MS SQL SERVER security settings audit

Abstract

The article is devoted to the trending problem of the information protection in databases. Correctly organized security policy allows you to protect sensitive information in database. Security policies ensure that view and / or modification of such information should be performed only by users who have appropriate rights. This minimizes the risks of attacks on the information, and also increases the assurance that the security management system encompass all confidential information from the organization’s database. The most important aspect of maintaining proper security policy is to control the security settings. From the set of available options, the author identifies the main, grouped into five categories, which should be controlled by the administrator on a mandatory basis: access control to SQL Server with administrative privileges; audit CONTROL and IMPERSONATE permissions; database owners control; access permissions to the database objects; failed login attempts control. In order to control security settings, the author proposes a set of procedures in the form of SQL-queries for each of these categories.