Securing Databases &

T-SQL for Data Control

Vu Tuyet Trinh
trinhvt-fit@mail.hut.edu.vn
Hanoi University of Technology

1
 Outline

 Understanding SQL Server Security Model

 Managing logins, users and roles
 Managing Permissions
 Data Control Language (DCL) and Security Issues
 Implementing Security through Database Objects
 Other Security Options
 Column Level Encryption
 Proxy Accounts
 Credentials

Microsoft
 SQL Server Security Model

Microsoft
 SQL Server Security Overview
 Layered Security Model:
 Windows Level
 SQL Server Level
 Database
 Schemas (for database objects)

 Terminology:
 Principals
 Securables
 Permissions
 Scopes and Inheritance

Microsoft
 Principals
Securable
Permissions

Microsoft
 Principals, Securable and Permissions

 Principal
 Individuals, groups, and processes that can request SQL Server
resources.
 Logins, Users, Roles, etc
 Securable
 A Securable is a resource that can be secured
 Tables, Views, Endpoints, etc
 Permission
 Permissions grant principals access to securables
 Grant a user Execute rights to a Stored Procedure, etc
 SQL 2005 introduces new permissions like Control, Alter Any and
Impersonate
 Permissions work in hierarchies

Microsoft
 Security Architecture in SQL Server
2000
 Authentication
 First stage of security
 Identifies users based on login information they provide
 Only verifies that users can connect to a SQL Server 2000 instance
 Does not provide access to databases and their objects
 Authorization
 Second stage of security
 Occurs when database permissions are checked to determine which
actions a particular user can perform within a database

Microsoft
 Outline

 Understanding the security architecture of SQL Server

 Managing logins, users and roles
 Managing permissions
 Controlling access with database objects and ownership
chains
 Auditing SQL Server

Microsoft
 SQL Server Service Accounts

 Local Service Account

 Permissions of “Users” group (limited)
 No network authentication

 Network Service Account

 Permissions of Users group
 Network authentication with Computer account

 Domain User Accounts

 Adds network access for cross-server functionality

Microsoft
 Creating Logins

 Transact-SQL
 CREATE LOGIN statement
 Replaces sp_AddLogin and sp_GrantLogin
 SQL Server Logins
 Windows Logins

 SQL Server Management Studio

 Setting server authentication options
 Login Auditing
 Managing Logins

Microsoft
 Managing Logins
 Windows Logins
 Authentication/Policy managed by Windows

 SQL Server Logins

 Managed by SQL Server
 Based on Windows policies
 Password Policy Options:
 HASHED (pw is already hashed)
 MUST_CHANGE
 CHECK_EXPIRATION
 CHECK_POLICY

Microsoft
 Database Users and Roles
 Database Users
 Logins map to database users

 Database Roles
 Users can belong to multiple roles
 Guest (does not require a user account)
 dbo (Server sysadmin users)

 Application Roles
 Used to support application code

Microsoft
 Creating Database Users and Roles

 CREATE USER
 Replaces sp_AddUser and sp_GrantDBAccess
 Can specify a default schema
 Managed with ALTER USER and DROP USER
 CREATE ROLE
 Default owner is creator of the role
 SQL Server Management Studio
 Working with Users and Roles

Microsoft
 Built-In Server / Database Roles

Microsoft
 Configuring Permissions
 Scopes of Securables
 Server
 Database
 Schema
 Objects
 Permission Settings:
 GRANT
 REVOKE
 DENY
 Options
 WITH GRANT OPTION
 AS (Sets permissions using another user or role)

Microsoft
 Managing Execution Permissions

 Transact-SQL Code can run under a specific execution context

 By default, will execute as the caller

 EXECUTE AS clause:
 Defined when creating an object or procedure
 Options:
 CALLER (Default)
 SELF: Object creator
 Specified database username

Microsoft
 Data Control Language

 GRANT
Used to grant access on an object or a statement to a user.

