQL Server Certified Master, Data Platform MVP, and experienced DBA, evangelist, speaker, writer, and trainer. Currently works as a Database Engineer at BlueMountain Capital Management. facebook.com/robert.l.davis.75 twitter.com/sqlsoldier linkedin.com/in/robertldavis/ Blogger, writer Check out my blog at where I also have links to the many whitepapers I have written as well as articles for SQL Server Pro magazine. PASS Security Virtual Chapter Co-founder and co-leader of the PASS Security Virtual Chapter. If interested in speaking or volunteering for the Security VC, contact us at securityvc@sqlpass.org

9 Managing Certificates

10 Managing Certificates Creating Logins and Users Mapped to Certificates

11 Managing Certificates Creating Logins and Users Mapped to Certificates Signing Procedures

12 Managing Certificates Creating Logins and Users Mapped to Certificates Signing Procedures Signing Procedures for Service Broker

13 Managing Certificates Creating certificates

14 Managing Certificates Creating certificates CREATE CERTIFICATE

15 Managing Certificates Creating certificates CREATE CERTIFICATE Backing up certificates

16 Managing Certificates Creating certificates CREATE CERTIFICATE Backing up certificates BACKUP CERTIFICATE

17 Managing Certificates Creating certificates CREATE CERTIFICATE Backing up certificates BACKUP CERTIFICATE Restoring up certificates

18 Managing Certificates Creating certificates CREATE CERTIFICATE Backing up certificates BACKUP CERTIFICATE Restoring certificates CREATE CERTIFICATE

19 Managing Certificates Creating certificates CREATE CERTIFICATE Backing up certificates BACKUP CERTIFICATE Restoring certificates CREATE CERTIFICATE FROM FILE

20 Managing Certificates Creating certificates CREATE CERTIFICATE Backing up certificates BACKUP CERTIFICATE Restoring certificates CREATE CERTIFICATE FROM FILE Store securely

21 Managing Certificates Creating certificates CREATE CERTIFICATE Backing up certificates BACKUP CERTIFICATE Restoring certificates CREATE CERTIFICATE FROM FILE Store securely

22 Creating Logins and Users Mapped to Certificates Creating logins

23 Creating Logins and Users Mapped to Certificates Creating logins CREATE LOGIN FROM CERTIFICATE

24 Creating Logins and Users Mapped to Certificates Creating logins CREATE LOGIN FROM CERTIFICATE Creating users

25 Creating Logins and Users Mapped to Certificates Creating logins CREATE LOGIN FROM CERTIFICATE Creating users CREATE USER FOR/FROM CERTIFICATE

26 Creating Logins and Users Mapped to Certificates Creating logins CREATE LOGIN FROM CERTIFICATE Creating users CREATE USER FOR/FROM CERTIFICATE

27 Signing Stored Procedures Grant permissions for a stored procedure without granting to user

28 Signing Stored Procedures Grant permissions for a stored procedure without granting to user Allows you to avoid common issues where you may otherwise be pressured to enable risky database options

29 Signing Stored Procedures Grant permissions for a stored procedure without granting to user Allows you to avoid common issues where you may otherwise be pressured to enable risky database options Cross-database ownership chaining

30 Signing Stored Procedures Grant permissions for a stored procedure without granting to user Allows you to avoid common issues where you may otherwise be pressured to enable risky database options Cross-database ownership chaining Trustworthy

31 Signing Stored Procedures Grant permissions for a stored procedure without granting to user Allows you to avoid common issues where you may otherwise be pressured to enable risky database options Cross-database ownership chaining Trustworthy Signing the procedures

32 Signing Stored Procedures Grant permissions for a stored procedure without granting to user Allows you to avoid common issues where you may otherwise be pressured to enable risky database options Cross-database ownership chaining Trustworthy Signing the procedures ADD SIGNATURE TO BY CERTIFICATE WITH PASSWORD

33 Signing Stored Procedures Grant permissions for a stored procedure without granting to user Allows you to avoid common issues where you may otherwise be pressured to enable risky database options Cross-database ownership chaining Trustworthy Signing the procedures ADD SIGNATURE TO BY CERTIFICATE WITH PASSWORD Executes as certificate which is mapped to a user and/or login

34 Signing Stored Procedures Grant permissions for a stored procedure without granting to user Allows you to avoid common issues where you may otherwise be pressured to enable risky database options Cross-database ownership chaining Trustworthy Signing the procedures ADD SIGNATURE TO BY CERTIFICATE WITH PASSWORD Executes as certificate which is mapped to a user and/or login

35 Signing Stored Procedures for Service Broker Relies on everything we ve learned so far

36 Signing Stored Procedures for Service Broker Relies on everything we ve learned so far

37 QUESTIONS?

38 Coming up next! Protecting Data Across the Environment Brian Kelley

39 THANK YOU FOR ATTENDING

40