SQL Server Permission Management: 12 Pitfalls and Misconceptions
Download as PPTX, PDF0 likes292 views
The document discusses SQL Server permission management, highlighting 12 common pitfalls and misconceptions related to it. It covers essential aspects of permission management, including what it is, when to implement it, and how to do so effectively. The importance of adhering to the principle of least privilege and managing permissions systematically is emphasized throughout.
![ALTER SERVER ROLE sysadmin
ADD MEMBER [public];
©2011sqlity.net llc, all rights reserved. HoBT](https://image.slidesharecdn.com/slidesharev1-140326210404-phpapp02/85/SQL-Server-Permission-Management-12-Pitfalls-and-Misconceptions-6-320.jpg)
SQL Server Permission Management: 12 Pitfalls and Misconceptions
- 1. SQL Server Permission Management 12 Pitfalls & Misconceptions
- 4. Overview ©2011sqlity.net llc, all rights reserved. emptyPic Permission Management • What • When • Why • How 12 P&Ms • Pitfalls • Misconceptions
- 6. ALTER SERVER ROLE sysadmin ADD MEMBER [public]; ©2011sqlity.net llc, all rights reserved. HoBT
- 7. SQL Injection ©2011sqlity.net llc, all rights reserved. HoBT
- 8. SQL Injection ©2011sqlity.net llc, all rights reserved. HoBT
- 9. SQL Injection ©2011sqlity.net llc, all rights reserved. HoBT Excerptedfrom OWASPTop10–2013(Page4)
- 11. Least Privilege Principle ©2011sqlity.net llc, all rights reserved. HoBT
- 13. After development is done. ©2011sqlity.net llc, all rights reserved. HoBT
- 14. After development is done. ©2011sqlity.net llc, all rights reserved. HoBT Security cannot be an afterthought
- 16. Permission Management GRANT REVOKE DENY Database Role Server Role Application Role ©2011sqlity.net llc, all rights reserved. HoBT
- 17. GRANT Statement ©2011sqlity.net llc, all rights reserved. HoBT GRANT Privilege ON Securable TO Principal; GRANT REVOKE DENY
- 18. Privilege SELECT UPDATE CREATE ALTER CONTROL … ©2011sqlity.net llc, all rights reserved. HoBT
- 19. Securable Table Schema Database Server Endpoint … ©2011sqlity.net llc, all rights reserved. HoBT
- 20. Principal Server Role Database Role Application Role Login User ©2011sqlity.net llc, all rights reserved. HoBT
- 22. 12 P&Ms REVOKE = DENY ALL PRIVILEGES GRANT on all Columns = GRANT on Table REVOKE un- granted Column Permission REVOKE CONTROL (Non)CASCADE DENY (Non)CASCADE Column GRANT > Table DENY DENY CONTROL Role Ownership Implications CONTROL SERVER Impact on Securable Owner Implicit User Creation Failure Ownership Chaining Quandary ©2011sqlity.net llc, all rights reserved. HoBT
- 23. References SQL Stylist with sqlity.net sebastian@sqlity.net Sebastian Meine ©2011sqlity.net llc, all rights reserved. SQL Server Permission Management 12 P&Ms http://goo.gl/YhsW1M