SQL Server security
Who can do what on your SQL Server?
Most SQL Server security problems are not sophisticated. They are old accounts, broad permissions, unpatched instances and services reachable from places they shouldn’t be. A practical review finds them.
What we review
A security review of the database layer
It complements your wider security work rather than replacing it, and focuses on what is specific to SQL Server.
- PermissionsServer and database roles, direct grants, ownership chains and
db_ownerused where much less would do. - Privileged accountsMembership of
sysadminandsecurityadmin, and who really needs it. - Service accountsWhat the SQL Server and SQL Agent services run as, and what those accounts can reach.
- AuthenticationWindows or mixed mode, the
salogin, password policy on SQL logins and shared application logins. - EncryptionEncrypted connections, Transparent Data Encryption and backup encryption, and where certificates and keys are kept.
- PatchingCumulative update level and whether the version still receives security updates.
- Exposed servicesWhich networks can reach port 1433, the SQL Browser service, and features such as
xp_cmdshellor OLE Automation left enabled. - AuditingWhether failed logins and permission changes are recorded, and whether anyone would notice.
- Unnecessary accessLogins for people who have left, orphaned users, linked servers with stored credentials and unused databases.
What you get
- Findings graded by risk, explained in terms your management and auditors can follow
- Specific changes for each finding, with any effect on applications called out
- Changes made in stages by us or your team, tested so nothing that legitimately needs access loses it
- A record of who has privileged access and why, for future reviews
Ask for a fixed-price assessment. We’ll give you a fixed price after a short conversation.
What this is not
This is a configuration and access review carried out by SQL Server specialists. It is not a penetration test, and it doesn’t make a system compliant with any standard on its own. It does give you an accurate picture of the database layer to feed into that wider work.
Security findings also form part of every SQL Server health check.
Next step
Unsure who can do what on SQL Server?
Tell us about the instances and how people and applications connect to them.