Browse by Tags

Consolidation Guidance for SQL Server
Sung Hsueh, a former SQL Engine Security team member, just published a whitepaper with co-authors Antony Zhong and Madhan Arumugam on Consolidation Guidance for SQL Server. Though it covers far more than just security considerations, it does outline the Read More...
Posted 24 November 09 08:16 by jackr | 2 Comments   
Filed under
How To: Share a Single EKM Credential among Multiple Users
SQL Server Extensible Key Management (EKM) requires the authentication information (user/password) to be stored in a credential mapped to the primary identity. This version of EKM cannot be used under an impersonated context; that is, you cannot access Read More...
Posted 03 October 09 04:16 by raulga | 0 Comments   
Filed under ,
Filtering (obfuscating) Sensitive Text in SQL Server
A very common concern when dealing with sensitive data such as passwords is how to make sure that such data is not exposed through traces. SQL Server can detect and filter the SQL statements in traces that include the usage of DDL and built-ins (such Read More...
Posted 10 June 09 11:11 by raulga | 0 Comments   
Link to Lyudmila’s blog
My teammate Lyudmila is maintaining her own TechNet blog where she writes articles related to SQL Server security. You can access her blog at http://blogs.technet.com/lyudmila_fokina . Her blog is written in Russian, but the samples she includes should Read More...
Posted 10 June 09 10:59 by raulga | 0 Comments   
Arx the latest vendor to support EKM
With the increasing popularity of the EKM feature in SQL Server 2008, more vendors are adding their support for this great feature. I'm very happy to announce that Arx has just announced their releaese of their EKM provider dll: http://www.arx.com/about/PR/PR-PrivateServer-HSM-Secures-Sensitive-Information-for-Microsoft-SQL-Server-2008.php Read More...
Posted 12 May 09 07:24 by Il-Sung | 0 Comments   
How To Choose Audit Action Group When Using Auditing in SQL Server 2008
SQL Sever 2008 introduces auditing feature which can audit both server-level events and database-level events and several specific database actions. Please check http://msdn.microsoft.com/en-us/library/cc280386.aspx for more details. One difficulty the Read More...
Posted 10 May 09 02:51 by liyingj | 0 Comments   
Thales/nCipher announces EKM support for SQL Server 2008
I'm very please to announce that last week during the RSA Conference, Thales announced their support for SQL Server 2008 with their nCipher product line of hardward security modules (HSMs) ( http://iss.thalesgroup.com/Press/Press%20Releases/2009/Thales%20Hardware%20Security%20Modules%20integrate%20with%20Microsoft%20SQL%20Server%202008.aspx Read More...
Posted 27 April 09 01:55 by Il-Sung | 2 Comments   
PCI DSS Compliance with SQL Server 2008
Since PCI Compliance seems to be popular subject for SQL Server users (by which I mean that a quite a few of you are forced to deal with it) here's something that may help. Parente Randolph is a PCI QSA (Qualified Security Assessor) and they recently Read More...
Posted 16 April 09 04:12 by Il-Sung | 0 Comments   
SQL Server EncryptByKey cryptographic message description
Since the introduction of SQL Server 2008 extensible key management (EKM), new opportunities may arise to handle data encryption on the client while still making the plaintext data accessible to authorized users in SQL Server. One issue between SQL Server Read More...
Posted 29 March 09 09:29 by raulga | 0 Comments   
Filed under
Enforce Windows Password Policy on SQL Server Logins
If users choose to use SQL login to connect to SQL Server rather than using NT authenticating, it is worth to remind that SQL server does provide the option of enforcing window password policy on SQL logins. When creating a SQL login you can specify CHECK_POLICY=on, Read More...
Posted 25 March 09 02:15 by liyingj | 1 Comments   
Interested in Compliance?
I'm pretty sure that there are many of you who have to deal with regulatory compliance but how many of you are aware that we have a SQL Server Compliance web portal? Check out http://www.microsoft.com/sqlserver/2008/en/us/compliance.aspx . There's a lot Read More...
Posted 13 March 09 05:51 by Il-Sung | 1 Comments   
Feedback requested: Default schemas for Windows groups
We would like your feedback on the scenarios where you need to assign default schemas to Windows groups. We have a post in the forums , but there has only been one reply so far. Please, if you have an opinion or even just want to express your support Read More...
Posted 10 March 09 01:34 by jackr | 1 Comments   
Performance of Impact of Auditing in SQL Server 2008
Il-Sung Lee and Art Rask’s whitepaper, Auditing in SQL Server 2008 , just hit the web. Congratulations! I just wanted to add to what Il-Sung already has said about this paper that this is a great resource that will answer some of the big questions we Read More...
Posted 24 February 09 04:59 by jackr | 1 Comments   
Auditing in SQL Server 2008 white paper
In continuation to the post by Jack back in October, we've added Auditing in SQL Server 2008 to our list of security focused white papers ( http://msdn.microsoft.com/en-us/library/dd392015.aspx ). We'll let you know as more white papers are published. Read More...
Posted 23 February 09 07:35 by Il-Sung | 1 Comments   
Data Protection Day, January 28th
Thought some readers of this blog might be interested in Data Protection Day , tomorrow, January 28. The Council of Europe established this day to raise awareness of data privacy and data protection issues and how we, as technology professionals, can Read More...
Posted 27 January 09 08:08 by jackr | 1 Comments   
More Posts Next page »

Search

This Blog

Syndication

Page view tracker