How catastrophic would it be if an attacker were to breach your SQL server and dump your organization’s data onto the public Internet? We’re willing to bet that the impact of such a breach would be dire.
The Ponemon Institute’s 2020 Cost of a Data Breach report finds that the average cost of a data breach is $3.86 million dollars, although the cost tends to change based on the type of data that’s compromised by an attack — breaches in which customers’ personally identifiable information cost 80% more. The average cost per stolen record is $146, but for customer information, the cost per record is $150 and rises to $175 if the breach is caused by a malicious attack. Unfortunately, breaches with compromised customer information are the most frequent; cybercriminals actively target customer’s personal info for theft.
So how can you protect this information? By locking down your databases and SQL servers to keep your information safe and secure. Security needs to be top of mind from the start when you’re provisioning a new server; it’s not something you layer on afterward. It needs to be built-in, so your servers will be as safe as possible. The following steps will help you protect your SQL servers against attack.
8 steps to secure SQL
1. Use the right permissions
It might be tempting to make everyone a sysadmin. It makes your job easier in the short term; you don’t have to navigate complex permissions or the egos of people who want more access than they need. In the long term, however, this is bad cybersecurity and it will make your job much, much more difficult. If everyone is a sysadmin, your network isn’t safe. If one employee is hacked, your whole network can be exposed. Instead, create a comprehensive permissions policy, granting users only the permissions they need and being sure to remove those privileges as soon as employees leave the company. Most employees don’t need access to the servers anyhow — they’ll only require application access. If and when you do designate administrative permissions, make sure the password is strong and complex.
2. Isolate your database server
Just as employees should access only the networks and applications they need, your database server should only be connected to necessary items and services. You may also want to put it in a restricted segment of your network to keep it as isolated as possible from unauthorized connections. By keeping your dedicated database server separate from the rest of your network, applications, and services, you’re keeping your attack area small.
3. Make sure it’s up to date
Install your security patches in a timely fashion; cybercriminals are counting on organizations to put off updates and forget about patching, so they can exploit known vulnerabilities. You can prevent these attacks simply by installing security patches as they’re released.
4. Restrict your SQL database permissions
As we mentioned earlier, your database server should be isolated so that it doesn’t have access to the rest of your networld. The user under which your database server runs should also have its access to the rest of the server. In some services, like MySQL, this is the default. In Windows, however, MSSQL is usually run as an administrator account and has privileges. Be aware that this sometimes happens, and prepare to set this account as a non-admin local account. That way, if there’s an attack on your database, your server (and your network) aren’t at risk.
5. Secure your ports
It goes without saying that your database server ports should not be open to the internet. They should be internally blocked as well. Only allow SQL traffic to and from specific IP addresses, so that a bad actor on the wrong side of your firewall cannot get into your server. Make sure you’re also auditing that traffic and seeing who is logging in — repeated failed logins are a sign that someone may be trying to attack you.
6. Protect Your backups
Your database needs to be secured but so do your backups. Why? Because they have the same data as the database itself. It’s easy to think of backups as simply a failsafe in case of attack, but it’s important to remember that they’re part of your data as well. (Cybercriminals definitely haven’t forgotten that.) So make sure they’re just as secure as the server itself — restrict access to backups, and know exactly who has permissions when it comes to backups.
7. Prevent SQL injection
SQL injection attacks have long been a threat to companies’ data; as of last year, SQL injections represented about two-thirds of attacks on web applications, and OWASP lists injection flaws as first on its list of security risks. What’s an injection? When a web application accepts user input and sends it to the database, a user can type in commands instead, injecting malicious code into the server. This allows the user to perform tasks they’re not authorized for and compromise the server. Prevent against injection by not simply not allowing direct SQL queries from a web application. Instead, use a set of pre-set stored procedures that don’t let users code their way into your database.
8. Monitor continuously
Even with the best cybersecurity processes, breaches can happen. You may have started with strong policies and a well-configured server, but mistakes can happen down the line. Ports may be left open, and patches might not be installed in a timely fashion. The best way to make sure your SQL stays secure is by continuously monitoring your cyber risk.
SecurityScorecard’s Ratings allow you to do this unobtrusively, showing you an outside-in picture of your risk. Our easy-to-read ratings give your organization an A-F letter score across 10 groups of risk factors web application security, network security, endpoint security, and patching cadence. Once you fall out of compliance in one area, you’ll see a change in your score that will allow you to address the lapse in security.
