Welcome to Sign in | Join | Help

Browse by Tags

All Tags » Security   (RSS)
The security announcements around Azure SQL Database keep coming. Auditing was implemented a few months ago, and today it was followed by a preview of row-level security. There were also announcements around transparent data encryption (TDE) and a new Read More...
I’d always wondered why they didn’t make the “ImplyingPermissions” function (code is part of the books online) part of the product. I originally thought it was because the function was subtly (or not so subtly) misnamed. What the Read More...
Just to let you know. The Portland (Oregon) SQL Server User Group has invited me to speak at the meeting on Thursday, Jan 24 at 6:30pm. I’ll be speaking on SQL Server service accounts, entitled “Who’s running my SQL Server services?”. Read More...
I recently completed another update to the whitepaper, now entitled "SQL Server 2012 Security Best Practices - Operational and Administrative Tasks" to cover best usage of the security features in SQL Server 2012. And, concurrently with the Read More...
... Continued from previous blog entry ... The point of using a Server Audit Specification with database events in SQL Server 2012 is this. In SQL Server 2008, audit is an Enterprise-only feature. Only available in Enterprise, Evaluation, and Developer Read More...
I've always been pretty "standard" in my approach to SQL Server's auditing feature. That is, Server Audit Specifications are for auditing server-level objects and Database Audit Specifications are for auditing database-level objects. Read More...
When I installed CTP3 of SQL Server 2012 (on Windows Server 2008 R2 OS), I noticed that the "Service SID account" (known as the Managed Service Account) was directly available in the setup dropdown box, selected it, wrote a blog entry mentioning Read More...
Two of the security features that folks have asked me about, especially since around 2002, is row-level and label security. Row-level security was present in one of the early betas (beta 1, IIRC) of SQL Server 2005, but it was pulled almost right after Read More...
In doing research for the Service SID posting , I encountered some odd things about service names, service user group names and services. I said I'd write about these; this is the followup post. Most of the information about Windows Services, Service Read More...
A couple of weeks ago at DevDays Netherlands , I struggled a bit with a demo that was relatively straightforward in SQL Server 2008 running under Windows Server 2003 R2, but has an interesting twist in SQL Server running under Windows Server 2008. The Read More...
I've recently completed an update to the SQL Server 2005 Security Best Practices whitepaper. It's available on the security and compliance website under whitepapers or the direct link is here . Unsurprisingly, its called "SQL Server 2008 Read More...
This blog posting is meant to bring attention to the fact that I'm doing a preconference talk, "A Day of SQL Server Security" at TechEd 2010 in New Orleans in June. OK, the TechEd folks asked me to publicize it. I'm also doing two breakout Read More...
I really enjoyed speaking at the Portland SQL Server User Group meeting last night about SQL Server security...and I have an update. We were talking about the supposed inability of auditing to audit usage of sys.fn_get_audit_file, the system function Read More...
This month I'll be presenting a session for the Portland SQL Server User Group. I'll be discussing and demonstrating the new security features in SQL Server 2008 with a post-talk Q&A about SQL Server security in general. I've also got Read More...