SQL Server Permission Management: 12 Pitfalls and Misconceptions

SQL ServerPermission Management

12 Pitfalls & Misconceptions

About Me

Sebastian

Meine

Clean Code

SQL Stylistsqlity.

netFast

Code

Overview

©2011 sqlity.net llc, all rights reserved. emptyPic

Permission Management• What• When• Why• How

12 P&Ms• Pitfalls• Misconceptions

http://sqlity.net/

I

Permission Management-

Why?

ALTER SERVER ROLE sysadmin ADD MEMBER [public];

©2011 sqlity.net llc, all rights reserved. HoBT

http://sqlity.net/

SQL Injection


http://sqlity.net/

SQL Injection


Exce

rpte

d fr

om

OW

ASP

Top

10 –

201

3 (P

age

4)

http://sqlity.net/

I


What?

Least Privilege Principle


http://sqlity.net/

I


When?

After development is done.


http://sqlity.net/

After development is done.


Security cannot be an afterthought

http://sqlity.net/

I


How?

Permission Management

GRANT REVOKE DENY

Database Role

ServerRole

Application Role


http://sqlity.net/

GRANT Statement


GRANT Privilege ON Securable TO Principal;

GRANTREVOKEDENY

http://sqlity.net/

II

12 Pitfalls

& Misconceptions

12 P&Ms

REVOKE = DENY

ALL PRIVILEGES

GRANT on all Columns =

GRANT on Table

REVOKE un-granted Column

Permission

REVOKE CONTROL

(Non)CASCADE

DENY (Non)CASCADE

Column GRANT >

Table DENY

DENY CONTROL

Role Ownership Implications

CONTROL SERVER Impact on

Securable Owner

Implicit User Creation Failure

Ownership Chaining

Quandary


http://sqlity.net/

References

SQL Stylist with sqlity.net

[email protected]

Sebastian Meine

©2011 sqlity.net llc, all rights reserved.

SQL Server Permission Management 12 P&Ms

http://goo.gl/YhsW1M

http://sqlity.net/

SQL Server Permission Management: 12 Pitfalls and Misconceptions

Technology

Transcript of SQL Server Permission Management: 12 Pitfalls and Misconceptions