 REVOKE
Used to revoke permissions on a database object

 DENY
Used to explicitly deny any permission on any object or statement

Microsoft
 GRANT Syntax

 GRANT <permission> [ ,...n ] ON [ OBJECT :: ]

[ schema_name ]. object_name [ ( column [
,...n ] ) ] TO <database_principal> [ ,...n ]
[ WITH GRANT OPTION ] [ AS <database_principal> ]
<permission> ::= ALL [ PRIVILEGES ] | permission [
( column [ ,...n ] ) ] <database_principal> ::=
Database_user | Database_role | Application_role |
Database_user_mapped_to_Windows_User |
Database_user_mapped_to_Windows_Group |
Database_user_mapped_to_certificate |
Database_user_mapped_to_asymmetric_key |
Database_user_with_no_login

Microsoft
 REVOKE Syntax
 REVOKE [ GRANT OPTION FOR ] <permission> [ ,...n ]
ON [ OBJECT :: ][ schema_name ]. object_name
[ ( column [ ,...n ] ) ] { FROM | TO }
<database_principal> [ ,...n ] [ CASCADE ] [ AS
<database_principal> ] <permission> ::= ALL
[ PRIVILEGES ] | permission [ ( column [ ,...n ] )
] <database_principal> ::= Database_user |
Database_role | Application_role |
Database_user_mapped_to_Windows_User |
Database_user_mapped_to_Windows_Group |
Database_user_mapped_to_certificate |
Database_user_mapped_to_asymmetric_key |
Database_user_with_no_login

Microsoft
 DENY Syntax

Microsoft
 Example

Microsoft
 Implementing Security through
Database Objects
 Securing data with views
 Views can be defined to provide either a filtered set of table
columns or a limited set of data rows from underlying tables
 A common use of a view is to create a special representation of
a table that does not contain certain sensitive information

Microsoft
 Implementing Security through
Database Objects
 Securing data with stored procedures and user-defined
functions
 Stored procedures and user-defined functions allow sets of T-
SQL statements to be stored and executed as a single unit
 They are typically used to enforce business rules
or perform logic

Microsoft
 Implementing Security through
Database Objects
 Controlling access with triggers
 Triggers are similar to stored procedures in that they contain
saved groups of T-SQL statements
 However, triggers are not called directly, so
permissions cannot be granted directly to use them
 They are controlled by insert, update and delete

permissions on the table with which they are

defined

Microsoft
 Understanding Ownership Chains

 Ownership chains
 Hierarchy of
dependent
objects

Figure 8-12: Ownership chain

Microsoft
 Other Security Options

 Database Encryption
 Encrypting Object Definitions
 Data encryption
 SQL Server Agent
 Proxies based on subsystems allow lock-down by job step types
 Preventing SQL Injection attacks
 Use application design best practices

Microsoft
 Password Policies

 You can now use windows password policies for SQL accounts (note
that SQL accounts cannot have a different policy than the Windows accounts)
 Password expiration rules
 Windows Server 2003 or higher
 Enforcement can be decided on a per-login basis
 This feature is not enforced by default. Logins upgraded from SQL
2000 will not have this turned on.

Microsoft
 Credentials
Overview
 A credential is a record that contains the authentication
information required to connect to a resource outside of SQL
Server
 Generally it maps to a Windows login
 SQL Server logins can be mapped to credentials
 A login maps to one credential but a single credential can map to
many logins

Microsoft
 Credentials
Benefits

 Giving SQL Server accounts access to OS resources

 Creating SQL Agent proxies
 Giving applications access to other SQL services (SSAS, SSRS,
SSIS)

Microsoft
 Agent Proxy Accounts
 Defines the security context for a job step
 SQL 2000 – only one proxy account available for all jobs. Generally
this account had very high levels of privileges
 SQL 2005 – Many proxy accounts that can have limited access to
certain subsystems and principals can be assigned rights to use
particular proxies.
 The list of available proxies will be filtered by the type of job step
and proxies to which the user has access.
 During upgrade the old proxy account is changed to an
UpgradeProxyAccount with access to the subsystems that were
explicitly used.

