Geek Sync | Taking Control of Your Organization’s SQL Server Sprawl
Download as PPTX, PDF0 likes227 views
The document discusses strategies for managing SQL Server sprawl in organizations, emphasizing the importance of understanding risk, identifying servers, and ensuring data security. It outlines various techniques for locating hidden servers and assessing the data stored on them, alongside the need for established standards and policies. The author provides insights on standardizing SQL Server installations to streamline security and compliance efforts.
Geek Sync | Taking Control of Your Organization’s SQL Server Sprawl
- 1. Taking Control of Your Organization’s SQL Server Sprawl July 26, 2017
- 2. About Me • Infrastructure and security architect • Database Administrator / Architect • Former Incident Response team lead • Certified Information Systems Auditor (CISA) • SQL Server security columnist / blogger • Editor for SQL Server benchmarks at Center for Internet Security
- 3. My Contact Information K. Brian Kelley Email: kbriankelley@acm.org Twitter: @kbriankelley Infrastructure/Security Blog: http://truthsolutions.wordpress.com Personal Development Blog: http://gkdba.wordpress.com
- 4. • Understanding the Risk • Finding Servers • Checking the Data • Standards & Policy
- 6. Risk Areas • Data, Data, Data! • Lateral movement by adversaries • Licensing
- 8. Servers on the Network • SSMS drop down and sqlcmd –L • SQL Ping and variants • Dedicated scanners • 3rd party dedicated scanning tools
- 9. Caution with Scanning • May be seen as “hacking activity” • Know exactly what you’re going to do • Check with your security folks so they understand • Get permission in writing (email counts as long as it gets saved) • Make sure that permission comes from someone with authority to give it.
- 10. Hidden from the network? • Network libraries disabled • OS Firewall turned on • Listening on a non-standard port • “Crafty” start and stop of services
- 11. Finding Hidden SQL Servers • Inventory / Configuration Management Tool • Need Admin rights. May need Domain Admin based on default permissions. • Understand how data is collected. • Can’t rely on Add/Remove Programs data • SQL Server is installed. What component? • Exchange issue – have to query for services installed to verify it’s the server.
- 13. Found the Server… What’s Next? • At this point, it doesn’t matter if it’s authorized. • We want to know what’s on it. • Looking for Shadow IT. • Looking for unprotected data.
- 14. Investigating the Data • Look for same database names as production • Then look for pattern matches (PayRollDB_20170701 matched by PayRollDB%) • Use object names from production to look for matches on discovered DBs • Then start looking at the data.
- 16. What are your organization’s standards? • What’s permitted? • Is it in writing? • What are the consequences for an unauthorized SQL Server? • Who is allowed to remediate? • What are they allowed to do? • Are there audit & compliance requirements you can leverage?
- 17. Standardize Your SQL Server Installs • Automate the install • Start with the OS. Usually the easiest and “biggest bang for the buck” for the organization. • If you can, standardize on drive letters to ease scripted installs. • Script the install. Leverage slipstreaming to minimize after-install work. • Execute post-install configuration scripts automatically as well: • Rename / disable sa login & change password • Configure Database Mail • Set up alerts & notifications • Any other defaults you want to set.
- 18. In Summary • Understanding the Risk • Finding Servers • Checking the Data • Standards & Policy
- 19. Questions? K. Brian Kelley Email: kbriankelley@acm.org Twitter: @kbriankelley Infrastructure/Security Blog: http://truthsolutions.wordpress.com Personal Development Blog: http://gkdba.wordpress.com