[SQL Server] Essential SQL Server security tools

r囧r小猫 2022-04-11 04:46 199阅读 0赞

**LEditor's note:** *This is the third part in a series on SQL Server security. Check out both* [*Why SQL security matters*][Why SQL security matters] *and* [*SQL Server security 2012*][SQL Server security 2012] *for more on SQL Server security.*

SQL Server [ security tools][security tools] can help a database administrator (DBA) quickly perform security audits on SQL Server, which will help them as they manage their day-to-day jobs. This article will present to you an overview of some third-party and native tools that can be used to identify security loopholes within a SQL Server instance.

### **Idera SQL Compliance Manager** ###

[Idera SQL Compliance Manager][] is a comprehensive SQL Server auditing tool that can help you monitor, audit and alert SQL Server user activities and data changes. You can get detailed visibility into who did what and when, and how changes were implemented. It can be used to track changes, monitor and audit data access, schema changes and login failures. There are several built-in reports to validate SQL Server audit trails. A [ DBA can configure alerts][DBA can configure alerts] to get notified of suspicious activity. Idera SQL Compliance Manager can help you ensure compliance with regulatory and data security requirements, such as [Sarbanes-Oxley][], [GLBA][], [HIPAA][], [ PCI DSS][PCI DSS], and [ Basel II][Basel II] across multiple SQL Servers. I have noticed that there is also minimal overhead when running this tool.

### **ApexSQL Audit** ###

[ApexSQL Audit][] is a comprehensive tool that supports tracking data changes to SQL Database. It can capture and store data changes to a central database and tracks who did what and when, and how changes were implemented. This tool supports comprehensive audit reports that are run out of the central database. It can also inform a user about how and when an incident occurred, capturing relevant information such as which SQL or Windows host and application name was involved. Finally, this tool can also track table definition changes and unauthorized or malicious changes.

### **Application Security Inc. DbProtect database security** ###

Application Security Inc.'s [ DbProtect][DbProtect] database security is a comprehensive database security and compliance tool that organizations can use to monitor database security needs. This tool can identify vulnerabilities within a database, identify user entitlements, enforce user access control and user privileges, implement appropriate policies to identify vulnerabilities, and can alert users in case of any suspicious activities.

### **Quest ChangeAuditor for SQL Server** ###

#### More on SQL Server tools ####

Denny Cherry's favorite [ native tools][native tools]

[Third-party tools][] you should check out

[Quest ChangeAuditor][] for SQL Server tracks, audits, reports and alerts you to any changes to your environment in real time. This tool is capable of tracking all user and administrator activity, such as who made what kind of changes, when the changes were implemented and from which work station changes were carried out. This tool monitors for critical change within the environment, and you can configure to get alerted in real time whenever there are critical changes to your environment. Since this tool maintains a centralized repository, it makes it easier to monitor multiple servers from a single location. It also supports role-based access, thereby allowing auditors to run searches and reports without the ability to make any configuration changes to the application.

### **Auditing feature in SQL Server 2008** ###

Microsoft introduced the SQL Server audit feature in SQL Server 2008. [ SQL Server Audit uses extended events to perform audits][SQL Server Audit uses extended events to perform audits], thereby helping DBAs meet regulatory compliance requirements. However, this feature is currently available only in SQL Server 2008 Enterprise Edition.

### **Microsoft SQL Server Best Practices Analyzer** ###

Microsoft SQL Server [Best Practices Analyzer][] is a free diagnostic tool that can be used by database administrators to identify vulnerabilities within an installed instance of SQL Server. Using this tool, a database administrator can quickly gather information with respect to configuration settings of SQL Server and Windows. This tool has built-in rules to determine SQL Server configurations and determine whether the environment is configured according to best practices outlined by Microsoft. This tool reports all configurations within an instance of SQL Server that are not set according to best practices. This tool can also help a DBA identify potential problems within an installed instance of SQL Server. What I like most about this tool is that it volunteers recommendations for potential issues it identifies, which can help you to fix them quickly.

[Why SQL security matters]: http://searchsqlserver.techtarget.com/feature/Why-SQL-Server-security-matters-A-case-study
[SQL Server security 2012]: http://searchsqlserver.techtarget.com/feature/SQL-Server-2012-security-Changes-for-the-newest-version
[security tools]: http://searchsqlserver.techtarget.com/tutorial/Fast-Guide-Free-SQL-Server-tools
[Idera SQL Compliance Manager]: http://www.idera.com/SQL-Server/sql-compliance-manager/
[DBA can configure alerts]: http://searchoracle.techtarget.com/news/1226036/Increased-automation-means-changing-roles-for-DBAs
[Sarbanes-Oxley]: http://searchcio.techtarget.com/definition/Sarbanes-Oxley-Act
[GLBA]: http://searchcio.techtarget.com/definition/Gramm-Leach-Bliley-Act
[HIPAA]: http://searchdatamanagement.techtarget.com/definition/HIPAA
[PCI DSS]: http://searchsecurity.techtarget.com/definition/PCI-DSS-20
[Basel II]: http://searchsecurity.techtarget.co.uk/definition/Basel-II
[ApexSQL Audit]: http://www.apexsql.com/faqs/faqs_audit.aspx
[DbProtect]: http://www.appsecinc.com/products/dbprotect/index.shtml
[native tools]: http://searchsqlserver.techtarget.com/tip/Microsoft-SQL-Server-tools-Native-is-nice
[Third-party tools]: http://searchsqlserver.techtarget.com/feature/Three-third-party-tools-for-SQL-Server-you-need-to-have
[Quest ChangeAuditor]: http://www.quest.com/changeauditor-for-sql-server/
[SQL Server Audit uses extended events to perform audits]: http://searchsqlserver.techtarget.com/tip/Implementing-security-audit-in-SQL-Server-2008
[Best Practices Analyzer]: http://msdn.microsoft.com/en-us/cc320409.aspx