Microsoft
 Agent Proxy Accounts
SQLAgentUser Give Access
Role

SQL Login Credential Proxy

Grant Logon
as Batch
Windows Login Principal
Microsoft
 Agent Proxy Accounts
Subsystems
 ActiveX Script
 Operating System
 Replication Distributor
 Replication Merge
 Replication Queue Reader
 Replication Snapshot
 Replication Transaction-Log Reader
 Analysis Services Command
 Analysis Services Query
 SSIS Package Execution

Microsoft
 Encryption
Overview
 Final security barrier for sensitive data is typically data
encryption
 Encryption increases processor load and consumes
storage space
 Encryption requires key management
 Symmetric encryption:
 Is fast
 Uses one key
 Does not provide nonrepudiation

Microsoft
 Encryption
Types

 Asymmetric encryption:
 Uses a key pair
 Is slower than symmetric encryption
 Provides confidentiality and nonrepudiation
 Hybrid encryption:
 Takes advantage of the speed of symmetric encryption and the
increased security of asymmetric encryption

Microsoft
 Encryption
Diagram

Microsoft
 Encryption
Best Practices

 Key management is critical to an encryption framework

 Key generation
 Key usage
 Key backup
 Key regeneration

Microsoft
 Encryption
Best Practices

 Limit the use of encryption to sensitive data

 Consider performance effect of encryption
 Consider whether an external source requires access to
encrypted data
 Consider increased size of ciphertext over plaintext

Microsoft
 Auditing Security in SQL Server 2000

 Auditing security events in SQL Server 2000 allows a

historical record of activity to be made for later review
 This is helpful to identify attempts by users to violate security
policies

Microsoft
 Auditing Security in SQL Server 2000

Figure 8-13:
Configuring login
auditing with
Enterprise Manager

Microsoft
 C2 Auditing

 Class C2
 Rating granted by National Computer Security Center (NCSC)
for products that have been evaluated against the Department of
Defense Trusted Computer System Evaluation Criteria
 The minimum security rating required by many government
agencies and offices and by many corporations

Microsoft
 C2 Auditing

 A system rated at Class C2 provides a Trusted Computing Base

(TCB) that implements the following mechanisms:
 User identification and authentication to control general system access
 Discretionary access control to protect objects and allow users to
distribute access to those objects as appropriate
 Auditing to enforce general user accountability

Microsoft
 Chapter Summary

 SQL Server 2000 has a flexible and scalable security architecture

capable of supporting the full spectrum of requirements from 10
users to 10,000 users
 Validating user activity is implemented as a two-part process
consisting of authentication and authorization
 Logins require a separate database user account in each database
to gain access

Microsoft
 Chapter Summary

 Objects and statement permissions are assigned at the database

level to users
 Roles are an organizational unit in databases that allows users to
be grouped together and share a set of permissions
 SQL Server 2000 is capable of meeting rigorous C2 certification
standards for security and auditing

Microsoft
 Summary

Microsoft 44
 Database system security is more than
securing the database !
 Secure database
 Secure DBMS
 Secure applications / application development
 Secure operating system in relation to database system
 Secure web server in relation to database system
 Secure network environment in relation to database
system

Microsoft
 References

Microsoft 46
Microsoft
 Chapter Eight

Security in SQL Server 2000

Microsoft
 Logins

 Authentication is implemented using logins in SQL Server 2000

 Logins
 SQL Server 2000 object that provides connection access to an
instance of SQL Server 2000 (authentication)
 Logins can be based on Windows users and groups defined
natively in SQL Server 2000

Microsoft
 Authentication Modes

 A SQL Server 2000 instance can run in Windows Authentication

Mode and Mixed Authentication Mode
 Windows Authentication Mode allows users to connect to SQL Server
2000 instances using their Windows user account
 Mixed Authentication Mode allows both Windows accounts and SQL
Server logins to be used to connect to instances

