Don’t fall victim to Little Bobby Tables: Guide to Developing a Secure Database Application

Is your SQL Server driven application safe? Does your application have 'sa' anywhere in the code? Are you a victim of SQL Injection? If you answer "yes" or "not sure", come see how to secure a SQL Server driven .Net application. Learn about some exploits and vulnerabilities and implementing best practices for securing SQL Server driven applications. See firsthand how to use Object Relation Mappers, MVC.Net and other tips to develop a secure application. Take home the ability to defend your SQL Server and your data at your applications level.

Transcript

1. Don’t  fall  victim  to  Little  Bobby   Tables Guide  to  Developing  a  Secure  Database   Application
2. Please  allow  me  to  introduce  myself… -­ Rolling  Stone,  Sympathy  For  The  Devil § Gabriel  Villa § Solutions  Architect § MCPD,  ASP.Net Developer § MCTS,  SQL  Server  Database  Development @extofer www.extofer.com
3. Take  Home  Outline § SQL  Server  Security  Model § Security  Defense § Writing  Secure  Code § Database  Security  Threats
4. Database  Security  Threats Privilege  Abuse
5. Database  Security  Threats Database  Platform  Vulnerabilities
6. Database  Security  Threats Weak  Audit  Trail
7. Database  Security  Threats Weak  Authentication
8. Authentication § Windows  Authentications § Domain  or  local  Windows  Account § Active  Directory  Integration § Supports  Groups § Use  Whenever  Possible
9. Authentication § Mixed  Authentication § Legacy  or  Hard  Coded  Referenced  Logins § Non  Windows  Clients § Connections  over  Internet
10. SQL  Server  Security  Model Principal Windows  Users SQL  Logins Roles Groups Securables Schemas Windows  Users SQL  Login Database  Users DB  Roles Schemas
11. Principal § Windows  Authentication § Active  Directory  Integration § Supports  Groups § User  Whenever  Possible § Mixed  Mode  Authentication § Legacy  or  Hard  Coded  Referenced  Logins § Non  Windows  Clients § Connections  over  Internet
12. Roles § Group  users  roles  based  on  usage § Database  Roles  and  Server  Roles § Server  Level  Roles § Sysadmin,  bulkadmin,  securityadmin,   dbcreator
13. Securables § Using  Schema  to  secure  database  objects § Schema  is  a  name  space  container § Simplify  Access  Permissions § Group  objects  into  Schemas § Grant  permissions  to  schemas,  not  objects
14. Write  Secure  Code § DDL  Triggers § Using  Stored  Procedures   § Parameterize  returns § Check  valid  inputs § Customize  Error  Messages § Using  ORMS
15. Database  Security  Threats SQL  Injection
17. Thank  you! § Contact  Info § Email  &  Google+:  extofer@gmail.om § Twitter:  @extofer § Linkedin:  www.linkedin.com/in/gabevilla § Website:  www.extofer.com