Solved

how do you secure or review a SQL 2000 or SQL 2008 Database.

Posted on 2014-09-29
4
124 Views
Last Modified: 2014-10-01
Hello,

I have a Database SQL, how i'm able to know that is very secure from hackers and no one access the database.
Can I see logs? etc.. which ip etc.. please provide me info.
0
Comment
Question by:koila
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 25

Assisted Solution

by:jogos
jogos earned 250 total points
ID: 40350500
First give no user more rights as he needs.  Concider to use windows authentication over an application-user with a appication login.

Be aware of sql injection
http://technet.microsoft.com/en-us/library/ms161953(v=sql.105).aspx
https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
so limit dynamic sql
http://blogs.msdn.com/b/raulga/archive/2007/01/04/dynamic-sql-sql-injection.aspx
0
 
LVL 4

Author Comment

by:koila
ID: 40350515
how i'm able to view these logs file? to who access the database?
0
 
LVL 25

Expert Comment

by:jogos
ID: 40350561
0
 
LVL 50

Accepted Solution

by:
Vitor Montalvão earned 250 total points
ID: 40351649
Set the instance for Windows Authentication only.
Use domain accounts for SQL Server service and SQL Server Agent service.
Deny execution on xp_cmdshell.
Give no one privileges  to access the machine, only DBA's.
Grant low privileges for user databases and no permissions to system databases (once more, only DBA's).
If data are classified think in put the SQL Server behind a firewall. Apply the most recent security hotfixes and keep it up to date.
Activate Login Audit.
Perform backups constantly.
0

Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
Examines three attack vectors, specifically, the different types of malware used in malicious attacks, web application attacks, and finally, network based attacks.  Concludes by examining the means of securing and protecting critical systems and inf…
This video shows, step by step, how to configure Oracle Heterogeneous Services via the Generic Gateway Agent in order to make a connection from an Oracle session and access a remote SQL Server database table.
Using examples as well as descriptions, and references to Books Online, show the documentation available for datatypes, explain the available data types and show how data can be passed into and out of variables.

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question