Is your data secured? Are you a victim of SQL Injection? You'll discover some commonly overlooked practices in securing your SQL Server databases. Learn about physical security, passwords, privileges and roles, and preventative best practices. I'll demonstrate auditing and we will take a quick look at some .Net code samples to use on your applications. Get up to speed on the new security features in "Denali", the next version of SQL Server. Takeaway the 20/20 vision to identify SQL Injection and other database vulnerabilities and how to prevent them.

1. SQL Server Security & Intrusion Prevention

3. .Net Developer VB.Net and C#

4. www.extofer.com

6. Security Model

7. Auditing

8. Write Secure Code

9. Best Practices

10. Physical Security

11. Security Patches

12. Network Security

14. Manipulating people to gather data

15. Not using technical cracking tools or techniques

16. SQL Injection

17. Vulnerable to any RDBMS, not just MS SQL Server

18. Attacker post SQL commands via front end applications

21. Windows Users

22. SQL Logins

23. Roles

24. Groups

25. Securables

26. SchemasWindows Users SQL Login Database Users DB Roles Schemas

28. Active Directory Integration

29. Supports Groups

31. Legacy or Hard Coded Referenced Logins

32. Non Windows Clients

35. ASP.Net encrypt web.config

36. Encrypt password in your code

37. Strong Passwords

38. 8 to 10 minimum characters

39. L33t speak or special characters (i.e s = 5 or 3 = E)

40. SQLPing checks for default passwords

42. Database Roles and Server Roles

43. Server Level Roles

45. Database Roles and Server Roles

46. Server Level Roles

47. sysadmin, bulkadmin, securityadmin, dbcreator

48. “Denali” User Defined Server Roles

49. Allow creation of new Server Roles

51. Schema is a name space container

52. Simplify Access Permissions

53. Group objects into Schemas

55. Server Operations

56. Database Actions

57. Audit Specifications

58. Server Audit Specification

60. User Defined Audit – applications write customer events to audit logs

61. Filtering – filter unwanted events

63. DDL Triggers

64. Use Stored Procedures

65. Use Parameters

66. Customize Error Messages

67. Avoid errors returning securable names

69. Windows Updates

71. Restrict access to unauthorized individuals

73. Test updates or hotfixes immediately on non-production servers

75. Don’t surf the Web on the server

76. Only enable required protocols

78. Test backups by restoring

80. Defensive Database Programming by Alex Kuznetsov

81. Protecting SQL Server Data by John Magnabosco