Microsoft
 Windows Authentication Mode
 When using Windows authentication, SQL Server calls out to the Windows
domain to validate the account
 When a user tries to connect to an instance of SQL Server 2000 without
specifying a user name or password, Windows Authentication Mode is used
 If the Windows credentials of the user are flagged as a valid login for a SQL
Server 2000, then the user is allowed to connect to the instance

Microsoft
 Windows Authentication Mode

 Along with limiting administration of a user to a single location

(within a Windows domain), Windows authentication provides the
following benefits:
 Secure validation of credentials through Windows and encryption of
passwords passed over the network
 Windows password requirements
 Automatic locking out of accounts that repeatedly fail to connect
 Native auditing capabilities of Windows accounts

Microsoft
 Mixed Authentication Mode

 In Mixed Authentication Mode, either a Windows-based account or a

SQL Server 2000-based login can be used to connect to an
instance
 Mixed Authentication Mode is provided for backward compatibility with
older applications designed to utilize SQL Server-based logins
 Mixed Authentication Mode is also necessary for situations where users
connecting to an instance of SQL Server 2000 do not have a Windows
domain account

Microsoft
 Changing Authentication Mode of a SQL Server
2000 Instance

 Once an authentication
mode is specified for a
SQL Server 2000
instance, it can be
modified easily through
Enterprise Manager

Figure 8-3: Configuring authentication mode for an instance

Microsoft
 Managing Logins in SQL Server 2000

 To manage login
information,
expand a
registered server
in Enterprise
Manager, expand
the Security
folder and click
the Logins item

Figure 8-4: Default logins in Enterprise Manager

Microsoft
 Creating Logins with Enterprise
Manager

Figure 8-5:
SQL Server
Login
Properties
screen

Microsoft
 Managing Logins with
T-SQL Statements
 Windows-based logins
 The sp_grantlogin system-stored procedure is used to add Windows
users and groups to a SQL Server 2000 instance
 The sp_denylogin system-stored procedure is used to deny access to a
particular Windows user or group, without removing its SQL Server login
entries
 The sp_revokelogin system-stored procedure is used to remove a login
for a Windows user or group

Microsoft
 Managing Logins with
T-SQL Statements
 SQL Server 2000-based logins
 The system-stored procedures used to add and remove logins
for SQL Server authentication are:
 The sp_addlogin system-stored procedure
 The sp_droplogin system-stored procedure

Microsoft
 Other stored procedures for working
with logins
 As seen in the Enterprise Manager interface for creating new logins,
both a default database and default language can be set for each
new or existing login
 The sp_defaultdb and sp_defaultlanguage stored procedures are used
to specify a default database and language for a login

Microsoft
 Database Users

 Database users
 Individual accounts stored within each database that control
access to database objects through permissions
 Database users are mapped to Windows users,
Windows groups and SQL Server logins

Microsoft
 Roles

 Roles
 Allow you to group database users (and even logins) who
perform similar functions and to apply permissions for the group
instead of the individual users
 Allow both Windows and SQL Server logins to be grouped
together, which eases administration in diverse network
environments

Microsoft
 Fixed Server Roles

 Fixed Server Roles

 Associated with Windows and SQL Server logins defined for an
instance
 Used to provide special permissions, like configuring instance-
wide settings and creating databases that cannot be explicitly
provided to individual logins

Microsoft
 Fixed Server Roles

Table 8-1: Fixed server roles

Microsoft
 Fixed Database Roles
 There are several
predefined roles in
each database that
provide sets of
permissions for the
database users who
belongs to them

Figure 8-6: Adding logins to fixed server roles

Microsoft
 Fixed Database Roles

Table 8-2:
Fixed
database
roles

Microsoft
 Fixed Database Roles

Figure 8-7:
Creating custom
database roles

Microsoft
 Application Roles

 Application role
 Special roles that do not contain users
 Used by applications to connect to SQL Server 2000 databases
 Used primarily when an application is managing user
authentication itself but still requires access to the database

