DBA 911!: For Database Environments In Crisis by Chris Hall

Author:Chris Hall
Language: eng
Format: azw3
Publisher: Chris Hall
Published: 2016-11-25T08:00:00+00:00

Security Checklist

As a general rule, the follow security checklist will give you a great start to securing your database environment. If you happen to have an exception that prevents you from enforcing a security best practice it must be documented and I also recommend having the appropriate stakeholders signing a document stating they are aware that in this case you cannot implement best practice and what the risks may be.

Prevent unauthorized users from access to your servers physical.

Install only what is required on your SQL Server instances.

Allow only the bare minimum number of sysadmins required access to the SQL Server.

Disable the SA account and rename it. If the SA account *MUST* be used, then give it a very complex password

Follow the rule of least privilege and only grant the minimal amount of permissions to users required to perform their job.

Use stored procedures or views to allow users to access data instead of letting them directly access tables.

When possible, use Windows Authentication logins instead of SQL Server logins.

Always use strong passwords for all SQL Server login accounts.

Never grant permissions to the public database role.

Delete sample databases from all production SQL Server instances.

Configure login auditing so you can see both successful and failed log ins.

Never use login IDs that are members of the sysadmin group as accounts used to access SQL Server from applications.

Ensure that your SQL Servers are behind a firewall and are not exposed directly to the Internet.

In SQL Server 2005 and earlier, remove the BUILTIN/Administrators group to prevent local server administrators from being able to access SQL Server.

Run each separate SQL Server service under a different Windows domain account.

Only give SQL Server service accounts the minimum rights and permissions needed to run the service. In most cases, local administrator rights are not required, and domain administrator rights are *NEVER* needed.

Download

Copyright Disclaimer:
This site does not store any files on its server. We only index and link to content provided by other sites. Please contact the content providers to delete copyright contents if any and email us, we'll remove relevant links or contents immediately.