Diverse

Re: Resurse - Security

xmldeveloper — Sun, 10 Dec 2006 18:47:14 GMT

SQL Server PASS - Preconference Security Sessions

SQL Server 2005 Security – Technology, Guidance, and Best Practices
Presented by the SQL Server 2005 Security Team
SQL Server 2005 introduced a host of new security features and capabilities, but understanding what they are and how they can help can be confusing. In addition, existing security mechanisms have been strengthened and extended, introducing new possibilities and considerations on how to best secure your installations. In the current climate of ever increasing compliance and regulation as well as the monetization of hacking where the bad guys are after high value data, it is more important than ever that your database installations be made safe against malicious access.
This session will give you the inside story on how the security features work, and how and where you should use them. The security team will:
Drill down into the features and technologies, such as encryption, authorization, authentication and audit
Cover best practices such as surface area reduction and lockdown, as well as separation of duties

Authentication and Authorization in SQL Server 2005
Ruslan Ovechkin, Software Development Engineer, SQL Server Security, Microsoft Corporation
Encryption in SQL Server 2005
Robert Walters, Program Manager, Microsoft Corporation
SQL Server 2005 Execution Context
Laurentiu Cristofor, Software Development Engineer, SQL Server Security, Microsoft Corporation
SQL Server Security Best Practices
Al Comeau, Security Lead, Secure SQL Initiative Team, Microsoft Corporation

Re: Resurse - Security

rremus — Sat, 25 Nov 2006 06:42:50 GMT

Recomad blogurile lui Laurentiu http://blogs.msdn.com/lcris/ si Raul http://blogs.msdn.com/raulga/

Re: Resurse - Security

xmldeveloper — Sun, 12 Nov 2006 11:20:15 GMT

Plus niste prezentari fantastice din cadrul IT's Showtime:

What Nobody Ever Told You About Securing SQL Server

Is That Application Really Safe?

Resurse - Security

xmldeveloper — Sun, 12 Nov 2006 11:15:10 GMT

Celor interesati de subiectul securitate le recomand urmatorul link: http://www.nextgenss.com/research/papers/

Sau direct:

13/09/06	Inter-Protocol Communication
12/09/06	Low Cost Attacks on Smart Cards - The Electromagnetic Side-Channel
16/11/05	Database Servers on Windows XP and the Unintended Consequences of Simple File Sharing
08/11/05	Securing PL/SQL Applications with DBMS_ASSERT
30/09/05	Buffer Underruns, DEP, ASLR and Improving the Exploitation Prevention Mechanisms (XPMs) on the Windows Platform
30/09/05	Data-Mining With SQL Injection and Inference
19/09/05	Writing Small Shellcode
22/08/05	The Pharming Guide: Understanding & Preventing DNS Related Attacks by Phishers
26/04/05	Stopping Automated Attack Tools
21/03/05	Anti Brute Force Resource Metering
28/01/05	Security Best Practice: Host Naming & URL Conventions
22/12/04	Blind Exploitation of Stack Overflow Vulnerabilities
01/11/04	Second-Order Code Injection Attacks
22/09/04	The Phishing Guide: Understanding & Preventing Phishing Attacks
05/07/04	Hackproofing MySQL
05/04/04	Mail Non-Delivery Notice Attacks
04/02/04	Passive Information Gathering - The Analysis of Leaked Network Security Information
08/09/03	Defeating the Stack Based Buffer Overflow Prevention Mechanism of Microsoft Windows 2003 Server
10/07/03	Variations in Exploit methods between Linux and Windows
09/05/03	Writing Secure ASP Scripts
21/03/03	New Attack Vectors and a Vulnerability Dissection of MS03-007
14/01/03	Quantum Cryptography - A Study Into Present Technologies and Future Applications (Appendix)
03/09/02	Threat Profiling Microsoft SQL Server (A Guide to Security Auditing)
08/07/02	Microsoft SQL Server Passwords (Cracking the password hashes)
24/06/02	Violating Database Security Measures
18/06/02	(more) Advanced SQL Injection
05/06/02	Non-stack Based Exploitation of Buffer Overrun Vulnerabilities on Windows NT / 2000 / XP
28/02/02	Assessing IIS Configuration Remotely (Low Level IIS Application Assessment)
06/02/02	Hackproofing Oracle Application Server (A Guide to Securing Oracle 9)
31/01/02	Advanced SQL Injection in SQL Server Applications
09/01/02	Email spoofing and CDONTS.NEWMAIL (Protecting Microsoft Active Server Pages Applications)
08/01/02	Creating Arbitrary Shellcode in Unicode Expanded Strings (The "Venetian" Exploit)
20/12/01	Hackproofing Lotus Domino Web Server