Microsoft
 Creating Database Users

Figure 8-8:
Creating
database users
with Enterprise
Manager

Microsoft
 DBO and the Guest Database User

 Every database in an instance of SQL Server 2000 can

have two special users:
 Database owner
 Special user that has permissions to perform all
database activities
 Guest user
 Special account that allows database access to a
login without a mapped database user

Microsoft
 Permissions

 The three types of permissions that can be used to control user

access within a database:
 Object permissions
 Allow access/modification to data as well as execution of

stored procedures and user-defined functions

 Statement permissions
 Allow access to certain object-creation T-SQL statements

like CREATE DATABASE and CREATE TABLE

 Implied permissions
 Permissions only available through predefined roles

Microsoft
 Object Permissions

 Object permissions
 Allow users to work with objects and they can be granted to
users or roles for database objects
 Allow users to insert, update, delete and select data from tables
and views

Microsoft
 Statement Permissions

 Statement permissions
 Used to allow users to create databases and database objects
 Access to the following statements are controlled through the
statement permissions
 CREATE DATABASE
 BACKUP DATABASE
 BACKUP LOG
 CREATE TABLE

Microsoft
 Statement Permissions

 Access to the following statements are controlled through the

statement permissions (cont.):
 CREATE VIEW
 CREATE RULE
 CREATE DEFAULT
 CREATE PROCEDURE
 CREATE FUNCTION

Microsoft
 Implied Permissions

 Implied permissions
 Special privileges that are provided through membership to a
user-defined role
 These are often permissions that cannot be explicitly provided to
individual users

Microsoft
 Applying Permissions

 Permissions within databases are hierarchical and, consequently,

are inherited through group and role membership
 Since a database role can contain users, groups and other roles,
permissions could be applied to a high-level role and all of the users
and groups associated with that role would receive the rights
assigned to it

Microsoft
 Managing Permissions in Databases

 Both statement and object permissions can be assigned to users,

groups and roles within a database
 Each permission can be granted, denied or revoked
 When a permission is granted to a user, the user is able to perform
the operation in the database

Microsoft
 Managing Statement Permissions

 Most statement
permissions are easily
managed through
Enterprise Manager

Figure 8-9: Granting statement permissions in Enterprise Manager

Microsoft
 Managing Object Permissions

 Object permissions
are managed in a
similar way to
statement permissions

Figure 8-10: Granting object permissions in Enterprise Manager

Microsoft
 Resolving Permission Conflicts

 SQL Server 2000 always applies deny permissions first when

evaluating a particular action for authorization
 Denied permissions always take precedence over conflicting
granted permissions at the user or role level
 When permissions are revoked, SQL Server 2000 simply removes
the previous granted granted or denied permission

Microsoft
 Resolving Permission Conflicts

Figure 8-11:
Conflicting
permissions

Microsoft
 Implementing Security through
Database Objects
 Securing data with views
 Views can be defined to provide either a filtered set of table
columns or a limited set of data rows from underlying tables
 A common use of a view is to create a special representation of
a table that does not contain certain sensitive information

Microsoft
 Implementing Security through
Database Objects
 Securing data with stored procedures and user-defined
functions
 Stored procedures and user-defined functions allow sets of T-
SQL statements to be stored and executed as a single unit
 They are typically used to enforce business rules
or perform logic

Microsoft
 Implementing Security through
Database Objects
 Controlling access with triggers
 Triggers are similar to stored procedures in that they contain
saved groups of T-SQL statements
 However, triggers are not called directly, so
permissions cannot be granted directly to use them
 They are controlled by insert, update and delete

permissions on the table with which they are

defined

Microsoft
 Understanding Ownership Chains

 Ownership chains
 Hierarchy of
dependent
objects

Figure 8-12: Ownership chain

Microsoft